a57b3ebc1a5ed1a28245d258b7dad4728c9b984f17957e3117687f7ccede1ea1

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rollinsexec.exe
Size 158KB
Sample260722-nv4lhszzft
SHA256 a57b3ebc1a5ed1a28245d258b7dad4728c9b984f17957e3117687f7ccede1ea1
MD5 9e5c65460984de805dc6b78f0ebe8ee7
SHA1 0fe5a317275288969e0d5758c6710bba5cb51cee
SHA512 0a11e7acde096917fc670a662f5d1c636f62f561f38482233a3b8df831bd838c3db5a3102297d59446549fceca7ddf862c91b5b916aa5ad4d0b707fe78080c57
SSDEEP 3072:hlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT5Lr:fAIwxrI14Q3kYBTMo
TLSH
T144F33B13A6A811BEE1B3D678C9924941FB7278594B71A7CF07504EBA0F77BD09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4504	firefox.exe
Token: SeDebugPrivilege	4504	firefox.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe
4504	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 4504	4992	firefox.exe	97
PID 4992 wrote to memory of 4504	4992	firefox.exe	97
PID 4504 wrote to memory of 2056	4504	firefox.exe	98
PID 4504 wrote to memory of 2056	4504	firefox.exe	98
PID 4504 wrote to memory of 2056	4504	firefox.exe	98
PID 4504 wrote to memory of 4772	4504	firefox.exe	99
PID 4504 wrote to memory of 4772	4504	firefox.exe	99
PID 4504 wrote to memory of 4772	4504	firefox.exe	99
PID 4504 wrote to memory of 4772	4504	firefox.exe	99
PID 4504 wrote to memory of 5068	4504	firefox.exe	102
PID 4504 wrote to memory of 5068	4504	firefox.exe	102
PID 4504 wrote to memory of 5068	4504	firefox.exe	102
PID 4504 wrote to memory of 5068	4504	firefox.exe	102
PID 4504 wrote to memory of 4892	4504	firefox.exe	103
PID 4504 wrote to memory of 4892	4504	firefox.exe	103
PID 4504 wrote to memory of 4892	4504	firefox.exe	103
PID 4504 wrote to memory of 1748	4504	firefox.exe	104
PID 4504 wrote to memory of 1748	4504	firefox.exe	104
PID 4504 wrote to memory of 1748	4504	firefox.exe	104
PID 4504 wrote to memory of 1748	4504	firefox.exe	104
PID 4504 wrote to memory of 2796	4504	firefox.exe	105
PID 4504 wrote to memory of 2796	4504	firefox.exe	105
PID 4504 wrote to memory of 2796	4504	firefox.exe	105
PID 4504 wrote to memory of 2796	4504	firefox.exe	105
PID 4504 wrote to memory of 5624	4504	firefox.exe	106
PID 4504 wrote to memory of 5624	4504	firefox.exe	106
PID 4504 wrote to memory of 5624	4504	firefox.exe	106
PID 4504 wrote to memory of 5624	4504	firefox.exe	106
PID 4504 wrote to memory of 5636	4504	firefox.exe	107
PID 4504 wrote to memory of 5636	4504	firefox.exe	107
PID 4504 wrote to memory of 5636	4504	firefox.exe	107
PID 4504 wrote to memory of 5636	4504	firefox.exe	107
PID 4504 wrote to memory of 5652	4504	firefox.exe	108
PID 4504 wrote to memory of 5652	4504	firefox.exe	108
PID 4504 wrote to memory of 5652	4504	firefox.exe	108
PID 4504 wrote to memory of 5652	4504	firefox.exe	108
PID 4504 wrote to memory of 1672	4504	firefox.exe	112
PID 4504 wrote to memory of 1672	4504	firefox.exe	112
PID 4504 wrote to memory of 1672	4504	firefox.exe	112
PID 4504 wrote to memory of 1672	4504	firefox.exe	112
PID 4504 wrote to memory of 5760	4504	firefox.exe	113
PID 4504 wrote to memory of 5760	4504	firefox.exe	113
PID 4504 wrote to memory of 5760	4504	firefox.exe	113
PID 4504 wrote to memory of 5760	4504	firefox.exe	113
PID 4504 wrote to memory of 6028	4504	firefox.exe	114
PID 4504 wrote to memory of 6028	4504	firefox.exe	114
PID 4504 wrote to memory of 6028	4504	firefox.exe	114
PID 4504 wrote to memory of 6028	4504	firefox.exe	114
PID 4504 wrote to memory of 5316	4504	firefox.exe	115
PID 4504 wrote to memory of 5316	4504	firefox.exe	115
PID 4504 wrote to memory of 5316	4504	firefox.exe	115
PID 4504 wrote to memory of 5316	4504	firefox.exe	115
PID 4504 wrote to memory of 5692	4504	firefox.exe	116
PID 4504 wrote to memory of 5692	4504	firefox.exe	116
PID 4504 wrote to memory of 5692	4504	firefox.exe	116
PID 4504 wrote to memory of 5692	4504	firefox.exe	116
PID 4504 wrote to memory of 5700	4504	firefox.exe	117
PID 4504 wrote to memory of 5700	4504	firefox.exe	117
PID 4504 wrote to memory of 5700	4504	firefox.exe	117
PID 4504 wrote to memory of 5700	4504	firefox.exe	117
PID 4504 wrote to memory of 5520	4504	firefox.exe	118
PID 4504 wrote to memory of 5520	4504	firefox.exe	118
PID 4504 wrote to memory of 5520	4504	firefox.exe	118
PID 4504 wrote to memory of 5520	4504	firefox.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\rollinsexec.exe
"C:\Users\Admin\AppData\Local\Temp\rollinsexec.exe"
1⤵
PID:3992

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {273b8673-74e0-448a-8961-8efc0fcf3c69} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {eb83660b-8c24-4f66-b42e-80ddee84c0b3} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 27276 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {7149bb3f-3f0f-449f-92dd-ed22febd4a0d} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27276 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {3c4467e2-56ed-4bb0-94f2-b69161376c37} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2940 -prefsLen 34775 -prefMapHandle 3148 -prefMapSize 270279 -jsInitHandle 3152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3060 -initialChannelId {df93e831-6f49-45f2-a96b-82472fa8db15} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4880 -prefsLen 34824 -prefMapHandle 4884 -prefMapSize 270279 -ipcHandle 5020 -initialChannelId {00799393-8000-41f1-a5ba-1ca8450fc674} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5312 -prefsLen 32952 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3548 -initialChannelId {347e6259-5f4c-493c-ae0c-994540a57b16} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5460 -prefsLen 32952 -prefMapHandle 5464 -prefMapSize 270279 -jsInitHandle 5468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5476 -initialChannelId {6871e295-cd1b-4d10-972d-a9ce5dfd8330} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2768 -prefsLen 32952 -prefMapHandle 2772 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5648 -initialChannelId {f5b3542b-45ea-4518-92c7-11c3c103d3d0} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6252 -prefsLen 33071 -prefMapHandle 6256 -prefMapSize 270279 -jsInitHandle 6260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6176 -initialChannelId {cb732ab7-5632-46e6-8895-6030225348b5} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 33071 -prefMapHandle 2824 -prefMapSize 270279 -jsInitHandle 3640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {6382cbe8-2b29-4e1b-a935-c0a44df293ef} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5508 -prefsLen 33071 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5564 -initialChannelId {17cad358-5a77-4257-9dc0-58ef835b600f} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:6028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2992 -prefsLen 33071 -prefMapHandle 6684 -prefMapSize 270279 -jsInitHandle 4688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3712 -initialChannelId {b0e0fbf7-07ae-4c71-ae3a-39501d737a50} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2916 -prefsLen 33071 -prefMapHandle 3716 -prefMapSize 270279 -jsInitHandle 6192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6844 -initialChannelId {4ac971f9-3fa5-48fa-9472-1ca78040fbff} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6436 -prefsLen 33071 -prefMapHandle 6440 -prefMapSize 270279 -jsInitHandle 6276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {23369c59-6253-4ecc-ad75-50562539fade} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6364 -prefsLen 35200 -prefMapHandle 6268 -prefMapSize 270279 -ipcHandle 5512 -initialChannelId {8d8905da-2fc9-48e3-8249-df495c9469b6} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 utility
    3⤵
    - Checks processor information in registry
    PID:5520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 36758 -prefMapHandle 4872 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6320 -initialChannelId {e9ee3b8c-501e-46b1-bd15-8069e3774c7a} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:5144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6184 -prefsLen 39877 -prefMapHandle 6868 -prefMapSize 270279 -ipcHandle 5280 -initialChannelId {05584b39-f0b9-4615-a6aa-fdbaba49a51e} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 utility
    3⤵
    - Checks processor information in registry
    PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 02cf631394ec2a11a54e27b45fb540afbab55a20e6e58101cc84a20113f87895
MD5 9f83248a9fc2e4a3548ffeb03ad9d46c
SHA1 98c05630489018b34a1f1be330ae17140b89e659
SHA512 7c051112cdf88c8af3584e29e76c91a9b281b3e6490ef1cabd4444fa19ec5343e613889f5e0ea5b4b1e22fbd855e185db37fd3eb3996e16b91a4a78b0df2c7b7
SSDEEP 384:HwCe7iO024Y2dcs3hk2nhfdDE2Ba/rIVy8eavM+2vM+n:QqZY2dv3hk2nhfS2sDIVy8n0+20+n
TLSH
T16E728DBBDF416C5D1917D585C8AD9369DC15F9ABCBF680B608203449C78432AB0FA0DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

654C1EF20FB554952024978072B9B2164C2C60A0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\654C1EF20FB554952024978072B9B2164C2C60A0
Size 15KB
SHA256 129f51464439ee49f21a5654f6aa790931defc6d9eb1e8e6376c0232336bfcc5
MD5 132852894ae4397b483dadcf5e160201
SHA1 c8c5f1ef4d6104ebc7c2f30b869872c579276178
SHA512 8ae069b5f81830725979888ae0141d0b3777b0bc6e885c42d26e8bd6d219825f9c70e53f6a4b5cf1aadbadffdf2221d566fe67f317797cfdc8d68cc11affe46d
SSDEEP 384:WP4zrLKK9JT/LylKyQindo1ToRVgcBIcz6t7KDGL0:WG/KK95OEqdo1k41czm7Ki0
TLSH
T18A62C13BEE016E464AC1C963DABF78812D5E5363CED5E8EFBC903744540473994F520A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 0919ad6ea89b1883c02900ea8a9984db7353b726edebc4a69ad10f54949e80cc
MD5 aa2f3429e35fac05cf02fcaf3ad998e3
SHA1 367d14c32dde0ec11bc3a479343c8837eddbbbad
SHA512 2ad51ade43097bdcc645515086328b87385de4e68268673f58f6eb5743bdf7756ea58a956a170459a5c877c0d18bdb4db538d73cb5fdb36f6710f807b83c9d32
SSDEEP 384:H9XghOiO024Y+dcs3hk2nhfdDE2Ba/rIVy8e+75:dX+ZY+dv3hk2nhfS2sDIVy8V
TLSH
T176729DBBDF116C5D1957D585C8AD8369DD15F9BBCBF681A608203449CB8432AF0FA0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 46KB
SHA256 97cbc7c1ddf2b6344939b52eef9df5cf593d3d6c802697f74e5ea876cc13f6dd
MD5 ddfa83fb8c2f4567dbe0faedb19be0dd
SHA1 9cee6d7200f6655ee537027552cb9308f2e4ba1f
SHA512 9ebf14f7025b98b9c0bcb7ba2e1920d5d39198e80368a00fda499a4657e7016afa15a7b21d3db9ce838f64a602fdf9688a039cb1ceb189630232546579968c6e
SSDEEP 96:/ba1vT3Pp1xBL0I56M+80M/pd9Z3yx23gyuZGZV33Lx/XJWcS7oT5JGRgtWMt3Ra:OeQr22wZZ2nXfbxtcFt9DhY
TLSH
T18C23A6F757B5B862F4A38FB05098709C9C3302191578C9CCCA54A1AB06A6B95E17FFB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 47KB
SHA256 bbc490596c72c2c2d5c634ca35d564b69f666b7f9868dd29558c3bcb8f68ba87
MD5 c872326e86108b6870335f1da8de1880
SHA1 98328c2af011c7ed882599b589057ba14fd65ddf
SHA512 3647c6b1e1638135828284508eb9dd9e0f876332f463b57a3950c17db49b23e801ff7fd972cc1875e085d68c80bf458a99455b9fa66a72f986c388b093707935
SSDEEP 96:ba1vT3Pp1xBL0I56M+8RM/pKFt+yx2MRjyuZFMg2Uk/sHcS77wqHRpqWMtyPf3PD:WHQz22MjZZ8VxtGFt0hY
TLSH
T1B423B5F757B5B861F4729FB05098708D9C3302191978C9CCCA54A1AB06A6B96F13FFB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 10KB
SHA256 9ce6fcb4390d56bc2eec1a63e80b2960c1d9afdff467240882b383f1cc33726c
MD5 d6be04768b295a00b6f0122c3c98e840
SHA1 5f5cbcd2d4ee18622d9712e5d969fdf5c518cdf1
SHA512 0a43be13de9a67df1c440baaf0b546bc426fbbac838ed2b20d22dd650e55916679439cb0c8c91bfc38effc88b327ed8d08806db6006d57f1da4eb2ea05c15dde
SSDEEP 24:ouhMZD91LFn29xSF+9BGFy9FwFTS9VvkFUVW5q9F55A5lF+9l8F:yrs0EggykBMUV8I56vEO
TLSH
T1F92292F76B71B472F0A28FB05059B15C9C33032555789588C754A1EB06E2ADAA13EBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 6b5af3046b2256e4ffab2d41c21ebeefd1e2c3918cf75392693001b0bc406440
MD5 8bd3b370a95e9b9843b6b40a61905f36
SHA1 6c2b07610e034ec0dda0a60eba73035394402abe
SHA512 b126be1b6dffa77cf691f4a6b9bcd9c398e5b156cfce0f357ed547b963367554304340e06d1121ed88ce15277c5bd040e289c79a92c77d8b7542e12eb54aff2d
TLSH
T14E619758F2298A3FE449413ACC921B411F347456A8AF7F2A35AC604D1E5B2CE778D53D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9089217f5786fd24ec2bd6c40230184887c5cab3b77d6633b5c0af7c111b9f62
MD5 22e40d4033ff856ebc899f5d3cd92313
SHA1 d400876143a680944c9d3d00a818121ce187d7a3
SHA512 7019bcdf5dcc938b056cabf308e6a0a0b74b3b355333a252c2c6c991926bbead214e12ef80c19cf5b6e1bb90534ff3fea084f06b1c3178b7304b170ba3619e83
SSDEEP 192:MM1d66JozGzgCl6mc0dRPOv5zboP+ZqmyjVM:M2d66JozGzgC1jjgboGZqmyj
TLSH
T125E1F068EA28863FC418127BCCA61F814F3A395AD84E3F25319C741C2D572DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f150f43c3d4c57ff26e7a921f55649d7e5f4a8da867d13680b5ac1f2d4928db1
MD5 ca0e17f0dbca26153fadb84ce6558e2c
SHA1 8c6dead789ed1df6c6539e057fdc86ac450664f2
SHA512 d8e293bb5f0b0d1534b4ef662ab93e2cac4f7dbb83a0d116e43c1c2899ead132ca3ae19213e3643f0d4c0ff078fb1d3213dc0f50ddf7070b12a6d7e82e3d073c
SSDEEP 192:rPOv5zboP6qmyjFM7M1d66JozGzgCl6mc0dz:rgboiqmyjy2d66JozGzgC1jd
TLSH
T1F1E101A4EA28863FC418027BCCA61F414F3A395ADC4E3F25359D741C2D562DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6923392f36873ca2609f0676919fb462c3b086e862c0b8ae2fd9e714137d3201
MD5 d2fd4e2662121585b74109c4102de607
SHA1 b81a3155120c4a5f62fcaee497bc3c00f418fd64
SHA512 d3a31e7989d1751b44d9c4d73799098671ca972ea378e15db33fe080b6c215f266e2cf8db2d7ab586705401473a486b04c335cf08684827dd29f45e15f533cca
TLSH
T11D216A9C36B9CD2AA8CAF29C7450128E53984E06049B2C474D72FF8CCDE6ED9316A439
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 5KB
SHA256 0c518a0ee8e9ad944bf2d750e3bdb49e3f51f1d85fe644ef60ea1e33295b0e25
MD5 5c9af0cc9db5d529d83a38bd34a9e353
SHA1 136f1beb0be24dcc2b0f38970af2f8a20bd00640
SHA512 7e341a8652807521a0ef55f752177ef64bdd4c03c41f77876d4c3e81ab00a3f73b2164fd4d27a09b6662f31b87ea2f3738a90ca9d3c4c779dc9fc2f3f1dd4aba
SSDEEP 48:YYVe8XbQCAp83Z8zKKOYCV6i/KzShYOLpcsvOj4nZpZKbdGkdKFRKrIlBWKBi/6n:zTUkKGkAtL0j4nncbdZdRMhNZbYYtIE9
TLSH
T155B1221D34A94C7F29DBE35DB880528D86ED4B02848B18474DFBFF49CC9AE99321E539
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

413641dd-612c-465b-82a4-d7b904f0fc7a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\413641dd-612c-465b-82a4-d7b904f0fc7a
Size 2KB
SHA256 15f6f8b6fd281cc443d4864aad09190cded2085e5a42d006c82e928db92bbe32
MD5 fb8e49058ca4ea3aaad79c908e456c2b
SHA1 94c04a73646a6443474559eacb14536dbcef694f
SHA512 19adb4ebed1de1f37916f137b43c2e55f152075ba97be029fa7636d14984cf8bbcf3a037dc9923356c15dfbc8f39df71d4d3bbe6e8b989ccb67d8dca46107ab0
TLSH
T15F41545C75785C764CDAE18CD582278E57608E1740C728C32E62EE0CCDD675E332A43B
MD5 SHA1 SHA512 TLSH

Submit Download

6b797747-00e2-4733-a78b-a1c80316ba5a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\6b797747-00e2-4733-a78b-a1c80316ba5a
Size 16KB
SHA256 5881c45fa4d87eb167e8fc526ded32f8575b126b28e4f20040d3ccc82d1c313a
MD5 e4fa83cc35b71d9174bb29b417eb809f
SHA1 d0a0899a1a1355820bb7f2d8f94cf994ed74e4c4
SHA512 20080548bacf7d32d77d753ad56de35b6e78ef5b15d8972857c975f45cf9c7255d0751d6f6998df2aed25f4cdaf00a0430f1a76bf65b42ee84522e04e8da679b
SSDEEP 192:b9HUCpgW9OHy6t6HP0WQ479CL7T9gKH4dXi4B22e1wDvCHfX0u5hKl7EucTL51z2:b/EqY4k2HbC/X/T0LcTL51xSZ6MvvCQJ
TLSH
T15972C956682045BA8251E36998F8BFC3E5F638CF4C419FCADBE47D082DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71c6de58-005a-47bf-bb70-23ddc3b34636

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\71c6de58-005a-47bf-bb70-23ddc3b34636
Size 235B
SHA256 7b93ff64a4e4c799047bc4cb73571763f234f5d6b709bf972df6c4a940ed6288
MD5 ad0b7b6552f690854d90beeee085d150
SHA1 3123172abc42c0b3037ef4b2fa9451e87252b398
SHA512 084c652a6aa2f733c04e674f975b044aaa230e81dfd964a2893760aae5bcf494094be8df0d0b0fadedcd00658e672c6c0ef486f1b714d4b45ad554675685c8e7
TLSH
T125D09794189CE39D08280F02B4B0A9C734488C3354B09C20A5A00238EDB89C861A180B
MD5 SHA1 SHA512 TLSH

Submit Download

a9afea5b-9611-451f-9cdb-80c9a4d803ff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\a9afea5b-9611-451f-9cdb-80c9a4d803ff
Size 886B
SHA256 68b8b0a4b450d599b41472fb8379496a5bc25263c8406328e0e538dd9ea00f23
MD5 2db8f723ae839b71ddc93b9d3ada3a61
SHA1 94a240d8ac07c28a6ec721792a29b72137cd40af
SHA512 86b66d7c515f5fb53cf47241e7091b2483ee473b344671068d4d0fa3f2d58a957a3abeb94048d5bf9a22e98454ef8d1a98602afb3d384b45d3212434025121e8
TLSH
T14E1104908634B9728C7CD24796E17B428AD47523C0CA58607D556A2C0DAE51EA36B607
MD5 SHA1 SHA512 TLSH

Submit Download

b21187d0-8711-4118-b4b3-223d51bd52f3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\b21187d0-8711-4118-b4b3-223d51bd52f3
Size 883B
SHA256 b24554536e03ddb7ca7f957fd5ccb9605cceaac81e2f82381f8a6fe0e9e6641a
MD5 1357e56f59e99c9c85216c0348a6f79d
SHA1 8b0f82e371b11f18aa920366eb61649f4d86e540
SHA512 b216943b4fae8c53d3c6e42e73bd33aea3cd2b250b59f4ac6c42c7b095d640d7c687a1eb5d946e97e1f6357711d653903c4426f9460c917799edf301f8f2ceb0
TLSH
T1EA1104919630F873CCACC20785D57B524BA4652380C954143D616A2C0D7961E936A307
MD5 SHA1 SHA512 TLSH

Submit Download

be3a77d5-899e-40ab-99d1-810073501dd3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\be3a77d5-899e-40ab-99d1-810073501dd3
Size 235B
SHA256 011ad1a579b122f0bec9a9cdcca25e92cdcd86bc37242a8c19c7dd25a5151666
MD5 5a6e246481692fe9742bb0f27d126783
SHA1 53b2eb74a8981e0270a90b57db9a62d0ed049f63
SHA512 b6cdb19d8e25369f629d65b8374067e36ebc3c2e739b43b9707dce9cb5250fa651117fc47a95933a02358b434ed14cd7999fc6b16cf130a21b8ad230a1cccfd5
TLSH
T1C3D0978024A8676C48140F27F0B02BC330864C3310625814D7610D789BF8EC88162817
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
Size 16KB
SHA256 aaccc297624a1e3a21fb2e1f3719fba532eb0c7953c4a8060097b1b67ce5220b
MD5 b658ad32be6f5f24c7c048035102694e
SHA1 c4e4929e5b6386b4b9a8d3abd0b13294491f899f
SHA512 b2e98b8575601fdd88d71b37843d4cd6d794215e8394e4dd5d2cd9a54971d8c5c1a5ab63bc3d67bff5b56cafe198a298ca9596b1c681f2923057c2d862d4a6f6
SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4Hx/4hG:ujI4VRfOXN4e60434L474f4N40
TLSH
T17272421545049EB8294FA79BAA367E01C37D473B60845C78F4DD8FC802FB5B902BB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 f9aa5de97d73a58f62aca08f60787a64fbac7224a3ce5d1bf5797577b18e10ff
MD5 cd4cdf98229b41a830a034f66d5eb31f
SHA1 940f55a86da76872dc4a7039c0355bb8023ceb1b
SHA512 c824fcfa0d66225c448e1770fe6f1d9822cf431dc087760fc15b73769d3851b9c1e01c597ef8df9a0ac8c283ecc10884bcc806e741108eb7142f74cbc204feae
SSDEEP 96:xHcUTUuqGqdf2g3kzSlhFSSlDdv9j7nERH9O+y1Bw88n8L4cnrzBHjGS:65Rdf2g3nhFSSC9A1Bw88+X
TLSH
T1ADE1307854088F7F64B6766CAC6888716AB2013BBBBF68C750B554C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 7KB
SHA256 6160647693e011631eaa60de7636ef536f95c4b965de7e5a504f398814e8641f
MD5 233a9293389e28444dca6c4fb92e7152
SHA1 aabd30eeeee2c4a8cfa76c657a9b1c9114f7274b
SHA512 3bf1f46c5bf0ebbb4da9489886537194d96e393d7d1128241302bf03b3bb3f6806395aaf681c7e23a089360379cfa038bb296d35ba10acec954c545b8a1aaf9d
SSDEEP 96:xHcUTUuqGqdf2g3mbzSlhFSSlDdv9j7nERH9O+y1Bw88n8L4cnrzBHjGS:65Rdf2g3DhFSSC9A1Bw88+X
TLSH
T1F5E1407894088F7F74B6766CAC6888716AB2413BBBBF68C750B554C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 2f23a4547b7411e731ca8d962e927ba719a201772156a82514fcbd090741fe4d
MD5 a870efd0ddc0223f30fb35e66e2816e1
SHA1 86a1d7394b772f46f0b0f45d84e752ab36db7c9d
SHA512 ddd4e9a5b2009acdc5b5cd850b1a7b476b69aaa1d89508514c86387cd491303aa620326699fd2839574f5af8796dbcb8eb913d86798331fc6155b902e5176885
SSDEEP 96:xHcUTUuqGqdf2oE1zSZUFSSlDdv9j7nERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEgUFSSC9A1Bw88+w
TLSH
T1C4E1307894088B6F74B6766CAC6888716AB2413BB7BF68C750B554C4050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 8KB
SHA256 3c116e1f768d8e5ab6733ad5e5212626ab65b95d8be4470190f8d9cc226a23d6
MD5 e2a68134d052b1279e09f14365a1e0fe
SHA1 3d2f7bfde462821f293c2d24dc997fc6adf92ac8
SHA512 36768f7b5bd0ef4b13694fa9597a51dcd134d4f2c951e2eac9fe8920dbcb6a26e29e9c8f0fa6fae520eba857e89e0d202f44edbcc1737edbdab91f8f4f3115a3
SSDEEP 96:xHchTUuqGqdf4g3mbzSlhFSSlDdv9jdnERWR0BO+ykBw882yA8L4cnrzBHjGS:6MRdf4g3DhFSSM8RHkBw88TX
TLSH
T1900200785004CF7F68B276BCAC2449715AB2023BB6BF68C711B964C5055CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 87b7d2bf5cd5a262462a249ffb5baf567216f22f18eaa542daa6995511d4985f
MD5 40bf45dbcc9cdaf7debe0afa8edab4a7
SHA1 c7aa08edb575d15f229c121265ec67ba1dbcf0a0
SHA512 421e8fadce9b261c7930dff30260c1e2d70969500f42806d20e9e9362a4ddab638e441898d8d969148908a8d7ec3dfa2bda121de2b42e1cd711d21d0d265bdef
SSDEEP 96:xHcUTUuqGqdf2g31zSlhFSSlDdv9j7nERH9O+y1Bw88n8L4cnrzBHjGS:65Rdf2g3IhFSSC9A1Bw88+X
TLSH
T1D1E14F7894088F7F64B6776CAC6888716AB2013BBBBF68C750B554C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 19KB
SHA256 d53584fd72b64c5e53da90c27920cacbe2c3fd66484fb6f8234322565a0d152d
MD5 f013445bd82f46687627e5be65dfef8f
SHA1 c2c51fffe91477b1566134cf56c3f694cc9bf7c7
SHA512 d45c68bc304afd5c4e3e1312207bb675aa88efd843a7378584de38abab73b6af3e3808ed114ff75eb82a0414c56469f49ecd050a83b96f648faa0bdf61270a58
SSDEEP 384:q1H4b+QKMQT4fB5m7OSBz3XNE8fKWR8IVlghDMbeiKHBYzlIZwPpbgUkCk7:aI+wB5m7OSBz3e8CWRtKHBYzlCUgUk1
TLSH
T12D92BF72E6422BDDCD613A0B857C3F1406BF509B2AF59109FE4CE95D8C359C867F8688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 20KB
SHA256 e529503cfb8e6d6e4c11c0de4438c4a681a671191d1b6bf4d41b6c25dffc624e
MD5 1cc5dd0ac667e5cf109dd2d0d7043933
SHA1 9cbf2dec76bdf765b54ce0c800b5339f094f0655
SHA512 808d57baa9ebaf7766ef87cf3f2b368c7592b8240f18923c639e14f1ba326a31286482a8e79007e0a34285fbc3031dd954fc460de227ae40ae80b156ab74fd16
SSDEEP 384:b1H4b+QKMQT4fB5m7OSBz3XNE8fKWR8IVlghSIipKqXgljl9252v9jIYbgUkaDz0:pI+wB5m7OSBz3e8CWRllpnXSjlI52JIT
TLSH
T1F8A2CF71E5422BDE8DA03E4B42BD7F0406AF218A36E19114FA4CAC5DCC359C867F928D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 e105955a6d82e64192da418fbe5e2cb390d576791a2ba918a7b0f6d95b3a61ac
MD5 f36d09425fafaee9b03e4168d16bae2f
SHA1 befa552a633636933821a0e6a399682c016a3f97
SHA512 c39eea84b1c5b38d7e2bb4cc288b47a107c50cef6c1749b53269075a2ba5768a778cf94720cb2abb62a5d0f5f423fb1cbf0df83f08352b0fcc4f51c937ccc664
SSDEEP 96:Gf1gaPgjV9fytEH6lMp6iOVmE/fAQkoKP/xZfQwCeJEjMjUnUk9j0+KfcQXOAnST:I1gaIZ9qHrLovQteG4gUkK+KBej
TLSH
T1F5C17F929547A8DAF5D1F4C40CE87B570AFE6189D0B400808678F30DECB5A5E376D29D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 19KB
SHA256 4c71fd2e6e5d31383644f0c250186e627be5b963c5e7f789452d1c9feaa9d1c2
MD5 9fc3df0000f7b2f0743d20c7e5e31bbc
SHA1 638eb6cf658ddf1217ae233e4c027f5f025f310e
SHA512 ea806ff95087f3678f4decd5ac48802e131521a00b94f1a46277ce8f430b8b43b388705e96e6e10ec0953474512efe0b705cd0c99120df1cd07016e7892a56b4
SSDEEP 384:O1H4b+QKMQT4fB5m7OSBz3XNE8fKWR8IVlghDMbeiKZTOelUU7DSDm2bgUkuJyp:eI+wB5m7OSBz3e8CWRtKZaelPXSlgUkx
TLSH
T16492BF76E6022B8D8D613A0B847C3F2406BE509626E69149FE0CDD5D8C799CC57F8648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 20KB
SHA256 99677e9a828616947aecaf072dea5fdf8be84b645518952d131bc7b2e5cb64a5
MD5 f97c95d24e2517509163c36f5a4497f5
SHA1 5e3d42e922aca924554b78b251ec27fc8c367eac
SHA512 477ff6743afa1cd9f22b8ac5f1b404b81310f7f476fb6da9841d70a820d15a557eb3d9fad9dba4ac58b82d503bd0781ba302b8f3134289d45ab50691a45b8c90
SSDEEP 384:D6Bs0x+QfMQT4fEm7OLZBz3XNE8fKWR8IVQnghjkQKGZlI6YrdbgUksTOx:G+vEm7OLZBz3e8CWRLrKGZlCgUkp
TLSH
T16E92BF73F54127CD8D603A4789BC3B550ABF518A2AE69205FA08FD5DCC399C827F829D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads