c3bf851d34f9f658eafa66448af4602d874fc88f836cbda94189e973532efe2f

Analysis

user interaction
yes
max time kernel
299s
max time network
308s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
waif_v4.5.4/Release/player models/player_t.skindata
Size 708KB
Sample260730-xt72zsec43
SHA256 c3bf851d34f9f658eafa66448af4602d874fc88f836cbda94189e973532efe2f
MD5 6c179150b792565ed9ea924e775e5950
SHA1 3b5440fa0c7fca005b385d2d267f546d6dc2d5c7
SHA512 857bfab876352fcf1f67d2c8b51ac1314ee16018297114cda11a0d10100a78f77562cc3c8df8d97b9649713f342aca9fe2d67b96876492dc3c266b9752bb2bb9
SSDEEP 12288:PxggxL8zLC1Gyb9L+QjOxUsO2ZFCkCX30o9Y/oSsNz3cu:pgSL8z/yd+QjmUKCkCXk/oSsNz3c
TLSH
T178F43957B8539B3DC1BD02B180FF0E6A993E8945891229B3A33995583EE371B75C37C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
708	cmd.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	firefox.exe
Token: SeDebugPrivilege	2724	firefox.exe
Token: SeDebugPrivilege	2724	firefox.exe
Token: SeDebugPrivilege	2724	firefox.exe
Token: SeDebugPrivilege	2724	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2724	firefox.exe
2724	firefox.exe
2724	firefox.exe
2724	firefox.exe
2724	firefox.exe
2724	firefox.exe
2724	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4264	OpenWith.exe
2724	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 5224	4264	OpenWith.exe	91
PID 5224 wrote to memory of 2724	5224	firefox.exe	92
PID 5224 wrote to memory of 2724	5224	firefox.exe	92
PID 2724 wrote to memory of 6076	2724	firefox.exe	93
PID 2724 wrote to memory of 6076	2724	firefox.exe	93
PID 2724 wrote to memory of 6076	2724	firefox.exe	93
PID 2724 wrote to memory of 2636	2724	firefox.exe	94
PID 2724 wrote to memory of 2636	2724	firefox.exe	94
PID 2724 wrote to memory of 2636	2724	firefox.exe	94
PID 2724 wrote to memory of 2636	2724	firefox.exe	94
PID 2724 wrote to memory of 2700	2724	firefox.exe	95
PID 2724 wrote to memory of 2700	2724	firefox.exe	95
PID 2724 wrote to memory of 2700	2724	firefox.exe	95
PID 2724 wrote to memory of 2700	2724	firefox.exe	95
PID 2724 wrote to memory of 4868	2724	firefox.exe	96
PID 2724 wrote to memory of 4868	2724	firefox.exe	96
PID 2724 wrote to memory of 4868	2724	firefox.exe	96
PID 2724 wrote to memory of 4208	2724	firefox.exe	97
PID 2724 wrote to memory of 4208	2724	firefox.exe	97
PID 2724 wrote to memory of 4208	2724	firefox.exe	97
PID 2724 wrote to memory of 4208	2724	firefox.exe	97
PID 2724 wrote to memory of 3924	2724	firefox.exe	98
PID 2724 wrote to memory of 3924	2724	firefox.exe	98
PID 2724 wrote to memory of 3924	2724	firefox.exe	98
PID 2724 wrote to memory of 3924	2724	firefox.exe	98
PID 2724 wrote to memory of 4240	2724	firefox.exe	99
PID 2724 wrote to memory of 4240	2724	firefox.exe	99
PID 2724 wrote to memory of 4240	2724	firefox.exe	99
PID 2724 wrote to memory of 4240	2724	firefox.exe	99
PID 2724 wrote to memory of 4084	2724	firefox.exe	100
PID 2724 wrote to memory of 4084	2724	firefox.exe	100
PID 2724 wrote to memory of 4084	2724	firefox.exe	100
PID 2724 wrote to memory of 4084	2724	firefox.exe	100
PID 2724 wrote to memory of 4100	2724	firefox.exe	101
PID 2724 wrote to memory of 4100	2724	firefox.exe	101
PID 2724 wrote to memory of 4100	2724	firefox.exe	101
PID 2724 wrote to memory of 4100	2724	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4\Release\player models\player_t.skindata"
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:708

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4\Release\player models\player_t.skindata"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4\Release\player models\player_t.skindata"
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {86016584-42f9-460f-9192-c59d1217e0b5} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:6076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {5464104d-0dd6-4ad6-bf41-7f941f8d2192} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:2636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3896 -prefsLen 27274 -prefMapHandle 3900 -prefMapSize 270279 -jsInitHandle 3904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3912 -initialChannelId {c030ac2d-ac98-43eb-92e6-0ef5b30281c8} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4064 -prefsLen 27274 -prefMapHandle 4068 -prefMapSize 270279 -ipcHandle 4140 -initialChannelId {546126c8-3d68-4b38-b3f7-18f9b82c801c} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4384 -prefsLen 34773 -prefMapHandle 4388 -prefMapSize 270279 -jsInitHandle 4392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4400 -initialChannelId {11085f07-e156-4cb7-a8ab-c7e4fbb2469d} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4208
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5232 -prefsLen 35010 -prefMapHandle 5236 -prefMapSize 270279 -ipcHandle 5244 -initialChannelId {6058e5ce-acf8-43a4-9764-acd5bf5a5d9d} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5432 -prefsLen 32900 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5448 -initialChannelId {709d513a-b6ec-47d4-89a4-6046b71ee32f} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5488 -prefsLen 32900 -prefMapHandle 5492 -prefMapSize 270279 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {80537150-c890-42c7-b3f9-777f60e0d434} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4084
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5824 -prefsLen 32952 -prefMapHandle 5828 -prefMapSize 270279 -jsInitHandle 5832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5840 -initialChannelId {b40384bb-e512-4827-bc1a-4e08660230dc} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

26087

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\cache2\doomed\26087
Size 16KB
SHA256 9ef22965afd4fe827b553ada88eec441daefe739ca5704143a4c79d22ce145a6
MD5 2c01456af7148c41a0248149e1669448
SHA1 05bf90080147f7ceff08085fa2f357bc9bd1fbf5
SHA512 a1b561a2133161674239f5e5089e3e021fb3ddc66669ad1058ab89e8fca3ebb7841ceb1d8c5551094f2ad222a0a062c9f2b8eda932bec0e980d9fa0984d234f9
SSDEEP 384:HXuz9YiO024Y1DL84KKDL849B7SOEAd9KVRaAcP+AWRMAKViVP:3ajZY1DL8lKDL8CB7S/AmVAf+hRMtVit
TLSH
T19F729E3E9F413CA81953C0E8C4F952994D0976A3CFE6C06D255C3D0DC6A8A6AB4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 26fa0a87bc49c14ba05c404edc2fec81e4119af91590bb68b0503471d9548cc9
MD5 b415ac8aa21366b35ed262adf7c70c21
SHA1 a24b9d3c6347440884935184eb85ca32d599f349
SHA512 df547e20b2f3e37fcbef565d440d935a0027d2f8dc117acf271cd069cca910935c99626a9eb2066bdba4cacbf2ce3fa34949a6caa66f267eb763bd74862fffb7
SSDEEP 384:HwCe7iO024YGDL84KKDL849B7SOEAd9KVRaAcP+AWRMACkD:QqZYGDL8lKDL8CB7S/AmVAf+hRM9kD
TLSH
T12A729D7A9F013CEC1597C0E8C4F892D94C18B7A3DFE6806D25683D0DCA98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2daa6e34-d579-45b9-9ea8-c61feb7562b1.zip

Path C:\Users\Admin\AppData\Local\Temp\2daa6e34-d579-45b9-9ea8-c61feb7562b1.zip
Size 3.7MB
SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
MD5 3850f642d336e5b283975359ae18e3d7
SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
TLSH
T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 1f9f35482f228a80464fb08f67f9b81db431d28f7157d1a213f989d491638c25
MD5 7d56605963958ba9bcbc5bf643e109ed
SHA1 20182207c03cf2b906304599ca58fc96a0d1b546
SHA512 d5be7d149cd81d1ee89993d37e9619cfd3b2b9ad4dddf366a9a110794880d8cece5e9b3e9455029d410811339c9cc3ad65710e2f72350aa1ec91ae6b56ef9b99
SSDEEP 384:ZBC6sP5X+eGcm+ur0LGmhvhKD56zHbQbGvVld66Joz/zgC1jEboCAnyjr:ZBMX+eGcm+urhm3KD56zHbQbCVS1+aE
TLSH
T1A1C20E44FB2A913FC41552BBDCA60B401F79B88A585D2F5B3A4D64682C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 67c0a818f8a2b4a3778dbc69aadee28db634eb1d9330d4d1b428742373f703a8
MD5 f8b4aa4c658805b2c77851fb2f3b1d1b
SHA1 db26426af56c2192bb609e8b11d13dda5331a95c
SHA512 71d5e22cbcfc8d387634a6631cedceec92370b9e02e21fe512c76172aeb1956468e0abb5f65462232e8185d067bfe988f68b0b575d96112332e23fd15e80161b
SSDEEP 192:hOvetVcU1d66JoztdzgCl6mc0dBToOv5zbo7/GZAyuyjNq6H:hld66Joz/zgC1jTbo6ZAnyjr
TLSH
T16DE10F64E628863FC408427BDDA21B400F35389B9C8E7F19769C751C2D5B2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\events\events
Size 1KB
SHA256 166ebb4d58ab1595d4b6f19701721ab0d431cd1f040c86587b4840ed932f76db
MD5 3f35c13b2811551280920bab954f5722
SHA1 26440c794df212b7e6f5de6a2ffecfca7a43278e
SHA512 c9a1e97cad4874a1b7d2115a4c3c52dedb5082da0069f5b8c421fad344cd13bf1fce55e6a79edad85ced83a392bcc933a723a195c141dce0c2073d5d4d231c55
TLSH
T142217C4C39B84D3A9AC7F79C7451468E53618E0748871C474E42EE8EDDC1AD9326E43D
MD5 SHA1 SHA512 TLSH

Submit Download

0bca7177-3e5f-4b7a-afc8-33cb9c867467

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\0bca7177-3e5f-4b7a-afc8-33cb9c867467
Size 15KB
SHA256 45548cf61fc09fab77e0cf44a92706f1e31112bb257bae1bd45312a425a2ac29
MD5 08603a2f739b01981480da03c699f5c8
SHA1 6a766150184a0985f4230a1b1d43baad0b47e5a1
SHA512 1e8fa20604eba418c4a9d3b9441074b7ff83d6c1eb05c809349a52fd75577c76b66926e9302452183159314b5c1fec040b0364e64b0e42553457e4f74a8c2e56
SSDEEP 192:RpwdJZl5W4ClU5ZV/3Y0pCrahMZrkbAjhGB7Nzd5GMS155ARVfzdHRpqdGeZe32:WTWzZrkWI1kX5ARVfBRpqdnZv
TLSH
T1E062E856646049BE8650E368D8EC7FC7E2F118CB4C019FCE9BD47E0859EE0AD512BD4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

268810e7-4525-4d6b-aa8c-a876f22fe02b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\268810e7-4525-4d6b-aa8c-a876f22fe02b
Size 886B
SHA256 49d89dd04185ab55c3f3de326132ef24e57dfe0bda4b9e0721f9bf390f3fdda0
MD5 cfbd37a217ef7471353670005b701f45
SHA1 3edfc0a1a54fa70b9ba8d119884b4a9f30805318
SHA512 fdca029bac2c640292f73344debdb95015ec075a1323f655b96bf71d0130be70fbd801db744df1df1b90eee4b68fbac8075480b79abf5a2614a28c851489f547
TLSH
T18E112740863479B6CD38D28BDA9177418BE4702380CD48047FA55F180FEB61F979A717
MD5 SHA1 SHA512 TLSH

Submit Download

3555c205-b619-4767-aec5-74ee889bd802

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\3555c205-b619-4767-aec5-74ee889bd802
Size 883B
SHA256 084a00ca54d510e34a94da7e7493dcbb630f846740df2e027fbc155d1b6008fa
MD5 ccf679f0140b5c35bd217afaf4603aea
SHA1 0f672acfc59bfff31dcd5b0a43b62445d8d19b40
SHA512 0dbfba1a8c987b4cfe3c0b30b8caef01c2008f7453c278dd4088eaf6b7624b15b863e11ce705fc905c6b4cedb2b97f7b7b6ea0ca43b640cea101bfce994795a2
TLSH
T12A110480963475B6CD6CD14BC6A23B058BF8281380CD8404BEA06F180E6A62F979A717
MD5 SHA1 SHA512 TLSH

Submit Download

675d32a3-f839-44f6-bc7a-64fbe37fdd4d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\675d32a3-f839-44f6-bc7a-64fbe37fdd4d
Size 2KB
SHA256 01f4137928c0b7e4ff9e0380781517566794b58cfe01f36294213579d014d5a0
MD5 78385fde25e7efa2631938ef2f154022
SHA1 35ea6ee0d08ca2af2ee3319c98065fc077417795
SHA512 33d768f7b7d4515fff6de95d777486cabd657e2e6ee4ce9a1f1285eb2614f81ea3303a7899f65fa3fcad9bf4ebcec8aec132e2a4fae98722481f8107900217b7
TLSH
T15F41335835789C3A8CCAF1AD9583328DC77A491344C61C436E51EF4C8E967EE23AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

a6515403-2956-4663-b9b6-11b9a40c29f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\a6515403-2956-4663-b9b6-11b9a40c29f7
Size 235B
SHA256 099106d7cb9953371ac4597b7bcde5cb993b48c891cef30cd50504d13c35c112
MD5 03a6569eb604c2a28d9215eebf1b1bba
SHA1 a2cff3fe1f1af1dabb2d6715de463194ed138dcf
SHA512 e2c4f6bfaca91af20aab973cb1c55b911c5c157d21e1497ef8c1acb733f38ff5442158968c97669fd03cee27b22734afab94b208bb102ea41050027e78972db6
TLSH
T1CDD097E024E83BAC08100F0BB0A02CE270444C3318B45810C651093499F9FC413D180B
MD5 SHA1 SHA512 TLSH

Submit Download

f0238eaa-66db-4278-bf42-52c5775a4481

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\f0238eaa-66db-4278-bf42-52c5775a4481
Size 235B
SHA256 6f3f7d74724bb8e9af2727df15e7ee4e3b5a61dc2918c5a3bb605a8c4424b401
MD5 4bf13e6e7a63a43862311e9679dc2b69
SHA1 d3608545795312ae10ba1421acf0c1b1f958076c
SHA512 9beba29840c5a2520715a8cda14dac12d576fe85c143fb52db0688c89d7f18556314b56a453dc6dbde4756b2ee057d25324daa615ee1384250937e2142206065
TLSH
T1C3D0979038A8EB5E08000F03B0E069D630844C3324A05810A6A681BCA9FEEC41162917
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\extensions.json
Size 16KB
SHA256 cb6d2fc2abe166ff099e31a01e7b1c278c3d29913783379b2ce06302876ddad4
MD5 fdbb4b439eac3d094618bb4db0214d25
SHA1 2c87c1f61c1d216855491027933a9ab1e5f49738
SHA512 b9ddd0b5c842175f526edeeaef8883cb45bb1e706b096caed85b4ee17c3f0368c3cf974ebc9533f40fcd221a43b08a8e1265acaff69059d28426c35170794915
SSDEEP 384:ISkI4v5UmldvG8dhW094zM96o+L4HXqL4PCL4HPL4HeL4H7/4hO:8I4BRfLXd486P4I444z4E474Y
TLSH
T10272431545049EB8298EA79AAA367E01C37D533B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs-1.js
Size 6KB
SHA256 6fd9033f9cd44fda71ed3331ce8830bb2afc0a898f4acff2dd1edfd4497044f3
MD5 f7ff0e0556e519b8549d756a3f7bc545
SHA1 4f8c05b62c2c0d56bfa93bf43cf634f89f1ae3ad
SHA512 1f7424c981a4f0989f47ef8116e57d03d546105bf7eeb2820a7b7f232bd55c59b442afed2a54e5bce651bc617c32078a1b0bf3d0c4170d71a7d9fe48eb3a1ffe
SSDEEP 96:xHvUTUNqGqCf9mN1zSMoSSlvdv9j9nsRHrDqBw88u8L4cn+VLe5t:9ARCf9mNBoSSM9rGBw8800t
TLSH
T1EDE1107895088F7F64B6776CAC6888315AB2013BBBBF28D750B954C5010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs.js
Size 6KB
SHA256 659e9c74a5964fcc4df9ea910e77a7b647e5c286b1908acc3d9f165c1c249868
MD5 8ef1a58d43e1063b8c673c4a37bdcf6c
SHA1 568e4c5ec0dab449504491f8b5f811bcf1881e3a
SHA512 603cf3289e5c4b30e924ca6c4b9ff166b55802fe61af28194dbbee879a0b8912620e85011410519f66826b531688019701772af84e06aa8e9a9eab2118f624f1
SSDEEP 96:xHvUTUNqGqCf9vj1zSMquSSlvdv9jFnsRHrDqBw88u8L4cn+VLe5t:9ARCf9vj9quSSo9rGBw8800t
TLSH
T1E2E1117895088F7F64B6776CAC6888315AB2013BBBBF68C750B954C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs.js
Size 6KB
SHA256 ebb87d093707d14bc3912367d3454cd39cd29a10118ffec3a1b37b549e17581b
MD5 1381d6b32ef3b3154c1f2c4383119eb7
SHA1 e09f07b9c644733d485caa7ea4dab5ecec31811c
SHA512 420ffbba9f493197997453dda9a9ddb6d7a3e1618da4455f7eef5b56aee81ab1c227e9b2362a3f82f61c51cc92ccd3a83def03e669a8c64c406b295183c38479
SSDEEP 96:xHvUTUNqGqCf9vj1zSMoSSlvdv9jFnsRHrDqBw88u8L4cn+VLe5t:9ARCf9vjBoSSo9rGBw8800t
TLSH
T141E1107895088F7F64B6776CAC6888315AB2013BBBBF68C750B954C5054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs.js
Size 9KB
SHA256 cede26108128bbd35510825799a02c34faca7396701b894254225e10d3572157
MD5 8c2d39099a742afce8544dac197dcd33
SHA1 49be6644a2c0245967eb23e9d441c6aa93c0c38c
SHA512 c56392f350c0db141ba9b0c05481160072d41d3ad251f12683893b2b43add0d7b969e5cd3bd0b8147abe160744b91368030d9f262c89d779d737189cc71de6b8
SSDEEP 96:xHARTUNqGqCfKmNObzSMoSSlvdv9j9nsRHrDhk5OBw88+uaVdjk8L4cn+VLe5t:y1RCfKmNGoSSM9rGOBw88oVdjS0t
TLSH
T1B822EE386404CB3F75B7367DAC648D705AA2023BBABF6CDB01B99485550CF3441EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs.js
Size 6KB
SHA256 ea6895801110833d9737b726c43b8d1d5f39e4c046858d1aff0f711ccac6e115
MD5 1bd5b47940659b10fd581d6d36cccca7
SHA1 8a5b4c7f5ebd88a594b04c3f4f5452feace166a9
SHA512 5b801782b2940a74c6f129c17dd382653fc71330a0188717748985fb6bd9cde03284ff7f7549043d4b7f4c9f5dd091b8d92d969e12dcc4cea19be3cb94eb9de8
SSDEEP 96:xHvUTUNqGqCf9mNObzSMoSSlvdv9j9nsRHrDqBw88u8L4cn+VLe5t:9ARCf9mNGoSSM9rGBw8800t
TLSH
T12BE1117895088F7F65B6776CAC6488315AB2013BBBBF28D750B954C5014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs.js
Size 7KB
SHA256 885eb562dc09b3a97b6fd967457e827aff39bbe8691e2abddfc9ab62b7ea90e6
MD5 0501afdfa693e9661bf444eec0f7fab9
SHA1 851e51ef1acf0172d646c5f67ed6a8bf93bd916e
SHA512 08fbb11008f224007307282daf1708b14a69c89392c70f5e0e5d753181c6098c6baff0cbeac353364efa85afb9675e0d596fac4538fcf3f58b01c1a2c63262ac
SSDEEP 96:xHAUTUNqGqCf9mNObzSMoSSlvdv9j9nsRHrD5Bw88m8L4cn+VLe5t:yARCf9mNGoSSM9rNBw88s0t
TLSH
T1EDF1007895088F7F65B6766CAC6488315AB2013BBBBF68C710B994D4054CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 e067106b2c71f98503a6a6badf019481e74e25c82879d3df03c038f7d0f1f031
MD5 7a9adb439095221d7b0374f7602e81c6
SHA1 4436008dbd83b7c0e1cf350ded8ddce4fb74b605
SHA512 f4fdf58bb40ccb69de93638c6b28f41f5f759e26a3c404f4c822f7331e1ea20953c3e2781c50e8d807f284753663cb572e13cb101329a99b086232b055a1f308
TLSH
T18321B753C4372EB57B51919998498FF0CA94312280B108F0D95FCE45ABED599B34626A
MD5 SHA1 SHA512 TLSH

Submit Download

GUUJFvGU.skindata.part

Path C:\Users\Admin\Downloads\GUUJFvGU.skindata.part
Size 708KB
SHA256 c3bf851d34f9f658eafa66448af4602d874fc88f836cbda94189e973532efe2f
MD5 6c179150b792565ed9ea924e775e5950
SHA1 3b5440fa0c7fca005b385d2d267f546d6dc2d5c7
SHA512 857bfab876352fcf1f67d2c8b51ac1314ee16018297114cda11a0d10100a78f77562cc3c8df8d97b9649713f342aca9fe2d67b96876492dc3c266b9752bb2bb9
SSDEEP 12288:PxggxL8zLC1Gyb9L+QjOxUsO2ZFCkCX30o9Y/oSsNz3cu:pgSL8z/yd+QjmUKCkCXk/oSsNz3c
TLSH
T178F43957B8539B3DC1BD02B180FF0E6A993E8945891229B3A33995583EE371B75C37C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads