1654c1c70b15a8eba9bdd092565f30385d0278c2d10a45628716fc9138db8d59

Analysis

user interaction
yes
max time kernel
25s
max time network
27s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 14:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.html
Size 24KB
Sample260722-rj3fvsff87
SHA256 1654c1c70b15a8eba9bdd092565f30385d0278c2d10a45628716fc9138db8d59
MD5 1242c5e2d4db4c51a45afd8ad9b549f0
SHA1 74edb7a9af91c83a39de6e6b584c51e666cf011b
SHA512 a9f740df0f87ab68f8a154a8f41fa1dcf85650618259ee7ccc2889e2e0048e7a8f2825d9916187e6de2b7da2c66f544a3f650dc172dd5466e2693e041a7da799
SSDEEP 768:cEx/WcZVgbfOFlx5ojbknr5d5W5Bf5o5PT5Y2X:HocZVgbWFlx5ofknr/sTeRv
TLSH
T1DBB2A59E0AD64114A62ED0856C9672097316412BAF07FCA87FFD405C6FDA29FC0B368F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	firefox.exe
Token: SeDebugPrivilege	4768	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4768	firefox.exe
4768	firefox.exe
4768	firefox.exe
4768	firefox.exe
4768	firefox.exe
4768	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4768	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4768	3956	firefox.exe	88
PID 3956 wrote to memory of 4768	3956	firefox.exe	88
PID 4768 wrote to memory of 1160	4768	firefox.exe	90
PID 4768 wrote to memory of 1160	4768	firefox.exe	90
PID 4768 wrote to memory of 1160	4768	firefox.exe	90
PID 4768 wrote to memory of 1844	4768	firefox.exe	91
PID 4768 wrote to memory of 1844	4768	firefox.exe	91
PID 4768 wrote to memory of 1844	4768	firefox.exe	91
PID 4768 wrote to memory of 1844	4768	firefox.exe	91
PID 4768 wrote to memory of 4176	4768	firefox.exe	92
PID 4768 wrote to memory of 4176	4768	firefox.exe	92
PID 4768 wrote to memory of 4176	4768	firefox.exe	92
PID 4768 wrote to memory of 4176	4768	firefox.exe	92
PID 4768 wrote to memory of 5068	4768	firefox.exe	93
PID 4768 wrote to memory of 5068	4768	firefox.exe	93
PID 4768 wrote to memory of 5068	4768	firefox.exe	93
PID 4768 wrote to memory of 4804	4768	firefox.exe	94
PID 4768 wrote to memory of 4804	4768	firefox.exe	94
PID 4768 wrote to memory of 4804	4768	firefox.exe	94
PID 4768 wrote to memory of 4804	4768	firefox.exe	94
PID 4768 wrote to memory of 3044	4768	firefox.exe	95
PID 4768 wrote to memory of 3044	4768	firefox.exe	95
PID 4768 wrote to memory of 3044	4768	firefox.exe	95
PID 4768 wrote to memory of 3044	4768	firefox.exe	95
PID 4768 wrote to memory of 5544	4768	firefox.exe	96
PID 4768 wrote to memory of 5544	4768	firefox.exe	96
PID 4768 wrote to memory of 5544	4768	firefox.exe	96
PID 4768 wrote to memory of 5544	4768	firefox.exe	96
PID 4768 wrote to memory of 5292	4768	firefox.exe	97
PID 4768 wrote to memory of 5292	4768	firefox.exe	97
PID 4768 wrote to memory of 5292	4768	firefox.exe	97
PID 4768 wrote to memory of 5292	4768	firefox.exe	97
PID 4768 wrote to memory of 3440	4768	firefox.exe	98
PID 4768 wrote to memory of 3440	4768	firefox.exe	98
PID 4768 wrote to memory of 3440	4768	firefox.exe	98
PID 4768 wrote to memory of 3440	4768	firefox.exe	98
PID 4768 wrote to memory of 5568	4768	firefox.exe	99
PID 4768 wrote to memory of 5568	4768	firefox.exe	99
PID 4768 wrote to memory of 5568	4768	firefox.exe	99
PID 4768 wrote to memory of 5568	4768	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\a.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\a.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {48467407-7766-4c5b-a008-9ac082f4255d} -parentPid 4768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4768" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {d0bb4b55-f8cc-40d2-904a-4476d166d27e} -parentPid 4768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 27274 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {c44ca586-cf6f-4636-bf2e-a366b0be1a73} -parentPid 4768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4024 -prefsLen 27274 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 4116 -initialChannelId {9b53d4a8-c11f-4028-bd10-05ae5f1504b3} -parentPid 4768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4768" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4580 -prefsLen 34773 -prefMapHandle 4584 -prefMapSize 270279 -jsInitHandle 4588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4608 -initialChannelId {14507773-6434-4ddf-9fdf-df4d4c977b3c} -parentPid 4768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5248 -prefsLen 34903 -prefMapHandle 5252 -prefMapSize 270279 -ipcHandle 5260 -initialChannelId {4a1dc003-b7f0-4ac5-ac5b-a38a17d577a8} -parentPid 4768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5748 -prefsLen 32952 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5004 -initialChannelId {f6ea3d2b-0dd2-4d91-bd3e-65d8595a6e07} -parentPid 4768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5904 -prefsLen 32952 -prefMapHandle 5908 -prefMapSize 270279 -jsInitHandle 5912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5920 -initialChannelId {d3af6f4e-d70c-4485-b687-65ac157ef793} -parentPid 4768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6088 -prefsLen 32952 -prefMapHandle 6092 -prefMapSize 270279 -jsInitHandle 6096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6104 -initialChannelId {ac495449-b3c5-4a0d-84db-43c67265c549} -parentPid 4768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5636 -prefsLen 32952 -prefMapHandle 6292 -prefMapSize 270279 -jsInitHandle 1096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6480 -initialChannelId {fca63000-d722-47fd-90bf-e85e48d3d266} -parentPid 4768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\AlternateServices.bin
Size 8KB
SHA256 1d7f667d99d3611f7559db2e40c1715c74f04c892147b3b2f28979ed32c57940
MD5 a8f64d83e5bd9d5656bd9a9a84466f54
SHA1 03d7cfa9cfac647c9f6385359f93032c794713f3
SHA512 203a01ac1644ff42891d34cc4036c98aaf72537dcacc65fe13b0f607f9f6981558e40e0aaf533fab56c746efae9af64042ebd78b191558970df32c469c45e630
SSDEEP 24:cuhMZNb+xqkezY8+XroFWkLTbBxPblTbB7PbxrlTb1KY48Pb:8gEzTnXbzbNbhbxrNbUYrb
TLSH
T17D02C5E753B6A022F0B25FF060A975D9DC37032A5D60D54C9B44A09A02D2F99E06FBAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 f6b31d58b854fea33054173512fedc42053656b89b2b2a6296d5956f72b7f966
MD5 31526365e609dfe3fff5ff34406dfc1b
SHA1 69af7ebe986b71d6301fc455dbfa2f68e39218e4
SHA512 18223285ebe7830816d6899d4c243d5b96ac2f3585e4b782a9b02dfc5269bb094c8d443fc8123ca59aade0ee1013f15fdfa4f7c621fa6e6caecdd13f4ea409cb
SSDEEP 96:J7SdF95/7bkW6ArcEu4nyUR6iWZ3nPFRc2FqjFVFZFD/dd66JoztdzgClKtmc0dz:lOv5zbo8bJnyj11H+1d66JoztdzgCl6s
TLSH
T1A9C1BA64F639863BC418423BCCA61B500F767A4BA85E3F1531DC640D2D5A3DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2ffc3aec1f821134f080a857aea7481d055c33114b2290a1b0fb953a2ceb1e0b
MD5 73aa4c5e31042274e824aa865e634aa2
SHA1 0e42593dfbd0f6f50365f22811aafbb0d72ee9d5
SHA512 efc5123b969e6ed48463f2e20ea1d8961ef913827c0ddc8373ec08796fac154d5b76ef6d7755666b836ed9e7c81254a1002791c043fd6d9f2bd7f2f86d311851
SSDEEP 192:mH+1d66JoztdzgCl6mc0daOv5zbo73ZJnyj1I:pd66Joz/zgC1jTboDZJnyjS
TLSH
T1ABD1EB68F639863BC418023BDCB61B900F36794A984E3F1531DC641D2D563DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c6aee004992c9726a4ddd41f359de654baf1596e2b80376e8e2ed50195f3ce6e
MD5 f652103c7fefc6195183657f8156ebbf
SHA1 5ca56d0e2afe095bf971f35aecfb6a7ea9be838f
SHA512 50994b1924ac23ab8949b4efa7b9160fc33aa5978d8d67c27f2cf63cdf3adc97f5408f3faa3bad63f4f1d1ef58df7166431a01e386a30eea2a739a270b056a61
SSDEEP 192:gOv5zbo73ZJnyjMA4KH+1d66JoztdzgCl6mc0dz:LboDZJnyjMd66Joz/zgC1jd
TLSH
T19DE1EB68E739863BC418027BDCB61B504F3A398A984E3F1531DC641D2D563DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 351c507a608234ff5f8f95887f11e0f6dafc5524a0a817b88394a2e57ddebefa
MD5 10985b87c96f83cd8be9542f7fe523b1
SHA1 0fafb3b7109161bec6519354df8d64a69380dbe6
SHA512 2393404fad91f1626183ed142d86b69a2c542dbc4e6bde3a9eb6533644af36d602dcf2fbb3404461990a8b821a1868f6701a7c56282d0e0bbba3fe6eb51b384e
TLSH
T1A621A9AC39B88D2A6C87F69C7451268E575D4A0708876D430D62FF8CCEC0EDD32AA438
MD5 SHA1 SHA512 TLSH

Submit Download

1b051860-f51c-4e15-bb82-5d7fd5d0e754

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\1b051860-f51c-4e15-bb82-5d7fd5d0e754
Size 235B
SHA256 8ddd3db3f3abd7ca407acd280329165008ee88540a4ec4703147bebb2fdf4024
MD5 80f0b5457f7c1d3fe52f9c5ffe347113
SHA1 b9751e0ea2ad9e8dc9211be14c09da05ecc901fa
SHA512 586cc74b3808c83328b64ddf496a4768939ab55f0b74abde0bd045a006ade534185fef3204f88b225ef5a8350b2cc3772f81685e7864b288ee9ead144b792959
TLSH
T11FD097802488236D08104F02B0B0AFC230848C3314E478308EA01678CABAEC882B281A
MD5 SHA1 SHA512 TLSH

Submit Download

33943ce4-d1f1-4a84-beb9-9fd2ae99dd94

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\33943ce4-d1f1-4a84-beb9-9fd2ae99dd94
Size 883B
SHA256 9df11e6f9b6c0c5551dacf1d6d7f98a7d45ceb9040a9336dc1abb2fc9b67f8be
MD5 ec2a2cc3706fae7c1705b2da59998a2c
SHA1 97e94077b24afc17597d0ce3067a869fbef0796d
SHA512 9f3f450cf0a59f00ab944629b96e995da14e14560ffc23caa1a6b69eb13f96e809de2c28d1315efffe0f3fd9bdceb4de1b5880c4282b6a4e03c575d819177f89
TLSH
T129110080D635BAB1CC28834BC9A577568FF8A91380C655043DA64E180E7E65FA7AB24B
MD5 SHA1 SHA512 TLSH

Submit Download

453fc502-75aa-49d7-89ee-ec8d1763888a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\453fc502-75aa-49d7-89ee-ec8d1763888a
Size 886B
SHA256 52437ee7c2f8b3435c9f77b1fed1b608481e3c810743843aeb55f8ecb0327a65
MD5 b7f31f024c0bee7011b21dec72d65bde
SHA1 95b745316b1eaa3c9bb97021519cc9b1c8340438
SHA512 baad46e6110e2c97a1086c83a19dd58843cb0e2ca1ccf306f2b8ccfe73f760c55251e0676dd6272ca1fcfcab418bb0a8519457e4a4c80cd50f559f9df11c1d60
TLSH
T11E110040CA387572CC38E34B88F5B7528FE8B61380C619047C958E184EBE25FA7AB247
MD5 SHA1 SHA512 TLSH

Submit Download

72176c25-8eee-49dc-8756-d9743745893a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\72176c25-8eee-49dc-8756-d9743745893a
Size 2KB
SHA256 4551491f617931a4dd0e8eacd6814dbe48a314a1ddd9cf899264953188f0f2f3
MD5 6dc3b3126ee1030b5d6ecb29d613c0cb
SHA1 01fd62ed68012b787556af2512c8e0a6adcb967d
SHA512 7e05f8ef0956520ba4faf0be30b589eb92c1648eb77ffe51aea59b91a2da3362d579c9b6402f09b488ecb9330f636f988cf4c23fb80c0916f160ee37847921e1
TLSH
T17B41115C36789D378C8AF25DD492338B97A09E13508218432E51DF0CCEA679E73AB56B
MD5 SHA1 SHA512 TLSH

Submit Download

e60560fa-9668-4091-aacf-c31ec22d75af

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\e60560fa-9668-4091-aacf-c31ec22d75af
Size 16KB
SHA256 f3b4cbbfdaad849a355eb38e5630ce5f9fa77d1367a441bc9291ee9f94ca8cec
MD5 c4e505fb6f5f5a64266b82a9535a6570
SHA1 25b61636ef54241be2192dcac81e40f8b9e43b61
SHA512 dcc0af1c3f95c2c5e8e96bde76813fef3308d1fc0f2a9c99a19aa8d769267100a602144f7ff08dae1a1d780db412ebf958462b7cacab8803aaefce9816ec4ce9
SSDEEP 192:r5gmlBK2cZMP14bPJ10H7m1HJiwd5zxRSIKVE6/kFXopYEj1gsI8Dqk02aYz90Yl:CIw2uDd10q5d5lRSIKVFr2+02tzfl
TLSH
T1F072FB56686059BE8151E3A9D4FC7FC3E2F528CF4C419FCA8BE0BD085DDA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc47182f-e601-45e5-a55e-a0f8f44104b9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\fc47182f-e601-45e5-a55e-a0f8f44104b9
Size 235B
SHA256 942f5b000f056dd3fac8d13baedd10352500021627b50f5d978e12976c2c7ee3
MD5 edb5871fd2b623c5686e5d02f9f13839
SHA1 d8172b3739f7fe6563819bdbfff303a2f60d59bb
SHA512 fe7381a96aa4d98f0888631461bbf53d998fda32f053ec64bb851f7742c47ef3b07c4fc7646609e31d1db5112945addde91261868143e73ee72ece9e73585b44
TLSH
T178D0238038E8AB3F0C040F07F0E02DCA30868C3314746820CA9103B8CBFCDC84292957
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 3b50adb175f0230454d1c1ebd214ff99db559cdad520691834430d8f13e7b3b5
MD5 33a1aa36aab980863075fb8d4a45286e
SHA1 81931f48ce1e53989a77c5f2a13b7a19429f2ab4
SHA512 2cbac16f0481cd7b7ba5df95061fa0c75935956f7b26e080866c36238e974a620670850ed9a8addfc43b41dc99b61bac343da5df59192fa3d88e827f90f77793
SSDEEP 96:xHpUTUWqGqPf2BDH1zSESSlvdv9jDn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BDHBSS/j7/Bw88qU
TLSH
T17CE1107890088F6F64B577BCAC688831AAB2023B7BBF68C750B95484015CF3845F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 b7b28dfdc9ee630847c2cc20f869ca127c192c4cc05885a542e3fa2e0fc97f38
MD5 a254848677566a2f5191d574fb7ff0e2
SHA1 2932b727b05d5eb992a9b71f83844e55d92f12ac
SHA512 1376268e667b0d898c5d407529709553b12b3a5ee20cd6e2814a7df4ad6b09981e69d55faf72812f507071658626eae87399a6819c2b7b90a6dff9704f82203a
SSDEEP 96:xHpUTUWqGqPf2BBs1zS9sSSlvdv9jDn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BBsAsSS/j7/Bw88qU
TLSH
T13FE1117891088F7F64B6777CAC648831AAB2423B7BBF58C750B95484015CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 a68ddaefce9a7cabc812b42eacf67d205e60d5471ce5b92b09ebda9eaf4cff41
MD5 0585498b65991737b8266a0270c76146
SHA1 e5a9059e6b7fb3eb0b1028aa0b9bcb9d1c9c4a32
SHA512 b476e2ecaff8698d35f0794b2e2a626601528872571b7cc687a901ace7fe4305606a0d8f68902098ca540509e6875de495ab1e239186bc9f4986693d6285482e
SSDEEP 49152:DQZLL7RjjSRvYc/3b+nSyf505p/JNVcth:cLCr+nSyf56p/1ct
TLSH
T1EF4629E860D1A257F3814073724993EB21EFD00D5037DA085BA95AE9A474CEF8E17B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads