hxxps://web[.]archive[.]org/web/20220103170612/hxxps://stock-images[.]0o[.]si/?p#/old-man-tries-to-climb-ladder-falls-down-and-eats-cookie-2298498123

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://web.archive.org/web/20220103170612/https://stock-images.0o.si/?p#/old-man-tries-to-climb-ladder-falls-down-and-eats-cookie-2298498123
Sample260728-2tesnaybmb

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
812	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 812	2768	firefox.exe	85
PID 2768 wrote to memory of 812	2768	firefox.exe	85
PID 812 wrote to memory of 3796	812	firefox.exe	86
PID 812 wrote to memory of 3796	812	firefox.exe	86
PID 812 wrote to memory of 3796	812	firefox.exe	86
PID 812 wrote to memory of 4360	812	firefox.exe	87
PID 812 wrote to memory of 4360	812	firefox.exe	87
PID 812 wrote to memory of 4360	812	firefox.exe	87
PID 812 wrote to memory of 4360	812	firefox.exe	87
PID 812 wrote to memory of 2236	812	firefox.exe	88
PID 812 wrote to memory of 2236	812	firefox.exe	88
PID 812 wrote to memory of 2236	812	firefox.exe	88
PID 812 wrote to memory of 2236	812	firefox.exe	88
PID 812 wrote to memory of 1236	812	firefox.exe	89
PID 812 wrote to memory of 1236	812	firefox.exe	89
PID 812 wrote to memory of 1236	812	firefox.exe	89
PID 812 wrote to memory of 4840	812	firefox.exe	90
PID 812 wrote to memory of 4840	812	firefox.exe	90
PID 812 wrote to memory of 4840	812	firefox.exe	90
PID 812 wrote to memory of 4840	812	firefox.exe	90
PID 812 wrote to memory of 3752	812	firefox.exe	91
PID 812 wrote to memory of 3752	812	firefox.exe	91
PID 812 wrote to memory of 3752	812	firefox.exe	91
PID 812 wrote to memory of 3752	812	firefox.exe	91
PID 812 wrote to memory of 4544	812	firefox.exe	92
PID 812 wrote to memory of 4544	812	firefox.exe	92
PID 812 wrote to memory of 4544	812	firefox.exe	92
PID 812 wrote to memory of 4544	812	firefox.exe	92
PID 812 wrote to memory of 1012	812	firefox.exe	93
PID 812 wrote to memory of 1012	812	firefox.exe	93
PID 812 wrote to memory of 1012	812	firefox.exe	93
PID 812 wrote to memory of 1012	812	firefox.exe	93
PID 812 wrote to memory of 5108	812	firefox.exe	94
PID 812 wrote to memory of 5108	812	firefox.exe	94
PID 812 wrote to memory of 5108	812	firefox.exe	94
PID 812 wrote to memory of 5108	812	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://web.archive.org/web/20220103170612/https://stock-images.0o.si/?p#/old-man-tries-to-climb-ladder-falls-down-and-eats-cookie-2298498123"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://web.archive.org/web/20220103170612/https://stock-images.0o.si/?p#/old-man-tries-to-climb-ladder-falls-down-and-eats-cookie-2298498123
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2028 -prefsLen 27099 -prefMapHandle 2032 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {45897509-02c0-49e7-b6c8-92f369e4e869} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {8b82b707-cbb0-4ad1-b278-1e1f18d6b263} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3772 -prefsLen 25164 -prefMapHandle 3776 -prefMapSize 270279 -jsInitHandle 3780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {0c735a67-17b6-4955-abdd-ba4d182d4557} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3968 -prefsLen 27276 -prefMapHandle 3972 -prefMapSize 270279 -ipcHandle 4060 -initialChannelId {598d7136-89a0-4e9c-8a47-116b0d651105} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4468 -prefsLen 34775 -prefMapHandle 4472 -prefMapSize 270279 -jsInitHandle 4476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3164 -initialChannelId {a8dfbc68-7f8d-4f78-9e56-21e3d65824db} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4904 -prefsLen 35012 -prefMapHandle 4908 -prefMapSize 270279 -ipcHandle 4916 -initialChannelId {36bcaadd-321b-4232-933a-9aa277befa21} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5164 -prefsLen 32952 -prefMapHandle 5168 -prefMapSize 270279 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5180 -initialChannelId {5441ce3a-1923-4f90-8a26-39d9537bae65} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32952 -prefMapHandle 5204 -prefMapSize 270279 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {e7d80d5a-86a8-4e50-bee7-6033c5d877e3} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 32952 -prefMapHandle 5612 -prefMapSize 270279 -jsInitHandle 5616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {76edd1fa-a126-4fe7-a946-d33b49fa7d93} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 9fd5b0a0bc04cf60e05704afd970574a55c6d071b4a2590308ef3d82a2f3e716
MD5 8ceae083c9e09b34dc400fca18835b13
SHA1 5f78b62bfcc34cd8730005c073bc5422eb2fcde0
SHA512 94243357bceb605c7fd9d4b047781d49a42528b86ab53af39b8afd35c4f1ce699ad9fe59dbad7600ad085ee50c586d04552612f774c5f9b7e7df86b1f451d934
SSDEEP 384:HwCe7iO024Y+dcs3hk2nhfdDE2Ba/rIVy8eHw+Dw+8:QqZY+dv3hk2nhfS2sDIVy8/+U+8
TLSH
T14D729DBBDF512C5D1957D589C9AD93A5DC05F9ABCFF680B608243449C788326B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 92b8699982dcbf7b30774a2ae5c8d94f6f8c4e65e97478009722aa66e8dad3ee
MD5 f83774cfc0c93cb41e272a149619bdbb
SHA1 01ba34495806cf55a162cfbef3ca85d751329bec
SHA512 decd878b17668a4c83c9caf9b4402d8180fbd4e890c5304c095887b39b1e5e1b7a9a9d74d429c80887c99855cf7df26248e7b6a98c88bbc5f293af43668053f2
TLSH
T1B461C958F229963FE445413ACC821B412F747486E8AF7F2A35AC604D1E5B2CE7ACD47E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c61efd05a49950641f61915e1397580612117a9af1500acd7b98f7778646f6a7
MD5 056482a72b92d1c8ec66d9cef3fbd702
SHA1 df38429171836490112953bfa16a2ebfbf6a8a13
SHA512 92144e7372a65fa26a1ccf547cbdde3eba780ed47715f44c16c1b06307549afb582d4a83cc6bb321fb31c76cc2593d60445f759011420e45bd898929e549db36
SSDEEP 192:UF1d66JozGzgCl6mc0dkOv5zboPZRgcyjPUy:UDd66JozGzgC1j1boPZOcyjB
TLSH
T132E12064FA29867FC408427BCCA50B454F39389B984E7F19359CA40C2D572DE7ACE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 09f77a2ea3e6cef398ab40bb4a4771de4777e18f090709d5e494a9c4634013ee
MD5 b429e3f23eb4313f22be39f972a8b6dd
SHA1 ad50e114285dba0ad12ae2d86188f27809dcaa99
SHA512 1046a6efc12034d1cf3bc3af25b615305d9eb0e00bcdbfea26129fce2cae149d64c8b4a934f1134a193c51d37efda303a199b78415ff350f675e31ef8f90394c
TLSH
T15A213A9C39FA5D6A68C7E39C785102CE63624E4644872D434E12EF8DCE85AD9336E43C
MD5 SHA1 SHA512 TLSH

Submit Download

27d49064-ae3a-4b35-8c3b-e3942e728c24

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\27d49064-ae3a-4b35-8c3b-e3942e728c24
Size 883B
SHA256 928b57514ef72f96923f0d57fe58297d8e1df87f3c07bbcb67115f7b4fc16da2
MD5 5f790c8b7dc07935d8598d389b81d4a4
SHA1 9a5bdb8e097132b8a9737f79ec61d1ea2d04e45a
SHA512 85ab98013b38fad3463853881f9889159220668ce425e204e3d8732381aa4f68a4e433b2863d50621e6342903aba8b4b51ea31ff29eb4ba96d9fc103f4691078
TLSH
T1ED112380A639B5E3CC78D24B895537028BE43523C0C994043D90CD180D7F62FD7AA60F
MD5 SHA1 SHA512 TLSH

Submit Download

3ade9bc0-a22b-42ee-9fce-6dd45ab57285

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\3ade9bc0-a22b-42ee-9fce-6dd45ab57285
Size 235B
SHA256 387b671072eea5d0d12d02f111acfeb3b0e6ca3ec9b1308213c2ee4c68c0064b
MD5 02503f976f12c93c6d0ff133a863d1f1
SHA1 13020a1a60bb823eda0af9eeba1fcfa450ecb5b4
SHA512 59a90a4331d261335145860e3c1542eec0147619545d9e8fbf64898833bdb066dcdb26f97b8d8163e6fff775254553ff88d0173d0cc402d9c0846389910ffa01
TLSH
T1F9D0A79868987B6E08146F17F0F07AC670444C3364B96820E5A24578AAF9AC5525586A
MD5 SHA1 SHA512 TLSH

Submit Download

4336c984-f8fc-4740-bf55-0f44cd45576c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\4336c984-f8fc-4740-bf55-0f44cd45576c
Size 235B
SHA256 5e1c2ba80a4251c98fe89e0e08f71485fb2cc7683ebf0167ad11328b1aaf660c
MD5 9fc710b50ccdd1dd9993caaed4cb5b51
SHA1 17f637a27648d38809957179eb7434fd4b79c123
SHA512 63cfd9bb760cbf11cda3deb8e1a9f341abc621b3d04500f4e76480dbf1237879e891391940ccd97ae100f92cd6ebbb2f5d5feec6c6fb2c9bb2b5e3138eb96daa
TLSH
T18AD0A79064986B5D08141F26B4F16AC63984CC3314A96850DA6186B4AAFEDC5516AC5B
MD5 SHA1 SHA512 TLSH

Submit Download

58d6a593-e974-4f29-8e27-be9a779ff836

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\58d6a593-e974-4f29-8e27-be9a779ff836
Size 886B
SHA256 fd77af9e4d2baae62b9bb951f9520cf2e1ac006c5c376e2fcfb6f926b7dd5b6e
MD5 cbb5f249861d4900217c2b340793013b
SHA1 dc63ff942cb92b136add440cfd4b75a27c154917
SHA512 a38fe87f6ed6df4f684c0b500b5f227a1e4a21584571e0a0cdf5c8e2c21b5478acbf9e5fa45078caadf268dd7e89fdaf5947ca7d952f3504716cc50147783723
TLSH
T1C411C4509B39B5B38C79D18B949077068BE4756380C599087D50DA1C0DAE51EA7E660F
MD5 SHA1 SHA512 TLSH

Submit Download

c3a063f2-1349-473a-a3c2-d6ef0ad5a05c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\c3a063f2-1349-473a-a3c2-d6ef0ad5a05c
Size 15KB
SHA256 cf30e6b3b2af62e7047c7d67bb665d4fe4d6387e4242d3e78813caf54dde007f
MD5 cb1c94a79465522836eb43db937496b8
SHA1 4937106223913f97a9d1ebfd72d088fb924e8c74
SHA512 0dd4fe52d0008f3414f9ba1b6ede0a816271861bd2b8f7dbbb799b2289ab43a9463b5bee94a8a8e8238c1bf367294b777e0bda1df692a955979881d445458932
SSDEEP 384:g07hbRs20MWZYY7ek0eL/KD9auG6F+cjMi:gQIZ0eLCD9+6F+q
TLSH
T1FA72DA166830457A8291E3A9D4ECBFC3E1F538CB4C419FCA9BE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6e75dfc-12a9-478c-9618-abc5122ce5f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\d6e75dfc-12a9-478c-9618-abc5122ce5f6
Size 2KB
SHA256 1124431968c38f53f529707bb9d82bd6e79f2bd2b72eb6b0d93144fbc91b6a0e
MD5 2057a345cd7e986350faf0306abaf31d
SHA1 d56140a6a4c52e3972c50300cf74281eaa31e1a0
SHA512 a23983c5628531e367c4de5f7931973f3e016f61cdfb686e11b223ae2cbfd76f367b950daed56eeead82ee1444e8d7a39040ab513e65fde8b67d6c46b6e24f26
TLSH
T1B041345C36B89CBB4C9FF58DD452334D53745A0300C668432D61DE0C8C9A79E736A57B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extensions.json
Size 16KB
SHA256 d5d19783cbd8b13fc2ba93f680708eba60b3eb0f3a30f2afd00c15d8f29228ff
MD5 838372e39bce53c867de4dab83f8de5c
SHA1 ceb82031a74bc7af77a3e0036824dffdda4e15ff
SHA512 ebaea663a6dde8b921c0c8458fe62fd2835d4041b05bd57c1f58550a823e9564be1f72990a853cf13558aae8926ef61234beb94e63fce80ece0cf13510ca4077
SSDEEP 384:ghkI4vzUmldvQ8dhWo94zr96oQL4HQL4PGL4HzL4H/UL4Hze4hl/:PI4LRfJXF4F6Z4y4U4f424a4T/
TLSH
T15E72421545049EB8294EA79BAA36BE01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 6KB
SHA256 ddb65fe42e8b90154c2c45fce1bc1a4c4979b626aae4f3af8bd20e9419aee8cf
MD5 f1187e3668ca9c157429b560bbe50927
SHA1 3ea215ed35050868b4982fc5cc0bc0bd9f64a02f
SHA512 71161ff93e808702486be9eb3734482f5ec9aad3dd6d85a49b7e804f11ff6bdd9d887dcf0e004db978bfa9f160ba432b1af5f0649049ed1e6da51b4aeabe0ddd
SSDEEP 96:xHiUTUMqGq/fSeC1zSuSSlmdv9jTnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSeC7SSxxisIHzsBw88J
TLSH
T1A4E120789048CF6F64B6776CAC688C716AB2013BB7BF28D650B554C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 bf85c216bf694ade283e2c75cb12c0b570e52e21e0d6c3351781c1d41adf42a3
MD5 768f68ac565d6a3788e5999dbbdc659c
SHA1 e2405431f7e6d982ec91606bf5e20d6839f27cef
SHA512 5c8cdff2fb80dd51db1c566a26a617ea17f4e7c5cf17eab1b01eb8cf70e9ffa9aca2b029c3768986d316de619286e253a415a8dc534b4075ca4609bc7ebe5ade
SSDEEP 96:xHiUTUMqGq/fSrO1zSYSSlmdv9jTnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrOBSSxxisIHzsBw88J
TLSH
T105E130789148CF6F64B676ACAC688C716AB2013BB7BF28D650B594C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 7KB
SHA256 116004cb9d17a277ad2cc6406780a6dd165bce7043ae2b71f50d3791d61c83d5
MD5 90d570a779c7b8477372aa9c69da1800
SHA1 6e00882271aebd3caddc9cfd744390c21e7c1a1b
SHA512 ae40a1ad4d776826ca68f0794c3bb657599741bfe7134a88a380b87d802c6c4d908e852c9465d603be55c0a009cb6f416c3af8dc0c68562af78170f20cb3d5e7
SSDEEP 96:xHi1TUMqGq/fPeCObzSuSSlmdv9jTnytHlAsO7HjvBBw88gwW8L4cn23U1K:UCR/fPeCMSSxxisIHzBBw88o
TLSH
T130F10D789054CF7F64B277ACAC25893169B2023BB7BF68D710B94484055CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 011ede2baddf1cbd9c30a7182c66a1fb62b79b3ce654433e128c82129fb7bd71
MD5 18b8322e39afd57ce8c358b55ecf5669
SHA1 622e57d0735b40f59bbb65e9da7a56ecff190582
SHA512 a146afe934536fd725416358a230f6c9ecd6568e5c3d289ecac87c26362ffc68bc076ead78f440735d8666d5e4a905da14ec2fafa0984eff04d9eabe9468d316
SSDEEP 96:xHiUTUMqGq/fSeCObzSuSSlmdv9jTnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSeCMSSxxisIHzsBw88J
TLSH
T12BE13F789048CF6F64B6776CAC6888316AB2013BB7BF28D750B594C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 390d012ab7c2d9a982f79fc4b78cd21b0a8c2ff27d28d7b597e0fa1d06e6d37d
MD5 7565b53a2c282d8b4802e5ed59dc4a30
SHA1 542bb4517347ebefb77770d5edfc7fcb521a0943
SHA512 bd16a47c60ffe4f9ae11feac913fbda4ed4b3d3cbfa86d6063578998130b532e004fa81c360eed3c76e425fe9bd6a94232493053e5d80c0c35252765eea1bfa0
TLSH
T115212B43D5572EF87F21A268D0428BF1965B356680BE44B0C21D860429DE15A7747A19
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads