d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zqv5uz.html
Size 11KB
Sample260723-l89ctawake
SHA256 d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84
MD5 c229b9d23420402bdea979bae2d31dde
SHA1 cf5cb6cd0c16a3cd252c792a13907df48fa2f0d4
SHA512 bdabdc88c2c5f8c1b6e4730801ad263d8f0172f9cbc19d80de98acaec7d06218f830366b5c10a63cf589de17ed23dd3b84542ab2183f93fe383f9fa3bd6f6fb8
SSDEEP 192:zMilLhIJhKYX5kerCNRupjQ4vYJkTcOHsU:zNOJhda4s4vYJk4OF
TLSH
T1BF32764A1EF280E701E785A97DF2FD0DAD85864BD219FC4832BC80A90FD7D468DC7995
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeDebugPrivilege	2548	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2548	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 2548	3552	firefox.exe	87
PID 3552 wrote to memory of 2548	3552	firefox.exe	87
PID 2548 wrote to memory of 5840	2548	firefox.exe	89
PID 2548 wrote to memory of 5840	2548	firefox.exe	89
PID 2548 wrote to memory of 5840	2548	firefox.exe	89
PID 2548 wrote to memory of 2612	2548	firefox.exe	90
PID 2548 wrote to memory of 2612	2548	firefox.exe	90
PID 2548 wrote to memory of 2612	2548	firefox.exe	90
PID 2548 wrote to memory of 2612	2548	firefox.exe	90
PID 2548 wrote to memory of 3292	2548	firefox.exe	91
PID 2548 wrote to memory of 3292	2548	firefox.exe	91
PID 2548 wrote to memory of 3292	2548	firefox.exe	91
PID 2548 wrote to memory of 3292	2548	firefox.exe	91
PID 2548 wrote to memory of 4356	2548	firefox.exe	92
PID 2548 wrote to memory of 4356	2548	firefox.exe	92
PID 2548 wrote to memory of 4356	2548	firefox.exe	92
PID 2548 wrote to memory of 1396	2548	firefox.exe	93
PID 2548 wrote to memory of 1396	2548	firefox.exe	93
PID 2548 wrote to memory of 1396	2548	firefox.exe	93
PID 2548 wrote to memory of 1396	2548	firefox.exe	93
PID 2548 wrote to memory of 2140	2548	firefox.exe	94
PID 2548 wrote to memory of 2140	2548	firefox.exe	94
PID 2548 wrote to memory of 2140	2548	firefox.exe	94
PID 2548 wrote to memory of 2140	2548	firefox.exe	94
PID 2548 wrote to memory of 5968	2548	firefox.exe	95
PID 2548 wrote to memory of 5968	2548	firefox.exe	95
PID 2548 wrote to memory of 5968	2548	firefox.exe	95
PID 2548 wrote to memory of 5968	2548	firefox.exe	95
PID 2548 wrote to memory of 4920	2548	firefox.exe	96
PID 2548 wrote to memory of 4920	2548	firefox.exe	96
PID 2548 wrote to memory of 4920	2548	firefox.exe	96
PID 2548 wrote to memory of 4920	2548	firefox.exe	96
PID 2548 wrote to memory of 4568	2548	firefox.exe	97
PID 2548 wrote to memory of 4568	2548	firefox.exe	97
PID 2548 wrote to memory of 4568	2548	firefox.exe	97
PID 2548 wrote to memory of 4568	2548	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\zqv5uz.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\zqv5uz.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {25d5af3e-3d5f-466c-aea9-236ee54db85c} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27133 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2468 -initialChannelId {c0efe3e1-3072-4aed-baad-07a6c6efbf46} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27274 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {b3a66ce6-e313-44ec-8fd1-6bb41a7e1d93} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27274 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4076 -initialChannelId {736e4f54-ef0b-44ed-bf14-028b7c60a6ed} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4504 -prefsLen 34773 -prefMapHandle 4500 -prefMapSize 270279 -jsInitHandle 4508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4516 -initialChannelId {c9251015-4d1c-449a-b098-97c170c07f59} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 920 -prefsLen 35010 -prefMapHandle 1192 -prefMapSize 270279 -ipcHandle 5056 -initialChannelId {6ac0afb8-1401-4938-8185-eddcad60b8fa} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3272 -prefsLen 32952 -prefMapHandle 5424 -prefMapSize 270279 -jsInitHandle 5420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5404 -initialChannelId {ed6bf54b-0e72-4660-8b88-05dca64f4c41} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32952 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5580 -initialChannelId {eaac725f-27b4-4608-96d2-6a85b35e61ea} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5752 -prefsLen 32952 -prefMapHandle 5756 -prefMapSize 270279 -jsInitHandle 5760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5768 -initialChannelId {55546098-9f1b-44ee-ae6e-6625a9f4e1d8} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 67f6a2c2b98a84995ebde4dd1534fa01234935a7d3f7ea73216915f60db5709d
MD5 41d27a9c5a04756dedaf4c79982466d5
SHA1 9b4db7e06b7549516f4d2b92d1e514dc6b90cd99
SHA512 baf0701f04d12483ab4038d7c4bdd149bdd58e8f33619fb9e2afed3219382563d4d5100686017a89a25761cc17622b60f27f54f38777c094ac2f87f6359c5e5a
SSDEEP 384:HwCe7iO024Yk2dcs3hk2nhfdDE2Ba/rIVy8eVT+JT+E:QqZYk2dv3hk2nhfS2sDIVy8k+t+E
TLSH
T1B7729EBFDF416C5D2917A589C8AD5769DD04FAA7CBF690BA08203449C78432AB0F648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 29925032f0fec87c007fde64a0054a6ea47b4d1f03b3389800d5622289633d8b
MD5 5b36dfb01387ef9adda9a97bf66207f3
SHA1 74de512ecac57a1c1c5d18c56647b7d8603f0546
SHA512 21f10c021f47b925136a96bb582885adbfbc282bfb5566c13a2fdf333159a0cbe90d6c7a8ce8019dfa66a765a4992cc8f3c3b150953a6dce38311087c5c94630
SSDEEP 192:Bs1d66JoztdzgCl6mc0d3SOv5zbodbC9yjH+I:wd66Joz/zgC1jhRbodbC9yjHJ
TLSH
T1BAD1CB24E729863FC455423BDCA61F401E76384BE88E3F1535EC24092D662DE7B9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 665986f1d43215cc6c49eab9d9d23f82644307541d2e86886d4f572c76a860d3
MD5 7077071de60a31d7cbe62dcdea43d445
SHA1 782cecf773a1c60f9ac7ae495aa0fe78ea0493b3
SHA512 c86968f8308ea676d7000f50a2e9d3580903b4902bbecca247f9c6f8b139728aa2f8befc8a376e7869b1834586719aedb967a4aa9298354ef71388bac8bd5c0f
SSDEEP 192:DSOv5zbo7oZC9yjHs8is1d66JoztdzgCl6mc0dz:DRbokZC9yjHXd66Joz/zgC1jd
TLSH
T1D9E1FD64EA28823FC454027BDCA62B454F39388BD88E3F1935DC64082D572DE779E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f2519a8d8e3559292f9c6aad2477de150c432cbd22a2fc1363bd75691fab5056
MD5 924bee14ea7667ff4bdd4a49195f2c46
SHA1 df25388556a6ab1de273dc48509a1f24facff205
SHA512 ce7988881479adbbb9db0f75c7a05b49485ccb1ffaed24a07e6a3b2ba8357179a43887378c0cafa38cbddc3c3d3859acc1a56fb350166dbc450eae7f87806aef
TLSH
T19721489C3BF84D6A58CAF69C7894128E57814E06149B1C434E63EE8DCE91EE9726E43C
MD5 SHA1 SHA512 TLSH

Submit Download

0bd5a880-21cd-46cd-9e30-8d05f4462b64

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\0bd5a880-21cd-46cd-9e30-8d05f4462b64
Size 235B
SHA256 84f8d2f8f407e75b33ba6e825eebeb646346777ae465b5f78869115d3a738548
MD5 99f1c5c433dff1c482077b0ab6ae7cbb
SHA1 62d944a081014331519ecb3fa14998d3f8b35127
SHA512 d612e64cb510766d381aa62b2421089a29ad85f7b8e8af3c237ab0341ec2ebe1d9d2457135c3c43d2b0070a9161ec9e1729eb09e30d596440a10e2e2297d9ca8
TLSH
T1FDD097C038A8272D09144F07B0B039C2305A4C3310789C208A604A3899BC9C84262C07
MD5 SHA1 SHA512 TLSH

Submit Download

3d7d3c11-3853-4f10-9200-50671481753c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\3d7d3c11-3853-4f10-9200-50671481753c
Size 886B
SHA256 5dbe81b2440db1647f069e53c4c09ad801a644bba916fffe033a5d3f7b368e2d
MD5 a795dabcde8f240c0cd3c0d4275bf562
SHA1 9a098c3a24e7563f0ff142a621e578defb95c4f4
SHA512 d2e9567cd44f08621523980d10f6ae864bcebc6daa2278849371fadecb40f4aed0e40aeda680ceb8b63a847b212da02ea991188639376e6f7ceb812d32c35f47
TLSH
T1D21123408B74B5B2CD78D24B98E07B829BD47423D0C61C147EA45B084DFE25F97BB20B
MD5 SHA1 SHA512 TLSH

Submit Download

6827b2db-7cbd-4674-9735-076eb72b7817

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\6827b2db-7cbd-4674-9735-076eb72b7817
Size 235B
SHA256 501a181be602fa9832776d6d59b05f583466de718a5010571d22edef2d123a40
MD5 d2f78a6b0806a652a3fb178b2f4efbff
SHA1 c8dc3b082d85c5e13cfbfe825ef5839ad73abc21
SHA512 a9d7afc6c93d0eeece656980136b9ceac1fef721f1d69988c182a1fa37225a5d3bf89546c43cd6b1a561af588220c796b1a5886e46445351233601bf96329853
TLSH
T1E6D097C0249C6BAD08000F03F0A829C230544C3310B46820E551863499F9EC80262917
MD5 SHA1 SHA512 TLSH

Submit Download

acf71a23-54c3-4da8-a819-6445a83d2ce5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\acf71a23-54c3-4da8-a819-6445a83d2ce5
Size 883B
SHA256 1589f012b9039c700badb5296fc39aabf2fceaeb116bbaab67cd1638c8033992
MD5 a9d0a24cc0cdc9346cb6b02978e5a1e9
SHA1 e874c30f01c9c6e2f99eab20214407fe8be2c459
SHA512 38387a05ff1c8e2ac871cb407e91548d5471357112521e3be7700e44d326e9cea696fcf90d9557e0b4bfc2e99d50706d278424cd8c462f1d442e669edb7391bc
TLSH
T135110041D739B5B2CC7CC24B89953B468BE8B817C0C754103DA49E040A7F61EDBBA20B
MD5 SHA1 SHA512 TLSH

Submit Download

b5097e36-5f17-4d04-8999-1e9531bd1464

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\b5097e36-5f17-4d04-8999-1e9531bd1464
Size 16KB
SHA256 5fdb9d04073900f1fbe7828b8011b4be20e9d3fd5030392acb4faddec8dbaefe
MD5 e3a4815d6afb37e3e9d88eb3d07c53e7
SHA1 f1153b1ae3b1fa80359a3193b5612e3c9089a7d9
SHA512 43218479f2bbd2a9084372b039ce12b60f4aae224e79b8645b9a4fe869de448809cdb60405ac621aba006c11e0108eab0519a57e37eaf35d57e41e4dff6e0951
SSDEEP 192:HuneTObjUVPoickWbpJKwb8CkA3BfCHPUhwxD9M+TzNuvIbzxKRR5wNyB7AtWSeF:tTIqPPck0AblKRR5wE0WSW
TLSH
T13A72FB56687045BAC191E36884FC7FC3E2F528CF4C419FCA9BE4BD086DDA0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd83b188-446c-4cc1-af52-c20b8433ac06

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\bd83b188-446c-4cc1-af52-c20b8433ac06
Size 2KB
SHA256 905a239abc535f3005a7916665310f8b2775f2498a2b167183522eecc38beee8
MD5 7e48c2c94b2283791e183401f3b103ad
SHA1 20d4bb2c2b28f577aa50bd67c98d40ee987c7b03
SHA512 c75d1d5ef89bbe96837d418f22fe806452860e6f379ace49d6b53906bbb805ee22b09fd170884baf672b420207be644833b1c7d01f131c0f8871c36c87f45eec
TLSH
T1BB41E25C7678CD7A8CD6E15D949223CD9394890740C35C432E51EE0C8E9669D73BA42F
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\extensions.json
Size 16KB
SHA256 52fa720a0b8ff473e9ba530329b8ed0b0758ffadffa75f4f04638ffb887489b0
MD5 33549ac81156be578b7578d7a89c7026
SHA1 2d3fe4f9631dd485d78e46a95b213a37a9e2678a
SHA512 26a1477d71baa5d0ddcfb3b7fef7046ac1731240b8b3f91ae3d1c048905a9264f570cffb05ed0d93495a6266cf607e06166a58a1af639d852de98ac9bd75843d
SSDEEP 384:UkI4v2UmldvR8dhWZk94zP96ohL4H8L4PtL4H2L4HxL4Hfh4hTQ:7I4eRfiXi+4Z6C424l4c4J4Z4q
TLSH
T1D972641545049EB8294FA79AAA367E01C37D473B70845C78F4DD8FC802FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 8KB
SHA256 18ef611e2aa93d062ab7ae1444e908fdaa5f7e7fd2866be08cab7b918e556535
MD5 419183c2d7a525c67f8fa650dda5345a
SHA1 2298c8d93191521ba17aba6516f15bfcf6d6bb27
SHA512 3389b33289772c2a22bb6ed28be7e9b00e09d7f2f07e41ed3bdf1ed7c18ee6ad8946bd1eb6ebdeb44806773c301a9cdee922a80f6482a4849952bb009d12b2c0
SSDEEP 96:xHTGxTUEqGqSvfNuZObzSG9SSlvdv9jJnNWR6em97uBw881Lz8L4cn5VXB:oGRYfNuZ89SSUR4cBw88uH
TLSH
T15002FF385608CFBF75B6366CAC684D705AA2023B77BF68D614BA5485010CF3481FDAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 6KB
SHA256 632a495053aa844c1843e6e1abcecdfb9704a52220d1b04536aa297be0e1768c
MD5 c7b14c96bbe76ffa6fb65ce955075bfe
SHA1 4fe9ec45b10fc2f9866382090ec2795535c05cb9
SHA512 94a612d1181ebaedbcf2573d38b861b826a26f9f820b2abe11fdf9b7dfe431c9cba014eb9a223732e8d300d027dd6714902f957d4d3a52f0935f68f517a543a1
SSDEEP 96:xHTGUTUEqGqSvfkuZObzSG9SSlvdv9jJnNHKm9fBw88u8L4cn5VPB:oHRYfkuZ89SSl35Bw88vT
TLSH
T162E1307895088B7F75B677ACAC688C715AB2413B77BF28C610B654C4011CF3482F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 7126e62d5a974789891a28b1ab9d166c0811dbc53f77bb31a5ff24506eb7c724
MD5 c6848abf2f85bebfcfa8737693823952
SHA1 b7f182cbb4d2656292d9f32120967ecb6d9393ce
SHA512 64ab5dc13f1d68df2c4ed537d24d5ffc409b861dcd10696c206fb5976a8fa6bd01094a966b92029f0637c38ff0faba5cc043e3b88e353ec83f09a27a24b76f2c
SSDEEP 96:xHTGUTUEqGqSvfklN1zS6PSSlvdv9jMnNHKm9fBw88u8L4cn5VPB:oHRYfklNrPSS035Bw88vT
TLSH
T1C0E121789548CB7F75B677ACAC688C315AB2413B7BBF68C610B95484010CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 cc08a6b70cb009cd3f182b63367ce2d49e76b5af9aeb2b0d158ea716260f92f4
MD5 e150b0b6de891348e2df1236cb0722ff
SHA1 4595ac2f0c9fdca81af94060cbe7d5da9c6c4ae9
SHA512 63b38c9e555118e8db9ebb5212ca58322089c665a165a98c4d1f0cb3418f907b9b16c93a054b8b18b4fbdc01f94cc234bb4af7cd10746f3ae7a565ca8597bb0e
SSDEEP 96:xHTGUTUEqGqSvfkuZ1zSG9SSlvdv9jMnNHKm9fBw88u8L4cn5VPB:oHRYfkuZv9SS035Bw88vT
TLSH
T1A7E1207895488B7F75B677ACAC688C715AB2413B77BF28C610BA5485010CF3482F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 3fbe3663aeb69278bf0a86b751d8a7801ddb4784530b312dd40f0fd9bea0b29c
MD5 0d65528ea35cabc69d2041573c56b3ea
SHA1 c0538248e4471d2792e4f5f2c36e3f32b2c892a2
SHA512 6066fd7324917a7ed64ac1278aa5f797de302fde4fa950e92ead350783e9473f2f4f232a52e980a360b0ca12f9709952a6069733cd14302cc6d4c7759740bcd5
TLSH
T1792108C344B72FF66A16884EF0C9CBF7CBA52475807218F0995E5E81855D61DF38920C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads