909247ab27a62af891158d0adc3db779a1d5b3448c03bdf621fd21c767c7ad50

Resubmissions

27/07/2026, 04:38

260727-e9mrwahc266

27/07/2026, 04:36

27/07/2026, 04:33

27/07/2026, 04:31

27/07/2026, 04:30

Analysis

user interaction
yes
max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
content.png
Size 2.9MB
Sample260727-e7874avyhy
SHA256 909247ab27a62af891158d0adc3db779a1d5b3448c03bdf621fd21c767c7ad50
MD5 3633d22d421083133b01f1487e6554ef
SHA1 5ecabc25528b98b4450f20e4df6dcf1181b17a83
SHA512 3fe9bb27216e12a9626e677032b73894581b56da2b9d148b247d7d45217141580e7c273c1bbecd8c3f11251ba8ade4d836ba3fa139ca97b9332621de26db3b64
SSDEEP 49152:OcJaBD4j4FVHifROIQK3SaSpXYhEHvtXhq2JEEDy+nBDh9kr1sSsGmlqaH1oT:OcJau0FpifRbfiHpohEH3q2adohi2jGx
TLSH
T1F8E533EDCBC1CBF0C62F623B4AEE55A0429A155FA393434521B5C6CCE069748D72BF26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
167	2220	firefox.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
299	camo.githubusercontent.com
296	camo.githubusercontent.com
297	camo.githubusercontent.com
298	camo.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\OperaGXSetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\OperaGXSetup(1).exe:Zone.Identifier	firefox.exe

Checks processor information in registry 2 TTPs 42 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\OperaGXSetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\OperaGXSetup(1).exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3384	mspaint.exe
3384	mspaint.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	firefox.exe
Token: SeDebugPrivilege	2220	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
3384	mspaint.exe
3384	mspaint.exe
3384	mspaint.exe
3384	mspaint.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2220	1760	firefox.exe	95
PID 1760 wrote to memory of 2220	1760	firefox.exe	95
PID 2220 wrote to memory of 1492	2220	firefox.exe	96
PID 2220 wrote to memory of 1492	2220	firefox.exe	96
PID 2220 wrote to memory of 1492	2220	firefox.exe	96
PID 2220 wrote to memory of 1812	2220	firefox.exe	97
PID 2220 wrote to memory of 1812	2220	firefox.exe	97
PID 2220 wrote to memory of 1812	2220	firefox.exe	97
PID 2220 wrote to memory of 1812	2220	firefox.exe	97
PID 2220 wrote to memory of 3408	2220	firefox.exe	98
PID 2220 wrote to memory of 3408	2220	firefox.exe	98
PID 2220 wrote to memory of 3408	2220	firefox.exe	98
PID 2220 wrote to memory of 3408	2220	firefox.exe	98
PID 2220 wrote to memory of 3852	2220	firefox.exe	99
PID 2220 wrote to memory of 3852	2220	firefox.exe	99
PID 2220 wrote to memory of 3852	2220	firefox.exe	99
PID 2220 wrote to memory of 3012	2220	firefox.exe	101
PID 2220 wrote to memory of 3012	2220	firefox.exe	101
PID 2220 wrote to memory of 3012	2220	firefox.exe	101
PID 2220 wrote to memory of 3012	2220	firefox.exe	101
PID 2220 wrote to memory of 4532	2220	firefox.exe	102
PID 2220 wrote to memory of 4532	2220	firefox.exe	102
PID 2220 wrote to memory of 4532	2220	firefox.exe	102
PID 2220 wrote to memory of 4532	2220	firefox.exe	102
PID 2220 wrote to memory of 5960	2220	firefox.exe	103
PID 2220 wrote to memory of 5960	2220	firefox.exe	103
PID 2220 wrote to memory of 5960	2220	firefox.exe	103
PID 2220 wrote to memory of 5960	2220	firefox.exe	103
PID 2220 wrote to memory of 5976	2220	firefox.exe	104
PID 2220 wrote to memory of 5976	2220	firefox.exe	104
PID 2220 wrote to memory of 5976	2220	firefox.exe	104
PID 2220 wrote to memory of 5976	2220	firefox.exe	104
PID 2220 wrote to memory of 6020	2220	firefox.exe	105
PID 2220 wrote to memory of 6020	2220	firefox.exe	105
PID 2220 wrote to memory of 6020	2220	firefox.exe	105
PID 2220 wrote to memory of 6020	2220	firefox.exe	105
PID 2220 wrote to memory of 2672	2220	firefox.exe	112
PID 2220 wrote to memory of 2672	2220	firefox.exe	112
PID 2220 wrote to memory of 2672	2220	firefox.exe	112
PID 2220 wrote to memory of 2672	2220	firefox.exe	112
PID 2220 wrote to memory of 5492	2220	firefox.exe	114
PID 2220 wrote to memory of 5492	2220	firefox.exe	114
PID 2220 wrote to memory of 5492	2220	firefox.exe	114
PID 2220 wrote to memory of 5492	2220	firefox.exe	114
PID 2220 wrote to memory of 5768	2220	firefox.exe	115
PID 2220 wrote to memory of 5768	2220	firefox.exe	115
PID 2220 wrote to memory of 5768	2220	firefox.exe	115
PID 2220 wrote to memory of 5768	2220	firefox.exe	115
PID 2220 wrote to memory of 4248	2220	firefox.exe	118
PID 2220 wrote to memory of 4248	2220	firefox.exe	118
PID 2220 wrote to memory of 4248	2220	firefox.exe	118
PID 2220 wrote to memory of 4248	2220	firefox.exe	118
PID 2220 wrote to memory of 4252	2220	firefox.exe	122
PID 2220 wrote to memory of 4252	2220	firefox.exe	122
PID 2220 wrote to memory of 4252	2220	firefox.exe	122
PID 2220 wrote to memory of 4252	2220	firefox.exe	122
PID 2220 wrote to memory of 4596	2220	firefox.exe	123
PID 2220 wrote to memory of 4596	2220	firefox.exe	123
PID 2220 wrote to memory of 4596	2220	firefox.exe	123
PID 2220 wrote to memory of 4596	2220	firefox.exe	123
PID 2220 wrote to memory of 1884	2220	firefox.exe	124
PID 2220 wrote to memory of 1884	2220	firefox.exe	124
PID 2220 wrote to memory of 1884	2220	firefox.exe	124
PID 2220 wrote to memory of 1884	2220	firefox.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\content.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2536

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Drops desktop.ini file(s)
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {9c71a7ed-b48d-4068-98dc-2a2e9987407d} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {9e49d3ba-0876-4ce4-9c36-11be56a8384a} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3608 -prefsLen 27276 -prefMapHandle 3612 -prefMapSize 270279 -jsInitHandle 3616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3624 -initialChannelId {1293f020-0a98-4c6b-b391-10069bdddc5f} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3776 -prefsLen 27276 -prefMapHandle 3780 -prefMapSize 270279 -ipcHandle 3868 -initialChannelId {692ee6b8-20a4-4604-9036-e7d5934b0286} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1496 -prefsLen 34775 -prefMapHandle 2964 -prefMapSize 270279 -jsInitHandle 4312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4376 -initialChannelId {00618432-b3d1-4783-8455-bd0296bd14b3} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4772 -prefsLen 34931 -prefMapHandle 4804 -prefMapSize 270279 -ipcHandle 4780 -initialChannelId {742f7166-1c64-48fa-9e7a-9e91e3fbad4a} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5172 -prefsLen 32952 -prefMapHandle 5176 -prefMapSize 270279 -jsInitHandle 5180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {d1008375-f5d7-4e31-a076-0c610739a772} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32952 -prefMapHandle 5204 -prefMapSize 270279 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {1191bc7a-a4a9-4115-b362-f1f1d14623b1} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5560 -prefsLen 32952 -prefMapHandle 5564 -prefMapSize 270279 -jsInitHandle 5568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5576 -initialChannelId {beb46ea6-11b4-4451-ab1b-61e544d9392d} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6408 -prefsLen 33031 -prefMapHandle 6412 -prefMapSize 270279 -jsInitHandle 6416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6424 -initialChannelId {6cd1e555-2cf3-4697-8b21-38544be7c8be} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356 -prefsLen 33031 -prefMapHandle 5444 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {b512fd1a-c1fe-4029-9572-7cc527cf90cc} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6900 -prefsLen 33031 -prefMapHandle 6904 -prefMapSize 270279 -jsInitHandle 6908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6916 -initialChannelId {50315943-fe18-4a62-9103-b48e0cb22056} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2840 -prefsLen 33071 -prefMapHandle 2896 -prefMapSize 270279 -jsInitHandle 4640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2852 -initialChannelId {ee794d78-3ed6-4c83-ad3b-67392af1d72c} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7816 -prefsLen 34061 -prefMapHandle 7820 -prefMapSize 270279 -jsInitHandle 7824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7832 -initialChannelId {0d714266-50ed-434a-8749-89b7c5bbf320} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:4252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7744 -prefsLen 34262 -prefMapHandle 7772 -prefMapSize 270279 -jsInitHandle 6524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {79715659-8431-4d32-ad43-5ee52d0f9120} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:4596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8000 -prefsLen 35266 -prefMapHandle 8128 -prefMapSize 270279 -jsInitHandle 6596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8004 -initialChannelId {cff8e8da-52c7-41ed-b899-e669dc69053d} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:1884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8392 -prefsLen 35266 -prefMapHandle 8388 -prefMapSize 270279 -jsInitHandle 8224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8420 -initialChannelId {720c8829-9418-4bb3-b663-9a65c98266f7} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:5368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8048 -prefsLen 35941 -prefMapHandle 8052 -prefMapSize 270279 -jsInitHandle 8060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8072 -initialChannelId {d4ee7ede-28f0-4261-995b-8901e0a67749} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5216 -prefsLen 36757 -prefMapHandle 7656 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7564 -initialChannelId {fe3153d3-5ce5-40eb-88f5-19a0a191a7c6} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:2688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5732 -prefsLen 36757 -prefMapHandle 6256 -prefMapSize 270279 -jsInitHandle 6276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6308 -initialChannelId {2a1d4474-5b01-41e2-a387-e064ffa355be} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:6500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8872 -prefsLen 36757 -prefMapHandle 7840 -prefMapSize 270279 -jsInitHandle 7428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7424 -initialChannelId {8a282690-5ccc-431d-acfb-51b04602335e} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13040

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\doomed\13040
Size 61KB
SHA256 a0a8484e2ee6e1dd8834306579193abaadd40be0916bdd9393c69667e2de5df7
MD5 d9248500cef66c9a41882feb232cc5ce
SHA1 bb332cf28de70660c5b56086b12cc6126b440473
SHA512 3b4d7fc876cc0a9cc21d6a2bf9557957067e76ecbdb681de8a846abbb1da62b839f3a02b16196b18df42de050637d374abdb61bc2f8e809b0d55281ee1b612e9
SSDEEP 1536:P4GBoEsWEpjGvdmwdqwXbQPGoVu+DmvkLqLJ:P4eoa6C1mwdqwXbQmum4OJ
TLSH
T12C5302BD4E2C2F6105343DF6A92F92CBDD42DB4A87F323A4C7AA5590D409962C3B911E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

304E367B2277059EBD85830BD2CE4233D6968ED5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\304E367B2277059EBD85830BD2CE4233D6968ED5
Size 51KB
SHA256 89a13a035ed87d39d7f54b9b707167cb62907ef7ce1d218eabab571fa5143d74
MD5 5a7022cc545eacb9f56da4e0f517c7d7
SHA1 b3a0ee8fc1a837bcc1f0aa470c0d70a4cf62eef3
SHA512 0654741207398dd3e2d04a3f8c86b85fee3c9b97f7b6ec078b3b7e317e7ce38b949e15f1526876e7f93f2d614d14d5a1394d5e5988bc80cd83b3e3899a5d48c4
SSDEEP 1536:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlmbEVW1W2w27:c6nHvPxMUsglU4AZRf
TLSH
T1B833F2339F60B6044A15A07195D7BF982F377613DBB2ECAC1858678D6F8023858FA8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 4561a11a770f09af560ddca6b67e82e4c84dd18d739c71d9fab8a3a4e6f2bb88
MD5 ede90b2f344341c8cca9aba80320ec5f
SHA1 2dfc5d77aeaa4b0aee249640bd2e70f3d57a0bb1
SHA512 ef50764a149f5c682042949f1e5a000db1235a46cbf23d686ec2efcdc01030453aaa13e5def6fcd72ad91c62721321a800b60b3e16794f06b0433883a2310242
SSDEEP 384:HwCe7iO024YFdcs3hk2nhfdDE2Ba/rIVy8ewN+cN+n:QqZYFdv3hk2nhfS2sDIVy8v+u+n
TLSH
T139728DBBDF516C5D1927E985C8AD9369DD05F9ABCFF690A608243049C784326B0FA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B15647BD59A5B60483AFD23FEEE5338CB2AB87B6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\B15647BD59A5B60483AFD23FEEE5338CB2AB87B6
Size 29KB
SHA256 a9b77181d2d0b18cf4830f29e1d9f787685e0c5d549defccb1537b6a5a53f62f
MD5 563331315f52c0b5e253d8d5a1379cc6
SHA1 bb0f011d20311049538e6496530ec76f2dafb309
SHA512 e659e6ea525f6d0f161095f934971a945e66ec7750b22fd07c3d4d582e7c2c15907f84088826f0f6ca432ba178352d3e7276007ec9e31cb6cb6364034b0b926e
SSDEEP 768:mJXKSyukFNxskSEzmtMFG2Yw4o5DsKLuDLesE:6aSyJ7xs6eMTr4o59Lt
TLSH
T106D2E1BE8F046BE8884620F6CB77C4BA7EF4E5D3CDD0C0AAE88C5757C8855E6AD41161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 25KB
SHA256 69fd338518b491db746158dfd8c0aefd954294a783aa5d9e9d4c288549d8f7bc
MD5 b6b2833c78fdc1a1f641fea6498e5cc6
SHA1 163d545dc31e50f400365dfb146a2550a917fa30
SHA512 8a32e02ac92b9224fa809d1b69b2c6bd24a9f67d7add096ae1fdd08fa1e6c453df9a141e84834558c4b9898fa794bf587b3d6c51a4a078de0354989f434fd75b
SSDEEP 96:7sqhkzb34LOfrLjvnP/jMt2acu2xMTM04I+70Qz3EuLEbEimtjh2xmYjeZxxA2x:UotpngD92VKZ
TLSH
T14BB2E3FB93B16562F4728FB194EC74ACAC330239995885885A2090D64B8DF94E0BFF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 10KB
SHA256 40eb61e1383ae7b575610ef119e77b0bb812f535746b342937e9df8f1a1361b0
MD5 3872b05c322cc2cc762b16ed7278f58e
SHA1 cf3aec7a9437c67e334bbced4d246857a1db209a
SHA512 c63c62e1bb4f4a932a3b03a5291e18c6557bf175e17f5697420fe4531a3ec8c73220458f95917259043ec563ac80f857b7bafb7cf13b20d7720620ea13def2e9
SSDEEP 48:bwnuKx6hkzXFg+bJLKPqesN2qmyjBytxq:bwnPx6hkzXFg+NaqesN2qJjMtxq
TLSH
T14F22C5F797F15422F4729FB4A8EC74ACEC370225996485A46E50A0D20B9DE94D03EF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 25KB
SHA256 38f5dceb3054de91e1c88ada63b282f38a11574f046c6807e0741fa96df6e973
MD5 d6bcc074f1d505e9a234eb04c1a43e17
SHA1 1233f9dc22d9d80fb7849b74605679faf6a408de
SHA512 3620c12ea6993f85e7ae66e18020a74b04165fa8c047d9f542d1e80cfa2129b00a01a784dc612207d8b989ab4a72ac4148ca0ad9e33bc2e10f0ef3f00248202a
SSDEEP 96:snPx6hkzXFg+NaqesN2qJjMtxq374yDYiMlMi4+J+7X8QzXeOEuLEbEimtjh2xmr:s5DotnngD92VKZ
TLSH
T186B2D3FB97B16422F0728FB098EC749CEC33022599588594AB54A0D24B8DF94E07FF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 25KB
SHA256 65b5c224020ea74833c6cb8775ac28d4e699992574dc19ea232acd904024ed6f
MD5 1813396af86d69ba3701a44fa66e8ccf
SHA1 8d56c30a570dc8c502c306322c66ac1c3a38165f
SHA512 d4033246a1391d3f8dd1b3cad0f80809fac2aed07739a7849bfa285b10e641595f4c53a9a798d0a96d0447d43205838e30696715bfb7a70e64fe15016a5363fb
SSDEEP 96:7sqhkzbdRrLjvnP/jMt2374yDYiMlMi4+J+7X8QzXeOEuLEbEimtjh2xmYjeZxxz:Qot9ngD92VKZ
TLSH
T15FB2E2FB93B16522F0728FB098EC75ACEC33022559588594AE14A0D64B8DF94E07FF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 67db321fb77a9af6098f359b5ce7785142526ba323741540c71f1ad340300d10
MD5 c75fb8cfb362ad82b76892b1557bbed0
SHA1 a193416d0f0996c8ab8e852d993dad123035b02b
SHA512 ba719a2b7aba3a3050a3e7143ee6657f776fe5c404595ce94059e6f224f5171af71f55a1cfc970b90d662369daa3ac14efd4b9e76a2054b46e0b540b39c3ae34
TLSH
T14A61A458F2288A3EE445423ACC925B411F747446E8AF7F2A39AC604C1E5B2CE77CD13E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1fbbcd04a53bf15b95624e248d9ef8ae02013364e1e108eb350e740d1689cc5a
MD5 304f1ef0ade9c3e222486be8b1732ef1
SHA1 0a1b43c25bdc5d7e57d236250db8afa7dcdcf4f3
SHA512 0c61a95f111446a9a083447c5cac3c70d6f962f78d9362c505b5addc839bee81da323dfec9a6392c4b2be68492d0a42fcd41f7889b0fe626df5fb05e1839b65f
SSDEEP 192:WOv5zbowZVtyjiOp1d66JozGzgCl6mc0dz:tbowZVtyjxd66JozGzgC1jd
TLSH
T175E1FD68E728863BC448427BCCA21B404F79399A9C4E7F25369C640C2D576DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 94KB
SHA256 53c13367080a7075f5d131ff6050016398170329d1a960f0c5d2ef18b79d1e5b
MD5 c58205e6bed0c6879cf0d9700d2623e2
SHA1 4314568855e2acc5575ebbf33155700bb80b310b
SHA512 8c1a10c82f03130b99498c97f98dabdd3e4848b48176e8bb9dbc6b03b1ff6418c312ca478fe640df8a0be4a622d7dcd376961cd76e7c31efd88116b4a5651d15
SSDEEP 1536:PtulzvSLbTinXF+SYmTT9NK4svoiyF79v5WKpu:Ptul7SHTinXBR9NK4svoiyF79v5WSu
TLSH
T1EB935ED4DB2B407BF91085BFB4946B3C1525B42049999B0F3AEC04661DCB7BF2D0AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 9fafe1762d092de53c08b5d534409b3c56c41803e2f8e44877a25357d799067e
MD5 bd4b46114a9f71351ddbd6e7e04c3a5f
SHA1 58fe1ffa49599a46fd96a7758fc56e67c8f7f81c
SHA512 ccfd2c8e48d301fb9eb232ba81b1477080baa5812f5f18c4836e397aaa11ad2a590b6eb8e623c2b4700651e4be350a9e018af1ce0a2b378e15ee2a3eefd7910b
TLSH
T1F9213A5C79B98EAEACCBE3AC7440028E53558E47058B1C470D02EFCCCE99AD9316A43D
MD5 SHA1 SHA512 TLSH

Submit Download

15c9a31a-93aa-4719-8e29-a30de9335b0e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\15c9a31a-93aa-4719-8e29-a30de9335b0e
Size 883B
SHA256 0c4087f18930ee7e1d9bd2144ab5a9f363a286ca3af15d8a5cd6626b3318eb6d
MD5 b46b54a087d849614ecd5925a13eb061
SHA1 b27c7f86a3f582cd463ee6de6755d2b9aa70ae6e
SHA512 9da2a0e487e38891df59b3268ed1f301d1151ab9792a2fd26b6991a2065085180d7ebad7bdcb4fd4a9d655aaf696a3bd9cd30c076c9800d7500729ac289d8271
TLSH
T17F11E78187787972CCB8D34FC95177425FE4B623C4C955143FA649084D7E91EE3AB60B
MD5 SHA1 SHA512 TLSH

Submit Download

3d039427-3d37-4047-a9e7-64530713014a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\3d039427-3d37-4047-a9e7-64530713014a
Size 235B
SHA256 b336a8559f8fdcc2ae44172d79c0396bdcba4341c28d9e28803134053d753850
MD5 328173e4d471e68d740611cfec21fac7
SHA1 6edea71dc384be2184915446830be1082b7c3e55
SHA512 1ceb4e374f7444b6b7502ac5664293a7229d3f9449e48bb69bc5b618341a4045207bdd04701710a07fa89647d18dfcc81fc4567904ec981987f9abd47882075d
TLSH
T18AD0979828882B5C08040F06B4A069CA31A44C3310A268609A918274EDF8AC801D190A
MD5 SHA1 SHA512 TLSH

Submit Download

4ba6dc2c-5c67-4e67-9c8b-f0e2173c6f00

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\4ba6dc2c-5c67-4e67-9c8b-f0e2173c6f00
Size 2KB
SHA256 6d90d03f5a68c796328c966b927803bc3ce54c3e172685d25586cd72ed6794cf
MD5 188203e4ee22d3f1ea1939c0aae45fb4
SHA1 be416ab98497766a696d86b6f18fea8ffd7b5568
SHA512 b0ef7fcfa4a049264627f1a5663f126baa4ef02927e2179514bf64dedf2c03cfe372fa823e95d78b55425fe0facdbe47630c152e22b89cf664251bf6ce3b9e13
TLSH
T16041416C767C4D7B8CDAF28DC091238D5764CF1300C62C932E61DE0CCCDA76A236A42A
MD5 SHA1 SHA512 TLSH

Submit Download

82d2da77-f02e-4ae9-a361-37639ccab3f1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\82d2da77-f02e-4ae9-a361-37639ccab3f1
Size 235B
SHA256 8c0b4d7b87644c12196bdbe320ef27bf4eabedc1f8a05b70131dbc6654e31827
MD5 d0c477b3c17a40d94c6506460c07f8f0
SHA1 27ae14253544e48541ab275c43faaac2806408bf
SHA512 6d95f48213331e7d7be2047c9053f38d29aead21542dd587626b8c305550c2a3d3108f67dcf489cf50c510a840971772562578c509e4425009ea70e3c11886a2
TLSH
T1AAD0979034A8A7EE08180F0BB0A029C73188CC3328B4A810D9900478AABD9C44257806
MD5 SHA1 SHA512 TLSH

Submit Download

9a4df7c1-fd8a-4c99-9927-29b1ed2b30ca

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\9a4df7c1-fd8a-4c99-9927-29b1ed2b30ca
Size 886B
SHA256 17f474de9bfbacdafb6b04294f35a4f022c10a7741fa862eecc37913e48dac67
MD5 20c091ef20c748010d21cc5bddaaf182
SHA1 98bd871f398cc44598eefbd2f8c00c7b20d103b3
SHA512 71aa64e820c7109e5f8c797e67882592f8956418789bbfc5597720ff8e53bcb4a9f38c41470549fe488467eb3f99c0d8a050e8ca39b38b350f493420e6a57f77
TLSH
T17111045487B879728968D24BC9A17B424ED4B61380C658147E555B180DA641F93A6707
MD5 SHA1 SHA512 TLSH

Submit Download

b44babe7-8508-418f-a6cb-75e872e00a49

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\b44babe7-8508-418f-a6cb-75e872e00a49
Size 15KB
SHA256 b96f9859fbc85f826222c03e4b22873be1e6a24d084a6d93598d0cb1b2051582
MD5 38feffc2ccf608b733770f8676abe0dd
SHA1 1289ac93d7bea7549ada9a63b6aecb4cb7af84c1
SHA512 01de3d789f1f8a8556ffe4979c0f3f7b6af13d6c8b25b31f6efd81d19e99b01c49516289c436bf6bee53be44c713d1aaf7070cfe101783b339e16b73362701c4
SSDEEP 192:G/+4BxygzyN1upeAA2VX3ZJuEjS/zZwjyTdL4UzmZ2FBMe1rhqzI5y3B0TiDJzi4:m+4L7HRV5J+OCl5yx0TiDJorpc16ncr
TLSH
T1E572C8166860567A8251E368C8F8BFC3E5F528CF4C419FCE9BE4BD085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json
Size 16KB
SHA256 d500c1fff5db4d5196ebc51392fca6ff24b6796510025e1cea8cacf0ec05eff2
MD5 f93ce1dde6177cd50ea5d06c0524d63f
SHA1 37f8ee494d8740b7da21a4da9850e2f50dd1e1a1
SHA512 0158504b0fd74e6f4e146b8a971b3f83ad31337213dd3550a6ca75bebcdd5db1b2279f8831dfb99df842dc4ad83bfae0fb878e820b18a13bac4a67f511720f5b
SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4H4I4hn:mI4dRfFXQ4d614d4D4J4+4N4l
TLSH
T1CA72521545049EB8298F979AAA367E02C37D433B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 6KB
SHA256 6e94d70f9cb81bef0a75e8cf3e7991dad4e2aa8e450eb7b17f875e1431baa715
MD5 cf29987c28084daf0713a40b7cfc2332
SHA1 6fa663074f2d72c5b8732104b99c9dfd7b78d159
SHA512 640a1d82a7b1cd1a2bb0d7c8d05cb5de8b29d979d16c7073c58295c689208ebe9ba0752e253ef7582d853864ac572db05761555a7a2e0e96b0fd2cfca51b029d
SSDEEP 96:xH4fUTUOPqGqsWf2gj1zSpNSSladv9jPmnIHeABw88n8L4cnTDEMGS:mf5RsWf2gjUNSSkeABw88qv
TLSH
T1A7E11F7895188F6F74B677ACAC6888316AB2413B7BBF68D710B954C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 8KB
SHA256 a2a5bc08c6703df3ec720404f24521ef9a2f41458a85feb499eb8a2dc4b851fb
MD5 14504d3171a8b390bee878790f0971dc
SHA1 fb63fbc3d3d986d05988308c6f1e2fed3a9bbee7
SHA512 39069a16fa1a5f4b82c53730eaed24b066f5867e036d1e7bd26f3b21834887a7457d7dc0a4819e8b8b789ee96bb506fbd3aa345178034225c9df86b24ad99f4d
SSDEEP 96:xH4fpTUOCPqGqsWfUgjObzSpNSSladv9jPmnIWRLeKPnJBw88iAm8L4cnTDBMGS:mfwCRsWfUgjfNSSBRLJPJBw88XU
TLSH
T1EE02FE389104DB7F74B677ACAC6489715AB2023BB6BF68D714B954C4010CF3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 7KB
SHA256 e947dad1e16c420b074ef56ad880bed9d9f86bb5b8025239188567fa5354fc46
MD5 ae1ab206744a265e436c329ddfc5fb6e
SHA1 02dc7657654bd71033c54a8d28d682f84067a566
SHA512 92fec2abbe632847206786f6c6b1b2ee147e60b0d660e924c8f0e60b0e9baa00a437b7729e2bc94723ccccd0d12454d957a41324658e410ec5cda837e24368a6
SSDEEP 96:xH4fUTUOCPqGqsWf2gjObzSpNSSladv9jPmnIHeABw88n8L4cnTDEMGS:mfhCRsWf2gjfNSSkeABw88qv
TLSH
T1ABE1107895188F6F74B677ACAC6888316AB2413B7BBF68D710B954C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 a7138b9cea013aab594c65517a421c9bab58a15112ae8147119019e499dc90d3
MD5 4a21eafe1570c9496856ba416bde171d
SHA1 4c248668f3c66d020d673c92ae7f3734a5ba287f
SHA512 98f9ec0acb53b3acf8f6fd09bc666d5badb990f96faeb9d44c4ec829dfef0ec3fa70f952ef24261e8384425b81288e225a5bb36a6a3d4374873c7a91a336e812
SSDEEP 96:xH4fUTUOPqGqsWf24P1zS/xSSladv9jLnIHeABw88n8L4cnTDEx:mf5RsWf24PKxSS5eABw88qY
TLSH
T14FE1207895188F6F74B677ACAC6888716AB2413B7BBF68D710B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 3995c545af6933384f256f7d9fc758b49794e7545087a22f1444c12bcb7e963c
MD5 a8b905f93c2ca1c54f5489ab35e2ec20
SHA1 40c4da5b00d0ba6c2d62d37b2f5ef108b7dc77b0
SHA512 7f1b4de6237fe772d544dff17e8ca627d5e23b9763890400c3d22270a071df4a9ec29cd8ec33e2ddb7f2744bb972070a82d1eb1f011a863196f8cab7137a0606
SSDEEP 192:FuuM4tjLYu6NEXXco+bjG4w9nENaZGnU29j1Jx73N:MIku6NqXco+nxw9ENaZGU2DH9
TLSH
T14B22B0CFE62B721891339B920D87557ACEE07E4B0A350BC471683B569C7DE0DCAD1782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 ead78e14b2560d76ab1fa032d80cbf2474209e6646a4d425fe251a4963c19ffa
MD5 20514ea7a41b61775e3162fd4bdae314
SHA1 52cf2d87b9a8c0c04f86e736722d280b4de04094
SHA512 6c2f8af2158da261ce42cba471b67f89d3464de44ae630e22336bdac2d37bae1f686356f9df9beb8396eb0d7742be7fec46abc2d82d8ecc857d876770c0f9320
SSDEEP 96:n2nmlovBVMsCstt1LYwbFgYfV6NENJKY2EDr4BhBZ4lTQv8ObjG4q50RCBuEnENd:nsVtjLYu6NEXXco+bjG4w9nENaZbxe
TLSH
T10302AFCFEA3F722C40339B960C8B567DC6A07E0B092457447059379669BEE0D9F64B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 13KB
SHA256 68d2460fd403ead009074ac1fb1629d93b192e60b518cd793257be9408ab0ab1
MD5 2e0c8b729f4c8af96d0787baf3e69872
SHA1 9cff2b01ca66fa9e504d7464d27b53216aad222d
SHA512 7e509c74fa68314c0e2cdc8740b717009c2bd0f8fa19b8ff9a665d1181dab9a645c755d6f6de8c67294f2338f6710c87ad113324920305ab5ac9df5068a75a66
SSDEEP 384:bUcS6Ymku6N6Xco+nxw9ENaZHYLQ2fT0Z7RXqdmO:bNT6N+axMaM247RXgt
TLSH
T17A52C0CFF62AB50BA1139B930C8B547FCAE0AF8B461207C4620833825E5EC0CD9D57C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.jsonlz4
Size 19KB
SHA256 48e999409b760d309ee2d83947f182f67cc3f95887d281e672901dde95fbadab
MD5 61498442b55557e7c6fd9f0b0f2534e5
SHA1 5b45ef761a59e4c7e4f6746ae28c55c2343ef9c7
SHA512 dc8cf1ff3cd48ef9fa264b1b7bb12761d81b88053739cb5b61ed43aff9545e0a0e4952ac89360308b6bb00f70088e5ac54b35cc19a88830e66b681eb757b2670
SSDEEP 384:4UcSjKYmku6N6Xco+nxw9ENaZSxYi06msqn+Z/HvGTYZ7b6JPexP:42KT6N+axMa5xYemsq+Z/r7bC6
TLSH
T11692D0CFEA0D6917511356C2088F257F5A90CED71B2A4AC5A3583B42472BD0DEAD53DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 21f05a839c842c6c2239b4529939dd1ec6a9cc33f6c68a976a2df0fa81674ac5
MD5 d66befa79d82fcfb66b7f4d4b03b8d5d
SHA1 28e22219861ac284dab76833553e2ec3528408b6
SHA512 1948a7c25887a42faf895a3d324d90270596d5d187f3a48c11f415b2ef1fce8858c5c6c1ee4a9a21ff167a5c27e0269e4c3755faa6fdd308a38538511173e22d
SSDEEP 49152:kL9LylaeUT6QC5zYYp66J52lV5PeYrrxH02jakqvnEMVzHbtAi6MFe11YfBxo46t:cOzxAi6MFe11hk423
TLSH
T18A665BE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 12959ae6aa03e1f7d46901577a4fec27b03a52c1c1eb77dd65499042f4441c81
MD5 477e2c1933c1a8869f19ad1b485976d5
SHA1 141c74df644b7fe83e9aaed01c95ef3782ddaecb
SHA512 a72233e0e4cb5bc8c44ca405fe586f96e054fa021ef313b135c6abb7e040d3be8ecce5a80bdfe2f56485f08a98d14567059202e82ded5ce0d8c9e2b69daa0bd0
SSDEEP 49152:fDmgBuOjA5lUT2loNcNeaKvgmRBbFOYTgN:rmYuO856T2KOeaKvgmcN
TLSH
T13A1639F820D1A257F3818037668563EF21AFD00C6467DD484BE966F994B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 b83b3e84f00026338bd6c53727f44e98b767904c2199d4025f34cbebff2fb94b
MD5 0b343a51572ab56c33df924281676cf2
SHA1 0dce6b6f8e526e844df179d37643e73dced5526f
SHA512 4bf1c6c34408ff20eab851b305dfeabd482ecbbaa934d39152b2fd77922ebc6a7ff030a0d840b086aa30110fed9bec6450ccf8575a9daec9bb914e32c4c1be86
SSDEEP 49152:ZpqcHbtAimMFe11YfBxo46rYH6kxY/usIV+ER3/K8VkH57I21rIa9mt77NabY4OG:7qcxAimMFe11hkm23
TLSH
T176664BE420E29252F34140B3719A53EB21EFC01C6077CE44579896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaGXSetup(1).exe

Path C:\Users\Admin\Downloads\OperaGXSetup(1).exe
Size 3.9MB
SHA256 aa9f32f2172d8eb2a9a3418084e58d10f577ef5d8217ca64607883386b785ed9
MD5 2798c80e9affaaf3d82a8ad7b1749e07
SHA1 e3bac4cc123372e446baafcbc8aa66ae33ce0629
SHA512 8531c61180564e917d019d765fa344a0f92b8eee630f8d69b17b3c33bdb5f23cb0b5f183c826b784d2134b5cae791cd9090d0fa365352ee49dff1707498a25fd
SSDEEP 98304:hAjmT6v6tJ1BuG2IiTpgfgIjSjHci7pPFHEuhtFtaXaYBjMAnJSGFXOV1gH:MYJvuGEpfIjIx9PFnFshBtnxF+VI
TLSH
T1211633723B86907AD29321304FA4F78D85BDB5251F2BA28F63C41E7D9E74242B634F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaGXSetup.exe

Path C:\Users\Admin\Downloads\OperaGXSetup.exe
Size 3.9MB
SHA256 72b282ff3e1d7d6214da91b18e9066e4d85134a4f851114d4bc22447edb06bc1
MD5 b8065f5d953138e8f15fe738946d9aa0
SHA1 4373b31450580c13a6d4b4a229ab17fa1735d924
SHA512 872a67fe09251d7f7198d2c2173e025294df7b487535e33bcae3fa1b75b0224d4c5d1e0854c6d6169a7ea8ba313b0099e6c063a5814a4ea83fa2da8c16b064eb
SSDEEP 98304:EAjmT6v6tJ1BuG2IiTpgfgIjSjHci7pPFHEuhtFtaXaYBjMAnJSGFXOV1gX:NYJvuGEpfIjIx9PFnFshBtnxF+VY
TLSH
T13B1633723B86907AD69321304FA4F38D85BDB5251F2BA28F63C41E7D9E74242B634F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download