hxxps://web[.]archive[.]org/web/20220103170612/hxxps://stock-images[.]0o[.]si/?p#/old-man-tries-to-climb-ladder-falls-down-and-eats-cookie-2298498123

Analysis

max time kernel
148s
max time network
153s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/07/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://web.archive.org/web/20220103170612/https://stock-images.0o.si/?p#/old-man-tries-to-climb-ladder-falls-down-and-eats-cookie-2298498123
Sample260728-2tesnaybmb

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	firefox.exe
Token: SeDebugPrivilege	3344	firefox.exe
Token: SeDebugPrivilege	3344	firefox.exe
Token: SeDebugPrivilege	3344	firefox.exe
Token: SeDebugPrivilege	3344	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3344	firefox.exe
3344	firefox.exe
3344	firefox.exe
3344	firefox.exe
3344	firefox.exe
3344	firefox.exe
3344	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3344	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3344	3488	firefox.exe	82
PID 3488 wrote to memory of 3344	3488	firefox.exe	82
PID 3344 wrote to memory of 2520	3344	firefox.exe	83
PID 3344 wrote to memory of 2520	3344	firefox.exe	83
PID 3344 wrote to memory of 2520	3344	firefox.exe	83
PID 3344 wrote to memory of 4412	3344	firefox.exe	84
PID 3344 wrote to memory of 4412	3344	firefox.exe	84
PID 3344 wrote to memory of 4412	3344	firefox.exe	84
PID 3344 wrote to memory of 4412	3344	firefox.exe	84
PID 3344 wrote to memory of 2436	3344	firefox.exe	86
PID 3344 wrote to memory of 2436	3344	firefox.exe	86
PID 3344 wrote to memory of 2436	3344	firefox.exe	86
PID 3344 wrote to memory of 2436	3344	firefox.exe	86
PID 3344 wrote to memory of 2300	3344	firefox.exe	87
PID 3344 wrote to memory of 2300	3344	firefox.exe	87
PID 3344 wrote to memory of 2300	3344	firefox.exe	87
PID 3344 wrote to memory of 2772	3344	firefox.exe	88
PID 3344 wrote to memory of 2772	3344	firefox.exe	88
PID 3344 wrote to memory of 2772	3344	firefox.exe	88
PID 3344 wrote to memory of 2772	3344	firefox.exe	88
PID 3344 wrote to memory of 3360	3344	firefox.exe	89
PID 3344 wrote to memory of 3360	3344	firefox.exe	89
PID 3344 wrote to memory of 3360	3344	firefox.exe	89
PID 3344 wrote to memory of 3360	3344	firefox.exe	89
PID 3344 wrote to memory of 3452	3344	firefox.exe	90
PID 3344 wrote to memory of 3452	3344	firefox.exe	90
PID 3344 wrote to memory of 3452	3344	firefox.exe	90
PID 3344 wrote to memory of 3452	3344	firefox.exe	90
PID 3344 wrote to memory of 3672	3344	firefox.exe	91
PID 3344 wrote to memory of 3672	3344	firefox.exe	91
PID 3344 wrote to memory of 3672	3344	firefox.exe	91
PID 3344 wrote to memory of 3672	3344	firefox.exe	91
PID 3344 wrote to memory of 4464	3344	firefox.exe	92
PID 3344 wrote to memory of 4464	3344	firefox.exe	92
PID 3344 wrote to memory of 4464	3344	firefox.exe	92
PID 3344 wrote to memory of 4464	3344	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://web.archive.org/web/20220103170612/https://stock-images.0o.si/?p#/old-man-tries-to-climb-ladder-falls-down-and-eats-cookie-2298498123"
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://web.archive.org/web/20220103170612/https://stock-images.0o.si/?p#/old-man-tries-to-climb-ladder-falls-down-and-eats-cookie-2298498123
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27100 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {bdbcf9a3-6c4f-44af-a91c-f74cddcd8f80} -parentPid 3344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3344" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27136 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {1be6dd5d-efe9-46d8-a1ed-65a9d4916759} -parentPid 3344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 25213 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {96babb30-3dde-4e03-89fd-89d9f3b6c00f} -parentPid 3344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27326 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {83fd6b82-092b-4eda-891a-aad3fb4e4bab} -parentPid 3344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3344" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4460 -prefsLen 34825 -prefMapHandle 4464 -prefMapSize 270279 -jsInitHandle 4468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2664 -initialChannelId {70e1bbf2-850f-4360-84d9-25150ed32274} -parentPid 3344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5028 -prefsLen 35013 -prefMapHandle 4720 -prefMapSize 270279 -ipcHandle 5096 -initialChannelId {2aa0e323-1988-423c-8416-a8568c3604b7} -parentPid 3344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5236 -prefsLen 32952 -prefMapHandle 5240 -prefMapSize 270279 -jsInitHandle 5244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {7443a10b-a389-4055-8922-a5f1260ed667} -parentPid 3344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5260 -prefsLen 32952 -prefMapHandle 5264 -prefMapSize 270279 -jsInitHandle 5268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5276 -initialChannelId {bbb4417c-94a6-449a-833b-52ea37e23f9d} -parentPid 3344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32952 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5260 -initialChannelId {7462bd35-fed8-4ae9-8294-a76f9966c811} -parentPid 3344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ploc9qy0.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 bc367e5de269c6b91ead7eb086d5601a36f193230bbd6e1e4f1b3871787e87a5
MD5 574cf55d5c1762fcd75da473f832cf33
SHA1 b1164259f74693f72362c2fcf77b91176c4c4607
SHA512 d57b8231b205b3e52618de9669efbbbb3a44df0461bf81bc449be351be667442e8826a1a90d47a2abc91de81d89999aac17e0dfcad413b79f1576905802932e8
SSDEEP 384:HwCe7iO024YUdcs3hk2nhfdDE2Ba/rIVy8eHw+Dw+3:QqZYUdv3hk2nhfS2sDIVy8/+U+3
TLSH
T1A6729DBBDF516C5D1957D589C9AD93A5DC05F9ABCFFA80B608203449C788326B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 ca1c7e608f4b6b7f85110f7a9e21fb1f78ada554645499fcc4fe3fcc1ab3a97d
MD5 3beba916ae1ef0ace8ca89ba9183af75
SHA1 3abf79feb92e7a0a5082eefc9daf79bdaa6045c5
SHA512 a7c7d12783731e8a26f9e9483f24d0db31a5e0c460cd33ed4d532ee4153a41ca0ddfdcec3a44e8cc7b1a1184e724797a1984ec98c5c135165ca7c5004836634e
TLSH
T1A161CB58F228463FE044413ACC821B416F747446A8AFBF2A359C604D2E5B2CE7A9D03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ebb7031e43ef7aa47a7b80ac37c04358c552ce78a9d846540ef83526c4cd4179
MD5 2945ddee528dcaf57ad228903ac27b3a
SHA1 297380ee1ff1abc662cfd233c5cf5de9039abf81
SHA512 d404d126750d21ba653fe1d295997bcb637af72a762a64ea30432f9c7fb3c055a0a6f4be425329565d36ff3a25e187c1fa170722ece23c7cd1bd453878eaa343
SSDEEP 192:NOv5zboZbdMyju6Zo1d66Joz1zgCl6mc0dz:iboZbdMyjDCd66Joz1zgC1jd
TLSH
T158D12DA5F628463FC404427BCCA60B444F39399BAC4E7F19359D644C2C5B2DE3A9E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3e0a1692d1ae89d73a1a535dd5b4df6f2ccc986e3402873515b5858492d1df19
MD5 88b8af78ec004a347d801c109abb3cc3
SHA1 bbeb25c1c1de3127e5e2b7b63a02102753b7ed1a
SHA512 e1f388337c7d70b19154c57b5b1bf65e24279608cd5f66aef9c2ecaa604d2d9d448df69f19a433d48a5f742cdcd41763a16926749a6fb3557321c9575a8ceb04
SSDEEP 192:Po1d66Joz1zgCl6mc0dmOv5zboAhZdMyju6:PCd66Joz1zgC1j7boIZdMyj
TLSH
T1F2E110A4F628863FC404427BCCA60B444F39389B9C4E7F19359D645C2D5B2DE3A9E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ea27711af7ef4e2d2d0078c8e61c8f14c9c5f4b7f1bc72c40fe50de08b47c56c
MD5 464ca1a72aa8de6654a062ad218c5588
SHA1 951ae96792e9a858eaf4e673a8d0a8803b8dda87
SHA512 ee12561f57e9c52e5486f916ef1ddc3b34b449dbc515647369b821fc7cdec909c755e4630a4017c6ecc8a6f7b4ce9545bed3b514a98b51737888fa785c59359d
TLSH
T1AB213D9C39F95D6A58C6E39C7491058E63A14E0604872C470E52FE8DCED5AD9336E43C
MD5 SHA1 SHA512 TLSH

Submit Download

41daf332-8d38-4305-abe0-423b89e6b9de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\41daf332-8d38-4305-abe0-423b89e6b9de
Size 16KB
SHA256 8d6eb721b81fa99108501965ce6a51fb63243139003b92e33f8e489a4f3960af
MD5 1b867ddad5f9e7cd1c33512581247fac
SHA1 4882ea045cce208645658e42645bf148932f5a53
SHA512 2ddb09e405daa919d85b1799656b030f29d3230c8e7bebc1d9152785f5d8a40e9dab027e24528d3b5a0e8141862f5bcfa4222c381b413596f37b461d854960d6
SSDEEP 192:iD1aLduAVikx74tauYD1p1B5iRMqhRdzx35Ib40UN63LGQ6CsLO2S3fIOhbngeks:iD1IduYgk9T1CMqhRdl3Gb4tIfB
TLSH
T16572CA56246046BA8251E368D8FC7FC7E6F528CB4C419FCA9BE47D0869DF06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74563007-d45b-4bc1-99f1-7c41c5ae2b41

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\74563007-d45b-4bc1-99f1-7c41c5ae2b41
Size 886B
SHA256 2bb2128c2d3a945104947f2912cc7fb6e8afdbd2816ebb5167de0058344e7117
MD5 e41780319923859a3d44569dada5db56
SHA1 c59fcc824a6787a9de2d6b92c3abde9bca0b1b8a
SHA512 5c8465d5377034b63d0d5fc21d28b8ee83e5e9e44f030b08feb4e115e8025eac2d8b70de44e1984d1ad3501468f3a0c25e81bc3b72470b3f326f1edf8fc7f1f2
TLSH
T1B61104419770B5F2DC78C18B89A077418BE4B46390CA99187E905D1C1DBF51F67B730B
MD5 SHA1 SHA512 TLSH

Submit Download

7fa6b950-f4bf-430c-887f-6da6ba4016ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\7fa6b950-f4bf-430c-887f-6da6ba4016ad
Size 2KB
SHA256 edc46859aa86e801506f3f9dc4f399485451b1e1b5ed253693d6728ea6393a5e
MD5 80751b10cd05cfbdbc2b08d49563820a
SHA1 d01ffd839ce36e87ba9518f09593b43073194c7a
SHA512 8b67be7506d7ba541a9b0ff28bdf12404f807b67de9988dbc0613bf8a435582c48f08dbdf5c7f0df6bc7ed03420c004cc1d31162c3a844e699909eefd104b15c
TLSH
T1C241245C35B44CB75CDAF95DD481238E63A08A0310C66C476E51DE0CCDAA7AE337A92B
MD5 SHA1 SHA512 TLSH

Submit Download

9d495f18-fbf0-41dd-9d30-e9494722e107

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\9d495f18-fbf0-41dd-9d30-e9494722e107
Size 235B
SHA256 62c3293d4815cf1956ef8d92a45c5b9abcfae3872a751269bd51e224610e3204
MD5 d4e77ca4c8b94c880c4ba9ac447ad923
SHA1 d26a503f354914c0bed9a4f1c57aedfdf30024e4
SHA512 6b94824928e97e8c1fc7860c14bf9f483aee57a26ca2d658875baac5792123a4646e99e28d4d0d6fdd378b03e11c421d346d71838828c53c26605162c1687f94
TLSH
T196D097C124B83B2C0C001F07F0E0A8C630588C3720BA6814C9A002788AFD9C802A283A
MD5 SHA1 SHA512 TLSH

Submit Download

b2a6ae1e-570d-4476-9f05-fa42686e192d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\b2a6ae1e-570d-4476-9f05-fa42686e192d
Size 883B
SHA256 47f5289c1d863f72c3e2f7faab101500eefc72f7f2f88b58184e4794242a307f
MD5 8b261dee0854dd0ba07e3027eaced164
SHA1 e926a059ff4341fb7f85cc7fe10fbc5e2b3a7bca
SHA512 41c5424290bdfb886f06235dc0ec3a7ee2d2b2b2789c1036a628a2a550175e7b7b35831532bde296df49c1383268882ca863047e672b2494038de038e4fb7793
TLSH
T18A1100419A71B5B2CC6CD25BC99137028FE4752390C694183DA10D180D7F91E977634B
MD5 SHA1 SHA512 TLSH

Submit Download

c9a95176-1405-4bbc-8dca-19afd4024467

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\c9a95176-1405-4bbc-8dca-19afd4024467
Size 235B
SHA256 3bccd1848caa993a663da0272edebd2ca39c38de6cc9b8a1f0d532e68cfdf391
MD5 3b28ec77b5be17d8a7c8166f0b3eb06d
SHA1 0f3bb4f0451098da490ca919b1c4a220edb55bea
SHA512 f88392b0468313aa38a02ebfd3d6682f52da1376e0b31965fd99b4e8afab4d7293d2fa2010c8547bdca2d2ac2160b71d7ea719f76b75f424c1e5fae5f4689546
TLSH
T186D0A790149D77DD89141F0BF1F079C671884C335CB8A8109A915578D9F9BD551D1C17
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\extensions.json
Size 16KB
SHA256 96d01d052fa440b05a698c7774fa2d92998224f25bffeed1b8e8d621837f550a
MD5 c2f92bee6eb8f9e2919881b06402e05d
SHA1 cb0afec7c5ff2c2741fc2949557976de5eac5979
SHA512 ee39bfaf24963faad1f7cabff24a3d9b76e8562e1554c48056a6fc8e8d8f8a56ea92b808af40c8497dc59ab05ba2d089e56d20a0e88a6b00917a4fb0af33824b
SSDEEP 384:XAkkI4vSUmldv18dhWM94zl96oHL4HWL4PdL4HcL4H5L4H+E4hn:X6I4KRfWXd4H6M484F4W4R4T4h
TLSH
T1B672421545048EB8294FA79AAA367E01C37D473B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs-1.js
Size 8KB
SHA256 ef98160933cc5e41654a8ff19953b7647e86a99fe265c63b5a5b712cca8441c7
MD5 0aa7915ca682c88bd99e732fc6755042
SHA1 3a2cdd5633a33ce5d499ac2cb434f8aad61defe8
SHA512 70861e732402020df6146de45e2cd038b1216fd7e366da5d859b6e062669b70b33d488ce85891eb9950aa0b651f6004854a3b42d89f96eb5ae2f80b2e6ee1b16
SSDEEP 96:xHyotTUQqGqi66fPFTObzSTSSlNdv9jOn0WR2GnOCIBw88UGMe8L4cnfT8Uh:N+Rz6fPFTRSS+RSBw88O5x
TLSH
T13F020C785044CB7F74B6736CAC6589306AB2023BB6BF68D701B954C5050CF3846FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs-1.js
Size 6KB
SHA256 96fa31d3a952ab3b60c042dc4d83ee70161ae5b16d40994891fd269caca7404f
MD5 775b8d606acab9916dd37bbb8be7aa3d
SHA1 53a25c8adb3b3885526669d15442e52508b89df5
SHA512 b6866937d7fa30bf624bc00e2b8b25edc75d33af0c4abe295f5d993b2a23e4aa21d06571935e643e4c7eaa40bcbf8b4af3ef420a0617bc706de08e3986aa07ed
SSDEEP 96:xHyoUTUQqGqi66fLFT1zSTSSlNdv9jpn0H6nyBw88P8L4cnfToUh:NLRz6fLFTuSS4XBw88W9
TLSH
T154E12F789148CB7F74B6776CAC6888716AB2013B7BBF68D650B554C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs.js
Size 6KB
SHA256 1b80b26a9a3323822451a3d37205d6a00e6ce1e9a8eec2111c9aa27e17267926
MD5 698052882f15e1fc53fdad3e5d4df3a5
SHA1 e88ef1e18af4221e0c49e76938575b0d0ccc278b
SHA512 c21c519f50f09e6643ceec2c311e742334b1a3eb51b7b2aa94475ee4848282554b5f99bd2ee3aaa45985756c0feae03a4cb255e687263f5cfca801e7fff6bc15
SSDEEP 96:xHyoUTUQqGqi66fL361zSISSlNdv9jpn0H6nyBw88P8L4cnfToUh:NLRz6fL361SS4XBw88W9
TLSH
T1D2E13F789148CB7F74B676ACAC6888716AB2013B7BBF68D650B544C4011CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs.js
Size 6KB
SHA256 75129d8c3223e8dd858596833db47ad4f560c91d621886536b421bce9c2298ff
MD5 44f3d8da9a80fdbc1bf631f419256042
SHA1 0d264062b09c6fece4e90f5241ed18284c46c94c
SHA512 e62e461f8b1bb41b6e851b49ce8578cd5b637290a990c22ddd034424cae6c21278256c1a6e7df7a5cf049d12deaad038b920854934f46978d03e0ac1c0f4464c
SSDEEP 96:xHyoUTUQqGqi66fLFTObzSTSSlNdv9jOn0H6nyBw88P8L4cnfToUh:NLRz6fLFTRSSfXBw88W9
TLSH
T10AE13F7890488B7F78B6776CAC6888316AB2013B7BBF68C750B544C4011CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 45f36e5c7089359725e2feb1d8d96d0596416da2bbdae87342954510154bbc91
MD5 f590eaf720e7db7fca790fd6665295ba
SHA1 dc5cea25b8639e6dfc765cd0eb5f4fb74c7a5f58
SHA512 05dc96fc4032262738377950e5da76d220bec41d3d2d7b868085dbebeed6e827d32e4df09dc897f8c4533220a430c12b425ea6ba1a898249a144fca656916546
TLSH
T18E213BC3115B2EBABBE3D09EC0994BB78256357680A1E4E0C0464E4004CF1DEB65900A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads