736269e1ac73809b9cc573e6b10872db26f32e0ff486f13edeb7903b4491b724

Analysis

user interaction
yes
max time kernel
72s
max time network
44s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.exe
Size 33.6MB
Sample260730-pxmapayape
SHA256 736269e1ac73809b9cc573e6b10872db26f32e0ff486f13edeb7903b4491b724
MD5 e611031be35d5949af5e958f097b3f89
SHA1 829a6fb904b287000620838d2fa4df6fc80a71a9
SHA512 22b06cf0f1b5fa29ac64c5c81d9a5e14b55f144fb22608a3787fd96cea2986f3293db91843cd06bc9fd1c2a816fcdc3b21b1d42c19fe08ed73e10b913117ed0a
SSDEEP 786432:J2hEpMtZdBlkSZFsmyIuFFIdXkLEgkcERE+ZG:UZZLCSrslI0IlkoBE+Y
TLSH
T11E771256E2FD00E8D5BAC0B8C6575617E7B23459133497EB52A48A692F33FE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	firefox.exe
Token: SeDebugPrivilege	464	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
464	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5144 wrote to memory of 464	5144	firefox.exe	91
PID 5144 wrote to memory of 464	5144	firefox.exe	91
PID 464 wrote to memory of 2056	464	firefox.exe	92
PID 464 wrote to memory of 2056	464	firefox.exe	92
PID 464 wrote to memory of 2056	464	firefox.exe	92
PID 464 wrote to memory of 3040	464	firefox.exe	93
PID 464 wrote to memory of 3040	464	firefox.exe	93
PID 464 wrote to memory of 3040	464	firefox.exe	93
PID 464 wrote to memory of 3040	464	firefox.exe	93
PID 464 wrote to memory of 1212	464	firefox.exe	94
PID 464 wrote to memory of 1212	464	firefox.exe	94
PID 464 wrote to memory of 1212	464	firefox.exe	94
PID 464 wrote to memory of 1212	464	firefox.exe	94
PID 464 wrote to memory of 1200	464	firefox.exe	95
PID 464 wrote to memory of 1200	464	firefox.exe	95
PID 464 wrote to memory of 1200	464	firefox.exe	95
PID 464 wrote to memory of 4416	464	firefox.exe	96
PID 464 wrote to memory of 4416	464	firefox.exe	96
PID 464 wrote to memory of 4416	464	firefox.exe	96
PID 464 wrote to memory of 4416	464	firefox.exe	96
PID 464 wrote to memory of 6000	464	firefox.exe	97
PID 464 wrote to memory of 6000	464	firefox.exe	97
PID 464 wrote to memory of 6000	464	firefox.exe	97
PID 464 wrote to memory of 6000	464	firefox.exe	97
PID 464 wrote to memory of 800	464	firefox.exe	98
PID 464 wrote to memory of 800	464	firefox.exe	98
PID 464 wrote to memory of 800	464	firefox.exe	98
PID 464 wrote to memory of 800	464	firefox.exe	98
PID 464 wrote to memory of 3832	464	firefox.exe	99
PID 464 wrote to memory of 3832	464	firefox.exe	99
PID 464 wrote to memory of 3832	464	firefox.exe	99
PID 464 wrote to memory of 3832	464	firefox.exe	99
PID 464 wrote to memory of 6056	464	firefox.exe	100
PID 464 wrote to memory of 6056	464	firefox.exe	100
PID 464 wrote to memory of 6056	464	firefox.exe	100
PID 464 wrote to memory of 6056	464	firefox.exe	100
PID 464 wrote to memory of 3116	464	firefox.exe	102
PID 464 wrote to memory of 3116	464	firefox.exe	102
PID 464 wrote to memory of 3116	464	firefox.exe	102
PID 464 wrote to memory of 3116	464	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
PID:5068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {5e505258-7152-49c8-b24b-0def2d209aa8} -parentPid 464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.464" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2384 -prefsLen 27133 -prefMapHandle 2388 -prefMapSize 270279 -ipcHandle 2396 -initialChannelId {e65483c7-a122-43f5-a525-d193f84dc0f0} -parentPid 464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3888 -prefsLen 27323 -prefMapHandle 3892 -prefMapSize 270279 -jsInitHandle 3896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3904 -initialChannelId {e2a6f4f7-1a0b-4ab0-9532-b4801de838b1} -parentPid 464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27323 -prefMapHandle 4100 -prefMapSize 270279 -ipcHandle 4192 -initialChannelId {9dc30561-b95e-4c80-93fb-d873a3d32252} -parentPid 464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.464" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2696 -prefsLen 34822 -prefMapHandle 2772 -prefMapSize 270279 -jsInitHandle 2708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2580 -initialChannelId {5d9615cb-e883-46f3-8ca8-bf3bfbcabf1f} -parentPid 464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1612 -prefsLen 35089 -prefMapHandle 1616 -prefMapSize 270279 -ipcHandle 5060 -initialChannelId {bd54788a-2b6d-4fc1-a915-a190b24b97c8} -parentPid 464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 33031 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {34238bc3-8d9b-4185-bdac-a8a369ae05c1} -parentPid 464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5784 -prefsLen 33031 -prefMapHandle 5788 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5824 -initialChannelId {fb8a95da-fc36-4c58-bd69-94fbea477aa8} -parentPid 464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5808 -prefsLen 33031 -prefMapHandle 5812 -prefMapSize 270279 -jsInitHandle 5816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5832 -initialChannelId {fcaa6b42-991f-4816-b18d-bb11a1604f98} -parentPid 464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6132 -prefsLen 33071 -prefMapHandle 6128 -prefMapSize 270279 -jsInitHandle 6124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6404 -initialChannelId {90fec38f-0a67-4e51-b181-15bc747e680b} -parentPid 464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\AlternateServices.bin
Size 8KB
SHA256 355ae654cdd223db762b560135c4e36708216e45ac75d2a71890f8ab674c74b5
MD5 90299118d71057fc071660bfae9d1bb9
SHA1 0ad09f03748631ab9d40df700a95ba5adafb4650
SHA512 cd8f7c4135aa22f1ec7b3f81a180e51f6b84526eb053517cb79b5582019e4cd93958d65f30238de7b0b8edd22b2dc9af19c7120adb7f8198b6fac887d80319b9
SSDEEP 24:IuhMZFfRy91+f98u9xzdf979BZf9Lq9VvEf9C9FAf9g39l8f9:Dc80lXZFLIBswyU+
TLSH
T14D026FE32F76A462F1928FF48068798C9C3303251A799584C60490FB07C2BE9913FFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 86869188617d32a3fb38027d1a4dc7760e01aa202c4157786fc8af26a0e531fb
MD5 bde5ef22a8d8a58af80a0514858ac68f
SHA1 d81cf99b3311aeef6dbb5358043bdda036cda5c1
SHA512 ee0df35d9aa0f21bd5f2f0fe67083a133eb8cd2f3fca2e12e0bff137356822a1d9031300ae065b90cb65da0d9178f10b56abf6de7ef54e6f1a492c095b0e8cbc
SSDEEP 192:DwWwPOv5zbo7hZUwWlyj7wZxj1d66JoztdzgCl6mc0dz:Nbo1Zslyjwd66Joz/zgC1jd
TLSH
T1E6E1FE54F638863BC455023BCDA61B840E36388AD84E6F2971AC700D3D972DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 e79e76d4108df67c0faeda04471ec12a6b1a6be3b878a5ea94f92ca4ec6a1935
MD5 90847317bd41d133fdd739b80500a181
SHA1 4edd0377025cb8731c47f21f592a05a3cc001cf3
SHA512 dc762dceb20334aaaf71a7cf0f86d9966c2f3561a3b0095e1a5f4cc77761f26ac58572cb693f6580201de2cdadb8a06b338d57f7ea913f92a23650f447c89ca6
SSDEEP 96:xFK2FZF4F7FW/dd66JoztdzgClKtmc0d/UjwWwPSdF95/7bkW6ArcEUwWlyUR671:t1d66JoztdzgCl6mc0dYwWwPOv5zbo8R
TLSH
T169C1DD64F638463BC855023BCDA61B800E76794A984E7F2932AC64093D972DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\events\events
Size 1KB
SHA256 73cbab55dc50ec544edf87f0d280fe0617f993a2166f410a80a71a60f7720bf5
MD5 ad03ef6afe82a09b55ba4258c7d012e3
SHA1 4e087edf7417ca19ef141c460b5bba739fd6b69f
SHA512 86b4ea56f5f7d9f14a712bb91e94eec9cd4d4b27e144c0747fb89ecd5bc044bab4ad16d9b8bbbb870b4b68e0ceca3c79c01f1906024626625e3590aaa3007a79
TLSH
T10221674C3DB88D6A5DC7E39CB4812E8E53554E060A871D430D52EE8CCEC1BDA326B838
MD5 SHA1 SHA512 TLSH

Submit Download

0affc9ab-f2d9-48c3-9e08-cafcbb3f5e52

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\0affc9ab-f2d9-48c3-9e08-cafcbb3f5e52
Size 6KB
SHA256 59694608e7948ce0c53fb41d8973d639be29b6a2b024cbc727066338ecb661bb
MD5 46e4814a9097095531cf1d22ffad37ad
SHA1 4daa43da15992ce847f8379f68083a4694ada309
SHA512 ec2d5c6053d72000a966fb8692ed603c766338545c959709c63165e7edf6a76d03b4b3c3e9f565f5d607af2ebe936030f67fec9510839495de9455b5ced40a49
SSDEEP 96:gvMNrUkmNedvrXnpfEsVHkp/3/wVmMwsQjqMvB45Cb0DzYHMMnbV7wk/fqh4+b9j:gvobTYOzS2Pp
TLSH
T111E1BAFEDD2240433A69F52EF5A8BEAF005A293149C8879D6BEC4C3A32D6DB71517301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e001bdd-018c-4234-a665-13b60a0c96ab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\0e001bdd-018c-4234-a665-13b60a0c96ab
Size 16KB
SHA256 736dff0a3bb2dac475e08eaf7c9e3e4a61084c1aea1bf944501797ff440c4f38
MD5 f34572c81ba9fe6754e911390224d3dd
SHA1 0d50d5533dfb9bbb83645d807dc8696be8efd21d
SHA512 b7ab2c5be81718e1610ace7dde667b929c0936d7eb5dfc1996ce12f724c0fc89ce5b14f673965ec00f7a40f3019aea043fd7293a06278b92cf429c3e9da861dc
SSDEEP 192:IZJaxquxIhgTyuXMniu2iqKkY14I7A91JTEAoy8BR28a86woGya38brvtzxixJEn:lYuWlLUSy8W8a86Ip38brvtlix+wS
TLSH
T18772CA566820457A8291E769D4F87FC3E1F528CF4C419FCE9BE4BE086DDA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a93b417-3a0e-4daa-b451-d81dce7532a8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\1a93b417-3a0e-4daa-b451-d81dce7532a8
Size 2KB
SHA256 0282add60189c9f4105413af2fc48e5773a698d4cb4d706d08de81de8a667196
MD5 526d0401a9f1ab7543bf3aa44845dc01
SHA1 e418fb899aec9917f960c95534c63468dd8967e0
SHA512 7bc7a6dab8bfdabf622a9c8e92a9161b5909c3cb5318485eddd0968fe827defacb7b02b86e265aee70c31bdc4c1c9e3229731ac5e3c3694fb9c0995371205216
TLSH
T1E641345C3A784CB78CDBF15D9581339E9764964700C518432E62EF0C8E967AE33AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

1dc9bad7-3d16-4997-92db-ae56062b9eac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\1dc9bad7-3d16-4997-92db-ae56062b9eac
Size 883B
SHA256 60cc3aaf24987e403c27971f827453290d90aa265fdb80f02037047338d5e6c9
MD5 7414f3259b7db8d8f19c8da5c68720e2
SHA1 f6015d22b8e3fe5a130508ee39fc9de771c24bed
SHA512 7ad538b0a9c0b27253769c2bad1453dbf829e6e4b8b069c6611270485e06a2b5206c58e4eb8183f886ffdbb62413831797aed10b982811db8345dbb96b57ee37
TLSH
T175112380D630B9B2CC78920F8AD1778197F4F51380CA94143EF26E080EBE72EA75721B
MD5 SHA1 SHA512 TLSH

Submit Download

44bc1005-479a-4b6b-94c1-ad736596164c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\44bc1005-479a-4b6b-94c1-ad736596164c
Size 235B
SHA256 0f64c8e2d4d1f5c1b96dd088cecabcaaa4e755b09724ba4dbb8694ad6a7cf39c
MD5 3080523aac93209f7c49f0bccf0b9699
SHA1 606e05132b5b40f86f1c185c39405fb01302f6aa
SHA512 76f6135fbeedd50d02518c293319bb8702d47a7203a76c808b59aa397f4994387b202ba254b05ebbbe8139b0f49e6cf3ab7efce841acd2a415a59498908e2a10
TLSH
T128D0A7C954A8776E58141F07F0F06AD6314D8C3755649C10996145789AFDEC482A2C1B
MD5 SHA1 SHA512 TLSH

Submit Download

59677b6f-f06c-4c6a-a81e-df41d5073c18

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\59677b6f-f06c-4c6a-a81e-df41d5073c18
Size 886B
SHA256 8bd631e8f285ef9a19678b1e90b391134eb091a3600aa6109056cf72c8a49633
MD5 ced4a99c347ca6c8eaa2e5a4cf104566
SHA1 1f7833961d5bdcc00b3686a27d0df0586bbb5f08
SHA512 518918057e7f9878c76788e7c0b021e430bfaafdd6150b406c1b5fd7611539338ff8d6d7cd55aac03cea99fa681c48aba369e3bc5d28e298b5330367eb2b407f
TLSH
T1131100809534BAB28C78925B89D1B79286E4B01380C589142E61AF080EFA22FA29261B
MD5 SHA1 SHA512 TLSH

Submit Download

fd2d0f19-a807-44ae-9b14-0ceaa18b51f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\fd2d0f19-a807-44ae-9b14-0ceaa18b51f7
Size 235B
SHA256 1ef5da6702fddfe1780f04b1f44c4c1c1257ae07c7a869c89b6bc3127caf03f4
MD5 c1729b182c4fc5884d7584973c0ac024
SHA1 bd413ed8e4f2d174c2b5ae4998b87fd28212a75c
SHA512 08c5e51ec392995959ea4892c212d443cc2873e0642f0cd54d255d269b465d4b7ca290a0a7c02e0eb198c84982860b4fff9ed22d8808084e4891f513c2be68cb
TLSH
T1F3D097C0288CA71C08040F07B0A0A9C630848C3728B0A82099A040788DFCAC9419180B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 6KB
SHA256 da386424b83523486562e57f3b57e47d368131580bec020bc61fe0acd9b50fb4
MD5 f061483b8f3e3dcbba890c332ec60e21
SHA1 48b7d97cdab25c8c514247de0ef75cf4dc15989e
SHA512 4de6c019944f6293bd79ba0c278c820d647afa4395e34ea4ad292e3836eb202d079b28bbc29bdce6904fa65c5b53576f96d59678baf99a1448efbd82ee1492b2
SSDEEP 96:xHLUTUhRqGqUfjDCkzSTSSlcdv9jl2nTRH0wkysLBw88u8L4cndBOsGS:B+RUfjDCFSSkk90wkZBw88Rh
TLSH
T12DE1117854088F7F68B6776CAC688C716AB2013B7BBF68D750B55484015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs.js
Size 6KB
SHA256 ea00de8177b03d8441580147998687d7dcdcfeb84ed0f600fcda6e791a7e3970
MD5 9a2ebf36bf50528ea342df366b65bb17
SHA1 37c7dcf368fc0dd87e0768b56c21c8cc65897d74
SHA512 49fed74ff45c862872a3bf4e2ef0af96f49fd624944ea93c4b8f1fe6981921a20474962cd5afff165378e45832341c57740a49c01ca9099e651c29334c292008
SSDEEP 96:xHLUTUhRqGqUfjyq1zSDbSSlcdv9jQnTRH0wkysLBw88u8L4cndBOR:B+RUfjyqWSS190wkZBw88Ri
TLSH
T18BE1207895088F7F68B6776CAC688C316AB2013B7BBF68D750B65484054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs.js
Size 6KB
SHA256 44fa3abb35d69a6790308f1b249887d2a7b5553b201869ada6c156c43cd5c689
MD5 af221ffb1807194fa1cb9c9ca391a368
SHA1 22221fcd97c48681c12000502d5a4b4179156a0a
SHA512 32dcb524e5da22dff1ef3b567a4155c7d9eb1b142e2f7ace32bd98d5aa4b87a01ebf86e518f5e817093c3e3125fedc1b09c82074ab232939ea36f7daec53629c
SSDEEP 96:xHLUTUhRqGqUfjDC1zSTSSlcdv9jl2nTRH0wkysLBw88u8L4cndBOsGS:B+RUfjDCqSSkk90wkZBw88Rh
TLSH
T119E1107854088F7F68B6776CAC688C716AB2013B7BBF68D750B69484015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.1MB
SHA256 16b09608e77436771bd0772f03042b17e4fdb1ec5b7798791c7554730e363446
MD5 7e9b4dfc8a9b4f0170ea5636a84a2809
SHA1 a82dc486f71e45a047b5ecffa4634ff5a22295da
SHA512 35660698c4c234c1685e14f8728e416ecbd7cb65c083858c8d093301cef4f8f43d056aa86d9ec9bf032e7d7babe330c7b0b8b2bad1b8f10ae02833ef58ec8243
SSDEEP 24576:Sfs/I7RzUEDUncDBUUx2AXYVpY+61Y4z3CoMZZxp17OPT90LecLEZgWj8f:Sfs/I7RRIce5YYU+61Y4eoMZHp120L/
TLSH
T16D362AF820D1A257F3814033664593EF21EFD00C6037DA085BA956E9A578CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5068-16-0x0000016F02190000-0x0000016F021B0000-memory.dmp

Download

memory/5068-20-0x0000016F02220000-0x0000016F02250000-memory.dmp

Download

memory/5068-0-0x0000016F01430000-0x0000016F020C0000-memory.dmp

Download

memory/5068-24-0x0000016F02250000-0x0000016F02270000-memory.dmp

Download

memory/5068-12-0x0000016F02480000-0x0000016F02680000-memory.dmp

Download

memory/5068-4-0x0000016F020C0000-0x0000016F02150000-memory.dmp

Download

memory/5068-8-0x0000016F00570000-0x0000016F005B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads