7940b89834b3790f0f9cd2967a4c04f3f289a8d6c42bb421bd595dbe12649da8

Analysis

user interaction
yes
max time kernel
48s
max time network
52s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Qk9SZEcjLT8Q.html
Size 1KB
Sample260722-rr4c5abk2w
SHA256 7940b89834b3790f0f9cd2967a4c04f3f289a8d6c42bb421bd595dbe12649da8
MD5 feb30da7180d78611977f3e1c9c13450
SHA1 640a5ee76c91f9153331d17fae9f84b39eab8624
SHA512 ae4fc7028ca5d5cf33b7b26ec90aee6c6f99dd5b2441976221abd80b6b7671f8f00dcc42a802460278bf2fdf0ee9605368008509abf30abc23aa2e4ae0b12736
TLSH
T12431B9CC3802A08A40F252D1041BB1BAADB644F26DD8AA045D37C3AF2AB24ED7433F58
MD5 SHA1 SHA512 TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	firefox.exe
Token: SeDebugPrivilege	4976	firefox.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe
4976	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 4976	4332	firefox.exe	88
PID 4332 wrote to memory of 4976	4332	firefox.exe	88
PID 4976 wrote to memory of 3220	4976	firefox.exe	90
PID 4976 wrote to memory of 3220	4976	firefox.exe	90
PID 4976 wrote to memory of 3220	4976	firefox.exe	90
PID 4976 wrote to memory of 4716	4976	firefox.exe	91
PID 4976 wrote to memory of 4716	4976	firefox.exe	91
PID 4976 wrote to memory of 4716	4976	firefox.exe	91
PID 4976 wrote to memory of 4716	4976	firefox.exe	91
PID 4976 wrote to memory of 4184	4976	firefox.exe	92
PID 4976 wrote to memory of 4184	4976	firefox.exe	92
PID 4976 wrote to memory of 4184	4976	firefox.exe	92
PID 4976 wrote to memory of 4184	4976	firefox.exe	92
PID 4976 wrote to memory of 3748	4976	firefox.exe	93
PID 4976 wrote to memory of 3748	4976	firefox.exe	93
PID 4976 wrote to memory of 3748	4976	firefox.exe	93
PID 4976 wrote to memory of 4820	4976	firefox.exe	94
PID 4976 wrote to memory of 4820	4976	firefox.exe	94
PID 4976 wrote to memory of 4820	4976	firefox.exe	94
PID 4976 wrote to memory of 4820	4976	firefox.exe	94
PID 4976 wrote to memory of 5008	4976	firefox.exe	95
PID 4976 wrote to memory of 5008	4976	firefox.exe	95
PID 4976 wrote to memory of 5008	4976	firefox.exe	95
PID 4976 wrote to memory of 5008	4976	firefox.exe	95
PID 4976 wrote to memory of 4020	4976	firefox.exe	96
PID 4976 wrote to memory of 4020	4976	firefox.exe	96
PID 4976 wrote to memory of 4020	4976	firefox.exe	96
PID 4976 wrote to memory of 4020	4976	firefox.exe	96
PID 4976 wrote to memory of 1228	4976	firefox.exe	97
PID 4976 wrote to memory of 1228	4976	firefox.exe	97
PID 4976 wrote to memory of 1228	4976	firefox.exe	97
PID 4976 wrote to memory of 1228	4976	firefox.exe	97
PID 4976 wrote to memory of 5720	4976	firefox.exe	98
PID 4976 wrote to memory of 5720	4976	firefox.exe	98
PID 4976 wrote to memory of 5720	4976	firefox.exe	98
PID 4976 wrote to memory of 5720	4976	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Qk9SZEcjLT8Q.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\Qk9SZEcjLT8Q.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {90ddfd69-1716-4459-bf21-eb3bf5eeb8f0} -parentPid 4976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4976" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {91ad5913-269e-41c2-8922-35b01321c217} -parentPid 4976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 27274 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3868 -initialChannelId {ee72fa00-15eb-431b-9f53-41adce10bbe1} -parentPid 4976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27274 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {8a09ef4e-82ae-4d2d-8361-5a1afef5887b} -parentPid 4976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4976" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4532 -prefsLen 34773 -prefMapHandle 4536 -prefMapSize 270279 -jsInitHandle 4540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1644 -initialChannelId {e2245c33-81b2-48de-a537-fb5e9c2ff11e} -parentPid 4976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5004 -prefsLen 34822 -prefMapHandle 5008 -prefMapSize 270279 -ipcHandle 4896 -initialChannelId {aea87715-7be7-4552-aa75-1ac57b1e3fbb} -parentPid 4976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2876 -prefsLen 32952 -prefMapHandle 2880 -prefMapSize 270279 -jsInitHandle 2884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3092 -initialChannelId {f298fe49-f56b-47e7-ad70-2905e8463780} -parentPid 4976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32952 -prefMapHandle 5584 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {0e740828-da9c-4a14-b576-2514c57e55c7} -parentPid 4976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32952 -prefMapHandle 5772 -prefMapSize 270279 -jsInitHandle 5776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {95adaf57-66ff-4185-9ba8-c16124d6ddc6} -parentPid 4976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 fa602c8bc615e934b0526c3f380f8a151907595139b08b4bf523976b7133c72a
MD5 94a582488ff3fd8f86be83cc0cb9fb02
SHA1 feb1f6083061f4f50008013fb018cf7c5e85a43a
SHA512 621eb3a4c2eb4e2c36606e1d009025967961cfee67ca50aa1fb584bd68d06202c19414f0e1c2743fe7b0e29a3ef659af90fc318bf8346a6b55eef9d73ceba2ad
SSDEEP 384:HwCe7iO024YKdcs3hk2nhfdDE2Ba/rIVy8eiL++L+k:QqZYKdv3hk2nhfS2sDIVy8f+K+k
TLSH
T136729DBBCF516C5D1917E985C8AD5379DC15FAABCFF690A60824304AC784726B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 164f7de51822b064cbdda2dd07acbb9153df705999418f5dd37d73ca8855b67f
MD5 ec6634cc2234dddbfdf247db621e72c7
SHA1 2d18a151dfa1b4b7178a075bf24ab911b8eb983d
SHA512 b4d09f258e5abf6870cac13af1f45076be60bd46ebf8f73671afbe1ab28939290118f88d757713a6ca945caea3202cd5ae5bdb6f63a2cbf6f556d3dabb3625e2
SSDEEP 384:H9XghOiO024Y6dcs3hk2nhfdDE2Ba/rIVy8e1Hv:dX+ZY6dv3hk2nhfS2sDIVy82
TLSH
T130729E7F8F116C5929579585C8AD8379DD05F9ABCBF690A608203449C78472AB0FA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fd36bfd9085f039d37ff387ebf1a01402c92708d3f08cc96f621d6e8df99bdd5
MD5 67ba9e3938c6972506e0d912fb18268d
SHA1 b99ab08a63d6b2c56ae1d6930fba91471f577bff
SHA512 5f6d6f28ffea7a6820f5ffa6777542214a16e4f51a8c35fba83fe900f5010381e7a08f96b008e10527b28ceef10f8c39c68ed5f9b4c572e7ee3a9765659a4b0a
SSDEEP 192:2SOv5zbo7CZC9yjHYx0cC1d66JoztdzgCl6mc0dz:2RboeZC9yjHOMd66Joz/zgC1jd
TLSH
T18AD1EE64E729863FC858023BDCA61B500E75388AD88E3F1535EC641C2D572DE7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2b61c71b080dc1b239123be76297354bc4d26e11cc20eb48378c766965ebafbd
MD5 a415b184e9a1b93d2e92398634f5d0b6
SHA1 17f80adc5837009a3d14985e89dbffe60b12f63c
SHA512 a30c52dcd64838f6a07e8491c675e139a6a75c54301ad757935876d0e9533f33e14ab205f792cec75def0317c26f810a48e322523575c92d4e5e81e7786d12e3
SSDEEP 192:BcC1d66JoztdzgCl6mc0dvSOv5zbo7CZC9yjHsiY:OMd66Joz/zgC1jJRboeZC9yjH8
TLSH
T1E0E11EA4E629863FC448027BDCA61B454F79388AD88E3F1935DC640C2D572DE778E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e0f71ca284ff4315177a69f7a7122b191a6b5b21beed0c51eaf1ff9c2a7c1d1e
MD5 f5abccf051058112d90fa6c4c333a989
SHA1 cc49fe03804ab0df0df4e4b3981e8913895f934f
SHA512 2efe45c7af4030ad8f0e264420e5edbab8e73ef7bf1803daeb056339103737b02c0b9937da05da200482c238f5a3c1f8db808ba93c04b1b3d83beeff506c203c
TLSH
T10521A96C39B98D2A98CBF2DC7840128E97174A52458B1D430D62FF8DCEA1ED9316A47D
MD5 SHA1 SHA512 TLSH

Submit Download

1baec83c-3a0b-4eff-9a1c-f1fbc1a603c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\1baec83c-3a0b-4eff-9a1c-f1fbc1a603c5
Size 886B
SHA256 ec4bd5ff690e3c317d02a9677941c11de73c80fcafa24f94428564d345367579
MD5 39e678dd06a6273df36911ff48c382bc
SHA1 d4d899d9590b478cdf33cc9876af6537f90e5031
SHA512 0adc3c8a2f36115d9cb4e742a7bf884217d47bca98c8da1edd626766648252836fc6421a1e298280ae97f356a98fad00958ddb43a28942fe95407dbe987fa0fe
TLSH
T134110082863AB5B2CD6CD24BDDE03B9287D4B413C0CA68043DA45A1849BA51FA7A7706
MD5 SHA1 SHA512 TLSH

Submit Download

274ff679-05e4-4cbd-ba0a-322670b54f6f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\274ff679-05e4-4cbd-ba0a-322670b54f6f
Size 883B
SHA256 8a6297092bbe52bdc9c57446822269815956691ec4e110d68ec55beb1c6ef791
MD5 fe55e8f529df46d69cfc9b5c206cb01f
SHA1 0bc36b0ede4ca85178ce4169a8652c59aab7443d
SHA512 1c2a7a41da088f797b1b631ea83a0618546b7526d87f7067319918b889828ca5c306354bd42cb5cbfd8f82b6709b82cf6dd8f1a02bfbd243d045f86628da55f7
TLSH
T1BD1104418335B9B2DD7CD14BC9A43B4287D87413C0C754043DA05A044E7E61FDBA764A
MD5 SHA1 SHA512 TLSH

Submit Download

4e13eee8-702a-421e-8dce-01dc3d7c7319

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\4e13eee8-702a-421e-8dce-01dc3d7c7319
Size 235B
SHA256 8f911abe077e0c9f34a707b2c24e165a0ee483e45d2217af933f745d5217892a
MD5 b3e37a22834cad4aff789ab63570810e
SHA1 8a29a9d655acb2e690b95f9bc60e689fac51434f
SHA512 71310627fe0a1aae1dad7ec521393909d8f63d594be4a4ac04ce4c5c0588184f4035818e5e43981ade2877c469783e50af68fa19c450cf4837240cae94683d41
TLSH
T133D097801498A71C08040F07F0E06DC630998C3311F49820CB504238A9B8EC84292C07
MD5 SHA1 SHA512 TLSH

Submit Download

5627efd8-849c-4010-9196-32102076531a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\5627efd8-849c-4010-9196-32102076531a
Size 2KB
SHA256 e13bb6eec29ac94c8d4c6f62e002ed214bb1dbce81515d225f19c5a804977482
MD5 8d6e7aa8477d7d198ac05c62e82e4a0d
SHA1 9a67c9700e48956a4729f34d2b7c1fecd0e0ae0f
SHA512 9f2735a88799ae4da4a22ef7d029bb3f16de68f1e92c618dd9782b406f93b757deadef19d51184163c179134b5e30ad365a9188025e70fcf990bd1393ab7037e
TLSH
T1C841465C36788D7ACCDAF15D949133CE93A1890344C62C936D91EE0CCEA269E737F52A
MD5 SHA1 SHA512 TLSH

Submit Download

a6b55624-e7c6-4fa0-bece-9c79ea0be522

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\a6b55624-e7c6-4fa0-bece-9c79ea0be522
Size 235B
SHA256 27db6ef520703607a2aa5a08b00c6ee6f7e76b9b35fb2df22ced468ca51045f2
MD5 4ecc066a48d17159e509265fe53b74c4
SHA1 e2dbc1b5bc1cbd6eb66896d3da1f12f2d1c7f007
SHA512 b2e12bdd4bccf289df22bbc686529dd8f54cdb9a70f51f28d9f43929d2050c53cb1ef3822c4e4c4d02bb65c1b3ad85ead7b1580cbd218b460da76494f9f1015d
TLSH
T1D3D09798288C6BED48180F12F0E129CB30588C3710A8A86089904939AABCEC84212867
MD5 SHA1 SHA512 TLSH

Submit Download

f4428028-3404-4270-8d4d-6990ec3e1273

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\f4428028-3404-4270-8d4d-6990ec3e1273
Size 16KB
SHA256 54091883521c5f854c206d96bdf25f5ea391436c45bc45a1d2036f87f57e0715
MD5 5c26fd5462567077fb8db026cd18fe09
SHA1 8571769b214977b1238e87c0438ce0f825c23aa6
SHA512 11fcbba6139b2788502d279b4b6d87bc790fd45b0eddfc4d45adcbe76fd0315d8f91f36b27d44504f9a1947125a32993b639c0cfac8ab6dd3884bab4994e5d86
SSDEEP 192:ZB0GJeeUVmC2MZSg7zxwanfVhH2J8XJ7vCTlIHw/mvi2696gz0ic9h8/vPPPWr1u:JJeL928Sg7lwanfV9bZ7KTdMqxv
TLSH
T1CB72EA56687045BAC591E36884FC7FC3E2F528CF4C419FCA9BE4BD086DDA0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\extensions.json
Size 16KB
SHA256 97e45d0619eaebd97d75bf02636dc4bc916503d17f712d773f28b30509f8eeba
MD5 adb03dc3e1a6dde61c6a36cea7590211
SHA1 50710378da509195736ae136db9a048220a65207
SHA512 6341d361409fcbd7cb190a9187906af508731162cc0ec84adce997db737447a96ba973dab462bacafb913e1158f501e966c32035f9407727f626b9273a5f10c7
SSDEEP 384:UkI4v2UmldvR8dhWZk94zP96ohL4H8L4PtL4H2L4HxL4HTp4hTE:7I4eRfiXi+4Z6C424l4c4J494S
TLSH
T1FF72531545049EB8298FA78AAA367E01C37D473B70845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 9KB
SHA256 6bf200e2d38fa76d7ea8f0f2107cb8dc98b9b500e20eb3401cd17cb6930b48b6
MD5 289afa9ffae1ca695f373671b6ea25ec
SHA1 7540e6e1a562b02fe8015d647248ad56be93b692
SHA512 008e9a3d4cba005f4049211bb2811bdc22d031bb36d11d8fd7cded9c78445dfc959fd6089f54a7162d4a86a30b3bf0540c01ebff58f42a986eee89deb9d7d286
SSDEEP 96:xHTGFTUEqGqSvfD0ikObzSJSSlvdv9jznNWR6em930Bw88j/Mmc0V8L4cn5VzcGS:oCRYfD0fvSSeR4+Bw88Amc0K8
TLSH
T103120F3C5004CF7F64B636BCAC6449745AA2023BB7BF68D704BA5485065CF3452FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 8KB
SHA256 5c04b9b401a8dac21cdd47efaa9deba33f357401cc68e867e850444e9aa784ad
MD5 2d31f56edac0c623e96d7daee7961967
SHA1 42122db137e3d04041539d194ece6ea56a02ec5e
SHA512 0d79e1cd7c6467e2dbed9a7fa317013881bbae5b1b0f3f5199b334b6418ea5774e421d21411ad6c54b0f4f4db1ee6875596e3d10a33d03b4094373f2c4260470
SSDEEP 96:xHTGFTUEqGqSvfk0ikObzSJSSlvdv9jznNWR6em9dBw889/zU8L4cn5VzcGS:oCRYfk0fvSSeR4rBw88hF8
TLSH
T1E3020E385004CF7F74B676ACAC6449305AB2023BB7BF68C610BA54C5065CF3452F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 7KB
SHA256 29512531b21f3b2576f3820231cb4f20fa5e4cd95364f15b466c8ae62ecd6667
MD5 59e4cf8ce2fe48b17c646ee6bd125e6e
SHA1 20ddfd0e0aa303872add8d6f48c47895046ee55d
SHA512 337cff578b24561bc9a7669ca1b1c2466f0d495154b8c16ffd67fe4e0c195a4dabaf1020ac8c1950958a1f305532b0b0fc7c12e7cdee2f855c42a02fcea801b1
SSDEEP 96:xHTGUTUEqGqSvfk0ikObzSJSSlvdv9jznNHKm9fBw88u8L4cn5VPcGS:oHRYfk0fvSS/35Bw88vE
TLSH
T157E1207855088B7F75B677ACAC6888319AB2413B7BBF68C710B654C4011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 6KB
SHA256 a14cb6faa00e91a863b6386020b3a3628b6e8cc3068289d9adea967a5099dc23
MD5 f835236151b1f850fe6ab82a43873fba
SHA1 cdb99dc8b5164a9b5af6178e4810ffd4054cdd85
SHA512 7a4660f982671cec7c8c7c56d695fd6f83d302d920be89f8ed17bc38a61d4faf0289cf39810b4cf7fd27f91a467a44aec805bde7782a5fdf81a7163eb3f4b180
SSDEEP 96:xHTGUTUEqGqSvfk0ik1zSJSSlvdv9jznNHKm9fBw88u8L4cn5VPB:oHRYfk0fgSS/35Bw88vT
TLSH
T163E110785508CB7F74B677ACAC688C315AB2413B77BF68C610B65485051CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 7a2a1c18bd50fdb6defc0a667e99e4316d14b2a390a5dd0f1cf1a9ba4363daf6
MD5 32b203c9dd45130ed7311b15afefe00e
SHA1 702023923b06fb40937b3db6afe4885e524f9512
SHA512 fe6963855be9047bd8849db798862f4b6ba1e1e15e5559dfb766847450ff8beb0cbf8571ff951bca682455ebd96a2b8c1a681c269b4dda782f6a2db9e1a055dc
SSDEEP 96:xHTGUTUEqGqSvfklN1zSLoSSlvdv9jJnNHKm9fBw88u8L4cn5VPB:oHRYfklNioSSR35Bw88vT
TLSH
T1BCE110785508CB7F74B677ACAC688C315AB2413B7BBF28D650B95485011CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 11e3ed9a9b7e79a8710ab63922ec72b816cc97f1a2adcda731a53815263cbeeb
MD5 0061debc219921ca64d1733bacb637f4
SHA1 4c4c412d501e2bcec8fc67533b4a42b481064502
SHA512 691d9cf2be7ce25529429bba5672a3e0e92f94db1d84ab36aa9bfd4ad564b882f35a5efc70803a8f1cb0867d38416a88062b4226d750beccefe25c5195869bf8
TLSH
T124210B42846B3EE63761519ED48D87E9878D306340761DF0409DDE014C6E46DF39D20D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 3d1dbd91a64a2ab7cc00c226768a941569349e6343e98f3adf7beb8d55d34a5c
MD5 849409edaa80ae8cb9e3eac856c1e524
SHA1 d542df57232ffdf365dcaea45c8b7aa621c7cf87
SHA512 86f89d7805c0ddf30c62ae4b5f26bc5086c3899617442ab6b41f614b492d45849a27f2b10450dca118113f9cc7fce68665654c3689ba77513de3540c58329dc8
TLSH
T1B021DB53C46B3EF67762559DD4CE87E58B45206340722CF0D0999E01496E86EF3D920D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 f1a7422d251d74624f2e93a821835e7ab20e246435ec38f80f43fcbce70dc651
MD5 4d3eb523a31832f3f0f82352d70fe755
SHA1 41c49073769d3766c05079c8951d3e424eaf7d8d
SHA512 f01243a7f6f40d294b9256f027ce418cf5119461dcdd56898cc2ca63b891a74b9bf9f9f2f495b82e7a53e6d332db7b05904816baf5c45d7dd02de000642dbdf6
SSDEEP 49152:X8ZvnRPV8+B/XYcg4VE31yv0kReQq7rjje:Mydl31QFReQq7rjy
TLSH
T1C74629E860D1A257F3814073724993EB21EFD00D5037DA085BA95AE9A474CEF8E17B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads