b39e6080e8acf9a406f181c5e3495d1c335feaef5629a771dd948db86de7eae0

Analysis

user interaction
yes
max time kernel
298s
max time network
304s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
waif_v4.5.4/Release/player models/player_ct.skindata
Size 1.2MB
Sample260730-xt72zsec43
SHA256 b39e6080e8acf9a406f181c5e3495d1c335feaef5629a771dd948db86de7eae0
MD5 13cff49c9d0b5798db64cb47a7bf2175
SHA1 6472256d88c66f0d499b80b0233bc8a8a0197355
SHA512 9c4bf04b8fd1c25881046a07fd915c987ff45ee4f7c997ed565d0b8c399c059e102e30a5197103480b5b645f617460bf68132684281741cb5a0ab40531a7b4ee
SSDEEP 24576:/OgMHi/14zOgMHi/14zOgMHi/14inXZhJ0HEqCWDkXjwRlvvx7lm:/OgMHi/14zOgMHi/14zOgMHi/14iXZh8
TLSH
T1EA455965DC27467CD4B52932006B5F19E6B8E1AE91B418371331FAAC3CE071F49EAE8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4384	cmd.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	firefox.exe
Token: SeDebugPrivilege	960	firefox.exe
Token: SeDebugPrivilege	960	firefox.exe
Token: SeDebugPrivilege	960	firefox.exe
Token: SeDebugPrivilege	960	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
960	firefox.exe
960	firefox.exe
960	firefox.exe
960	firefox.exe
960	firefox.exe
960	firefox.exe
960	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3628	OpenWith.exe
960	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 1020	3628	OpenWith.exe	91
PID 1020 wrote to memory of 960	1020	firefox.exe	92
PID 1020 wrote to memory of 960	1020	firefox.exe	92
PID 960 wrote to memory of 4332	960	firefox.exe	93
PID 960 wrote to memory of 4332	960	firefox.exe	93
PID 960 wrote to memory of 4332	960	firefox.exe	93
PID 960 wrote to memory of 4244	960	firefox.exe	94
PID 960 wrote to memory of 4244	960	firefox.exe	94
PID 960 wrote to memory of 4244	960	firefox.exe	94
PID 960 wrote to memory of 4244	960	firefox.exe	94
PID 960 wrote to memory of 1912	960	firefox.exe	95
PID 960 wrote to memory of 1912	960	firefox.exe	95
PID 960 wrote to memory of 1912	960	firefox.exe	95
PID 960 wrote to memory of 1912	960	firefox.exe	95
PID 960 wrote to memory of 1120	960	firefox.exe	96
PID 960 wrote to memory of 1120	960	firefox.exe	96
PID 960 wrote to memory of 1120	960	firefox.exe	96
PID 960 wrote to memory of 5420	960	firefox.exe	97
PID 960 wrote to memory of 5420	960	firefox.exe	97
PID 960 wrote to memory of 5420	960	firefox.exe	97
PID 960 wrote to memory of 5420	960	firefox.exe	97
PID 960 wrote to memory of 1196	960	firefox.exe	98
PID 960 wrote to memory of 1196	960	firefox.exe	98
PID 960 wrote to memory of 1196	960	firefox.exe	98
PID 960 wrote to memory of 1196	960	firefox.exe	98
PID 960 wrote to memory of 1440	960	firefox.exe	99
PID 960 wrote to memory of 1440	960	firefox.exe	99
PID 960 wrote to memory of 1440	960	firefox.exe	99
PID 960 wrote to memory of 1440	960	firefox.exe	99
PID 960 wrote to memory of 2728	960	firefox.exe	100
PID 960 wrote to memory of 2728	960	firefox.exe	100
PID 960 wrote to memory of 2728	960	firefox.exe	100
PID 960 wrote to memory of 2728	960	firefox.exe	100
PID 960 wrote to memory of 1604	960	firefox.exe	101
PID 960 wrote to memory of 1604	960	firefox.exe	101
PID 960 wrote to memory of 1604	960	firefox.exe	101
PID 960 wrote to memory of 1604	960	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4\Release\player models\player_ct.skindata"
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4384

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4\Release\player models\player_ct.skindata"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4\Release\player models\player_ct.skindata"
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27098 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 1908 -initialChannelId {3ab72de6-fa92-4ffb-9f48-d23d05da94e5} -parentPid 960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.960" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27134 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {f91abc33-7492-4658-a811-f743c598ace8} -parentPid 960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4244
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 27274 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {bf784baa-263a-4615-adba-3e505da4b83a} -parentPid 960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3984 -prefsLen 27274 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {eb699655-5e51-4a86-9acc-dbd1deffd157} -parentPid 960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.960" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4372 -prefsLen 34773 -prefMapHandle 4376 -prefMapSize 270279 -jsInitHandle 4380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3128 -initialChannelId {e544047e-491f-4cd8-a7fb-bb85bd176de5} -parentPid 960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5420
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5256 -prefsLen 35010 -prefMapHandle 5260 -prefMapSize 270279 -ipcHandle 5108 -initialChannelId {5bc36d8c-7442-4f20-a73e-d1885ac4394b} -parentPid 960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:1196
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5744 -prefsLen 32952 -prefMapHandle 5736 -prefMapSize 270279 -jsInitHandle 5728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4940 -initialChannelId {e1c1bc6d-da35-4607-bd5c-a08c6c700264} -parentPid 960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1208 -prefsLen 32952 -prefMapHandle 1624 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2832 -initialChannelId {80eba73a-e415-4242-8df8-190ef24c9299} -parentPid 960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2728
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6044 -prefsLen 32952 -prefMapHandle 6048 -prefMapSize 270279 -jsInitHandle 6052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6060 -initialChannelId {04dd5488-36cd-439b-bdb7-67e16d958e37} -parentPid 960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 aaca49e62e7490c1e03e666ef5aebca3305f91dfe66822b2c61357e462f899a6
MD5 49362879f58942bcb996774159763b73
SHA1 c893a57fe9c5ac528710e153fbe4857609e25af0
SHA512 d9857bac9f9475ab7c8c421f054e1c1c9e793fc3c7f0c4141b92639fdc26cd02d98a5940bf8260b34453686d0764d1750533c01bd3b5c757c41a2388154621f4
SSDEEP 384:HwCe7iO024Y7DL84KKDL849B7SOEAd9KVRaAcP+AWRMAWm3:QqZY7DL8lKDL8CB7S/AmVAf+hRMjm3
TLSH
T14A729D399F013CAC19A7C0E8C4F952D98C19B7A3CFE6806D25683D0DCA98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d295a94-45d0-4f8b-b02e-d82abcecccdd.zip

Path C:\Users\Admin\AppData\Local\Temp\5d295a94-45d0-4f8b-b02e-d82abcecccdd.zip
Size 3.7MB
SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
MD5 3850f642d336e5b283975359ae18e3d7
SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
TLSH
T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b6c880ee78df4a0355b95eb0d9c45a5d61acbcb9336288ef680c36d624bed052
MD5 0eb40e18c253071b83df2f2563989e1f
SHA1 d441e1eb91a5d54a52df9f7eaee06e570ef0fce3
SHA512 7c07565d3825e17fefa52c04b7ac5ff20f00609ea69031862d33ec7ef80a81495f87dd2bfb50211607505a1efc6fe849f2b0b1bfe988af0addfb624787ff405e
SSDEEP 192:g57kvl1d66JoztdzgCl6mc0dGtOv5zboiNZCQyjjUy:Hd66Joz/zgC1jYCbosZCQyj9
TLSH
T15AE10FB4E628467FC408427BCCA60F444F35388A9C4E3F1935AD654C2E5B2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 d06fcb86a4a88ac9cbf946000c91f2007c8e908e13beaebec1f117aace7f19f6
MD5 e6165bb347d494550a44ca4741318246
SHA1 24a5e06a47045f3ca4c5c7afdbdc6cf558960844
SHA512 bd5e4711f005ab4453577201a00c8e85975f0152486fa1f141f09fd7c7286c17944e055e738044acd350d28b7d4f02e17d3dfd94872e325efb29d040edb30d8e
SSDEEP 384:ZYCFCjgzoGcm+ur0yfYeKDVQVkbxbMv2d66Joz/zgC1jDCboICQyj9:ZYs5oGcm+urjXKDVQVkbxbcX1E1u
TLSH
T1A2B21094F72A913FC41552BBCCA60B041F79B88A580D2F5B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6c08c5aee3ed15d435787b61c1d6218e62fc4fe6cf9afd94a3811cb4e7329ac3
MD5 979a47093011f67ba0ecfed56d13c002
SHA1 5e5868351ef6e854e3bf204a67d349d693c07561
SHA512 d51882573234315cca5ed2123e21caf9f2f4ecfa62b346ba90dbe650584d2764012ca724edfdfede5abe8747d874fae870e657a3f91cecd01b9da49620b576df
TLSH
T11F21674C3AF88D2E6AC7E3AC7441098E53958A4285871D874E02EFCDDE91AE9316E439
MD5 SHA1 SHA512 TLSH

Submit Download

0701121d-1ddd-4543-8f69-db593aebc814

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\0701121d-1ddd-4543-8f69-db593aebc814
Size 235B
SHA256 546c218a74ac21e6a26737c9f2413ff2772fb1f8c74fdc0f707e99965ed66219
MD5 7a34c4c67d686bd31587c6db24bee6a0
SHA1 a47f9bba98a143851eb0ff59b9092519951c00aa
SHA512 39e69d6919f6f53940e322d84974fb701cb8413fc1247150978840598bd09981f306308c2366218d380ba4ccb046bf19151a470456862dab272babde1b2d9e00
TLSH
T1B2D0979038C86FAD08288F07F0A029D630584C33246458208A6544B9EDF9DC88222C2B
MD5 SHA1 SHA512 TLSH

Submit Download

11a75bc7-cd62-4804-ab19-94695d428c10

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\11a75bc7-cd62-4804-ab19-94695d428c10
Size 886B
SHA256 6729cd9a3192018a9bf5f63c4c1efa69fb5e06102d2820732a9839a83a1eba1e
MD5 73935f71e14d636ee2df91a63a210e76
SHA1 42a53c38294917e29f07290337c31a57dc865387
SHA512 911242e3463fbd928015b9d79093c266fe1a6d31bec39728dac4ba25aff5d086d7568c5e1396757fc1311e2488c4e4343ff8e7a0e359f23a8e20f4e4939cc55c
TLSH
T15C11C8A186247571CC7C969F85D13B475AE0745380C544087DA55B184FBA11FA3D9617
MD5 SHA1 SHA512 TLSH

Submit Download

4bd2c1c4-c72f-41f2-a513-f5a7744a8a5a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\4bd2c1c4-c72f-41f2-a513-f5a7744a8a5a
Size 2KB
SHA256 fb4cb392a46cba7e333e2d22d3ce3473ef6db66090476bf78633a8e51ab12be3
MD5 2452bc235d2a4cfb1a9149571ea40d0c
SHA1 d49240863fe83312bfefa90c84a03fd069b35970
SHA512 33e61c03e7c8e827c24c7232edf2abf3dbd135e1ed1d77c4f40a7da029eaac765a9c3566b7f87733c259d85501965224ecd7b367c5ffad78677649ff9061f43c
TLSH
T19B41336C35B85D768CDAF54D909223DE97B08A03108628432E91EF0CCEA275E73BE51F
MD5 SHA1 SHA512 TLSH

Submit Download

840ab62b-fcfd-49da-89f2-db8a7292767b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\840ab62b-fcfd-49da-89f2-db8a7292767b
Size 235B
SHA256 d7637dacda30b6354eb5b3a60df032d97bc799552f392a945747e6388d143dad
MD5 b4e6f43928d82ef6ed1c7ad7df8bd0d2
SHA1 9b84bb1fb89e9b1145fa137457581b0e3630a729
SHA512 884558663d3bdbae4d778896426d9025ed0830586b97529ee23be4babd67555f9d334edededb4e039871a6c35a386509c2b94b8699a9c4bbe35da6eab711cb15
TLSH
T15AD0978014983B3D08101F62B0B02DC6308A4C3760B0E810E99003B88AFEAC80222907
MD5 SHA1 SHA512 TLSH

Submit Download

881830b5-4e78-4bce-9d03-bcee27f28b42

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\881830b5-4e78-4bce-9d03-bcee27f28b42
Size 883B
SHA256 268722de5bc414dc5518c8e7e528e305d88503057a60992058cefbea7077edc3
MD5 0b199988666e3e0905edf1763e4578aa
SHA1 a3fe4004cd7d25d81258ce66b9869028d6981616
SHA512 5a46a31858ebed7a61794df4572faade85b7554b0e54d976afa9d925f84b5b4889c41fbbf11b492ec70dbcd61fb068241c6a785fd60a4ba3d58e1455fec4d3c9
TLSH
T1BE1104D1963075B2CC2C824F84963F569BE4781380C550043DE15E144F6E60FA3A9717
MD5 SHA1 SHA512 TLSH

Submit Download

a423d5be-2ffe-454d-999b-b1f413789358

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\a423d5be-2ffe-454d-999b-b1f413789358
Size 15KB
SHA256 082eed83775de37e2d39915a48063fa7432cb36940e3fb527ea8d3a9bacaeba7
MD5 31e081fcb1bce01c36c3e8c0f53e668b
SHA1 c654f6cfe47b6e9e7861a1e17b0fc51297da1afb
SHA512 a14215b7aeeb823e82096f22e65e452628fa7cbb61c106062f1f0225954a18b4446a99637fb817ff8aa41052b04353b0d0c06bd6c3ac3ef406827c572fbe6ac3
SSDEEP 192:J9IwZMkhDjhQLzNDZ8sRrBIq1Aey97Dn3zT1qZ1gOMBTaEuz9CiKybGwXod460JI:Nh2fqMPi/n3zwyD5MhCiKybGwyJp
TLSH
T1D962E9666420497B8551E36CD8EC7FC3F5F518CB8C029FCE9BE4BD086AEA09E1127847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\extensions.json
Size 16KB
SHA256 d40e27a91a2ea2da86ec660ac33353cd62bf973d52bf5e5429305a08e1d603d3
MD5 a8b824d7530ed6815a1c37d0aeb3e674
SHA1 bcfdb44c378ea325f744b0617d42455504d5dce0
SHA512 fbd0c170bcd85d319763b73ab507549725746d8e2340edcb2eec1db13098275a2bf1e9028a8704af6633bb3608366a37d9c556050b88cdfbe626dbe2a7d2c759
SSDEEP 384:LkI4vUUmldvS8dhWp94z7j96ohiL4HsL4PoL4HFL4HwL4HWx4hA:4I4cRfHXY4Z6N4G4y4F4S4a4S
TLSH
T11A72441545049EB8298FA79AAA367D02C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 6KB
SHA256 db67ba47483df09362787d3d5a66ff18e7ae8b37c9641c997e64c795e58f363e
MD5 0385c9e350872bd0ee2cb077c8dacf01
SHA1 50de39a38d92a93d45296433627633c90ebff058
SHA512 b92660fd09e1912d3ed2b56017e74cd46a93df20bc27e8847d047c8b3e4183cde39685fade83b5a43d5f7fada4d7cfa651009e15ac1ba4d91ece2fa7b805847d
SSDEEP 96:xHGqUTUmK4qGqvfqiwh1zSIGSSlQdv9jGnoRHmBw88u8L4cnSqoL0:oqWKTRvfqicxGSSE9mBw88nZ
TLSH
T1BCE1107890188F6F74B6776CAC688971AA72023B7BBF68D710B55484450CF3482F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 8KB
SHA256 bb554c080a625b082206021ffac69c80cf30623d34f020c4202028baf3829669
MD5 8e5d0dbb1304f7ae60177b547593bae1
SHA1 c2bada6cf1f3214eb6f5cfe76a600b7bbdbacf50
SHA512 0226db93c67f747f88ed6ad040f13a759a68a5e1ce2bb39e5d97e539786cb24dce79feb98d37746f1a8a0366e3877f4c644f1d0599c583f417a99eef4e120b87
SSDEEP 96:xHvqUTUmK4qGqvfqQnObzSCdSSlQdv9jsnoRHV/Bw883F8L4cnSqoL0:lqWKTRvfqQneSSG9JBw884Z
TLSH
T1D7020D3855049F6F75B6376CAC6489715AB2023BB7BF68D710B994C4050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 12KB
SHA256 e2c048bb7ac7b0547a9d18ccd2c2b003ca6cf793944a836d6255291ae998420f
MD5 fe7ff440b4b9db34638bedc54fd37d93
SHA1 504bb584a338965b9d3dc6bbd5ce11afc5fb7b86
SHA512 11ac04ddc0f0c9a90b7568cecf128eec560b50d096f36f1dff927ba65152bd9039015ee1ec8eef97864bcceb69f44f9afc9afeaa272720528c61d87f38567810
SSDEEP 192:lqDKTRvf2QneSSGXLRAiOBw88vdWKLYfp:OKNfRGwl4B
TLSH
T15142AE38A1448A3F25F6367DAC258DA01AA14237F7BFBCDA06FC94D1544CF2441E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 6KB
SHA256 a4093c9233cd03379de3c5875cf8f56b22d0d8eb38fd59b2cc82dfdaa5e08eb8
MD5 d0e585d60a171e885ccc8bdb1ceb0d36
SHA1 5f63e48a378a3624ca5def5d1450c3a3056282ae
SHA512 bbf6eb3c56e60fe78511f03881b73c712c9f7825e3faeb8578094b85d0f72fe0013704bb6e0a4c031c88e3b10246901c0ee2876c271bdcc8dc6e77eda89f789c
SSDEEP 96:xHGqUTUmK4qGqvfqQn1zSCdSSlQdv9jsnoRHmBw88u8L4cnSqoL0:oqWKTRvfqQnlSSG9mBw88nZ
TLSH
T145E11F7890188F6F74B6776CAC6888716A72023B7BBF68D710B95484450CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 5c7078deeb88ed2503d78b789b2046695b1942443dfc8e73c1e72e342acab433
MD5 77b8f926ca30f4c3accc66bb9277788a
SHA1 fb99951de6010347d5bf5c216321facef9564ad4
SHA512 754ec6207e2fdd9af6d8c4820cce8237429349afb1bfa1147daca22ff4479ab73be11723934a1d4f7c9025b9d8c9629c9770cbb35ed62c1678012d34712ecc66
TLSH
T16B21D6D3692A2FF3B311C559A8444FF683A430364A300CB0DA8A875239AF859F386149
MD5 SHA1 SHA512 TLSH

Submit Download

c3JM_WuH.skindata.part

Path C:\Users\Admin\Downloads\c3JM_WuH.skindata.part
Size 1.2MB
SHA256 b39e6080e8acf9a406f181c5e3495d1c335feaef5629a771dd948db86de7eae0
MD5 13cff49c9d0b5798db64cb47a7bf2175
SHA1 6472256d88c66f0d499b80b0233bc8a8a0197355
SHA512 9c4bf04b8fd1c25881046a07fd915c987ff45ee4f7c997ed565d0b8c399c059e102e30a5197103480b5b645f617460bf68132684281741cb5a0ab40531a7b4ee
SSDEEP 24576:/OgMHi/14zOgMHi/14zOgMHi/14inXZhJ0HEqCWDkXjwRlvvx7lm:/OgMHi/14zOgMHi/14zOgMHi/14iXZh8
TLSH
T1EA455965DC27467CD4B52932006B5F19E6B8E1AE91B418371331FAAC3CE071F49EAE8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads