hxxps://casanc[.]org/

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://casanc.org/
Sample260722-vb3nfahe98

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	firefox.exe
Token: SeDebugPrivilege	1996	firefox.exe
Token: SeDebugPrivilege	1996	firefox.exe
Token: SeDebugPrivilege	1996	firefox.exe
Token: SeDebugPrivilege	1996	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1996	firefox.exe
1996	firefox.exe
1996	firefox.exe
1996	firefox.exe
1996	firefox.exe
1996	firefox.exe
1996	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 1996	4408	firefox.exe	85
PID 4408 wrote to memory of 1996	4408	firefox.exe	85
PID 1996 wrote to memory of 3772	1996	firefox.exe	86
PID 1996 wrote to memory of 3772	1996	firefox.exe	86
PID 1996 wrote to memory of 3772	1996	firefox.exe	86
PID 1996 wrote to memory of 4148	1996	firefox.exe	87
PID 1996 wrote to memory of 4148	1996	firefox.exe	87
PID 1996 wrote to memory of 4148	1996	firefox.exe	87
PID 1996 wrote to memory of 4148	1996	firefox.exe	87
PID 1996 wrote to memory of 4516	1996	firefox.exe	88
PID 1996 wrote to memory of 4516	1996	firefox.exe	88
PID 1996 wrote to memory of 4516	1996	firefox.exe	88
PID 1996 wrote to memory of 4516	1996	firefox.exe	88
PID 1996 wrote to memory of 3196	1996	firefox.exe	89
PID 1996 wrote to memory of 3196	1996	firefox.exe	89
PID 1996 wrote to memory of 3196	1996	firefox.exe	89
PID 1996 wrote to memory of 1248	1996	firefox.exe	90
PID 1996 wrote to memory of 1248	1996	firefox.exe	90
PID 1996 wrote to memory of 1248	1996	firefox.exe	90
PID 1996 wrote to memory of 1248	1996	firefox.exe	90
PID 1996 wrote to memory of 1052	1996	firefox.exe	91
PID 1996 wrote to memory of 1052	1996	firefox.exe	91
PID 1996 wrote to memory of 1052	1996	firefox.exe	91
PID 1996 wrote to memory of 1052	1996	firefox.exe	91
PID 1996 wrote to memory of 4956	1996	firefox.exe	92
PID 1996 wrote to memory of 4956	1996	firefox.exe	92
PID 1996 wrote to memory of 4956	1996	firefox.exe	92
PID 1996 wrote to memory of 4956	1996	firefox.exe	92
PID 1996 wrote to memory of 3384	1996	firefox.exe	93
PID 1996 wrote to memory of 3384	1996	firefox.exe	93
PID 1996 wrote to memory of 3384	1996	firefox.exe	93
PID 1996 wrote to memory of 3384	1996	firefox.exe	93
PID 1996 wrote to memory of 3148	1996	firefox.exe	94
PID 1996 wrote to memory of 3148	1996	firefox.exe	94
PID 1996 wrote to memory of 3148	1996	firefox.exe	94
PID 1996 wrote to memory of 3148	1996	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://casanc.org/"
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://casanc.org/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {c3bd70a5-7708-47f1-9c8a-cf78a75f66c8} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {5b212f7a-4041-49eb-a64d-f59863a5a679} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3680 -prefsLen 25164 -prefMapHandle 3684 -prefMapSize 270279 -jsInitHandle 3688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3696 -initialChannelId {6e536b54-d003-4c16-9a7f-c2dee299ab90} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3860 -prefsLen 27276 -prefMapHandle 3864 -prefMapSize 270279 -ipcHandle 3932 -initialChannelId {f5fc9402-fd08-4d0a-8ccc-1aaac00b2cb9} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4296 -prefsLen 34775 -prefMapHandle 4300 -prefMapSize 270279 -jsInitHandle 4304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4312 -initialChannelId {910e08b7-e53c-4dbc-a284-5e289f47867f} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4972 -prefsLen 35012 -prefMapHandle 4976 -prefMapSize 270279 -ipcHandle 2856 -initialChannelId {a0432830-2a83-4f55-994d-872080c5d88a} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2684 -prefsLen 32952 -prefMapHandle 5020 -prefMapSize 270279 -jsInitHandle 5016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5024 -initialChannelId {a5004832-bdeb-476d-adbd-a0d02deb499b} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5308 -prefsLen 32952 -prefMapHandle 5312 -prefMapSize 270279 -jsInitHandle 5316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5020 -initialChannelId {b3d4c501-154f-488b-81d5-1106c1faae16} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5508 -prefsLen 32952 -prefMapHandle 5512 -prefMapSize 270279 -jsInitHandle 5516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5312 -initialChannelId {4102c947-f049-4c91-a3c4-68ba9d2695fe} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 282219b56636cb9b2a44a952e5084c2cd8162a0a740a305d03c984d7525b5b22
MD5 f04f0848e4f11dbb8a736c30dfb590b1
SHA1 fa60ccceba72e89c620719a431e0f90e7b625ab1
SHA512 b7ed69f8dcaf0a049d79e8b64799d27768efbc3d847f0e2caaf03c517facf18be875305a1c28eb0b0cfa337df8bba536f22d67c09af42debfa9bc5fdb52860f5
SSDEEP 384:HwCe7iO024YCdcs3hk2nhfdDE2Ba/rIVy8eaa+ua+I:QqZYCdv3hk2nhfS2sDIVy8K+V+I
TLSH
T1EF729EBBDF512C5D1917D985C8AD976ADD05F9ABCFF6C0A60824304EC784326B0FA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 51d088e331b1053a24a51fbfafa023a279c40f26eb38375c74fb3df0155e0230
MD5 d0ba23be40bdb5ae48601806fd718ef0
SHA1 b0e7ce6f5c76192b402a4bb7320c8635ae786615
SHA512 86b93fa3d772e33365c4f61d336a86b0c515471f6cfcd6b08fbf25ca0c4f813d8ad26234304fe2e8990773df84a8d491fe17265396e8be60649a19bdc74bbedc
SSDEEP 384:H9XghOiO024Ybdcs3hk2nhfdDE2Ba/rIVy8e9Yr:dX+ZYbdv3hk2nhfS2sDIVy8T
TLSH
T11B728DBF9F416C5D1967D985C8AD5369DD15F9BBCBF680A608243049CB8432AB0FA0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 11KB
SHA256 0cabcf580ffa7f1edb0b81ecc6c404369192565423d89e4ff2c46bc60a8b231c
MD5 0d0b9d0c08e237e3043fe2a5bfa641ea
SHA1 948a20f1cbf9ba3b8ede8b206ef420f0a1b1a3cb
SHA512 b0d24e639b90fdfaf74c362ec32c95db5c7930e25b60c273940c1729f219d77aa08657635e36ba45648e9457f2a2a26e6ff7392cef8245a8e3a656728200e34b
SSDEEP 48:8wNifGN80N5IZzgNjVNqANhjNnZN0EfkEbE0N:N0ztEsEbE
TLSH
T12732E7F752B1A112E0A16FB2105D758CDC6376C91DF8CDC9EA04B49E0391790916EFEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 21KB
SHA256 ba77abe6dbc635864c46f1f1cbfd82d516a3d2363c671927997ad365c6381b5b
MD5 dddc2bf228ddb8099845cf5b4df29e6e
SHA1 431c2de4cfd92f46e6c650b5d156c3ce9b2da5a0
SHA512 669b8954efa94228f0d3fce3309c1e687efa236de6bbcec97e3bca192db08e8abbff4b38ce0e9da844f93b9558a16a030b0d125d1658372acc672f2003ae1a1b
SSDEEP 48:gwNifyNOeNXIZzqN4+Nf5NIBSNizSN3EfkEbEQSNL4B32NgtfdYpNRRkgNZBlNca:r0z4EsEbEBK3FtVYpqB4tIVJ
TLSH
T1DCA2B1FB56B16111E0B16F71009D748CDCB37AC91DF8C9C8DA04A49A03A5790E1AFFAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1fa00d4a5bf1d81db76688acab1a608ffd0a90c2db8d7cc25c1ea401a451f0ff
MD5 e122825a52f82da1e72ec161a5e733da
SHA1 560aea7ddb0d7305ad7b85dfaf7f2fc19bbe883a
SHA512 dbd578ed3ff7d2ef363eba0230599000dadab47c00c9c22da9db23bb88ef3c614e216e92ae6a50d48f70fcb8639882d5d536fa165abbdb9d0d13e20a991bc7f5
SSDEEP 192:Jd1d66JozGzgCl6mc0d8Ov5zbowbVtyjlwW:J7d66JozGzgC1j9bowbVtyjv
TLSH
T109D1FD68E728863BC448533BCCA21F404F3A795A984E7F2936DC64082D5B6DE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 32b8db5d9932ddebea16e066aa3f0f68c2a719e4f8b45b7f51b9ce56e4bd598b
MD5 77689ca0a42ea2d3ccc4ba7ad97b6447
SHA1 092c9ead740ea78195e1c2e960883680865e9585
SHA512 41d78790ef3cad235e6d7b383a2be2306f838809ff3f9c4eba85bee03efe65bb9c60fd4420ad7eb90b5b7ece77f64087a2550be848d7a283395f23c0eb4579fb
SSDEEP 192:gOv5zboPWZVtyjiwkd1d66JozGzgCl6mc0dz:LboeZVtyjI7d66JozGzgC1jd
TLSH
T191E1FC68E728863BC408037BCDA21F414F3A789A984E7F29359D64082D576DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8d7d07755f38f6a59224c9ffea41a47bdfed24914cd1c88fc9b4ab9d3a91ef9d
MD5 89b417e887d2b745a8ef3fc114f547b9
SHA1 a1b85ec86919f1407fbbcc45c400b4f124fc32f2
SHA512 c229f665f10c08e774ef02a3eed416ffdb38f508cebc993ef6bfdbd052b6984530fd84314fe12ea036ad0124763d3adc5484c8c82c03d3268a541b2746327833
TLSH
T1C0216D9C39F84E1A5887F35C748121CE53184A03085B1D834D23FE8DCDC1ED9316A528
MD5 SHA1 SHA512 TLSH

Submit Download

0bb2bcc5-e80f-446e-b9d9-6f2bb3edeb93

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\0bb2bcc5-e80f-446e-b9d9-6f2bb3edeb93
Size 235B
SHA256 419702f970af919965a30906a2c7e829f639ef53e3d62f1cec61388ff9aa6baa
MD5 7244bc4f05dcdc9259157591e8cbb564
SHA1 d87880aba98fd14524d32a9438561cf1d9247ac3
SHA512 6600591506ccade591800175503b6101ae045aa9b2105043582791aeff63725a99cd826f7bbca1e681af98eecb533bae66d419266627e04a3729e5ce58da126d
TLSH
T10AD097803488272C48240F03F0A178EA30898C3324709820C9940534A9FDEC441A2A2B
MD5 SHA1 SHA512 TLSH

Submit Download

38d0f68c-5168-4a81-ad7a-65c241d88940

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\38d0f68c-5168-4a81-ad7a-65c241d88940
Size 15KB
SHA256 8d97432cccf60214cf4840b9bb949fd94397f61f2a93ed80a294e15f158cf59f
MD5 48f06aca7a5ea6172976fe1d8f5e501b
SHA1 2f5952be042962ed13f75931078656b2dc5d9e8e
SHA512 eab732331032878421d78af234b6c64a1f821f59889fd9d07bf4db9eb1e9f1f62cced1ded59159f95a4f836fa905e40879630ab4a5b3426a05c0e074fa1ee11a
SSDEEP 192:rG0TB489eIs7RCGbSzdFRm0RJ8d1ydWzPq/Yio1WA/SPhUJuftGpye11QqBOUIz+:BB489eZ7RCGbSDR2Gn2ufgpTXpGmx
TLSH
T13772C816686055BA8251E768D8F8BFC3E5F628CF4C019FCDCBE4BE0859DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ddc2999-5acb-416b-be37-b6709c94cb08

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\6ddc2999-5acb-416b-be37-b6709c94cb08
Size 2KB
SHA256 e384e45416cb8caec962e37c4b10633667f369bfa52fca8384907b1a476665cc
MD5 fa982e0821957b9cf7390ecf8cf9d740
SHA1 e5e9aa4b73e42fcc986c99b88328879d71d250ca
SHA512 34e9e656ccf7db2fe1b95d1ba39e74eb6d19c4985aeb7bbcd6f621b84ebdb9e3b71c97ed858cd302f1600fafce149ff41c2e0a2e6359ffbfb6fa25921be20dea
TLSH
T14741235C76B85DB69C9AE18DD452278D57608F4300C72C872E51DF0C8CD6A5D336A83B
MD5 SHA1 SHA512 TLSH

Submit Download

aa9b3fdc-68af-435c-965f-58b49e1349e4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\aa9b3fdc-68af-435c-965f-58b49e1349e4
Size 883B
SHA256 04c83e6d693ff96db863a0a927fd93602fdc0b58e5f79b92d219d8f8b405a57d
MD5 fa2403f209395b50611e14df93267d52
SHA1 bea17b1543c7345d9199333b136aafcdfa1c81e3
SHA512 edf561ab60bc911282744067e9cba819c7ab779b7db47c3f919492abe8eef5f2d51ec60f1609e5d12089526ee371f07d594c2db16a28d43ec6f9c3c7cbcf1f20
TLSH
T18E11275187747D72CC68C24BC9513B015FE4B51380C554143FE55A140C7ED1A93AB20B
MD5 SHA1 SHA512 TLSH

Submit Download

bb00930a-f0fb-4642-823c-cd5e88cd9b21

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\bb00930a-f0fb-4642-823c-cd5e88cd9b21
Size 886B
SHA256 cd62384dfdc46b5e82b8a533f95e0565eb98b6316e9527c54564ae41f1e39183
MD5 641ddd74a73f6f9adf05f3c0d7e6ab9f
SHA1 0670f3ab96405dba895768b987bcd7794a65b5e5
SHA512 9a5207c958aa57e4b20bf0b390af7c9b3fdedbb0b8a26e72e0dac195f49131664564f9722e359c7ef1c5e4da2f5b421ce73f38107ef573bd4df21d7f582c6f75
TLSH
T1EA1123908774F9B2CD7CD28BC9E13B424FE4B513C0CA64143F950A180D7B91EA3AB207
MD5 SHA1 SHA512 TLSH

Submit Download

d1d25c8f-e1b4-4ddb-92ad-3ac616c589be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\d1d25c8f-e1b4-4ddb-92ad-3ac616c589be
Size 235B
SHA256 5332e16946dbf68efac2db52983eb7fedc3cc60d6a1d69df57c827c9a8cb34c8
MD5 cb9cbc6f1cb377e5a8897fd1fab1f657
SHA1 3b522bc015a56aef2c3e3b995bb7b1d0b0226c2f
SHA512 5405d10ec8a66faf1673f8fe5d21d493dc702e0cd2cbd698dc278eaed2e8f2938f36fe2e909cb9d69dac84ff632bf7af44ee4c3facab6396ccd742d636942366
TLSH
T184D09781A8A8273D88141F06F0F068C330448C3315B86C20D990457489F9EC44221827
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json
Size 16KB
SHA256 f652400f5c61658103b7a2f426496de37de7cb7e421da9439216ff267d82e6ca
MD5 6a92d2336f09984216a29bd1354a3498
SHA1 d8819182e6f5dc710da362160129b6111abbdd10
SHA512 7ee53a4c63bc3f907eec0f748cf937fd819b4b1d9180f5788a20f1702e332a149466dc9f166ac4021e996dd2506de2e2983e2103e524e8aec833eaf815a5a5a5
SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4HB84hn:mI4dRfFXQ4d614d4D4J4+4u4R
TLSH
T15672421545049EB8294FA79AAA367E01C37D433B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 8KB
SHA256 5e9e1e46d0e511b56e577257b6e7483d376c658525b81771004eac208f271690
MD5 b1f9911f2f65fb992c3d7fd057520527
SHA1 b9f520340649c31b8482f1539aba0ae866ca2930
SHA512 c0b85c93b7fd3980c8a6f460f5c12357a9879184fa4db18d1284c82d2727cc670458a00dfd664856436c0934b5b2f7cc07ac13755176cc6fcf596274248ca3a2
SSDEEP 96:xH4f9TUOPqGqsWfR7yObzSRSSladv9jvnIWR6K4Bw88UmCO6gEg8L4cnTDEx:mf8RsWfR7yzSSIRt4Bw88UfO6NLY
TLSH
T16F0200789114CF7F74B6776CAC6448316AB2023BBABF68D710B95485011CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 6KB
SHA256 861d812e66c0f9cf261590af428914cd54100587661f588fd3edfa1f9c5d117f
MD5 cb91638dc8e674eeeab88f7c9e501f14
SHA1 782e179792e58fe60c5ebbbacd89b34312639d58
SHA512 07754d8002be49502c53a02f3c7533135e73ae9aeb0a30913406f804b18de7ba4d746d474b51c75dc311d0674afd16f0adbb7df468eaf074ab356a455898d27c
SSDEEP 96:xH4fUTUOPqGqsWf27y1zSRSSladv9jvnIHeABw88n8L4cnTDEx:mf5RsWf27yMSSBeABw88qY
TLSH
T18EE12F789558CF6F74B677ACAC6888316AB2413B7BBF68D610B95484010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 3be1b9305c2ea5c15f25cb72b3880d3256ab7dcf99eccf26361229719fe967d1
MD5 6660838d2e2a6ebe9fdfc8e4345f9863
SHA1 c4a66173324b1624244f82edc99ddd3e79d2e870
SHA512 cb973ed5566689f7d290ba5aa99df1d6990233b295570ea5c95b8fb3f3c1ed8f9c4975806b3fe3465a231d96d38345c40dde0cf9d9f12de8b7a724a5cca8acf4
SSDEEP 96:xH4fUTUOPqGqsWf24P1zSRuSSladv9jhnIHeABw88n8L4cnTDEx:mf5RsWf24PAuSSTeABw88qY
TLSH
T1C6E11F7895188B6F74B677ACAC6888716AB2413B7BBF68D710B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 97efe5b62a6a3ccebc3af6938fb71600c250fa207a8dd3b94c5fb363657f1933
MD5 bf183e4653ed840bc2acc4afbc002335
SHA1 74da5db3ab940229c471dd1ed1a0582016c6a350
SHA512 218d731fb23af8edd573dc4c43767eb83ffe0c59fc37a6622fec832401c3656d55612deb8d4db0e1fbac6ee41a67685aff7a7d4ec18ff2520634a9bbc2f63bf9
SSDEEP 96:xH4fUTUOPqGqsWf24P1zSRSSladv9jhnIHeABw88n8L4cnTDEx:mf5RsWf24PMSSTeABw88qY
TLSH
T1F2E11E789558CF6F74B677ACAC6888316AB2413B7BBF68D610B95484010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 e4c956798a817ba4a39c89a3ff5008cc5cc6e8d83daccf4aba3a5477ce3c5321
MD5 bdaefc0f5e5b7201f954ad857bb84b4b
SHA1 e19e4173940463d1e55209b4e683f960075b96a9
SHA512 e19c2de45e0a2296878b8d075aefc5417678fbecce959dbe83a4f057366ba2fa062f176126831a7945ff425a6a5825510e5431d12fa5d3bca8536ec84b4a367a
TLSH
T12B211743269B3EF8BF63D28ED8014FEDC2853420442458E0D0CE4C2267EAA4E76C622D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 1dc9b2b0e8bbbab01d92e2ebdd26a1edc441dd888044851dd8709666c6741e33
MD5 df1534a1c97a5dcbf778b91998389878
SHA1 f0a3924d4bc4c4db07c253f450498ea3861acc00
SHA512 26796bfc98e88e35291ca65f3e4d110bf6f6e1fd57245a30f673f9684d670dd1cd13051e18cf3f571cb3bb42d624bfee7c439aae3b157a77190d521eb9ad648a
SSDEEP 192:2XgjnlbqjyVRHxiIhUAG9OPVe8RLQ0n/SsywkHE:2Xgjnloyd3hM9mrQ0nqsyRHE
TLSH
T1D302BE0474E02D08C455B6A5199A0F679B5B3C65CA3CEEF2D0D3BD1F3CBB94E606C291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads