1654c1c70b15a8eba9bdd092565f30385d0278c2d10a45628716fc9138db8d59

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 14:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.html
Size 24KB
Sample260722-rj3fvsff87
SHA256 1654c1c70b15a8eba9bdd092565f30385d0278c2d10a45628716fc9138db8d59
MD5 1242c5e2d4db4c51a45afd8ad9b549f0
SHA1 74edb7a9af91c83a39de6e6b584c51e666cf011b
SHA512 a9f740df0f87ab68f8a154a8f41fa1dcf85650618259ee7ccc2889e2e0048e7a8f2825d9916187e6de2b7da2c66f544a3f650dc172dd5466e2693e041a7da799
SSDEEP 768:cEx/WcZVgbfOFlx5ojbknr5d5W5Bf5o5PT5Y2X:HocZVgbWFlx5ofknr/sTeRv
TLSH
T1DBB2A59E0AD64114A62ED0856C9672097316412BAF07FCA87FFD405C6FDA29FC0B368F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

google persistence phishing

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
127	3332	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	firefox.exe
Token: SeDebugPrivilege	3332	firefox.exe
Token: SeDebugPrivilege	3332	firefox.exe
Token: SeDebugPrivilege	3332	firefox.exe
Token: SeDebugPrivilege	3332	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3332	firefox.exe
3332	firefox.exe
3332	firefox.exe
3332	firefox.exe
3332	firefox.exe
3332	firefox.exe
3332	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3332	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 3332	4772	firefox.exe	86
PID 4772 wrote to memory of 3332	4772	firefox.exe	86
PID 3332 wrote to memory of 3336	3332	firefox.exe	87
PID 3332 wrote to memory of 3336	3332	firefox.exe	87
PID 3332 wrote to memory of 3336	3332	firefox.exe	87
PID 3332 wrote to memory of 3380	3332	firefox.exe	88
PID 3332 wrote to memory of 3380	3332	firefox.exe	88
PID 3332 wrote to memory of 3380	3332	firefox.exe	88
PID 3332 wrote to memory of 3380	3332	firefox.exe	88
PID 3332 wrote to memory of 2312	3332	firefox.exe	89
PID 3332 wrote to memory of 2312	3332	firefox.exe	89
PID 3332 wrote to memory of 2312	3332	firefox.exe	89
PID 3332 wrote to memory of 2312	3332	firefox.exe	89
PID 3332 wrote to memory of 2384	3332	firefox.exe	90
PID 3332 wrote to memory of 2384	3332	firefox.exe	90
PID 3332 wrote to memory of 2384	3332	firefox.exe	90
PID 3332 wrote to memory of 4700	3332	firefox.exe	91
PID 3332 wrote to memory of 4700	3332	firefox.exe	91
PID 3332 wrote to memory of 4700	3332	firefox.exe	91
PID 3332 wrote to memory of 4700	3332	firefox.exe	91
PID 3332 wrote to memory of 4360	3332	firefox.exe	92
PID 3332 wrote to memory of 4360	3332	firefox.exe	92
PID 3332 wrote to memory of 4360	3332	firefox.exe	92
PID 3332 wrote to memory of 4360	3332	firefox.exe	92
PID 3332 wrote to memory of 564	3332	firefox.exe	93
PID 3332 wrote to memory of 564	3332	firefox.exe	93
PID 3332 wrote to memory of 564	3332	firefox.exe	93
PID 3332 wrote to memory of 564	3332	firefox.exe	93
PID 3332 wrote to memory of 4504	3332	firefox.exe	94
PID 3332 wrote to memory of 4504	3332	firefox.exe	94
PID 3332 wrote to memory of 4504	3332	firefox.exe	94
PID 3332 wrote to memory of 4504	3332	firefox.exe	94
PID 3332 wrote to memory of 3908	3332	firefox.exe	95
PID 3332 wrote to memory of 3908	3332	firefox.exe	95
PID 3332 wrote to memory of 3908	3332	firefox.exe	95
PID 3332 wrote to memory of 3908	3332	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\a.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\a.html
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {e2a8ce72-88b9-4f7b-989f-991ca9731f57} -parentPid 3332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {413af586-3f16-45ea-b315-6ad2b05f250c} -parentPid 3332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 27276 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {584b0afa-8eab-409b-95c6-9afdf0db2993} -parentPid 3332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27276 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 4028 -initialChannelId {05c7b7c7-7ce7-42d3-b38f-f63a9d3280f7} -parentPid 3332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4424 -prefsLen 34775 -prefMapHandle 4428 -prefMapSize 270279 -jsInitHandle 4432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1664 -initialChannelId {3f81be9c-1f2f-430d-9924-325e4ecd20ea} -parentPid 3332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5032 -prefsLen 34905 -prefMapHandle 4980 -prefMapSize 270279 -ipcHandle 5012 -initialChannelId {934205f7-a403-4291-82f4-70d66f0a6597} -parentPid 3332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32900 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {2a93f826-966c-4713-89e8-6a64680a1c4b} -parentPid 3332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 32900 -prefMapHandle 5240 -prefMapSize 270279 -jsInitHandle 5236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5212 -initialChannelId {6831bba1-4de0-4b43-bafd-a16ddc78af17} -parentPid 3332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32900 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5672 -initialChannelId {e6dd7251-10b1-4c9c-a7c0-f68daf5a4628} -parentPid 3332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 87c800dcf65bdfac4bbde52de74e383a0841154a08c0f8cd9974dc138f473e67
MD5 ecb472289cb88e5190c41f1937cc82eb
SHA1 0b7fbbdb21a82a73b945feefb0ab4901f20df33c
SHA512 014d0e378c4a680984f161ba1b31e725e34f1394b74a283c4457ccdca5d1f68561f4e718c009796d6e0492e4dbc0ec9de062d12f9794a51e26063dc3314dbc1f
SSDEEP 384:HwCe7iO024YHdcs3hk2nhfdDE2Ba/rIVy8eCZ9++Z9+w:QqZYHdv3hk2nhfS2sDIVy89b++b+w
TLSH
T157728DBBDF516C592917D985C8AD536ADC04F9BBCFF690A60824344AC78432AB0F608F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 381bcbb743f59f02e578c5bd3b7621a0ac25df35a7a84f8bc16a0ecc84d82dd5
MD5 a1dc3e3902ce45f62fd41e726e386a34
SHA1 f926a1cb2403cd9b5cd3b7eaa4802c6e81d03b71
SHA512 702b8008081c5cab923e0fc9de486b1faa9a24d85cdb4399c8ea86d2236b7098f25933c94709ec0d101eb24947c01a46a42961a846e0e077bd1c2bebb105ed8d
SSDEEP 384:H9XghOiO024YHdcs3hk2nhfdDE2Ba/rIVy8eBBaBP:dX+ZYHdv3hk2nhfS2sDIVy87
TLSH
T145729DBF9F116C5D1967D585C8AD8369DC15FEBBCBF680A608203449CB8432AB0F60CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de55dd7d-6a12-4e4c-a240-627129676216.zip

Path C:\Users\Admin\AppData\Local\Temp\de55dd7d-6a12-4e4c-a240-627129676216.zip
Size 3.7MB
SHA256 bc95998470d618938a0fe50570dbed499e4e6215b1edca8a6693192fe6632a81
MD5 522ec10a425d48b166d10444a5f97035
SHA1 65faa22b1cf5781051be57453db6de36407601d1
SHA512 58d22c8dac7f7163bcadbfb5cba368f912b1a9e076fca9192369e116846e7c59b5846044f867e7451895a4ce65ee30f90710791c9a4b721e1116846c70abdd4f
SSDEEP 49152:fwoQyV1AXPC/Tn2HVqo0Ssh3F2Z95OOlo36EiyHK1CgaESlsi/tpcuQtZcOCgLM8:IoQUUHz+f2ZnBQHK1VaEM/rK/LM45YU
TLSH
T13B06F135D25CD60ACDCF83BA810C2FC2C87C6F66A054A55BFEEA9571DCA32D21F54A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 8d7f5ccd40911bbce65fdcb0f7c988aec3f4626f322115d9fe114e2d5a90c4d6
MD5 2e795e17af3989ba85eacd2d250db0c0
SHA1 a493f68f7d84489459a4a96ef61fd67372d5cf9e
SHA512 86dd2b14ca3fea27dcb683fb29b45fc877bb1b0bd6cd58602fd86ae687b1e8e166f924a1e86d54faf68fa63c4522630605ba3665fa7bdb77e669ea0e159ac847
TLSH
T1F961A858F228863FE448413ACC961B451F34751AA8AE7F2A35AC608D1E5B3CE76CE47D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 17aa7882f66a1ce925d8f6a13e1f511b9d9bab1c56d0ccef93937b22235927b5
MD5 b3f4ca1fdfeb541230e1279bdf5c549f
SHA1 560fe4eb6567bcc3ec605f4452aa4673d6bf5f9d
SHA512 8a5b7da6fe6eae1be8c7b7ae233d894905d1c1901627182f5a68a91891bfaf89621d28095d8ffba0858a16bdab635f6238032d32100bed3b69054483094efff4
SSDEEP 768:oOQmrc5qUGcmhucJXlKcxvILbvbNrEcpj:oOQmrcgXlcP
TLSH
T1F3D22144FB2E953FD41412BBDCA54B002F79B889591A2F973A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 914b2473d3969efdeb2a193a86f7e5e49ab067634be82f5cdf3aa9b893aba810
MD5 6caaf81d76bd377631fc0697f86b3815
SHA1 47251f8b53f4f33ad1f0d63bfef831b32429b5ef
SHA512 bee4248233fa3328de88d4a9fc2d9809ba61946c2eb9e586b08fbe3fb1caeb73ff410c22dff9877fa84b9289c3e11c57748f820cc0a02152529a81600d6256ad
SSDEEP 768:hEJOQmrc5qUGcmhucJXlKcxvILbvbNDpj:KOQmrcgXlcZ
TLSH
T165D22144FB2E953FD41412BBDCA50B002F79B889591A2F973A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 26032ad40410e51a3fc7bce7c3014efdd78e07123fc232823aa08f90c7baf6d4
MD5 223a9d091f40ad474ebaab5efdcde63e
SHA1 52bea50386f85c616f99fb6a0df2d6077e27c8b6
SHA512 60ce065350f1be9c955211567570e0d8385acb9cd81462f3579e90dac18626450644e99b685fb54a648581f3bea50b8f87af9262ee1f5a71ca5ec13d7ca034df
SSDEEP 768:hEcp9OQmrc5qUGcmhucJXlKcxvILbvbN:fOQmrcgXlc
TLSH
T17DD22144FB2E953FD41412BBDCA54B002F79B889591A2F973A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ee8857fcbcb79c034db06a5f7f380fcde8d043f3bf2b6b3e6eb9f0332b9f03eb
MD5 3f2359595212974cebed4ce60903819f
SHA1 2c63ad4bb7cf83f6eda7cafd05fa6f9b56331d16
SHA512 a0745d773bb8567537bc418bdbbd2d70208d07908bb3bdd2dadfa1971c290c07e02e34a8b3da33524a47238651f48fd2d2dbc9ca71914b126325e2e782f02c8a
SSDEEP 192:+H1d66JozGzgCl6mc0dYOv5zboPzZDLyjCA4:+Vd66JozGzgC1jRboLZDLyj
TLSH
T100E1CD68E638863BC418427BCCB60B410F36399A988E3F15329D64582D573DE7BCE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\events\events
Size 1KB
SHA256 482441f9a9e61fc6b99e6c4ca2b22839f9ac2b4bfe8ab71dee4638e41c2ad4bb
MD5 21fc1b64dfa262231f80e3878884bedf
SHA1 0d28b14093c3b5b142e9ab211ca8a04ad8ced713
SHA512 ef5eeb1158573a42cfa7ed9eed19bafd223a9b918fb10177432280c80062f93b96c9a1d45b86ae3b9adec859eef930bd5ea28d145cd5a5e7b8c2791eec368b24
TLSH
T1F621A99C39F94D2AADCBF29CB480228E57194A0208975C434D22FF8CCE81EDD326A43C
MD5 SHA1 SHA512 TLSH

Submit Download

2a6a5441-4cb0-4559-9eb4-2afbafc24677

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\2a6a5441-4cb0-4559-9eb4-2afbafc24677
Size 16KB
SHA256 9da2f0508452a1d1a3c7c513aa4e333072c093138a43ba1bb036679b54201f08
MD5 fd52f2c001ff5e71564123ac2201a6f2
SHA1 2480804479b4f5a9684b14bacd7b039764ae0906
SHA512 e65889eff000387fe2c4b75b2d8e898e691df82945432f36bdebce2cedf4d7c7693a35cf7c6a5e2ab8aaabfb1fbded5c06fe20fecc1dead18d8292c5e893ff67
SSDEEP 192:L4bUVbik2RbVzSzoOakENry80QjmQDguqSG6mPpyLNhjGxEU0be8R5x1P2BOMUgL:L4qb52RbVzSpanNyyl52FU5sue/BwI
TLSH
T14B72EA16286055BA8251E2AD98FCBFC3E6F528CF4C019FC9DBE47D0869DE09E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47ed8f60-5c00-4351-92ad-b17aaddc47d8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\47ed8f60-5c00-4351-92ad-b17aaddc47d8
Size 235B
SHA256 3b39338c278e9cdcc1ff06172d11443a8d22ab7d73a7de1f6910cc5e1ae5eeec
MD5 2ec7d3646f2b3c818fffe688f73f8099
SHA1 88211db7c63cfafb761aea605cc6e7c157fe2dbe
SHA512 804ef3ad587306d132f7afe967ce1e1357ba9c7df7960bdb79ceca8683c831500bf087f56dd58348ad0bf06d63f4b5b2b292cdfbb20acef1fb6a6ea42ba0d799
TLSH
T152D097A028A8376C48100F07F0A029C271944C3310B4A8508AA242B8EAFAEC80192917
MD5 SHA1 SHA512 TLSH

Submit Download

4fda438d-7f32-4ee9-bdc2-6a99245a1580

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\4fda438d-7f32-4ee9-bdc2-6a99245a1580
Size 886B
SHA256 2e18c95c2c4a993063bc93c2aef94e6d8400daa71e7c69de243c2529422a505e
MD5 587b48a296577a07f92241df4a7cc742
SHA1 f2ed8827a5819cde9f85570dd7eadf9914963c92
SHA512 5bd86eaa628d876f9fd2c5d45ab390371cbd92456b167c63811ed58034ef391b8c7d5c2009558899e1d1d20cd9ccea87947b256c35bec4ea15fdfee9e931db26
TLSH
T1D21140819A78B871CD3CC28784E4BB464BF4712380C625047EA14A180DBF71FB3AB21B
MD5 SHA1 SHA512 TLSH

Submit Download

6b6c3a80-02bf-4dd1-8a1a-4d66814c1f6d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\6b6c3a80-02bf-4dd1-8a1a-4d66814c1f6d
Size 2KB
SHA256 d8c485528926768bb2f0e97bc96c45d3e2dac8f22200f290ec2eace00566fe3c
MD5 e2a18e811e270809c2b98bfe6a48e9a3
SHA1 e826f3bd88cb2ace941d78172e16607eb2c2aa55
SHA512 baa800162cc32b836a71d4ffbeb37f2ffdd0a0665f34c30b87cf11f58b8a09e01e7d6278c2b57c8d86770e8db2982f32e6054428ea4b2a6fdc0816088e98261b
TLSH
T15541219938784CB68C9AE69DE891338E57704A0300C26C432D63DF0C8D967AE337B57A
MD5 SHA1 SHA512 TLSH

Submit Download

914f1599-5189-43dd-b312-21d4a1866582

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\914f1599-5189-43dd-b312-21d4a1866582
Size 235B
SHA256 1a125afa05dc87ac40fdb0a84b649157f85ba8e25f7be4f13a3929e1cfeb498c
MD5 6d30462d50c6cbc8e2b30b41d5220ac7
SHA1 a6056e99487c356509b632da48ad3404f63d67a6
SHA512 60220e5175ad3d0ef4c6a839ad57d12e5cc2ab6c0fd3d2885e849ec4f822b077f7ce2381851ca1ab09af14716f5387de9490f0e53a809dd95b001e18ba030d08
TLSH
T1B3D0978028E8637C08200F12F0E029C230488C3720799890D65101B89AFDEC84252867
MD5 SHA1 SHA512 TLSH

Submit Download

a5ece12b-1398-4e54-aeff-36f227c85ef2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\a5ece12b-1398-4e54-aeff-36f227c85ef2
Size 883B
SHA256 80be1a25d4e80a0d51b08a1addfeab6c7e1aec1308911265eb0730ea71ffe775
MD5 0aa85c7ecb93384c72a08293cf313dec
SHA1 9360ed7e7a2dc01a925c0a774bdf9b823e851684
SHA512 28470c993e23ba26c5de98a552ad8bd11327a9a6862f47afc68378305b54595c538d7122f0cd773a251f07161e423596efdea32a1d84726a723d6f05c3cc80cf
TLSH
T1CF112381AA38B9B2CC7CC25BC4653B434BF83923C0C551043EE14A140D7EB1EA7AB25F
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\extensions.json
Size 16KB
SHA256 42eecb6a0f904d28c8ce6cdc981a39a3ed16acb7dfe3b0968b9be6e9db8a3bcc
MD5 387dc3c41f8338abe0650fb8047d4d0f
SHA1 cb1fab9bc0c49b1aa35d0b1aef47af4b168d838f
SHA512 78884d0da9f37fd4ba52aa13fb511e506dec060c2569ff548daaa5947b0672ed5a5c7f4461151d765e01f0a6c8f76479da67736a292e72f850bdedaabd83d324
SSDEEP 384:B4kI4vuUmldvB8dhW694z396onL4HyL4PLL4HcL4HpL4HhyR4hw:BvI42RfiXb4p6Y4g4P4W4h4g4a
TLSH
T16972521545049EB8298FA78AAA367E01C37D473B70845C78F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
Size 12KB
SHA256 2b24973855c95152ae49a6a475fec2ecf81cc3eddf3488be06e86ba731ea4bca
MD5 66feb2a1b9f32f07c1974f7273568035
SHA1 817b65b8586c2aab7240f9db99d2972a5ed9c238
SHA512 4b582d5146274992519b02f07686030abcbfd10ece3502a0c529ae977d66a2fad50e17b01058f09459da0ef1f40cc5d08c9ce6e8ff572fee2452f77a8fb0ed4a
SSDEEP 192:9cF7ofhBQRvfP9+GsKSSwLRmOBw88xpynMbG:9w7ofhB84R5wD7q
TLSH
T10A42DE7C61409F3F20B2327DBC2559702AA50277BABFBCD705F9A492054CF2541E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
Size 6KB
SHA256 0c2aa764fea9c61111d16ed46d6e4fc0be6c21db0e66e3dd7f7d5899fb925277
MD5 22d94cca4e7c881fad5d6ecebd8e15d0
SHA1 77193fdf902bc0b54fae49e9fddbd6abae11d47c
SHA512 9bac19ab8a480633b3f771147487b11ed52134bd39de79d945419f6ed6828fda0758d2591ef362e0ed04b5c74a0d0fbbe9f0bbda496ee8bc392501e585149b7b
SSDEEP 96:xH07wUTUzqGqvf8Gs1zS0SSladv9jhen/5H1Bw88n8L4cnDOT:acORvf8Gs9SSwk1Bw88L
TLSH
T17CE12F7894088B6F64B6766CAC6888316AB2013B7BBF28C750B654C4005CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
Size 7KB
SHA256 bafb405c0afaaff4bba224368e826107fc4f9ccbdc4e700389b562192285f84c
MD5 3a681ac175120823310b3e8265b89464
SHA1 5d497e9073f8e2385605883da737da3cb43204e8
SHA512 cd5df0c6506727bfed2662d962ba0580911d57009db6f40499f3094129fcbadbf585180060f844c788b93cf560e345ce983a3837d47da75ca1f53dc8d9085816
SSDEEP 96:xH07wF7ofhBGTUzqGqvfP9+GsObzS0SSladv9jOn/5HIBw88s8L4cnDbT:acF7ofhBQRvfP9+GsKSSrIBw88/
TLSH
T156F1FD78A404DF7F74B6766CAC6489315AB2013BBABF68C710B964C4014CF3451F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 5c9712d96881d803588bc18b485db2bf4d6f13e0e9bc2d7eb24b0a52913207f2
MD5 f20d835656d7681a8e85a3e7f7648544
SHA1 cc52fd3cd768de8036a9bef7e9efc15919763815
SHA512 3cc222ebcda28f3f726ce67d612a80370ea0d8d13b18790a39429b82bc0052d1c7e2a11b4b6513ecdc73754bd9f58ab7a245a8ef4e45369cc143d2c58d3f5fdf
SSDEEP 96:xH07wUTUzqGqvf8nm1zSKSSladv9jhen/5H1Bw88n8L4cnDOT:acORvf8nmHSSwk1Bw88L
TLSH
T136E11F7895088B7F74B676ACAC6889706AB2013B77BF6CC750B654C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 36a2ff69b2cfee7c573e4e1f400bffb63feefa58d902c7eaec7e1d29d7e20011
MD5 104f52eadb5079a302c5a79dd0e07651
SHA1 9fd0cf9d1630758cf0ec34de7bec37cae677fc8e
SHA512 da5e1eda290ff70caf24e1a89fb9fdb07fffea50c8888bda146b49cf3c9eb5a6618bf1247691b84b668b55adcec0a3896c226c20469fd6f249c9bb1542aecd85
TLSH
T165210BC794973F71AB50851DD4468FF641B5303245B4A8F0990EEF85745E40D778B15A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 ecccd24056e4f345db7034fa9bff81563f6294d65acb8d5112a84177f3a4eb22
MD5 7dd4ec78b8a894011b6737099974ba1e
SHA1 0f7e305da522565ad1841dac9dbb944ca9086d21
SHA512 635c9ada964a7c60c5b4f647ae9a41cf9b070750ce10f33c4762b655f8f4d732213a6fcdac35a707f2d43b7524dbe5a2d97abbc4fb3b3fad925be53e88ce434b
TLSH
T12F210B8398973F61BB50851DD4468FF286B5303285B4A4F0590DAF85245E40E7B8B159
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 702adb1d536219687c9514626bbe04013be1619b6494e4da80b001d5e171cf85
MD5 c86f13105483ed5c3dca16ffcb7d96ac
SHA1 4293639a9a38e7e41821495c77dd3b0330d87ce6
SHA512 ba00d1777470532663431d283b391ec5785948b828d394fdd2dae75d770b1d2d7704465a3b5bd050cbf1495137edf12f66448b01373f0c8cae8f7ddd397d2225
SSDEEP 49152:8DmgsukI5lUl2D4xfaTeaKvgmRBbFOYPg/Kr:km9ukI56l2a0eaKvgmA/y
TLSH
T1B92639E820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 30eb44cae0a220a1672fa5cc37886bc80dd68f06349f9129c4cb231ae0afecf1
MD5 e8b59b05e87e2e28f5f4a8bd58f358a2
SHA1 9abbd40ecd0d4aa2435ba93d5fbd13537972ebc0
SHA512 410f3a6b48a9023d1a94b7aa42c7bc84b9679ef32804d8c1b909ea9d622db644b62010863bf2e65f43b1da014914e36ec5699e85e451aec48412ad16828b5c77
SSDEEP 49152:IL9LygaeUT6QC5zYYWnuJ5VEvxBelIpxHe25jeGcmA+gOZPAvRPXFppFt+puww41:5cOxA5PXFppFrWvsL
TLSH
T141665CE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads