hxxps://atpscan[.]global[.]hornetsecurity[.]com/?d=6kvyvAoOY49WfO3P_-rAfPNxPf96rF667McncCy110s2eFdMnpHfY31XbP-EpZl0&f=SC5zWsFy2rJaS42xXV980RO1LgSuxmZayeb-Zi3nVkafH6Dr_IK-e8jzp1_dgtNi&i=&k=gNZL&m=5qpgE_r2UOyHol0cZ01vXNlbsfVAPk8OhjbM9zAL0AhRUHY-b3Xu0ae53LlCzSyDeGc59qyFt5fHIZPOd4RNhGWuUWx4ZjVodOM4CGkYFAxJljsKtRJ5dsz67i8eSckd&n=7LlRYQo2zowKvgBitO16IYNT-v839vZqGYAVD7qXc8QWOQ-7i_WQKRkyRYPEr-1B9ZY0v1D8-AgrmY98t8V2Er-ey36seBTB5MytN2jK-KQ&r=y4K-t-FT42n5SDDERbKVS0Lj2Flsv9814UxUT-dyEoGOfy5NnLGiy5s9KEvApu6s&s=2d4ef001c8a36ee0b3e5b2dd8585cafedc3bc0f0ee09a0f191db35c222748995&u=https%3A%2F%2Furl-shield[.]securence[.]com%2F%3Fp%3D1[.]1%26amp%3Br%3Dssepulveda%2540ymflaw[.]com%26amp%3Bsid%3D1785331939368-031-00067646%26amp%3Bs%3Dqi3z4b6j%26amp%3Bn%3Dbt6xbhame%26amp%3Bms%3D3[.]6%252C3[.]6%252C0[.]0%252C0[.]0%26amp%3Bu%3Dhttps%253A%252F%252Fetrecruitment[.]com[.]au%252Fdocs%252F

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://atpscan.global.hornetsecurity.com/?d=6kvyvAoOY49WfO3P_-rAfPNxPf96rF667McncCy110s2eFdMnpHfY31XbP-EpZl0&f=SC5zWsFy2rJaS42xXV980RO1LgSuxmZayeb-Zi3nVkafH6Dr_IK-e8jzp1_dgtNi&i=&k=gNZL&m=5qpgE_r2UOyHol0cZ01vXNlbsfVAPk8OhjbM9zAL0AhRUHY-b3Xu0ae53LlCzSyDeGc59qyFt5fHIZPOd4RNhGWuUWx4ZjVodOM4CGkYFAxJljsKtRJ5dsz67i8eSckd&n=7LlRYQo2zowKvgBitO16IYNT-v839vZqGYAVD7qXc8QWOQ-7i_WQKRkyRYPEr-1B9ZY0v1D8-AgrmY98t8V2Er-ey36seBTB5MytN2jK-KQ&r=y4K-t-FT42n5SDDERbKVS0Lj2Flsv9814UxUT-dyEoGOfy5NnLGiy5s9KEvApu6s&s=2d4ef001c8a36ee0b3e5b2dd8585cafedc3bc0f0ee09a0f191db35c222748995&u=https%3A%2F%2Furl-shield.securence.com%2F%3Fp%3D1.1%26amp%3Br%3Dssepulveda%2540ymflaw.com%26amp%3Bsid%3D1785331939368-031-00067646%26amp%3Bs%3Dqi3z4b6j%26amp%3Bn%3Dbt6xbhame%26amp%3Bms%3D3.6%252C3.6%252C0.0%252C0.0%26amp%3Bu%3Dhttps%253A%252F%252Fetrecruitment.com.au%252Fdocs%252F
Sample260730-k32kcaeg66

Score

7^/10

persistence phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 46 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	firefox.exe
Token: SeDebugPrivilege	1944	firefox.exe
Token: SeDebugPrivilege	1944	firefox.exe
Token: SeDebugPrivilege	1944	firefox.exe
Token: SeDebugPrivilege	1944	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe
1944	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1944	4736	firefox.exe	88
PID 4736 wrote to memory of 1944	4736	firefox.exe	88
PID 1944 wrote to memory of 2776	1944	firefox.exe	89
PID 1944 wrote to memory of 2776	1944	firefox.exe	89
PID 1944 wrote to memory of 2776	1944	firefox.exe	89
PID 1944 wrote to memory of 4164	1944	firefox.exe	90
PID 1944 wrote to memory of 4164	1944	firefox.exe	90
PID 1944 wrote to memory of 4164	1944	firefox.exe	90
PID 1944 wrote to memory of 4164	1944	firefox.exe	90
PID 1944 wrote to memory of 5032	1944	firefox.exe	91
PID 1944 wrote to memory of 5032	1944	firefox.exe	91
PID 1944 wrote to memory of 5032	1944	firefox.exe	91
PID 1944 wrote to memory of 5032	1944	firefox.exe	91
PID 1944 wrote to memory of 3260	1944	firefox.exe	92
PID 1944 wrote to memory of 3260	1944	firefox.exe	92
PID 1944 wrote to memory of 3260	1944	firefox.exe	92
PID 1944 wrote to memory of 4588	1944	firefox.exe	93
PID 1944 wrote to memory of 4588	1944	firefox.exe	93
PID 1944 wrote to memory of 4588	1944	firefox.exe	93
PID 1944 wrote to memory of 4588	1944	firefox.exe	93
PID 1944 wrote to memory of 4732	1944	firefox.exe	94
PID 1944 wrote to memory of 4732	1944	firefox.exe	94
PID 1944 wrote to memory of 4732	1944	firefox.exe	94
PID 1944 wrote to memory of 4732	1944	firefox.exe	94
PID 1944 wrote to memory of 5352	1944	firefox.exe	95
PID 1944 wrote to memory of 5352	1944	firefox.exe	95
PID 1944 wrote to memory of 5352	1944	firefox.exe	95
PID 1944 wrote to memory of 5352	1944	firefox.exe	95
PID 1944 wrote to memory of 5388	1944	firefox.exe	96
PID 1944 wrote to memory of 5388	1944	firefox.exe	96
PID 1944 wrote to memory of 5388	1944	firefox.exe	96
PID 1944 wrote to memory of 5388	1944	firefox.exe	96
PID 1944 wrote to memory of 5396	1944	firefox.exe	97
PID 1944 wrote to memory of 5396	1944	firefox.exe	97
PID 1944 wrote to memory of 5396	1944	firefox.exe	97
PID 1944 wrote to memory of 5396	1944	firefox.exe	97
PID 1944 wrote to memory of 5404	1944	firefox.exe	98
PID 1944 wrote to memory of 5404	1944	firefox.exe	98
PID 1944 wrote to memory of 5404	1944	firefox.exe	98
PID 1944 wrote to memory of 5404	1944	firefox.exe	98
PID 1944 wrote to memory of 3440	1944	firefox.exe	104
PID 1944 wrote to memory of 3440	1944	firefox.exe	104
PID 1944 wrote to memory of 3440	1944	firefox.exe	104
PID 1944 wrote to memory of 3440	1944	firefox.exe	104
PID 1944 wrote to memory of 5808	1944	firefox.exe	106
PID 1944 wrote to memory of 5808	1944	firefox.exe	106
PID 1944 wrote to memory of 5808	1944	firefox.exe	106
PID 1944 wrote to memory of 5808	1944	firefox.exe	106
PID 1944 wrote to memory of 5816	1944	firefox.exe	107
PID 1944 wrote to memory of 5816	1944	firefox.exe	107
PID 1944 wrote to memory of 5816	1944	firefox.exe	107
PID 1944 wrote to memory of 5816	1944	firefox.exe	107
PID 1944 wrote to memory of 5836	1944	firefox.exe	108
PID 1944 wrote to memory of 5836	1944	firefox.exe	108
PID 1944 wrote to memory of 5836	1944	firefox.exe	108
PID 1944 wrote to memory of 5836	1944	firefox.exe	108
PID 1944 wrote to memory of 3720	1944	firefox.exe	112
PID 1944 wrote to memory of 3720	1944	firefox.exe	112
PID 1944 wrote to memory of 3720	1944	firefox.exe	112
PID 1944 wrote to memory of 3720	1944	firefox.exe	112
PID 1944 wrote to memory of 6092	1944	firefox.exe	113
PID 1944 wrote to memory of 6092	1944	firefox.exe	113
PID 1944 wrote to memory of 6092	1944	firefox.exe	113
PID 1944 wrote to memory of 6092	1944	firefox.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://atpscan.global.hornetsecurity.com/?d=6kvyvAoOY49WfO3P_-rAfPNxPf96rF667McncCy110s2eFdMnpHfY31XbP-EpZl0&f=SC5zWsFy2rJaS42xXV980RO1LgSuxmZayeb-Zi3nVkafH6Dr_IK-e8jzp1_dgtNi&i=&k=gNZL&m=5qpgE_r2UOyHol0cZ01vXNlbsfVAPk8OhjbM9zAL0AhRUHY-b3Xu0ae53LlCzSyDeGc59qyFt5fHIZPOd4RNhGWuUWx4ZjVodOM4CGkYFAxJljsKtRJ5dsz67i8eSckd&n=7LlRYQo2zowKvgBitO16IYNT-v839vZqGYAVD7qXc8QWOQ-7i_WQKRkyRYPEr-1B9ZY0v1D8-AgrmY98t8V2Er-ey36seBTB5MytN2jK-KQ&r=y4K-t-FT42n5SDDERbKVS0Lj2Flsv9814UxUT-dyEoGOfy5NnLGiy5s9KEvApu6s&s=2d4ef001c8a36ee0b3e5b2dd8585cafedc3bc0f0ee09a0f191db35c222748995&u=https%3A%2F%2Furl-shield.securence.com%2F%3Fp%3D1.1%26amp%3Br%3Dssepulveda%2540ymflaw.com%26amp%3Bsid%3D1785331939368-031-00067646%26amp%3Bs%3Dqi3z4b6j%26amp%3Bn%3Dbt6xbhame%26amp%3Bms%3D3.6%252C3.6%252C0.0%252C0.0%26amp%3Bu%3Dhttps%253A%252F%252Fetrecruitment.com.au%252Fdocs%252F"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://atpscan.global.hornetsecurity.com/?d=6kvyvAoOY49WfO3P_-rAfPNxPf96rF667McncCy110s2eFdMnpHfY31XbP-EpZl0&f=SC5zWsFy2rJaS42xXV980RO1LgSuxmZayeb-Zi3nVkafH6Dr_IK-e8jzp1_dgtNi&i=&k=gNZL&m=5qpgE_r2UOyHol0cZ01vXNlbsfVAPk8OhjbM9zAL0AhRUHY-b3Xu0ae53LlCzSyDeGc59qyFt5fHIZPOd4RNhGWuUWx4ZjVodOM4CGkYFAxJljsKtRJ5dsz67i8eSckd&n=7LlRYQo2zowKvgBitO16IYNT-v839vZqGYAVD7qXc8QWOQ-7i_WQKRkyRYPEr-1B9ZY0v1D8-AgrmY98t8V2Er-ey36seBTB5MytN2jK-KQ&r=y4K-t-FT42n5SDDERbKVS0Lj2Flsv9814UxUT-dyEoGOfy5NnLGiy5s9KEvApu6s&s=2d4ef001c8a36ee0b3e5b2dd8585cafedc3bc0f0ee09a0f191db35c222748995&u=https%3A%2F%2Furl-shield.securence.com%2F%3Fp%3D1.1%26amp%3Br%3Dssepulveda%2540ymflaw.com%26amp%3Bsid%3D1785331939368-031-00067646%26amp%3Bs%3Dqi3z4b6j%26amp%3Bn%3Dbt6xbhame%26amp%3Bms%3D3.6%252C3.6%252C0.0%252C0.0%26amp%3Bu%3Dhttps%253A%252F%252Fetrecruitment.com.au%252Fdocs%252F
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {bfe53267-8362-44c2-bd22-0125c2e3efbb} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {514f7389-5b71-4244-95f4-7e1b782d9f76} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 25164 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {09f62fd7-5470-461f-8d2d-48ed2e00fb47} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3968 -prefsLen 27276 -prefMapHandle 3972 -prefMapSize 270279 -ipcHandle 4064 -initialChannelId {8602ea69-1228-4558-b372-530f7170628f} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4272 -prefsLen 34775 -prefMapHandle 4276 -prefMapSize 270279 -jsInitHandle 4280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4288 -initialChannelId {1e01264a-5980-4d3e-9a2c-6fed76214b1e} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4628 -prefsLen 32819 -prefMapHandle 4632 -prefMapSize 270279 -jsInitHandle 4636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4644 -initialChannelId {1eb8c556-16b3-4f43-a6e3-3b78c3853cfd} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
    3⤵
    - Checks processor information in registry
    PID:4732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4904 -prefsLen 35012 -prefMapHandle 3144 -prefMapSize 270279 -ipcHandle 5044 -initialChannelId {fb28545a-9f03-4fe7-97c9-48c2c9e51d1d} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
    3⤵
    - Checks processor information in registry
    PID:5352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5256 -prefsLen 32952 -prefMapHandle 5260 -prefMapSize 270279 -jsInitHandle 5264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {029ec97f-e66f-426b-8fbf-cbef53e990d8} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5292 -prefsLen 32952 -prefMapHandle 5296 -prefMapSize 270279 -jsInitHandle 5300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {9ed7df18-cf4c-4a47-9467-25dbddbd8f27} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5332 -prefsLen 32952 -prefMapHandle 5336 -prefMapSize 270279 -jsInitHandle 5340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {9cb479e5-6341-4f65-bbaa-2a393661ae17} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4828 -prefsLen 36799 -prefMapHandle 4812 -prefMapSize 270279 -jsInitHandle 4816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5012 -initialChannelId {f630cfa5-e785-48ba-b69b-d34df387ee4d} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6244 -prefsLen 36799 -prefMapHandle 6204 -prefMapSize 270279 -jsInitHandle 6292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6312 -initialChannelId {70e7bd47-c3b2-4c36-aea4-55cec0031a74} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6676 -prefsLen 36799 -prefMapHandle 6876 -prefMapSize 270279 -jsInitHandle 6884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6892 -initialChannelId {6fac02ee-cfdb-4828-822e-2b90d42b3942} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7072 -prefsLen 36799 -prefMapHandle 7076 -prefMapSize 270279 -jsInitHandle 7080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7084 -initialChannelId {559c91b2-54cc-4765-8579-fc07c32541f6} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4768 -prefsLen 36853 -prefMapHandle 5588 -prefMapSize 270279 -jsInitHandle 5372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5672 -initialChannelId {5192a161-4d70-42e5-8b27-80d53957b00e} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:3720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5728 -prefsLen 36853 -prefMapHandle 6892 -prefMapSize 270279 -jsInitHandle 6600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5632 -initialChannelId {bfbea69b-f78d-4879-b9b2-7633b3b34f25} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:6092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 36853 -prefMapHandle 5676 -prefMapSize 270279 -jsInitHandle 5652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {a8307162-f4ed-415a-bb62-49a506991f42} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 36853 -prefMapHandle 7252 -prefMapSize 270279 -jsInitHandle 4824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7388 -initialChannelId {90114102-99cc-400a-8740-48420ae051ce} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:5924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 36853 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {31b39b74-d654-4506-bc27-8879eff3b6bb} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:3440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5268 -prefsLen 36853 -prefMapHandle 7028 -prefMapSize 270279 -jsInitHandle 7060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {48a4da0a-5856-46f9-8c27-4da02614dce6} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:3312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6656 -prefsLen 36853 -prefMapHandle 6716 -prefMapSize 270279 -jsInitHandle 6700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {0c46babf-a495-4192-b1c4-8ae38e3c60d1} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:5296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6908 -prefsLen 36853 -prefMapHandle 7360 -prefMapSize 270279 -jsInitHandle 7344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7592 -initialChannelId {3b17cd1f-9aba-49a2-8504-fc4e4b4ce9dc} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7620 -prefsLen 40020 -prefMapHandle 4824 -prefMapSize 270279 -ipcHandle 4780 -initialChannelId {bbffcd84-3b0b-4f6e-925d-729425a5ace3} -parentPid 1944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 utility
    3⤵
    - Checks processor information in registry
    PID:5628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11089

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\doomed\11089
Size 45KB
SHA256 65350c71a909744cc1c4a65ad6b84360dac95e1e2fae79795a821107df7d646b
MD5 c8b35d85331800ab969b3738d95115ef
SHA1 128ba7d72bb52c77fcd1a2ed463573ea5cd6375d
SHA512 3ced669c4a0c61ce383966dc172ec2518dec8cd0c8f6be1a2806409d75a6bc5145774a1a981c56e657ca3fa865be66cc633c3f1cece8c04158b683bd7411becc
SSDEEP 768:ZUfygn9CeKRf0NpP8ZUekUUfygn9CeKRf0NpP8ZUetA5vzy1hDWevzy1hDNVQs1T:JSCnRf078uelSCnRf078uetQrKhDtrKr
TLSH
T1E423D0B22B32155D136A957AF468C7DB2CC370671CE9C2A4C4CF92A0C68E6FD5CDC85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0FA235B0ABA0D54772C59935D4004B8479B7F76E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\0FA235B0ABA0D54772C59935D4004B8479B7F76E
Size 62KB
SHA256 ba0375165b99c5703fecbc771f8af0f072319abfb8d542611d51e45acf6f77ef
MD5 36d71e1035208e5d0426cfac746bb023
SHA1 db74d0251d5fa507b8424a5a3d480f241514aed0
SHA512 be4a378029d3432a8574c8bc9a6e847beeb44b9db5f53bf052c6704c129f34d91852d1d2f23c89b897cd1cf53e3ddffa5ad59f151b5db585ff9a37eb05b08785
SSDEEP 1536:HIe0mxoNkAY4fFK07vM0cDrqzAhHSTJ1W2w2L:HpEkAYmM4vVcDkAhyTJRf
TLSH
T14E53027B74112149956320E112222A5C3DAB96A39F3FF52C707E234CCCC67FD75AA369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 29e03834d6f6309e9f6682cb7f9535663c440a1aeb568b9a0b1cbde785bd80cc
MD5 2b1cbb20073657c89ef16bbe771f6fc1
SHA1 75a43f283f64bd0e416ec429a416f54de6c4ffec
SHA512 5c63b7c17c9b4cf4a4be53b58399e43bb973250cc570ec01d917db3303647a576abf80177ff5355ce343796f728c6d16bbae8a2a5d5afa095cca2f598af628a8
SSDEEP 384:HwCe7iO024Y0dcs3hk2nhfdDE2Ba/rIVy8ecz+Qz+p:QqZY0dv3hk2nhfS2sDIVy8x+Y+p
TLSH
T180729DBBCF416C5D1927D989C8A99369DD05F9BBCFF691B608243449C784326B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
Size 12KB
SHA256 094a6dab3979bdc18e1cd11a16e22ea519914237a96869f46846a513ddb2cdd5
MD5 6ae7db52580fba7930ed72310689dcd9
SHA1 fb6571be3a333c7552073273dff3f27df442d022
SHA512 96ef346d8d2b7f8abe7669f9eea5eeddc6a3321bb4e9147b6e3384605cae38e76998bc3beaa979ed73386371c264b37f486856fc3e3680f72811af585f9a93fd
SSDEEP 24:zuhMZJ+lzWQ1xH0ZQVrsIDrQBlGp3SQRtKGdQh7sAPbQlt3PQxbC:f4F37eSU/Gp3xrKGW1sAEz4NC
TLSH
T14542F6F76BF36921F6E24FB4C49AB548CC33052558AD9994CE04D0E28BA16B0E13EF5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
Size 10KB
SHA256 8d2ace29cd36ea5c1333622f95a1ef927e34ae207d0938b5d2f6a9870ede233e
MD5 63a3528cbff6ae2beba378be4517086d
SHA1 c4f3176a6e4299062f50ab89d4453bc42e08c5a8
SHA512 b77b3421d28730a5951ac896e8cfd2f89d483b8fa3e951aa1e4d0499f0f337ed872641b860f93ecc51f7c69b1bb34340bb6895fdc5f61b51e8809ad60d59591f
SSDEEP 24:zuhMZw+lz9Q1LzzQVgYLZQVrsImqA/QBlT6SQRtKqA+Qh73:+42J8yYeeUAo/T6xrKRNJ
TLSH
T15922A3F76BF26921F6E24FB4C49AB548CC3305254DBC9894CE41D4D64BA16B0B02EF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 58ce0a0ff593691b5bd0c699f2c05489e8ba04c45e79de33fa00d62dbcd61643
MD5 718abd1c4a8cfaaf8d1a920f4308dc27
SHA1 b66aa811f9ea845eb688408c3f13e1811e4bd366
SHA512 a70ffcc488df18afb2fae95f35b1a1a820eab2b688a6d6284587a2c5c05d258ac26939802e650f64f308f7df8677b8dd88062fb7699583437813e9f1dc5d24a2
SSDEEP 192:I1d66JozGzgCl6mc0dkQcOv5zbohZxLpyjO18w:id66JozGzgC1j/bohZNpyjk
TLSH
T14AE13164E629423FC408027BDCA21B414F35395A9C4E3F2935AD741D2D8B6DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 428412321c071ea1025f432d17cceb69b25c69069cb59d4128fb49718a540eb6
MD5 892f50103ae16825e11d79ad62e0408e
SHA1 2e9f84411914271670f6798df1ebadd9e418d6a8
SHA512 75ab86e5480d272d755140f8bcd8de599310d2517f2eeab7e2cde3ccdb4054bb45fceea1a9217fb44ac38637f1de67723658235bc40ab681a81fd69ebd1f4cc5
SSDEEP 768:zEAQ7Q12yCpA5q3g31L2Rl3GcmhucE/1IKWvT9UsUQU8vkErbDbxblbObBbsbNbd:SQ12yYA5q3Md2Rlv/1IF5/uqGrknQ0Zx
TLSH
T104232244EB1A553FD42802BADCA21B003F79F889590A2FA7375C64796C872DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 4f25318ec4fb80a74aff1a11ca5c68f28bb9f7b65761e447eb516a9235a11793
MD5 ff1bd52ba21f198db2bb3ebf3bc9c82a
SHA1 2dfb648dfd8c4e10b4a89c8e48e9e55064902ebe
SHA512 b9e84a8e4aa87b9eadb32bd8d75d85ea2d8c7d60282fe1a54ffd96e22349925e7f6aba1b5aa964357dddaa5d542fb416aa27483f7288c3b34c2690fdd3cb94be
SSDEEP 768:yQ12yCpA5q3g31L2Rl3GcmhucE/1IKWvT9UsUQU8vkErbDbxblbObBbsbNbhbT/D:yQ12yYA5q3Md2Rlv/1IF5/uqGrknQ0Z9
TLSH
T183232244EB1A553FD42802BADCA21B003F79F889590A2FA7375C64796C872DC3D9E07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 a33cdfeff15d1da1ae5598828106a616de22d27c590e6beec43289094d86efb5
MD5 309933dc74e926d99067a61cef30cd23
SHA1 0457d5419c4dbf1c45be95efbbd510b572cd3360
SHA512 66b97435c62bc7d71d278ebd80e3da9e16b19d522ef56fef7cf86667d439298e94105882b6d56ae63842d26a58aa47f4e459674858305b38c4fb1e418d0bbf67
SSDEEP 768:hQ7Q12yCpA5q3g31L2Rl3GcmhucE/1IKWvT9UsUQU8vkErbDbxblbObBbsbNbhbz:uQ12yYA5q3Md2Rlv/1IF5/uqGrknQ0Zx
TLSH
T12C232244EB1A553FD42802BADCA21B003F79F889590A2FA7375C64796C872DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 ee8384d6c8c96fb7201ffd8bab8aa4eea888bcb893a2b084190d347ea67256d7
MD5 6cfacc32ba5190f292ebcd360079bdc0
SHA1 0353fa164970e682b36726e29923ecf0b6e40270
SHA512 6e3d00c6565a0bafda9a4f080d0cd0e268d6c399baac85e89aab92b6911ca44547d52384e4ee37aa07f7fcb3f60fb048a5c684536140b9a90d74a3dafb943df8
TLSH
T1AD61ED58F229863FD049813ACC925B412F30744698AF7F2A35AC604D1E5B2CD768D07D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8181d7be101bb80e48b8cea97313411a8b6399ece44c9d7af9d812b516067013
MD5 fe4f1ac1f701d5096c4023518ff18434
SHA1 b6bb3c8cf88f90783023496b39e086efb1ca4787
SHA512 5eb580a320858005022a42f2748327e3c962c121648249ecd76def86d7547b0b71e3d26319b287192aaaf1283daf8d9f07b0d6df43425edb3a4cdedffb36e831
TLSH
T12B216B5C39F94D2AAECBF3ACB491028E53614E0758871D474D52EF8DCE81AD932AE53C
MD5 SHA1 SHA512 TLSH

Submit Download

1e262e49-cac4-4eba-8661-967c477bf122

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\1e262e49-cac4-4eba-8661-967c477bf122
Size 883B
SHA256 adc0d544984d3cec56dfc71b3859d0a37a56be2e637ef9fbe2bdb0759af1bb77
MD5 f9cc341180d6563eb849a01b27e015f6
SHA1 0a2a0f4c836e2e5f9d744edfb8f47297c4794f94
SHA512 a243f885f0bbed334537ebf12ee549b98757dfdcdcfe0d8af52424d030cf79dd7d18744256e2b18df67a04c4f221e4971a02a1b5adc4dfc05c0adf10f0bed335
TLSH
T103111C40A635B5E28C78925BC55537028BF4761380C944243DF19A140DAF81E836B20B
MD5 SHA1 SHA512 TLSH

Submit Download

31405a57-2fe5-4957-a76a-11f141ced3b9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\31405a57-2fe5-4957-a76a-11f141ced3b9
Size 2KB
SHA256 955e4074fed40283bcd37de0509ce7a869fd0a617f5c94e17172880a23ae6281
MD5 87f347c8899b57e04b1ca3b62673d073
SHA1 eede9c4252ac420aa29e6529381160cf26e5babd
SHA512 7386aaaea5ce9931d9d6dc936834756e510f9891cdf9279791b395ccf3839964633527395de0b85f84deb6655d19af4a40e7d2bce6ddd815de9b518121a1158c
TLSH
T1B241116C357C4CB64CDAF68ED492238E9BB58A0340C718531D62EE0CCC9A79D736B56A
MD5 SHA1 SHA512 TLSH

Submit Download

52d88c36-c389-48ec-b229-9453f017a011

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\52d88c36-c389-48ec-b229-9453f017a011
Size 16KB
SHA256 0a8b30d5a3fd0bc9449e3b23b1138f5983afb3d0b9eafee1d70209b1dfa9d7a9
MD5 b64c4f396f8aa3e8cd5ba9cac87e60ad
SHA1 76a1021ae61bc9cb20d19a156c66eca3fac0b229
SHA512 a8b6ba1a07a96f52a5e87c292df260d1ff3bdf4fa7c88a351e94f58f1ea1b34b610455e4372a60f6c5f4b069cecfc945738c3ea23a0577d1d84a2502bc2d1c41
SSDEEP 192:JVIc83l5SmzB79OboDk8XEPyFUBIC3vanKw1OBA0I96Dl+T9t+Tv48612YZxbMzT:JVIc83l5Smt9IoDk8XAICfwKDGo+TjU
TLSH
T1AD72E916243045BA8251E3A9D4F8BFC3E5F528CB4C419FCADBE4BD086DDE06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

893a04fa-aa69-4933-a82b-a8d785105280

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\893a04fa-aa69-4933-a82b-a8d785105280
Size 886B
SHA256 eb8a61e232797433cec6ae5d2a8d60d0eeb02db0ec07202c1ca2a36f95f076d5
MD5 0c4e9071dbc64c1d8693a4cd71424b53
SHA1 ff698a44c9df0d2081fe7bd5a3d09580316bc085
SHA512 a2d8ff24a731375d830682597c5f005aa43552dc9bc9e47caa36430dd87bb3f24a2f50fc68a5f0f31597e1f847151894ae2b962259f1c2de04040ed551d26a14
TLSH
T1EA1100415A35A4B28C6CD28F9590B743CBF47623C0CA59243EA5AB190DEF81E936760B
MD5 SHA1 SHA512 TLSH

Submit Download

915c9052-c84e-4278-a2de-91cfdc07b4be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\915c9052-c84e-4278-a2de-91cfdc07b4be
Size 235B
SHA256 547c8c6c58f5ac14ad15f6ba3fdad9a3887885ab257bac8ef010cef406afa6f7
MD5 dc9168632687cf91b40de00359eba107
SHA1 d19c81e348bb5d66f85931c3751f1c32a4a93f54
SHA512 3be1ad735f05e2566bacf0a8e90255bd25c7d975ab337743619206e1c4c08da422261127305ddb9dce22c6ade89e7a464482adb7cb7b042ca1afb09c4e478dcb
TLSH
T1CDD0978028AC67AC08240F0AB0A029C731848C3370F4B810E950087899B99C403A1826
MD5 SHA1 SHA512 TLSH

Submit Download

95e8a5c8-aa91-48b5-92cf-4ace5b714ea8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\95e8a5c8-aa91-48b5-92cf-4ace5b714ea8
Size 235B
SHA256 c6baf91379e1e459ca6e44d4794e85d75a4ed1d66eaa4b13898996df20020605
MD5 d3af9e50582d9329198fa7394b4e1520
SHA1 913244c41c0045b24b37729d4387ad0c71fac600
SHA512 02830bb7cde9f15a0b986750e58a1a4ff654fd46d523fc24230ac7c16dc3038db8f5237cda579c51b5d027ad446ea15cfce22571fa002b2016532a5ea2d5d7e9
TLSH
T122D0978024A867AD48340F03F0E028C630488C3390B4B810AA6841B4E9F99C4426192A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\extensions.json
Size 16KB
SHA256 49471641c341f87af0da05ea3b1cece9a262cbb7fa767d6c3d2bfed3c4904749
MD5 f2b87185082b1cac99e2aef8fc9c5650
SHA1 40177c6e12bf30bf56a7fea5c2d389d5330096f5
SHA512 475e65a3da5c6b46c72d549b6a524e15578041a33c7a5e8216d47bb055429b78d7e2dab31172d8c461b1e251098f8b2ceb350dc4bb269ccfec4a2b5adf41581f
SSDEEP 384:8kI4v3Umldv18dhWE94zh96oaL4HIL4PtL4H2L4H/L4HHD4he:TI4vRf2XZ4D634q4V4c4D4D4M
TLSH
T15A72521545049EB8294EA79BAA367D01C37D433B70855C38F4DD8FC842FB5B902BB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 28f86402d06d45d1a0b70050481a24a010a66fd530656aad09f0561d9d556b2f
MD5 7ec7af87065cab03e6f4ec35ee30d5af
SHA1 4cc3adfc0b677dd920d6ab6136107bd74c337a62
SHA512 0d61830ac2d1cc937ddd5e50ad9a8fb231a9b04fc48340876253f5aa22a9772b11a8cb5dc40417469045a712e129c95a3796813c5c8e813cae0f9827ccd4c4bd
SSDEEP 96:xHi+UTUHqGqgaf0C91zSZSSlmdv9jEnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0C9oSS85lfWTBw88qV
TLSH
T1A0E12E7895088B7F74B677BCAC6888316AB2013B7BBF68D750B59484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 7KB
SHA256 2927e27aafbaeaa1451ddac576af3f08d3643839b1cafa06cc5607962429fd48
MD5 4b22c564d47baa9e2403ebff662bd131
SHA1 1c150715855b83848ff5331a7c8b14fd679deb85
SHA512 d1c697d470b3da218ffc89e67e1adf8cfde6f8edd9aaaf168c1e8f693276a8047403e504d4e965e54fdc48c5c8c3d02ac15415a2c02de953274db669c10f481b
SSDEEP 96:xHi+hTUHqGqgafQC9ObzSZSSlmdv9jXnuH5lNdHW2Bw88JhB8L4cn3XH1:k+TRgafQC9jSSz5lfW2Bw88MV
TLSH
T1D2F10E789044CB7F69F6367CAC2448716AB2023BBBBF68D710B98485454CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 6e3121c1fd515a3fcf7a7885fb0865c5a4e1bb8cbbaba00112b4f485e1fe1305
MD5 ac20eb488bd644afcc201095606fda07
SHA1 70e851024db983b114f99839812fa6924315b0d9
SHA512 3eeea4dfca177983e1c3cda2c9cf1b682b594951587d86754555f8d00764386363f37122521e0530656e5b73ff1d4c5fabf048eda6309dce333cdc7f6ad70c80
SSDEEP 96:xHi+UTUHqGqgaf0io1zSzSSlmdv9jEnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0ioSSS85lfWTBw88qV
TLSH
T1F0E12E7890088B7F74B677ACAC688C71AAB2013BB7BF68D750B55484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 d3e7cee358bef34f8af67fadd9eced6b7622650487c0caaafaa942a793b0f63f
MD5 698c7a9de3755f85aa4276bb5c3c9ead
SHA1 b8d35d27a9f459e8ce80c739ab5d403498694776
SHA512 8956d1e668b160e75e873d515fd2cbe8d8b0f214f46f2f5728e8a8453a77f422bcfbf35bf0ef7a40b514cf99bf009fb242f36c1114edc3cdf0c085f3b00dcd7a
SSDEEP 192:aEGktUSr1KyBovdRj9Mn5ZjhntYJ8M+E4d0EjLypUP1ie7H6fqFF1l3i:8kxrcK0dJIm208y+PxFFb3i
TLSH
T1C4228E43ED1C6B29C396D30280E3BDB8465F0C25666376A4ED26F23899C579471FB788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 6231f7e62dc82b803a99553b3c7672f13fb29f3463142066a13265ca841b61a1
MD5 2651fdf86aa20a3c8943c234a7c420d8
SHA1 efae0eb74386ade35b7de5a3c2ab57d089060e32
SHA512 c3f5b0d5517ee384e1c76a8133ffc24814c2b43b166c3d1b262a832288bed61e5e9057fa613e406e5de57afc6680ebb8549754cfc8088308aacc3fd5fe04e8e7
TLSH
T122514AC6CA058AE0E515821EC0404BBD539D34331D7D28E0DEA2D9C4ABCB889726B35E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 f9a7871699a1b3ccfddca2ccd0415af71fd0af9d5054a9bd44a34832fcd0c3dc
MD5 21e65e2303c7cc2222805896ebc3f6e2
SHA1 54122a724a36803a3bb6759ac453772dab520399
SHA512 bbbde451fac676f76236a0a12b8942a5312ed1ce49f1737b4ba5f58f92c08da6fabd3cf772a4ee4dc868c08251c382718e361f31a5f43a7236522f785ebee882
SSDEEP 192:je4KyxovdRm9Ma5ZjhntYRM+E1d0EjLypUP1ie7w6fqFF1ldHWC:jeHg0dI/n08y+PyFFbdHWC
TLSH
T1A9228C93A94C2B29C292D30290E77DB4425F1C30696335D1EF22F23895D6788B2B775C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 99810edd3c2aec42d43c05a38bc7037ccc14ec8dbc49ad45dd035435492c77b1
MD5 384e2493959ba373b4468a31b8844368
SHA1 6117074529030acb6908b8f1c6cbee22f1b067b3
SHA512 e3309467c8f28406e6a309d9e5010d710c82c8b6b66f9e31ff6e3dce619bffe8cd06ecf3db75bfd0395ea0d55ca009238f5c03307d256644e00f09a278e538fb
TLSH
T1C0514ADADA468AE0A515421FC0405FBC539C34331DB928E0DEA299C4ABCB899326B34E
MD5 SHA1 SHA512 TLSH

Submit Download

301792106ttes.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\storage\default\https+++www.linkedin.com\idb\301792106ttes.sqlite
Size 48KB
SHA256 18ec3c9acdcd87b22909992d3ae280d448f747600dca446f82add4d19f55ea20
MD5 6919058ca5fa2266a6c3333c640585b1
SHA1 c16a2f779d3921b84d1bdce4f9c7f1b0e590ce3a
SHA512 ca79a501ac79407dd544d22eac17b9ae7d1d0bc63810803907b50c7fa04e85b4d84bd1da3de85a39f9da35db708e08a78d307120496f7b143c6227033ee8201a
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:Oa16S6CKnqlizbxV+2xVeU7X2B0
TLSH
T163235D8E3F07A511C53AF0B178A08D51B85E321E07222AD56990DAE4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 06719a6999f66018d24b61517e21415e5286f30ae07969aa10ec134e84a48d4a
MD5 a541ba1f2c7c0351d7088632fc088e1a
SHA1 6bb2cc058fc5bf64a1288d0d6ee2dbf0d6ed71c0
SHA512 0f0e81bf2186e38e24c58e0c01c2656e042536f23bfe4675585bbed92ca2c17dc3f4cf79940ea5a0ca6981ee7c10b29257b5303977c69a948c49011079746dcc
SSDEEP 49152:FZdqpU2HaeUI6QC5zYYWEHJgTGFdZ4nWJJsZzveg8Pt5q0JH1E/BHYnM6Yy6pqV3:5YqI+3vwM7iwHPHj
TLSH
T1C6665CE420E29252F34140B3719A53EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads