e8795fe11ff4bc812bc06fb394fcdbe20536995a942b024d25e7ec093d9f6861

Analysis

max time kernel
298s
max time network
210s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9jc0rt8.html
Size 5KB
Sample260722-n8a65a1sa1
SHA256 e8795fe11ff4bc812bc06fb394fcdbe20536995a942b024d25e7ec093d9f6861
MD5 5c61c861b7d40c337f41d2082931341b
SHA1 f569a8fcdfd0ffd9a8185ec04c8fb807d869d508
SHA512 7b35c7730c7c579e9234f112f57f30bbd9f933105d99df4041f581c28f3fdf5816ca49592980a945fbd43327e6374416ce8e8d796d47c957a0142773b82cf3bc
SSDEEP 96:PNyMtoXZzIEb0EaW87wNMUYsV+0VrrGT3n3hzhG2WHO6RHYzueh8JVimw:PNBtkCBLjVgknpWu6R4yjw
TLSH
T191B14AA75937602B87662F6524F373587231B919BB0152C4EEA1962C19EFF8AC1643C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	6000	firefox.exe
Token: SeDebugPrivilege	6000	firefox.exe
Token: SeDebugPrivilege	6000	firefox.exe
Token: SeDebugPrivilege	6000	firefox.exe
Token: SeDebugPrivilege	6000	firefox.exe
Token: SeDebugPrivilege	6000	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
6000	firefox.exe
6000	firefox.exe
6000	firefox.exe
6000	firefox.exe
6000	firefox.exe
6000	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6000	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 6000	6044	firefox.exe	88
PID 6044 wrote to memory of 6000	6044	firefox.exe	88
PID 6000 wrote to memory of 1468	6000	firefox.exe	90
PID 6000 wrote to memory of 1468	6000	firefox.exe	90
PID 6000 wrote to memory of 1468	6000	firefox.exe	90
PID 6000 wrote to memory of 5044	6000	firefox.exe	91
PID 6000 wrote to memory of 5044	6000	firefox.exe	91
PID 6000 wrote to memory of 5044	6000	firefox.exe	91
PID 6000 wrote to memory of 5044	6000	firefox.exe	91
PID 6000 wrote to memory of 4124	6000	firefox.exe	92
PID 6000 wrote to memory of 4124	6000	firefox.exe	92
PID 6000 wrote to memory of 4124	6000	firefox.exe	92
PID 6000 wrote to memory of 4124	6000	firefox.exe	92
PID 6000 wrote to memory of 1388	6000	firefox.exe	93
PID 6000 wrote to memory of 1388	6000	firefox.exe	93
PID 6000 wrote to memory of 1388	6000	firefox.exe	93
PID 6000 wrote to memory of 2672	6000	firefox.exe	94
PID 6000 wrote to memory of 2672	6000	firefox.exe	94
PID 6000 wrote to memory of 2672	6000	firefox.exe	94
PID 6000 wrote to memory of 2672	6000	firefox.exe	94
PID 6000 wrote to memory of 5576	6000	firefox.exe	95
PID 6000 wrote to memory of 5576	6000	firefox.exe	95
PID 6000 wrote to memory of 5576	6000	firefox.exe	95
PID 6000 wrote to memory of 5576	6000	firefox.exe	95
PID 6000 wrote to memory of 1588	6000	firefox.exe	96
PID 6000 wrote to memory of 1588	6000	firefox.exe	96
PID 6000 wrote to memory of 1588	6000	firefox.exe	96
PID 6000 wrote to memory of 1588	6000	firefox.exe	96
PID 6000 wrote to memory of 4300	6000	firefox.exe	97
PID 6000 wrote to memory of 4300	6000	firefox.exe	97
PID 6000 wrote to memory of 4300	6000	firefox.exe	97
PID 6000 wrote to memory of 4300	6000	firefox.exe	97
PID 6000 wrote to memory of 1148	6000	firefox.exe	98
PID 6000 wrote to memory of 1148	6000	firefox.exe	98
PID 6000 wrote to memory of 1148	6000	firefox.exe	98
PID 6000 wrote to memory of 1148	6000	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\9jc0rt8.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\9jc0rt8.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {66ba31fd-e61a-4064-a6dc-3cbd524b42e6} -parentPid 6000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6000" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {27e31abe-2d69-469c-8486-f84e6af7270f} -parentPid 6000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 27274 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {b215fc46-c9a0-4efb-8ab8-21fb2b857299} -parentPid 6000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3980 -prefsLen 27274 -prefMapHandle 3984 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {7da8f36d-afa8-46ab-ad60-83ce64b3a674} -parentPid 6000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6000" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4512 -prefsLen 34773 -prefMapHandle 4516 -prefMapSize 270279 -jsInitHandle 4520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4528 -initialChannelId {26bee8cc-826f-40e6-a8e7-3f2a0b82dfc3} -parentPid 6000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5012 -prefsLen 34929 -prefMapHandle 5016 -prefMapSize 270279 -ipcHandle 5020 -initialChannelId {9f814d14-3094-424e-b3cd-6d35741eb208} -parentPid 6000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1632 -prefsLen 32952 -prefMapHandle 5408 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {f3aa0d82-ac46-4380-a985-a0af36d68488} -parentPid 6000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5660 -prefsLen 32952 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5676 -initialChannelId {95f97c76-e373-482d-b40e-386891cfbf4b} -parentPid 6000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5848 -prefsLen 32952 -prefMapHandle 5852 -prefMapSize 270279 -jsInitHandle 5856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {2ffd800d-8a5f-4b5c-b47d-70299f5cf7ff} -parentPid 6000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 dc3afeca4aa13b5fe82d63cbe2758e9091feb858bf8905d76089df8f45f182fe
MD5 44b57b251e8264b48aab801354b4689b
SHA1 26f3339733d8e236e01080df5c7fce8393200da2
SHA512 2a141b0e851c82b5e855869f22024775b3d48de06e7489b81e9754fba7f99f58eb3b1336c9027f928df81209c056f0701626c7b302726d5cb58c8e2ef8158458
SSDEEP 384:HwCe7iO024YEdcs3hk2nhfdDE2Ba/rIVy8eavM+2vM+n:QqZYEdv3hk2nhfS2sDIVy8nU+2U+n
TLSH
T1CA729DBBDF416C5D1917D589C8AD93A9DC15F9BBCBF680B608243449C78432AB0FA0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 f05bcb3e818ae0bc1fafbfb84745156bddb2d123fde90382819f7b0d3f7f8706
MD5 e2f5dba734bd52703499920da75eee22
SHA1 3c4c4d45efd49e2e4ab3907ef658aa06fc04de6a
SHA512 04ba34986312d4bc2409a2e6dd64587a23e5f844a86816ff06141af4074b7004a4b785a4e50f19f0d59509106624720692ba2d8d367bd28be63a5d8f9ec4a8a4
SSDEEP 384:H9XghOiO024Yfdcs3hk2nhfdDE2Ba/rIVy8e7I+:dX+ZYfdv3hk2nhfS2sDIVy8i
TLSH
T141729DBF9F017C591967D546C8AD8369DD09F9BBCFF690A609203549CB8432AB0F60CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TUD4EL4KMFFTYDKGFJXH.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TUD4EL4KMFFTYDKGFJXH.temp
Size 7KB
SHA256 74b87e190edf4444f8a8dc516bee085cba0eaa6beb59a3fd137942e51171901d
MD5 59d23239a62dc5c7ad61bab40d774f4f
SHA1 ff1b9f2cc5843e88082c60a8c937cc3b88f026c6
SHA512 9d11e323dc65564d73547e03c4308ef12c1fe0bd1b0d0bb510215b8c235cb99077c8c2b3a8396b1f2ecca195fd44079c7b86c08afb83d67721e7c1c6e827d39e
SSDEEP 48:dX/nndJDLJ5UgdwwlklrzuXMnndJDLJ/6BdwwlkltuXKnndJDLJ/adwwlklvJEXb:dhRImw/EIw+/0ISzHplIcQ2
TLSH
T12EE19A120BFB0999F5F7D6336A3167025773F940D62A475DC18AA2848E3776081ADFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 682788d2beb9a07c77d9cb637565dc9fb470c12a61a8d12f474394c094c9aa8c
MD5 86c0451bc9c50efb68e665f2ce0d6667
SHA1 7d0489b96ef9d445260b5aab285cd9d0dc80aeba
SHA512 8ef4ad4143fc4f8fdec9ed82959ae707d91b33652bff1f1142cbc22e0d591855123433be2c63508ee5f96e4903dcc7443bf6b886c304d5068e6c560d70071984
SSDEEP 192:5Z1d66JoztdzgCl6mc0dgwWwPOv5zbo7uZUwWlyj7wZ+o:5Xd66Joz/zgC1j0boiZslyju
TLSH
T110E130A4E628863FC814027BDCA21B940F3A389A9C4E7F19359C740C2D472DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b6c5708d164950a690171a88de7d174a09f2ceafdec1afaa8c44da5f89974bd2
MD5 6c6993397434dcaf6ce4c4705b9cb288
SHA1 8fd64e05473d16a5713c583e7573b3760cd3155b
SHA512 415a314d3edbcca9aedd6d605e8e77c0459238277b522b2bf8b764a651863fe84c78a2a9d729cf9a75734bb0232dd861f76cdac75e0af976c4c45b7f987b2911
TLSH
T1C021679C39B98D2BA887F29C7480128E535E4E0614971C4B5D22FF8DCE91ED9726A439
MD5 SHA1 SHA512 TLSH

Submit Download

19a6da46-ca32-4e77-94c2-d72d5c5bfe89

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\19a6da46-ca32-4e77-94c2-d72d5c5bfe89
Size 235B
SHA256 c17e2fc9d5afad97837a535b97bc38ef6427c008760fce986acae5cd44bf849b
MD5 6f4f723640412ef466c5e49c6f6dc8e4
SHA1 d0270083d703d1b96fa2ae44308c9bb3cfb47222
SHA512 f56c355d41139d4f68b502a258697c120360a1f6ccd45fa42d52e37063efa033473fac662dc392b949e0b1fb77f2af7dcf9384171e3544153194749e52ca2aa4
TLSH
T152D0979014A8272C88040F1BB1A0BAE230848C3324A49850CAA04274EABAFC90152C5B
MD5 SHA1 SHA512 TLSH

Submit Download

6a32502b-fc93-46f1-946f-631f50415e7f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\6a32502b-fc93-46f1-946f-631f50415e7f
Size 2KB
SHA256 d4e05f99fe7730329c194db0f546a48a565aa933cdb30281634399df521c0afb
MD5 2375abcdd737f5f11af4dd7362c18105
SHA1 f39ac51272740e9a671d94d6017315d6a72275e0
SHA512 c3072d7ec774e9673ead60438d64fc4adafe8a8133b5cac5a5b462d6ac51113e22f2d829d4fa8fdc36a2d1008620ae3f82a5f121c3eeb233f1ce667b637c0a6d
TLSH
T13841116C35744DB68CDBE15D94C2238ED3A0995304C62C432E76EE0C8ED27AE736A42B
MD5 SHA1 SHA512 TLSH

Submit Download

6df0e735-6a19-4a71-9f19-bdceb219dd1b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\6df0e735-6a19-4a71-9f19-bdceb219dd1b
Size 235B
SHA256 c284d2d45bc84d02aa8a64e2931e5b503ed924467ce13ad9f9242c3ea623ced8
MD5 321b9300689e5a9cd491191237097f22
SHA1 32ade7491c8760d6ee38ad1eba4314d5fa5ac4da
SHA512 6ee3b88e4d3fd471f562d1ea748dbd7c19bc0771f8156b7d802bea749c669ce6660acd79c8781865131873781d113ca77c7bccc1dccdb55821d2180b8b7d2e9b
TLSH
T171D097C02498632C08080F57B0A068C270564C3320A8D8A0E56142B89EB9DC88291916
MD5 SHA1 SHA512 TLSH

Submit Download

7094f26d-3bd6-47fa-9f76-e07c6778defc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\7094f26d-3bd6-47fa-9f76-e07c6778defc
Size 16KB
SHA256 145bf14061c71c06a265c3b4f25b71d20c254da0cacd87088834e2483ab32624
MD5 0f4accac4c27bc0b822640bf4e7d742f
SHA1 0882b7ccfb0eaeee7afad10f4a8a41ff9c8eb1a6
SHA512 82edaa711fe9e3fdf6a66231ec5bd1262e89af63aac30935308f5e0bd3db94a91690fd2e220cced192041b8761806d849ccf8038ba4016c3c95f68492b667c8b
SSDEEP 192:r7QfDhZOY8JoLg2L5t81mrre+OK3qCO7g8Yz3huGzlRtbNK0UB+1MrHQgQdtjoG0:HkhZRTLg6BtcGxRtbNK0UtwLdJ0
TLSH
T1E272C8566860457A8291E768D4FC7FC3E1F228CF4C419FCE9BF4BE0859DA0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96b561f0-b481-4557-8be6-0734707133d0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\96b561f0-b481-4557-8be6-0734707133d0
Size 886B
SHA256 d6aac3434d442335431aa8093ec89d4e69b3dc4231ca9eeb8ce1dd5ec6a13e49
MD5 e5f6c3663f3a99b8baf0b1d5c9999d30
SHA1 e9269bd1c3497bfedad348904674ddc0a14f07ad
SHA512 55607a2e4c814e78092d729057d5e44221b719a3e7850be43b349b01f46903855bf7028ada9bad601cd4c7c4f843d9d99457cfc0cbc18065602d6e8286e1dc31
TLSH
T114112341963476B2CC78A29FC9D17B9686E4B43380CA5C047D616A080EEA26FA37330B
MD5 SHA1 SHA512 TLSH

Submit Download

c83f4749-1579-4f73-81fa-556e44e0ef7a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\c83f4749-1579-4f73-81fa-556e44e0ef7a
Size 883B
SHA256 0738d8e0870404fabb9e25f52abde53d5bff78dc85c12ca5d08c979dbe69ee75
MD5 94797864877b270ad88e2634e4cdff3e
SHA1 79e83d7b62de3da73bef41dba295bf4995ba2f43
SHA512 31fe37d7ac0d2aa8b1053884227d1c170aac27ffc45ae312c5de57a85e29c2f3b32a1ebac1bbbd4ea23ebc5e2e512a94782162e7f9440e8fae55057c99fbabec
TLSH
T1111127C1D530B5B3CC78915F8991379687F4B42380C994143E7259080EBE72FE76671B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\extensions.json
Size 16KB
SHA256 6f0e1414d8bc2c65720e186dec08d5353b873f843bb061fde1b60e849928679a
MD5 b1785e20be2956b9943ea0b869c97c20
SHA1 ac9e292f9770614d75bd2650e469a2b8f35811a4
SHA512 fd2637fcd1751e2f2b9faa41e055c14f3f45bb7243a7038bb0ec70cee442f22a9a5550a624e9a68700e51c919259c7589e0321fee2b0575c47a9cdad38b76ae1
SSDEEP 384:lkI4vlUmldvB8dhWM94ze96oML4HIL4PqtL4H6tL4HxL4HLA44hz:2I4dRfSXJ42614q4St4at4J4r54V
TLSH
T18572541545049EB8298FA79BAA367E01C37D573B60845C38F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 8KB
SHA256 b5ddd28202a42b13d39759028859d69562a62d1fadf9faa302b4466de8e57765
MD5 909d51c6399280db77d99e0ec24c5fc2
SHA1 2b9e2b5972cf2f5923f0de09293df7ea9ef91bee
SHA512 595b3f7771b1b9113a994c81029f68ce82744f7cd0c24e99307af4cd4b44d5b996c46ed59be5295f3525bcfed112fe2672dc55bf29da56b4d8308bfc75381894
SSDEEP 96:xHLlTUhRqGqUfhSgIObzSBpSSlcdv9jWnTRWRlowkysIBw88MaY8L4cndBOR:BfRUfhSgI/pSSj8R2wkCBw88di
TLSH
T12E021D389404DF7F64B637BCAC6449305AA6023BB7BF68D610B96485051CF3845FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs.js
Size 6KB
SHA256 0b559864e115523bf9b46a6da57039eade2d71c910af1612243be973adc90efd
MD5 f46f41888f9c9b47a4638703c58d557b
SHA1 dea30e65a6104ab9b88d9beba2e0a0edd6e797c5
SHA512 209247e657c92a550327e608172eeada3ce3ab5a4c526b32d12dedeb69e273501045b6a24fbb0ebd63382664a0ae9cd40b07ce80efd798891902c4c84314d0dc
SSDEEP 96:xHLUTUhRqGqUfjyq1zSRSSlcdv9j2nTRH0wkysLBw88u8L4cndBOR:B+RUfjyqkSS790wkZBw88Ri
TLSH
T1E2E1107894088BBF64B6776CAC648C316AB2013B7BBF68D750B65485054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs.js
Size 6KB
SHA256 1d951e0bb0ad198de7c00a199a6f287fa79d881d738978591054197a4c8acadb
MD5 694f6d7f7832decbc0c4e4340ec913af
SHA1 f605dd1db577afc554fcae56ac4587e0f39e69be
SHA512 da340aaed2a28cf5792df76f2ee02cdf9afa6c1e6d5b335847654591dcd745a9f83e8327f08000326dbaa94811e25ece4460d5761771a6f405842e0a8bfbfce1
SSDEEP 96:xHLUTUhRqGqUfjSgI1zSBpSSlcdv9jWnTRH0wkysLBw88u8L4cndBOR:B+RUfjSgIwpSSj90wkZBw88Ri
TLSH
T12DE11F7894088F7F68B6776CAC688C316AB2013B77BF68D750B65484055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 92215bb172f1d72d59f13a2b006ae48bf65e336ddff57b3b3fb53a452c1f998f
MD5 973b1572c0cfe60e8c251f3da3f0e8f9
SHA1 c9f3b197448618f55210d9a41536b78f983a2469
SHA512 5887ddf9b1d8c23f3aa7990e9abc31ff355406d5a69f86901b6a1a8887c9ca8b01aa610fd6ba047e09596f22ecb896138541f3bceb17cc4480044d28d1619617
SSDEEP 24576:8SsFXC/loBWtIcDy+Eux30ZYg9Jpz7Y4z3CoM6ZxpsOOPT50WJfqREZDpWjxsy/g:8SsFyd9tJBEqmYoJ7Y4eoM6Hpsb0W2V
TLSH
T1A84629E820D1A257F3814073724993EB21EFD00D5037DA085BA95AE9A574CEF8E17B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads