63530b0c4a73b27da28645ebbcb0c625d93ecd7431ecf8d67ed95f5c47eaa6d1

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
data/python-packages/sys_config/sys_file.py
Size 16KB
Sample260723-y75pfsvthy
SHA256 63530b0c4a73b27da28645ebbcb0c625d93ecd7431ecf8d67ed95f5c47eaa6d1
MD5 f059974ae2246bc8c440e2148c45fbde
SHA1 c7f8f5b78be55faaa21d5afbdaf9a0ac5e75e871
SHA512 c1acbe021dbf2bc882cf8e4ce4f88f9df15f9169862d4a410e23583758cd3048237ff9d52ff4f72692b6c3688dac3d855514da5d890b40ce3fa70c5c0bc4de12
SSDEEP 192:N5EQ5E1xnCHrsuWM9YIvLCid8wYx3t1KssJayO+q99TaTCsWEe:9vssJayO+UEWEe
TLSH
T18E72AAC3C74DAAA9F326431A188BB74640A57C97162CDD6C76FCC84EAB40EFB11D64B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4388	cmd.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	firefox.exe
Token: SeDebugPrivilege	4696	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4696	firefox.exe
4696	firefox.exe
4696	firefox.exe
4696	firefox.exe
4696	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5216	OpenWith.exe
4696	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5216 wrote to memory of 3152	5216	OpenWith.exe	91
PID 3152 wrote to memory of 4696	3152	firefox.exe	92
PID 3152 wrote to memory of 4696	3152	firefox.exe	92
PID 4696 wrote to memory of 5088	4696	firefox.exe	93
PID 4696 wrote to memory of 5088	4696	firefox.exe	93
PID 4696 wrote to memory of 5088	4696	firefox.exe	93
PID 4696 wrote to memory of 5588	4696	firefox.exe	94
PID 4696 wrote to memory of 5588	4696	firefox.exe	94
PID 4696 wrote to memory of 5588	4696	firefox.exe	94
PID 4696 wrote to memory of 5588	4696	firefox.exe	94
PID 4696 wrote to memory of 5144	4696	firefox.exe	95
PID 4696 wrote to memory of 5144	4696	firefox.exe	95
PID 4696 wrote to memory of 5144	4696	firefox.exe	95
PID 4696 wrote to memory of 5144	4696	firefox.exe	95
PID 4696 wrote to memory of 5652	4696	firefox.exe	96
PID 4696 wrote to memory of 5652	4696	firefox.exe	96
PID 4696 wrote to memory of 5652	4696	firefox.exe	96
PID 4696 wrote to memory of 3732	4696	firefox.exe	97
PID 4696 wrote to memory of 3732	4696	firefox.exe	97
PID 4696 wrote to memory of 3732	4696	firefox.exe	97
PID 4696 wrote to memory of 3732	4696	firefox.exe	97
PID 4696 wrote to memory of 2668	4696	firefox.exe	98
PID 4696 wrote to memory of 2668	4696	firefox.exe	98
PID 4696 wrote to memory of 2668	4696	firefox.exe	98
PID 4696 wrote to memory of 2668	4696	firefox.exe	98
PID 4696 wrote to memory of 2900	4696	firefox.exe	99
PID 4696 wrote to memory of 2900	4696	firefox.exe	99
PID 4696 wrote to memory of 2900	4696	firefox.exe	99
PID 4696 wrote to memory of 2900	4696	firefox.exe	99
PID 4696 wrote to memory of 3712	4696	firefox.exe	100
PID 4696 wrote to memory of 3712	4696	firefox.exe	100
PID 4696 wrote to memory of 3712	4696	firefox.exe	100
PID 4696 wrote to memory of 3712	4696	firefox.exe	100
PID 4696 wrote to memory of 4172	4696	firefox.exe	101
PID 4696 wrote to memory of 4172	4696	firefox.exe	101
PID 4696 wrote to memory of 4172	4696	firefox.exe	101
PID 4696 wrote to memory of 4172	4696	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\python-packages\sys_config\sys_file.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4388

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5216
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\data\python-packages\sys_config\sys_file.py"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\data\python-packages\sys_config\sys_file.py
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1920 -prefsLen 27097 -prefMapHandle 1924 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {8cda9c5c-b666-44cc-b911-7d7e667c4347} -parentPid 4696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4696" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {a74ae40b-da4c-419b-836b-7bb13e910ad1} -parentPid 4696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:5588
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3732 -prefsLen 27274 -prefMapHandle 3736 -prefMapSize 270279 -jsInitHandle 3740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3748 -initialChannelId {79b7e0b7-f56e-4838-b2a1-88a720600cbd} -parentPid 4696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5144
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3896 -prefsLen 27274 -prefMapHandle 3900 -prefMapSize 270279 -ipcHandle 3984 -initialChannelId {3c33cf69-ee89-4648-935b-b6ccaff42e8d} -parentPid 4696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4696" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4400 -prefsLen 34773 -prefMapHandle 4404 -prefMapSize 270279 -jsInitHandle 4408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4416 -initialChannelId {99d53145-6e5e-4ed9-a593-f67fa383a48a} -parentPid 4696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5020 -prefsLen 34822 -prefMapHandle 5024 -prefMapSize 270279 -ipcHandle 4928 -initialChannelId {5aa16d01-39ac-451e-95b7-0b2500e530a7} -parentPid 4696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5392 -prefsLen 32952 -prefMapHandle 5380 -prefMapSize 270279 -jsInitHandle 4392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4396 -initialChannelId {abab1aec-44c1-463d-911d-5e40074932b9} -parentPid 4696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5576 -prefsLen 32952 -prefMapHandle 5580 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {f580667a-583e-4c7a-8c56-6a2e9bf6a1a3} -parentPid 4696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:3712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2744 -prefsLen 32952 -prefMapHandle 5780 -prefMapSize 270279 -jsInitHandle 5784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5792 -initialChannelId {372f171f-d057-47f1-96b0-2689e1b3f27a} -parentPid 4696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 e57987d8deaad5a728c27cd9cc4ef9572170463f55e8b3198cf97ef487ed8ecf
MD5 3f6652787d1608d64838f637f1b772a3
SHA1 31d3b069e14150a741d08788492c13bdcd5cdbe5
SHA512 5d355f2fa91822931dd8f7a017f7473f12fca394d7d576cb0674565c434936c0f9f540c5b2b923682621030eba6393849622b44560f28b28217f0dbe01cbc230
SSDEEP 384:HwCe7iO024Yldcs3hk2nhfdDE2Ba/rIVy8efF+LF+B:QqZYldv3hk2nhfS2sDIVy80+p+B
TLSH
T1BF729DBB9F516C5C2917D985C8A95369DC09FDABCFF6C0B608243449C784326B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef9eeb68-e787-43ff-9929-7421f1ed607b.zip

Path C:\Users\Admin\AppData\Local\Temp\ef9eeb68-e787-43ff-9929-7421f1ed607b.zip
Size 3.7MB
SHA256 7c446f0b52fb8efc74274b48fc9faece792734fe6733d4cef42da63418a4ee4a
MD5 80a265b44bdb27b8e3690f324a3f1b9e
SHA1 0d4cdb3c13bc9b5d8195e1e39fbb99bcb911fb70
SHA512 ce70158c9ba5a6aa11cc066fbb4624771683abf73aec7c43b2f618f7c4a2d462d2bdca924a59789293c29cfd43069eee1182c5c329a8e46fdcdabbf0531111ea
SSDEEP 49152:txjBnLMLVNXElX0KvW+d1wFf9NWS3Aud5OSuKZgvSuCoK9OQxr3qmABb02skPQ0Y:bjBb0/4Q9NLiSZgvjCoQxBctPQ0Ru
TLSH
T18506F175DE9C1609C9FF83FE850C2FC2984C4FAE805CA96B7A6E99F15CA31E61F44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3c0f1ad655ebaae1437bf2031435054603a5cfabc9c68ec6bde974558ba2f4ed
MD5 96adc3c5e69b3495610359a2fe23fd1e
SHA1 a2066247205b2784cc5662a61cf004b6e4ac9b31
SHA512 e3a1f206c6efa0d5faf46a8076dac660f7a5953d26c0a44dcc0d1fa1ce32bb9a95f4f4306cade85c945e223eab410c2b56c324df810f663efcab769d4be07123
SSDEEP 192:LH1d66JoztdzgCl6mc0dDOv5zbo7CZAmyjv0q:Rd66Joz/zgC1jubo2ZAmyj1
TLSH
T139E122A4E628467FC404437BDCA61F404F39385A984E7F19759C744C2D5B2DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f65ed1bfe7ab8dd21c31c93a11fe5770009a8a8a5764f8c5921a9948712172fd
MD5 de0615d4f3d165afb10ce74a50cb56ca
SHA1 30e016cdff974395505c39c9ab282136cbede0fc
SHA512 96e1d067176f8ecc9ecec49048de1d57d60dfeb9d39b2050328c9ae059aa1e9d20ea0e821e9f7a135289018c11b7b9b0214b9559e307d8b2f591ba7db6cf8808
SSDEEP 192:jOv5zbo7CZAmyjZyH1d66JoztdzgCl6mc0dz:sbo2ZAmyjEd66Joz/zgC1jd
TLSH
T15FD1FE68F628467FC408023BDCA61B500F36388A984F6F19719C744D2D972DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 45KB
SHA256 fb3bb3a5d67387b2ecfdcf45f50cf8905111dd1e1c828c3fb65b9719d7a3276c
MD5 f8113460c80ecd68ac3c78d1cad146c6
SHA1 13226869d3115d4190d7a47d3b9e0570949c8a46
SHA512 df6bcca294dfa777c2a1c2c455554082eccfb7604971b2ae77b7df9de4726ac321779a6a57540ea0db0854dc57914151f40e0268e6453b6e06ec58ca15c6df77
SSDEEP 768:JXO1qloAhVFf0iB6Gcm+ureFcYKDFap1f+ZnF9nbebybpbobpbybcbGb+372Ot6s:floAhVFf74FcYJ372Ot6chr
TLSH
T1CF23F044EB2A953FD82812BADCA607003F39F889551A2F57365CA4786C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 46KB
SHA256 6c44256c0b508aa0457f6409ee5389282e72e2cfa48eba75b554b337fbfbdf25
MD5 2507819c1bef312d306de2ec015086c3
SHA1 6e7bf38b09ec7e371c1abe56592b24797d14eb50
SHA512 94f743cd3ee633c70c233eac8184df8c573049a80b9c11b0abb0c43e62be5b7f50b62912d952a509fcebcc557cf42d72fd0ec817f2b7425798835be9cb49b7fc
SSDEEP 768:+1wXhlUAhVUcfVdbiF6Gcm+ure2YqKDsqS1/zUn1f7bYbBbNbobubD1b7bGbs37X:ZlUAhVUcfVdGU2YqjT372Ot6chr
TLSH
T1EA23FF44EB1A953FD82812BADCA607003F79F889591A2F57365CA4782C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 058daee4787abfe3c13bea856c1664e956ebaab8b6b3c1c361ddb7d7d3f68f3b
MD5 822a52f6fb3982b7694b203637d7a2fd
SHA1 e728edb003e777fa728816e8faa6e26e8dfa5ccc
SHA512 0da3dfb929b86480ba2a047e3feea7fe518c145291e04f56f772f8193164a5999c9438e59f67da18a189f6ae8ea89e321af50a14967e95f0f44981bb468c148a
TLSH
T1E5217C6C3BB88D6AA8CBE2AC7459128E57954E0604571C834D52FE8DCEA1ED9326E43C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
Size 2KB
SHA256 d0ce62a4320a2f3c62e1bb17087cac89fbaa8b26e7d70becdf4989d05cee7631
MD5 50bc802badeb1b4d9345242e525bdc11
SHA1 70ae3bb7f4ca4e43e92417835f2360822141b6da
SHA512 1822c724132c00a03e0dc7758998e6b47d45a5217cb7a00d060f6131865f9edfa4384b7465e59bd8f9632aba87514eb3af44146233ceb1300dc6a2ebcdf9e369
TLSH
T11251AD1C27AA4CBF68CBD2DCF845028D56854A0685D31DC34DE6FE8DCE62A99325F42D
MD5 SHA1 SHA512 TLSH

Submit Download

95393230-c368-4874-8c9d-043adf4242e7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\95393230-c368-4874-8c9d-043adf4242e7
Size 2KB
SHA256 8b987e9ccc2b286cab0c5b23dfe02ef1bcd8033db4c6f6da397eaf28864881f0
MD5 b0920012d63fb747be34158b2c5bbca4
SHA1 17de8e827df2b323f9d98c5583f9a2f3a10d2fe4
SHA512 8e59aee3694cbba5f357a0fae0c6a5272fa339335fae70a6ce17a4c30fbd3b3e728ccaf68795325a53d5b629ddf215ffdef28bf64059f676a54192e84ab6ec58
TLSH
T15E41305835784D769C9BF54D9092338E93649A9300C32D432E62EF0CCED669E337A52F
MD5 SHA1 SHA512 TLSH

Submit Download

9e674502-556b-4b8d-9aba-2a6cadb0eadf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\9e674502-556b-4b8d-9aba-2a6cadb0eadf
Size 235B
SHA256 e7cc339f0284c5c669f7eb8d1b1f9c45f7f8fed3b36265e239412704cf48f806
MD5 715157b01e303b9ed76b648ca4a672ea
SHA1 f130b8423bc8bb332f9409d8c4df3363a928d3ae
SHA512 1ead4431ec34afd06c7707a8a9e878fd201b710a596eba9e0eb7771cfd55f0cb6c8568535d5145c470204652526c98fdcda7d3442db1eae9a96aca47158de154
TLSH
T1BDD0978058C8671E4C005F02F1E428C2B0844C3318689820DA6141B89AFEEC88161916
MD5 SHA1 SHA512 TLSH

Submit Download

a0d33fdc-16a1-4282-b4ba-2d3e50952c81

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\a0d33fdc-16a1-4282-b4ba-2d3e50952c81
Size 235B
SHA256 ddcc5ae8cd56687983c8db80bb87c6333fa994eb279b61dc24d3252bc9605cb8
MD5 0066e6e3d3f022b357dbfe7e2e0bc267
SHA1 48bc0062278bf2a523578a4c35a54e247b715135
SHA512 b2bbe3e67d2d787c954e1a937b33b88971a1666a66c82885d48073e7806a8b10544c785478dfa5d8784ddf0fd70118c4a6048f8aa08ceb50959cdde13e01fbc4
TLSH
T187D097801498736C08100F03B0F0A9DA30848C3310B178209FA082788EFE9CD011182A
MD5 SHA1 SHA512 TLSH

Submit Download

b8646517-2f77-4280-bced-07f55604a2bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\b8646517-2f77-4280-bced-07f55604a2bd
Size 886B
SHA256 6cdcc6bccb8a593feff4270d59a09ac9491febe2a542845efc67a91bad8730f3
MD5 626e47d18b45b7fe93d0cbcdcd3b29b7
SHA1 bdf5ab27a3def2715e3e50937f7d121b43aac88d
SHA512 513397d56a04bcb7a1ce62a4d61a40462a3de69613f7b1069020f614e08d26c72a39a93f0f28bb1b75c5e0f61655b60bf3c7c81d38fa5263868ef81dbeb0f117
TLSH
T1E51100808A64B9F1DC38D38BC6A57742CBE4711380CA5E1C7DA5AE184EFE02A537670B
MD5 SHA1 SHA512 TLSH

Submit Download

b9094f19-3663-4866-92f0-5f292ca54cfd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\b9094f19-3663-4866-92f0-5f292ca54cfd
Size 16KB
SHA256 6ed0de395b7eba0e38563c830db63e4193ddd8d0d5f2ce529085a83ac7ee2851
MD5 de587ff6ef25fbf2a7f5b2d17dd9d040
SHA1 e29d20cb023556fd227fe34f3cbdb2f73eed8813
SHA512 ce26e0383260dbdaa5ab32d17aa47dfc897c5621846ddf6051ef65cfd1e55688cb15237e9d47e4ed9e205fbd1859d6aa87aa48703a7ea24a36b6d13ac6f87e49
SSDEEP 192:upbNN6K4CIzxJSJK/dwOuPdCBU1nSWJXCfDiYPF5kXLey+TXmBrMHCbHQFbJK9rf:ubNN6K4hlkJK/dwO2CLc/knkfBbmU
TLSH
T12272D856186096BA8251E36994FC7FC3E6F638CF4C019FCA97E4BD085DDE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d01b0fab-9354-4605-b1d9-8639842a846d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\d01b0fab-9354-4605-b1d9-8639842a846d
Size 883B
SHA256 bb2c6902c57d9e36aa24b0126a2cf3511e97e4c9ef62cea9dedd3bb96db6afde
MD5 e018bd548abbdb2753cce28c5346c088
SHA1 1674e45a0f75b7e1850dc115b60bfbca8e5f3605
SHA512 6727a1c649dc687e1d5a5d825bf90ef4fba777262cb584a499cfad1bffee3c7c545d4d5ec5961f3e06ae3d34dc79a2c56b029f137459c8f46614704d0fd49f44
TLSH
T162110090963976F1DC38D24FC965370687E8752380C659083DA5AE180FBE51E936A30B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\extensions.json
Size 16KB
SHA256 3e81cb8f489e012d74f3ecdd3f24fb2845b1a3798bdd47c509f8629087e594ef
MD5 f32c1fc19c0f9c5b190d1f5526a3a38c
SHA1 7ba4149c0704f5add0fe772f85d578bd99d1def6
SHA512 b6b16556ae67335f0286750d8aab7e941683131deb95f38e2bea3f0400e2a3e61afa234e8be41f23279aa3b4d30faa4fa0e9d85faf5cb99ccea35812781eae56
SSDEEP 384:CkI4vnUmldvO8dhWd94zt96o8L4HTL4PfL4HKL4HZL4HY6c4hYz:1I4vRfjXM4H6F4/4r4Y4x484s
TLSH
T16172521545049EB8298FA79AAA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 6KB
SHA256 6231a8c9ce7e4618d05861fa4707157aa6fbeabeb35635b845fbd458241f0260
MD5 e042b9baaaa33891dbe5249db374593d
SHA1 4c6228f875550d1f860241e617808cabd2a35939
SHA512 518f8d9901f2fb105938e1d3287777c1752f39ccb3540c4e142fbfe9cfec4ebb6d8fd45307d0ab15392214be5b20a065d88ea41aa7b255c7b7d4451284ee16ca
SSDEEP 96:xHSUTUNqGq1DfGKIH1zS5LGSSlvdv9jTnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfGFHaKSSy9IjzBw88jM
TLSH
T195E11E7894088FBF74B6766CAC688C316AB2413BBBBF68D610B554C4055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 8KB
SHA256 33052c3e2c16f1aeefcd2dc67efa875342ceb0c8ec4d330bf4a1aea2725e25f6
MD5 baaf0ce1be21b3ddcaefd38b8159ea02
SHA1 8e8c154c2eb53ee9a0b297d9faf28db4a96ff758
SHA512 5f373fbfc167bc17272eceb208386fddc513b417b850460641f3a90237f682a0156d74f700f4e3891fe39da2b7384b9b7aede531e8dd8f6d7831c78cfd70f72e
SSDEEP 96:xHgOJTUNqGq1Df/KIHObzS5LGSSlvdv9jTnNeRWRrdaEcSqZJgRTBw88I8L4cn1O:/NR1Df/FHDKSSy8RrdTjnBw88FO
TLSH
T18102EC385504CF7F64B6766CAC688D315AA2023BB7BF68D710B9A494051CF3442FDAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 6KB
SHA256 17526153a8f8b43c70000f73f1b3a3753ea5632de396369f29643762abd5dab0
MD5 acd6194d9099c817314666c796b1be7c
SHA1 ff4440e396dd09451f57d8d4542fcb7c08d5fbbd
SHA512 177d7688c6208185f052152b5fda3982fc8d7ff2167c24e43ed0042b4558bdabc841ba158c2a10bb33466277081c61a4a518dba76f4e642ea66cf1cd405b233f
SSDEEP 96:xHSUTUNqGq1DfG45G1zSO3SSlvdv9j39nNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG45GD3SSw9IjzBw88jM
TLSH
T1E5E1217890088F7F74B6776CAC6888316AB2413BBBBF68D650B554C5054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 6KB
SHA256 0d99f75c724d1739a0f253b60aa2d796de58054fe00dd588778935b4d98657fc
MD5 fedae53f5507aee2a38d218cb4070478
SHA1 46223ae0e860ba3647851cfcd2557958dbb4cfe5
SHA512 091191283a411338901300b3308532e7098ab7c29e5a4c80e182f676709c42d2aa81fcd5ea3d79011871464a61d46d62849969a4e5c0c385987ff17b5c2a39aa
SSDEEP 96:xHSUTUNqGq1DfGKIHObzS5LGSSlvdv9jTnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfGFHDKSSy9IjzBw88jM
TLSH
T12DE11F7894088F7F74B6766CAC688C316AB2413BBBBF68D610B554C4055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 7KB
SHA256 a8394f975ffd2295d62cbeb9b1159f711414e59b42d5d026ce474940bc70a70f
MD5 345f211e593155b937d9a6497dfa69c0
SHA1 71a804160cec88fcf540ff640fa1f372d1d8cd51
SHA512 4097ec2e5129a34d73a63705d266427abf1395b6a730b5e39787807b5c1b5f70a81dd6e6e373c63f153c3bfd6c3c18029398008cb32f3e7c9abcbe2ce7a16182
SSDEEP 96:xHgOUTUNqGq1DfGKIHObzS5LGSSlvdv9jTnNeRHIcSqZJgMBw88n8L4cn1VnAx:/gR1DfGFHDKSSy9IjCBw88MM
TLSH
T169E11E7894088F7F74B6766CAC6888316AB2413BBBBF68C610B554C4055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 1e0c264060e356d13a024ec024fdccd87891cf975a6496cca0b9092330070944
MD5 eead9f7107c142af1f69fa28168c6a2c
SHA1 f70a3838a525ce31da033cb14132e4840a7b6953
SHA512 d3dfc4114316f49e66931708435e78dcb9d19dd2f8c619ca1a7aaaddb1cb87f582b8a09a1ce59ffa4ecb97aced80addcc095e7ff9fe21b0465e8d1e94b032449
TLSH
T106212B43A5631EBEB350986AC48B1FF2CA54307244382C70E19EFAC75DAA5C6328D608
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 13.0MB
SHA256 5dcde69f2c2b13f1fd288e264c4488993c164cdcbe552e356227e932f575cda3
MD5 8140d488bc5e1d3ce66dd44facbf1385
SHA1 cb2873c97dedead6935479e6b2606ac4f5729d96
SHA512 39556c90b51feecd8c77de448be3adf811b18cf284672ce534daae75e510796b65e8f5a040695e8bc7dde6e4b3d97bdd315973fa90355663fe52927740973eb2
SSDEEP 49152:BQZLL7RjjSROYPq3ulnS4fA05p/Jyt5ZlNXsNaF4cjXzCKCvxk:+Lp+lnS4fA6p/k5Zns/cz+M
TLSH
T1A0D63A9670D4DA92EB0186B2F30F43DB317FC1DC20E6859416B8BA5C596329BEE2F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 13.8MB
SHA256 0a0f7937cc413b5d772e61d77994b6de9de8323566e964ee237603cab153a950
MD5 920e4033acc48382c484c57c538401a1
SHA1 439e4ec7e916877654be95bca1884fabe7959010
SHA512 4b059710c7a42bee5b34a2526f50a219a4233a9e235d6d825f2532c73afda402ee7939da3bc1dd391ea51eb18c2cadc904111a7388e91561b0ebc7f97887b12c
SSDEEP 49152:EWRAYbGyaY00vMonSctclFj0rRiAZZaX0N6FLWkBsd7ZMnR6QC55a9mtu4CCUkTs:/ZUonSct6Fj5AQ0IhBiu
TLSH
T146E63B9270E0D692EB0146F2B31F43EB317FC1DC20E589941678BA5C596329BEE6F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads