ae7143b9b81fb32f3bf3d90560bc739ef3e531bf04e9dca6952c8f988c906d03

Analysis

user interaction
yes
max time kernel
199s
max time network
204s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-eslocale:es-esos:windows10-ltsc_2021-x64systemwindows
submitted
31/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Team Gold v14.exe
Size 49.3MB
Sample260731-ejhegatdmb
SHA256 ae7143b9b81fb32f3bf3d90560bc739ef3e531bf04e9dca6952c8f988c906d03
MD5 d52044cd9a5c62ba719598a96fb1932a
SHA1 4ebcc175b96c36479499d946e01d0cee2e0f45e1
SHA512 eb00b8a0e52257e55faebeaf93969c887dc83a07c047d72658f193a35bf3d242598e2baea4406547403ebdbb764b76c262c32f56b2e7ad62b7ef474020863dcf
SSDEEP 1572864:muCyOKG+P7iFAd8FdcD7Pm9zNd9uuu8eY:maOAvuFdcfPm9H9+8eY
TLSH
T12CB7335EB7E808F8E037AA75FB54A345E4B7F86A63717B0F06A544A70F63290983D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	firefox.exe
Token: SeDebugPrivilege	4480	firefox.exe
Token: SeDebugPrivilege	4480	firefox.exe
Token: SeDebugPrivilege	4480	firefox.exe
Token: SeDebugPrivilege	4480	firefox.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4044	Team Gold v14.exe
4044	Team Gold v14.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 4480	980	firefox.exe	93
PID 980 wrote to memory of 4480	980	firefox.exe	93
PID 4480 wrote to memory of 3172	4480	firefox.exe	94
PID 4480 wrote to memory of 3172	4480	firefox.exe	94
PID 4480 wrote to memory of 3172	4480	firefox.exe	94
PID 4480 wrote to memory of 2416	4480	firefox.exe	96
PID 4480 wrote to memory of 2416	4480	firefox.exe	96
PID 4480 wrote to memory of 2416	4480	firefox.exe	96
PID 4480 wrote to memory of 2416	4480	firefox.exe	96
PID 4480 wrote to memory of 4968	4480	firefox.exe	97
PID 4480 wrote to memory of 4968	4480	firefox.exe	97
PID 4480 wrote to memory of 4968	4480	firefox.exe	97
PID 4480 wrote to memory of 4968	4480	firefox.exe	97
PID 4480 wrote to memory of 2644	4480	firefox.exe	98
PID 4480 wrote to memory of 2644	4480	firefox.exe	98
PID 4480 wrote to memory of 2644	4480	firefox.exe	98
PID 4480 wrote to memory of 2072	4480	firefox.exe	99
PID 4480 wrote to memory of 2072	4480	firefox.exe	99
PID 4480 wrote to memory of 2072	4480	firefox.exe	99
PID 4480 wrote to memory of 2072	4480	firefox.exe	99
PID 4480 wrote to memory of 5576	4480	firefox.exe	101
PID 4480 wrote to memory of 5576	4480	firefox.exe	101
PID 4480 wrote to memory of 5576	4480	firefox.exe	101
PID 4480 wrote to memory of 5576	4480	firefox.exe	101
PID 4480 wrote to memory of 5672	4480	firefox.exe	102
PID 4480 wrote to memory of 5672	4480	firefox.exe	102
PID 4480 wrote to memory of 5672	4480	firefox.exe	102
PID 4480 wrote to memory of 5672	4480	firefox.exe	102
PID 4480 wrote to memory of 5700	4480	firefox.exe	103
PID 4480 wrote to memory of 5700	4480	firefox.exe	103
PID 4480 wrote to memory of 5700	4480	firefox.exe	103
PID 4480 wrote to memory of 5700	4480	firefox.exe	103
PID 4480 wrote to memory of 5728	4480	firefox.exe	104
PID 4480 wrote to memory of 5728	4480	firefox.exe	104
PID 4480 wrote to memory of 5728	4480	firefox.exe	104
PID 4480 wrote to memory of 5728	4480	firefox.exe	104
PID 4480 wrote to memory of 2268	4480	firefox.exe	112
PID 4480 wrote to memory of 2268	4480	firefox.exe	112
PID 4480 wrote to memory of 2268	4480	firefox.exe	112
PID 4480 wrote to memory of 2268	4480	firefox.exe	112
PID 4480 wrote to memory of 5632	4480	firefox.exe	113
PID 4480 wrote to memory of 5632	4480	firefox.exe	113
PID 4480 wrote to memory of 5632	4480	firefox.exe	113
PID 4480 wrote to memory of 5632	4480	firefox.exe	113
PID 4480 wrote to memory of 4252	4480	firefox.exe	114
PID 4480 wrote to memory of 4252	4480	firefox.exe	114
PID 4480 wrote to memory of 4252	4480	firefox.exe	114
PID 4480 wrote to memory of 4252	4480	firefox.exe	114
PID 4480 wrote to memory of 1032	4480	firefox.exe	115
PID 4480 wrote to memory of 1032	4480	firefox.exe	115
PID 4480 wrote to memory of 1032	4480	firefox.exe	115
PID 4480 wrote to memory of 1032	4480	firefox.exe	115
PID 4480 wrote to memory of 2448	4480	firefox.exe	116
PID 4480 wrote to memory of 2448	4480	firefox.exe	116
PID 4480 wrote to memory of 2448	4480	firefox.exe	116
PID 4480 wrote to memory of 2448	4480	firefox.exe	116
PID 4480 wrote to memory of 1176	4480	firefox.exe	117
PID 4480 wrote to memory of 1176	4480	firefox.exe	117
PID 4480 wrote to memory of 1176	4480	firefox.exe	117
PID 4480 wrote to memory of 1176	4480	firefox.exe	117
PID 4480 wrote to memory of 4928	4480	firefox.exe	118
PID 4480 wrote to memory of 4928	4480	firefox.exe	118
PID 4480 wrote to memory of 4928	4480	firefox.exe	118
PID 4480 wrote to memory of 4928	4480	firefox.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Team Gold v14.exe
"C:\Users\Admin\AppData\Local\Temp\Team Gold v14.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4044

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27100 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {ac1432d1-bef7-4fbe-9336-1eb9a2aff317} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27136 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {6482839c-aa45-49fe-b0c0-aec93650b2eb} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3740 -prefsLen 27277 -prefMapHandle 3744 -prefMapSize 270279 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3756 -initialChannelId {d193eb73-b6d4-4ddd-8d81-6dc3c676d125} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3916 -prefsLen 27277 -prefMapHandle 3920 -prefMapSize 270279 -ipcHandle 4004 -initialChannelId {5580ec8b-1001-4143-ad21-f9ad85c1b6af} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3164 -prefsLen 34776 -prefMapHandle 4236 -prefMapSize 270279 -jsInitHandle 4412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2584 -initialChannelId {93515d13-f0ce-457c-bb5a-f4d5e388d694} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4956 -prefsLen 35013 -prefMapHandle 4916 -prefMapSize 270279 -ipcHandle 4944 -initialChannelId {fda257f1-4ebf-4114-a317-b84e5a43c979} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5092 -prefsLen 32900 -prefMapHandle 5096 -prefMapSize 270279 -jsInitHandle 5100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {01fdc72f-f1e4-4596-ba1d-7855b69fe432} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5196 -prefsLen 32900 -prefMapHandle 5200 -prefMapSize 270279 -jsInitHandle 5204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5212 -initialChannelId {2326480a-e30f-4404-b576-d871d52a4a20} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1332 -prefsLen 32952 -prefMapHandle 4832 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {4e9b9e3b-acbc-4186-bd52-a2347577f556} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6252 -prefsLen 36727 -prefMapHandle 6264 -prefMapSize 270279 -jsInitHandle 6268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6272 -initialChannelId {6c4e6985-74aa-4365-9a80-ce93ab0f4a0a} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 36727 -prefMapHandle 5360 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5700 -initialChannelId {9d0bb7e3-2e6c-4d12-8548-e8a54897b154} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6712 -prefsLen 36727 -prefMapHandle 6700 -prefMapSize 270279 -jsInitHandle 6704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6696 -initialChannelId {4b312844-aec5-462c-8c7e-54da4fa9b101} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5356 -prefsLen 39855 -prefMapHandle 5208 -prefMapSize 270279 -ipcHandle 5100 -initialChannelId {966dcba4-0165-4a85-97fe-0524bcd090fe} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:1032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 36727 -prefMapHandle 5628 -prefMapSize 270279 -jsInitHandle 5612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5644 -initialChannelId {fa03f89c-6b5e-44ed-abfa-5e035c9a8db3} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:2448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7180 -prefsLen 36727 -prefMapHandle 5748 -prefMapSize 270279 -jsInitHandle 7184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6060 -initialChannelId {f49ba1c4-d763-4afc-bdaf-585d8710a38f} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:1176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6272 -prefsLen 36727 -prefMapHandle 6452 -prefMapSize 270279 -jsInitHandle 5552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4392 -initialChannelId {05137fc7-bece-4fbf-b884-6b4eeaed0a35} -parentPid 4480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:4928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0olu2cg3.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 7553a819a9a3e2aad3c48dc8a26fdd78ce9e60105b3c465fc35b386d8ffacfc1
MD5 0bfcf8d329ff87f249cea7067a172924
SHA1 17ec9da9e5b265622e43c8e48ee4243f614d49c6
SHA512 6cc6c6ff59d372f0a43e5565b5b1979d539a2e66a4b9230d816541fe1e6a520fa04cc5f104831221a2e07b57957db25ef801138793b9ea7e141ed7da05c131c9
SSDEEP 384:HwCe7iO024YoDL84KKDL849B7SOEAd9KVRaAcP+AWRMAkbvYL:QqZYoDL8lKDL8CB7S/AmVAf+hRMjgL
TLSH
T102728E3E9F013CAC1597D0E8C4B852DA8C19B6A7CFE6806D25683D0DC794A69B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d544cec05f34ce7f889d81e0d01f234cdcd49dcd8ce0fd6e8ecf56339c700b34
MD5 e63bd3740aa958401c48e5cffcc52e22
SHA1 b34bfb0226c55b7a4d613abbc2753491eb6ad2a4
SHA512 45036c4912a901b1e36ee22b8b8dadc1855190bb3dcb68bffba1a88bf3c59dd63453d3e957b5257680b1e809112a37a7618b558d7dc99a5f75128309f14f3624
SSDEEP 192:81d66Joz1zgCl6mc0dVOv5zboAx2Byjb2X:md66Joz1zgC1jgboq2Byja
TLSH
T112E10FA8E638463FC008127BDCA61B804F75389A984E3F1535DC741D2D472DE3A8E27D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 69KB
SHA256 9f1f47edf8a333209b3bc421bc6f4071016ab3120276cfbd4f11a77f977049ac
MD5 9dd79a4341a7be4de1a3c6e800108e26
SHA1 1233b9510a249d8c5aabc5439aa91ea71565a590
SHA512 859f53e3b7367fa0c0f7c83f2e1109b92c7fd19c360688a8a2373c4e4124d0513c59ed0e561b7442dc2860ca442071b8ed85aa09b6642d87fb4526ed9dcaac2a
SSDEEP 1536:/r0zmDJRORvCx7CDPYMCeHcEnbtyzUZfsr5XSU9odge7rRP:/ISz8vMOkMhLnUIWVX/0F7rV
TLSH
T1D2631144EB1A953FD828127A9CD21B103F78F8895A1A2B67371C64387D873DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a84fb7889986a9bf3b244093a3e36ad63f99886761458dc4b72753b1467fbef2
MD5 167563dc62e76b5452c6378b161758cb
SHA1 485f8174d2762334325e038ae04381638bbe0d9e
SHA512 be20861ea47338cce09c59a0ea1354566eea2b986a96937d610eb44c54bf644c76764849f8d8ba52eda829d34c73274944baa9c9313958558b0469137f0088ac
SSDEEP 192:7Ov5zboAtZ2Byjb2X1d66Joz1zgCl6mc0dz:kboUZ2Byjud66Joz1zgC1jd
TLSH
T134E1FFA8E638863FC008127BDDA61B844F75389A984E7F1535DC741D2D472DE3A8E27D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 c024dc35b44f5eb95bacae0b0c589327795616986068c18dd049ce3dee6593a8
MD5 cd3c071f95c321a46b358a6871afbd34
SHA1 854997264335069a8fa5873a5538d768d99813e7
SHA512 5fafc4c6d11774f69bee783ec5865ef4589c3b23a668120fc444be0ae7eb1aa79c075c79f3c7f3df712b86b7c0ee4fcd2736e8bdc7715a77f3442d0f6c926556
SSDEEP 96:YFV2FDFoFFFo/dd66Joz1zgClKtmc0d/ULSdF95/7bkW6BrcE2ByUR6ux2WZ:11d66Joz1zgCl6mc0dyOv5zboBb2ByjQ
TLSH
T1D2C10F68E638463FC448023BCDA61B800E763956D88E7F2536EC740D2D572DE7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 c246b407c2f9fe3de6c521c03e4704c724b4f1816ecb0135b65fcb60b99f0f85
MD5 2a9dfd1a34ce37a5af54a23c7fe031e3
SHA1 001a2e947590aa287638887bfeea49db729d2512
SHA512 64e2ba92a29fbbf6a65f60d75515f480f74773a9a91b8d674fa58ca99872eaa96a766ea28c3bbf1f10d3aebea4e26aff2dd97209c67ca9e9fcd1ae7886045890
TLSH
T1DA61AA58F6298A3FE444513ADC921B405F747456A8AF3F2A34ACA04D1E5B3DE778E03E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\events\events
Size 1KB
SHA256 205aa7acde4427b90dd42d3e93f0337c2068deb7ec5967b87e270022557e5cc6
MD5 c77c33894a763c8310d776ac79509123
SHA1 3973670f6a55c90337c3a679268038689da6aa0b
SHA512 bf3db7f4d588f71f8e2f0ef0f067eed1702c77b11ab25f47f8265acdd8ae06c141daa2dfed83c634a5834e6b1b0797739487fda2ea4c07b6f291a37b81a81c6a
TLSH
T175217C4C39F94D2A99CBE39C7891018E63594E4704871C434D12EF8DCF81AD9316A839
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\events\events
Size 5KB
SHA256 7ad5ca3962528873027befe6b8857708d1fdd6ac4d44e7e4f8aaa712315c03ea
MD5 d4aba77cbef12e6d24d1592977fad92c
SHA1 d7f5aaa6426ace54d5735cf7a1db9c9234ec4b69
SHA512 afa0d97399c0ccf985808c36e861fd6a362f105a9ae1aa8d43534d85d711f21129ac8e27f4f4a9a236c09ee1a87054f74c6ae8479b5170ce1db91357b17a3d72
SSDEEP 48:YEFabxRd8vF1eELXwoRWviP0BcWZGNXDJOXC3+mIi/dFZODqSfpi/QaN47bVBY0T:Tvd1RI4nQYLjafq47nYpCEd/g4u
TLSH
T126B1FE1C75B91CBE69D7D3ACB841029D678C4B0385C71C874CDBEE49CE86A9A321F929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13fee115-eeae-47a8-a942-9c4487ec4c32

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\13fee115-eeae-47a8-a942-9c4487ec4c32
Size 235B
SHA256 e34460036803bdc38fbb154e3d5df346bd058292b86efbbc701c3986a5b261f0
MD5 e25ad0e779005cbb7c06064cb8188fb9
SHA1 850470ff2abd82827c8ba2e5e4ff67e1a6facb40
SHA512 61fb22859efe1f2b801f04155333042bfae9995e48e1e185bb17ce1c9e38bc62daf1848a398b4685cf08acbb3fe647eb49a76dc1e2ba309a868850695400c1dd
TLSH
T1D8D0978218C8B31D4C044F06F0F12AC330998C3320B4AC608A5008B48EBAEC88221817
MD5 SHA1 SHA512 TLSH

Submit Download

2d4e872f-e351-467b-99e4-0415a579dfdd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\2d4e872f-e351-467b-99e4-0415a579dfdd
Size 883B
SHA256 31bbef46174dedfcf06c6260aeff96d2f9092dcbb4e16cdc3ae7ec00dd502923
MD5 394966b23fb6e91bbd5c722db0741646
SHA1 60b89ac0c68cd553ca629d24bbe963e1cfcc074b
SHA512 4056d5168e6d22ffd06b4273658ea4c36095f64304bfd419fb1bc721560bd7ec2757c145d422be23ea88b003f6733c9b9e02411582176cc38e36acee3ee7ac4d
TLSH
T1881104C196347AF2CC5C924F899177428BE02513C0C554147DE15A184E7B51E639A70B
MD5 SHA1 SHA512 TLSH

Submit Download

4d964560-a31a-4ddc-a2a0-5eadcdcc106c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\4d964560-a31a-4ddc-a2a0-5eadcdcc106c
Size 886B
SHA256 418376fecf5dba0121f69645af5b54721496d4c6e8bb14e37de7d72f8145c8f7
MD5 278d738e28fa160fa50636f17f7e249d
SHA1 4e8838980992cb3696797e97e74f098a57b7c841
SHA512 32b871293429c9a2370e3e2dcd56d0dd2d95553010f2e16d9458e675da8037d070cf64e8fde9b07fe4003f945928267ee685eecb453e996e973ea16a8ece005b
TLSH
T10211048087347AB2CC6CE34B99D1774287D07013C0C959147DF09B184E6B50E63D770B
MD5 SHA1 SHA512 TLSH

Submit Download

6c858efe-66ee-4c84-9b7e-b239e6358d87

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\6c858efe-66ee-4c84-9b7e-b239e6358d87
Size 15KB
SHA256 7a350a5264ba70dca6442cf3f0c26a3d93cf2161e9080cf7db95bebe8ddb8e8c
MD5 a197dce25925e8a7dfb70ae17b3c34ca
SHA1 8f3ee9e48a3488669978e69fe3205253128546b3
SHA512 a3fef0a285468072d22f809ffc9d457f655ba4cfe01c9372d9ee7315d8b347ee2021b038be36123675fd08ce998d8c843684214cba23d322579a8155a6364386
SSDEEP 192:KFqGxXXBQ921R8NgrThBWpcn8ZCoppM9npqNqGBBX5zx7KuPbRR1F+SGKamq:KFqGxXXy9eX2WpEh15l7VPbRRH4Ku
TLSH
T1D672C956686045BA8251E368D4FC7FC3E6F528CF4C019FCADBE47E086ADE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bcb5fa8d-43fb-4d88-8030-9f7b07b11a8c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\bcb5fa8d-43fb-4d88-8030-9f7b07b11a8c
Size 2KB
SHA256 b8e691cb3192eb1a22f3ac2f01b2379a828757fcff07a46ff875c242a7035009
MD5 c36f5e126acf6b75ea96d395619444a3
SHA1 9f8724260e7c67fe805adcabf4bd2eb79346d00e
SHA512 e0fd3f63f2c9281eb7db67aea4e11c0876b27a91a0db16a431098d8f05258d5ca51d02370c14c3bc258c7169c305e84e0c955ba2ceaebd20ddb7e97c37ac224d
TLSH
T1A341545C35784DB688DEF18DD843338E57644A0304C128832E62DF0DCD966AD737A57A
MD5 SHA1 SHA512 TLSH

Submit Download

ef2a5294-5d99-496d-b795-beb7fb153709

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\ef2a5294-5d99-496d-b795-beb7fb153709
Size 235B
SHA256 dcef2e6aaa855179f55a1c5d9c8a1df417863ba53eba88a7c6b5dfeaca84ac8d
MD5 d66e2903b77cbcb2a5320abd290ecad1
SHA1 cea3b211a65fff3d6c6e2b7443b70417ce9a08eb
SHA512 16d981cad15682bdb22f0d1db47bc3b84cc00206ea2cc349be926d89914549d7bf65a3381cbe69b1170ad2b203676c0a4f36ded8fbe9e65a8b2afb8d9cccf7db
TLSH
T1D8D097901488676D08150F1BF0E02ECA30854C3B20B86C10C9914174ABB8EC40191806
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\extensions.json
Size 16KB
SHA256 1572fff59a278b3685e4135fd47da285e5ce057b522f433e0844aa33c90d3110
MD5 0c0c23d5188b893b1dd693ea90758242
SHA1 2b89ae8e4551bae3242e3c5398712eda70b66dfe
SHA512 5e0e8149b7afac79fd4ec90ce2e62db1c02deb47110e60dc0d558ccb75a79cfe0d86e3b66dfb90e898f9868e1c5eb406488b3cd9fc43e5e20b8b5568261e4a8a
SSDEEP 384:MkI4vcUmldvW8dhWr94zV96oetL4H5qQL4PBL4H1L4HnL4Hum4hR:DI40RfLX2436jt4ZqS4R4V4r4N47
TLSH
T16072531545048EB8294F979BAA36BE02C37D473B60845C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs-1.js
Size 7KB
SHA256 89fdc05de46a6d3bf78b5824f3288833f15b8034d7d2fc69b8846dc66c2d6c04
MD5 b51c12a0c1dd7a78b5c31db572b36651
SHA1 3687138e1aff7a1d7e2ee048cc65b834c66e6ba7
SHA512 cd3824621c32ee6e27ccf23e7de5d5f5e0e7cef2345caed89365a07a8ee998e0d4368304559701280347fb3ab421cd9d12e38c39d52b8a5eb732966553a1b055
SSDEEP 96:xHXWlTUuqGqSfa0qObzShSSlNdv9jcVngWRKd9XJKSIiBw88uv8L4cnzdF:4ARSfa0qLSS0RKTZKSBBw88R
TLSH
T1D6F10F78A014CF7F75B6776CAC2488306A72023BB7BF68D610B994D50618F3845F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs-1.js
Size 6KB
SHA256 256363c1aa48d8dd2c11f1d7912f49a426bdc0c0294d994a6f656e01c657a2de
MD5 ff17ad9914f6b87842f5d5b8ee53a4c5
SHA1 6f9057f6be2acf8d131b0c62d42b053e3553a199
SHA512 ca5fce65f5a170d42335e13421413fb356dc92709833a62101cd995d9abfabe2b68d6aece0d16fdb0aefdad2d23a3a211c3b04b8c23e16fb54d7a47b4c32b812
SSDEEP 96:xHXWUTUuqGqSfx0q1zShSSlNdv9jcVngH5XJKSIHBw88P8L4cnzbF:4ZRSfx0q4SSF5ZKSYBw88q
TLSH
T125E12F7890188B7F74B6776CAC6888316AB2013B77BF68D710B59489054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs.js
Size 11KB
SHA256 28806fddda144fe73e9d4483a72bc5751d5f0843ed936c2684a3449977b8d95f
MD5 382d571762895eb9041dfe46c8832ff6
SHA1 501d79a1d109c9bda7a3850f895bdb333cea5ee6
SHA512 12b4714d2ac42fb2083ee643c1b3e0eff49fba1259c1798f7927bb0566c30907565edcb1d25345fb490c94b2e068fbb45262a940ec3b39612df06bd69fb52196
SSDEEP 192:4ARSfa0qLSS5LRKTZKSe97OBw885BYNWrY:GIR1SfwThM
TLSH
T14542CB386050CF3F21B2727DAC25497029A50237B6BFBCD605B9D493465CF6841E6AFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs.js
Size 6KB
SHA256 5e82eb2d4584850d2d495415c4415e1698c95f8cfbb54a8af1fb0d3e9ba75bb7
MD5 9f350c3de50b28f853e434363f5ea2b9
SHA1 bbaf77a4dcb6deb03108951b3da585bd69c1aa63
SHA512 cf4adef64fd40e9ef708e290c569ea4a51739975fa2064d85e35c2f696ba6beff4a3c6622f30c6d007a26f81f62750325d9f59920dcb59dc81e8a9327976ac07
SSDEEP 96:xHXWUTUuqGqSfxH5Y1zSeSSlNdv9jpfngH5XJKSIHBw88P8L4cnzbF:4ZRSfxH5Y3SSdu5ZKSYBw88q
TLSH
T18AE120789018CB7F74B6776CAC6888316AB2013BBBBF68D650B554C8050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs.js
Size 12KB
SHA256 732b0ec77dd140411effb1df452f7377ac08728bf539257044d257b60d2da879
MD5 94da9e435921dadc47786b4f56e65ae5
SHA1 887e007e73ea33379f9e1109deb589a5453f61bc
SHA512 a1ea4b1585699708465152e479a7ed66eb2b1443c92825513e97379b9fadee3d2229ad2ab097bc91d27c79ac41b68e0d06191ec121ed2ccccb3c99a00173d817
SSDEEP 192:4ARSfa0qUSS5LRKTZKSe97OBw885BYNWrY:GrR1SfwThM
TLSH
T17842DB386010CF3F25B2727DAC2549B029A50237B6BFBCD605B9D493465CF6841E6AFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs.js
Size 6KB
SHA256 88a90b2794c6ed68f9b34f38bea79683f3cc3f5f4af87848772efcf6e6992755
MD5 9e01570a09ca158a233b281a5ad40761
SHA1 1090cd75dba054160adb895a4af0cbdd95b1e18c
SHA512 72c5bfeb522d5ec87eb2c8aa57243341d291198547aea40d4415247fa69fa689559bdc6c2c39b00c5df47a5cf8a6f81c2c2c28722f271aa22f5eb92ba8650330
SSDEEP 96:xHXWUTUuqGqSfx0qObzShSSlNdv9jcVngH5XJKSIHBw88P8L4cnzbF:4ZRSfx0qLSSF5ZKSYBw88q
TLSH
T1ABE12F7890188B7F75B6776CAC6888316AB2013B7BBF68D710B594C9054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs.js
Size 6KB
SHA256 ab3c4153a274fe954f6f314dcf7a573a8160f3bfcdeaa8ddb408cdd1cbc412d5
MD5 ff48881f06fb7f90476074698d076321
SHA1 84d89b2af0b82715ec333e74d5925ff1563791b2
SHA512 94d1a85bcc5689f9bd11236f393f9759899bfeaaae6523ab2ce22a01fcf00b9ce2dd56690f19897a51623916c18083dcbb5de31febc9407a9c4f6a103abf3038
SSDEEP 96:xHXWUTUuqGqSfxH5Y1zSeSSlNdv9jpfngH5XJKSIHBw88P8L4cnzbF:4ZRSfxH5YvSSdu5ZKSYBw88q
TLSH
T10EE110789018CB7F75B6776CAC6888316AB2013B77BF68D650B554C9050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 899B
SHA256 34dcb6e8ff3ddd83dac50d618f606038bf1b912ca602dac8389751a7576b7b6f
MD5 0263fe8441f4aaa51e16dd9f7f9fc88a
SHA1 438dae68585606933394d0d4f83552e7afd39359
SHA512 8ecd2827cc65a49dc144e338fe86104982a40a8ea87dfaed9668aed83d60e7a499aafd38c34e2f1634f0b31d98924c7ec230726eb69541944c3b5813d9098aab
TLSH
T1201144806D1A21756653A03F948D2FFA4AC4205346BE5858E29D174151A964BAF9F30B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 901B
SHA256 db3bec31b5272fea5a0fc1bba7168367c3c3c3be2bada7f295798a0e97a36d76
MD5 7f5b6b8a47a4f7b5cfa2844879befda7
SHA1 9361da46d9324abff07f81b763605489e713a1f8
SHA512 56320bb5fe72198a6aae1ad329db234f387cb1078e14bbe9032491da067d2db102b8743180c7825530be2821142d6f34dc670ae42757251fcc82d6dca22f6d26
TLSH
T13D1144C06D1A21756663A03FD48D1FFA4AC4105346BA6854D29C174151A964BFFAF30A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 899B
SHA256 b2379db472b070e0041947a1c9a49986a9530247217cd155957e38affbaf2ec3
MD5 47a8405c0c2af438d6a317ab66c93114
SHA1 d69002c5f42beae2e67ef41b277eb335d9bbff44
SHA512 3ee28b35a7dc7bb0d406e74d33cc0159421f47fd45928bcca6b91c1ce7234d3615c489880821ba0706b15ec9bec3a117c0b35dde4cba3a17d1c6466970038d23
TLSH
T1B71140C06D1A21666793A03F948D2FFA4AC8205346BA5858E29C174112A964BFFAF30A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 901B
SHA256 09c3085b4a3daf1873721ed7752bb40be381d93652cc8587648cf0c28074375b
MD5 77e5bd49aefba789cd0809a2ec628f74
SHA1 1e4c31fdfad4133cae39058dcbf82589290e40bc
SHA512 830d4ed3a7de138bcd3d8faa38912e26f038e35e10a1f3eed0e6c3524477aec3df6cda369ae13a9acdbbd6b06a63477cc234370f81832b473381c10435f07f30
TLSH
T1F61184C06D1A21722653A03F988D1FFA0AD8105306BD1458D29C174011A924BFF9F30A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 901B
SHA256 0fe3a98f8cc8823bb4186c3029141e568db1ba36662378d97c11a53d47f91ec8
MD5 da5d6e9b94b01a30ccfab4d9625f5685
SHA1 2f1e02fbe09af80166a8335c6081dc38c84ab7f7
SHA512 17730779356fc4eb98d8e4c301d67a23d1255e6dcfe4126f4856385ca89e72b79bc91625b6177c3c485bd57738a35594fb8d0914a7c12f47f1d4fbf45a1b486d
TLSH
T14F1140C06D1A21766763A03F948D6FFA4AC820534ABA5858E29C174151A964BFFAF30B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 862B
SHA256 1d29e00ba43c91093b6927016d3998ce4eb49b4b61be11b564b86ad3e2372c6d
MD5 5065f4e814ef8b806e3998f45483c61d
SHA1 ad58f142e178e87969c29c0285a1b8e3845e1607
SHA512 70b96230d9ee24787a040e2c3076b053a19af61e952554ce9610c4016895ec9de2bc5671508d79b37c9c166c911cbd792deaf04db9a92d63d0c8aaa50e3f0f35
TLSH
T144115642660A15769B10602F90C95FEB5F88243A867D2444F39D660055EC34F7ECE64B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 894B
SHA256 c39b4303d01a433909b9d45d21731e70c414a072539a9f9855ed38b86164eb56
MD5 ac1de5a9685faba1734945e925bc67cd
SHA1 9143b3346ab9c53bb99854a13272232ef3774aba
SHA512 3ae2b1f3bfb6582ee171aea343b83fee8eb812c74e50ff2ac3574cb633f953b709d6dadec7baa47a4572e653d5649d8951bbfb1d1935be8158b587f2c2b17e5a
TLSH
T1CD11B7812D1A21715242A03ED48E1FFE06C4101707BD1464E2CC5B0021ED60E6B9F30E
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 cb6b9487715660b6c4d44840cdc3afcf445e1a492b3f0ce6591d219b669e1e88
MD5 cd6adcad6c35d6496028b66454cc2a48
SHA1 d5aa749d9034a7af69d744d9c8e8fc705a4a32ba
SHA512 dc33e90e660c12976a744f4d5c884ec625a4446a64b23a2f8d367a7839e409a9c8f17e67e36d7f82c44f92bcda1fffb075d4f2eacdf359bc518e25538e9f68df
SSDEEP 49152:1LqLyvaeU+6QC5zYYfMVJgEBb3ZuzWHJGT6v2lEPc9ZYfdsHPtRKu9fr1J4KWp+u:gBtRZxJ4KWpYSe79
TLSH
T14C665BE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3e2b1b3-c499-4852-b9e4-b3cdbc26acdf.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\storage\private\uuid+++371b64e0-859e-45c6-8635-941a50a4be7a\idb\b3e2b1b3-c499-4852-b9e4-b3cdbc26acdf.sqlite
Size 88KB
SHA256 8d3fbb09ffe070f7649cf41d0d98c099fe7913b4bf1367d0b7bbfd3e6f7d9ed4
MD5 09933a3b458a9fe558cb099b61c9e73d
SHA1 f1c890514be1a3b8296e617eca589c9850e016c7
SHA512 0fa1f89dea55be2d46f0eb37a8eb23b1e9e683605d51a23ed3a7a5b6210601abd200d25f7a1f5ea728429fceb0681bf2a1dffee767646be16e4441cc66df5664
SSDEEP 1536:nbvXKPMjV8pvXKkIMjV8MHjXde7JzTAMx+BswhzkDOx+d4FRcKXIf8:bfTjV6fLLjVxjXdYae6UGRcj8
TLSH
T1489302CBD81BD743E24D7925A2250D6998D6938C9CC7811BA1813FCD2E0F8EB7099DD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads