f7e4b9ceb812ccf94ef2c9cbcfcb88a2431aaef14fc62f19e85d1b5a273e5abb

Analysis

user interaction
yes
max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clicker.py
Size 24KB
Sample260801-ej63tsdc94
SHA256 f7e4b9ceb812ccf94ef2c9cbcfcb88a2431aaef14fc62f19e85d1b5a273e5abb
MD5 5afed84a3b76ca7d3e478f3b41ded201
SHA1 d6a62287c722f4ed727ca546e8c5e859901597ff
SHA512 1d4674cb6392c468c84fcc1791ed428bf56d37bc274d3caafc154ea19a14e1bdee75286b334734bab9de3fe25691cda02e6dce75c2b0577c66fbd9df15310483
SSDEEP 384:pQShhkMZZfnOPPaETGRXnALC39AKTg+vdK:pQSnkMZtLh2Ct5gwU
TLSH
T110B231BA85441C15B383DC2F95B7A806164D7923BA0D18293AAD73E12FFC526C5F1FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2560	cmd.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3208	OpenWith.exe
2448	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3796	3208	OpenWith.exe	91
PID 3796 wrote to memory of 2448	3796	firefox.exe	92
PID 3796 wrote to memory of 2448	3796	firefox.exe	92
PID 2448 wrote to memory of 352	2448	firefox.exe	93
PID 2448 wrote to memory of 352	2448	firefox.exe	93
PID 2448 wrote to memory of 352	2448	firefox.exe	93
PID 2448 wrote to memory of 5796	2448	firefox.exe	94
PID 2448 wrote to memory of 5796	2448	firefox.exe	94
PID 2448 wrote to memory of 5796	2448	firefox.exe	94
PID 2448 wrote to memory of 5796	2448	firefox.exe	94
PID 2448 wrote to memory of 4296	2448	firefox.exe	95
PID 2448 wrote to memory of 4296	2448	firefox.exe	95
PID 2448 wrote to memory of 4296	2448	firefox.exe	95
PID 2448 wrote to memory of 4296	2448	firefox.exe	95
PID 2448 wrote to memory of 5356	2448	firefox.exe	96
PID 2448 wrote to memory of 5356	2448	firefox.exe	96
PID 2448 wrote to memory of 5356	2448	firefox.exe	96
PID 2448 wrote to memory of 4600	2448	firefox.exe	97
PID 2448 wrote to memory of 4600	2448	firefox.exe	97
PID 2448 wrote to memory of 4600	2448	firefox.exe	97
PID 2448 wrote to memory of 4600	2448	firefox.exe	97
PID 2448 wrote to memory of 4392	2448	firefox.exe	98
PID 2448 wrote to memory of 4392	2448	firefox.exe	98
PID 2448 wrote to memory of 4392	2448	firefox.exe	98
PID 2448 wrote to memory of 4392	2448	firefox.exe	98
PID 2448 wrote to memory of 3276	2448	firefox.exe	99
PID 2448 wrote to memory of 3276	2448	firefox.exe	99
PID 2448 wrote to memory of 3276	2448	firefox.exe	99
PID 2448 wrote to memory of 3276	2448	firefox.exe	99
PID 2448 wrote to memory of 6140	2448	firefox.exe	100
PID 2448 wrote to memory of 6140	2448	firefox.exe	100
PID 2448 wrote to memory of 6140	2448	firefox.exe	100
PID 2448 wrote to memory of 6140	2448	firefox.exe	100
PID 2448 wrote to memory of 4252	2448	firefox.exe	101
PID 2448 wrote to memory of 4252	2448	firefox.exe	101
PID 2448 wrote to memory of 4252	2448	firefox.exe	101
PID 2448 wrote to memory of 4252	2448	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\clicker.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\clicker.py"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\clicker.py
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27098 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {75295190-0901-49ab-9d31-05e61a0783fa} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27134 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {d9998c42-ab33-441e-8937-90b4fa6cf0ce} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:5796
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27274 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {b41bc9e4-b2dc-4fb9-a5cc-976e450c6825} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4296
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27274 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4076 -initialChannelId {47e77ee4-4d7a-4977-9eb3-0996d7a0fd79} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3168 -prefsLen 34773 -prefMapHandle 4396 -prefMapSize 270279 -jsInitHandle 4388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3184 -initialChannelId {5555d080-a2bb-4c30-b949-28667d2a3cc7} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4600
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4860 -prefsLen 35010 -prefMapHandle 4872 -prefMapSize 270279 -ipcHandle 4992 -initialChannelId {f6b5f6d5-e886-4233-b107-aa59790e7d77} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3156 -prefsLen 32952 -prefMapHandle 5084 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5080 -initialChannelId {a7950eef-5d0e-4c75-85ca-213aaab9fb28} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3276
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2600 -prefsLen 32952 -prefMapHandle 2612 -prefMapSize 270279 -jsInitHandle 2616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5412 -initialChannelId {8ddf211c-b695-48f4-aaa5-d8eef3471d65} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32952 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {c9f6e7d7-a32d-4b8a-af02-3a5b940437eb} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 f2334cec06ba40aaf574bf4fcc5a773d129fd3df97bc0e8abbbdc302d214f27c
MD5 2c52cbd60f02abfb0737a3e22dcba1e7
SHA1 7d8b4eaebb6154e60773ce18d57ee82f4ae3cfed
SHA512 d9ce6bbdab046adc3a288495211f49df7d821bc01b977c758f90206945a6286f0c7e4a88bb7655a1a6f8e45939aee3020958cb8c09b834011bf509163df4a4be
SSDEEP 384:HwCe7iO024YADL84KKDL849B7SOEAd9KVRaAcP+AWRMA+gT:QqZYADL8lKDL8CB7S/AmVAf+hRMxgT
TLSH
T137729E3E9F413CAC1597C0E8C4B852D94D19B7A3DFE6806D22683D0DCB98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6DED9FE7A50E8290358DC1D8C755B05692CB9E36

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\6DED9FE7A50E8290358DC1D8C755B05692CB9E36
Size 512KB
SHA256 eb3810aa528b0334e9ec659402076f1f463079977d825e44306f2ff1b7e8aac3
MD5 7ca8818438e88f22eec67b18474bafa9
SHA1 e76ecedddccb7f7917209a6bf555cc1e6758d1c9
SHA512 10c27d02725c249374bf66267bf8bb6382a9f86e181c18e4bcb2689341c6b93fbb9d16cc2d5518a86a41d1ea340b362fa368d1b6e5b3e7c2561c15e07d567613
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeEriRj:OltBL+PLQFZBgBo2xAzpsrs
TLSH
T177B423A8B73B766CD37A9C76C257D4F453E8DA2B56423CE80C4E018E6180BB136D63D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 fe2496f26d326150734815a2badf94cc5f385ae54577ea3033f40b104c50810b
MD5 dd63b67252a1816503cab949cc98c8c2
SHA1 4e1bf72b933259cf4fef01aad587d924c6e2dc7d
SHA512 7d1777b28283c9f2b3cbb831310bb3094c4113d760e555343105faa7a73b4a734e2dd08123fc91e8050e4420ab7bb5ea7c7cda562c90f2f84caf06f972740cde
SSDEEP 192:Nl1d66JoztdzgCl6mc0d1Ov5zbo7OZ4hyjy0q:1d66Joz/zgC1jkbo6Z4hyjK
TLSH
T16BE11EA4E628867FD414037BCCA61B410F75385ADC4E3F2975AD64082D5B2DE3A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 efc008f5e1c14fb25210174da485f865845cf9d21a1d9c6a78d556bd2025e54b
MD5 2a2724efc2a234af2c6dcda97ac2ddeb
SHA1 97488555aaa8623e13e560d374de19fc7b7a035a
SHA512 110ac98f075822abaaca2de0cddf526866c729ace9f8de9c10f3730c96f58fb535c6b7733e5828413fce79aa074d13fbcbd2fc846540060cf5b7a59d6f4f7cc8
SSDEEP 384:8InCAFP1JLZ5OoBfGcm+ur0n70tK+37zDbubSD5d66Joz/zgC1joboB4hyjK:8Cn1lTVGcm+urskK+37zDbubC21Kr1
TLSH
T144C2E084FB2A953FD41513BBDCA507002F79B88A590A2F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 a5c9657a224b83c8431e94c3b8566cc4fdebdcc75854ccaeaa4dd6a3e1a7512b
MD5 92cc258e5d549b1367feca2ee7d37618
SHA1 25c57dd47c1bf4cc13dc3681f6519a0b512bc18b
SHA512 4b685dd43e44c5c17c2792b65f4acd08f155d372fb8be03feb265b41a36e9aaf110e26f3bbad0011a7ff067c79065fbe170bcb9e34e75e1eb4b550473b58bbf9
SSDEEP 384:bboB4hyj9d66Joz/zgC1jHInCAFP1JLZ5OoBfGcm+ur0n70tK+37zDbubSD:/r51VCn1lTVGcm+urskK+37zDbubC
TLSH
T1FCC2E084FB2A953FD41513BBDCA507002F79B88A590A2F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 b1bd1d2581cea39ffc1604def311e108bd7e0d5d2fa20415e72dd81346baec16
MD5 d31679b192937dc1f82fcc9cfb018d78
SHA1 66e7f966cd821787c73bb4158e70687e60a1c15b
SHA512 5f9eedb69560b455bc539fa5bee5af2d263eed76bda16e995877c1efbc303afa85f894eb009c4c3228376f17765b8c8803c2f9f087c79f8397c6928d06e113d7
SSDEEP 384:1d66Joz/zgC1joboB4hyjUInCAFP1JLZ5OoBfGcm+ur0n70tK+37zDbubSD:C1KrPCn1lTVGcm+urskK+37zDbubC
TLSH
T1A7C2E084FB2A953FD41513BBDCA507002F79B88A590A2F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 9fe977cdb27f492a85f0065da3edd6d741322bb5a2fa4a96bf89a3ca64d01e61
MD5 7c662599b5801ad4f8db21c35110bd37
SHA1 7ec24c1e407f952ca0ca49cee9913d3041f67df8
SHA512 e83dfd2af82beec9c7bd0c7c421acd24b7a4c5fdb35f7aaa1697da73222f2e07289d03c69ff831dcf009ec4633cb8dcae463f9c31f7f34bfebaba393735721e1
SSDEEP 96:BFRY2FjFSFxW/dd66JoztdzgClKtmc0d/UUZnLSdF95/7bkW6ArcEtihyUR6iQWZ:Nl1d66JoztdzgCl6mc0dbOv5zbo8b4hZ
TLSH
T1BEC1FD68F639863BD818023BCCA61B400F72345AD88E3F2931DC64492D5B2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 36afcd17c40b90aafd9b1954888bd4a9110e747e9c0bdf7b6adb6a2e3fdd7fa1
MD5 d06e45684ca3a72585f744c112c0da8d
SHA1 726c19102b8c9eb146879fd78801772fd7e92b8f
SHA512 3d0e57624d6415e5f8923a43dea5f99871cf9c158aa8b7b31e65b640d6ae41b447ca9db3e7c17e54f65cb904107cba07ff9f9d8bd95431c098f2c4931be2a217
SSDEEP 192:bOv5zbovb4hyjQPl1d66JoztdzgCl6mc0d:Ebovb4hyj2d66Joz/zgC1j
TLSH
T17CD1FD68F639863BD819023BCCA61B400F76345AD84E3F2931EC64082D572CE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f87d297b174c9cb6a116beef2e8e95e5982676b5a076520edae0c24fac5c7467
MD5 9c1d4d4c6711afcaa52ed7225f701701
SHA1 70c1be50e65f3bbfdd1f3cf7ae1eef047c3fac5b
SHA512 84713aae313e394cf67b1fa0d0313a901104d5e486211418d80abcc34a523cdb6093ccc8c58518e822b708754844176aa3326becff5e2ed8f223ff9d50b2dd7f
TLSH
T1FA21B14C3BB98D6A6CC7F3BCB450028E53654E07048B1C430E42EF8CCE91ADA726A43D
MD5 SHA1 SHA512 TLSH

Submit Download

019f36ad-c976-48ea-a8da-d973c4bb8828

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\019f36ad-c976-48ea-a8da-d973c4bb8828
Size 886B
SHA256 7c4f199159079b859ea222430b7d9e942be2e56c4a001a774aab3927b53e83e1
MD5 c75a4b0efe0fd7493b2660c935fc2887
SHA1 41844dc6961c44d1212ad895da1877ca2f067072
SHA512 4b03b28ce7f66599bb75ac24af7d0abf990b0bf50398806b85254b31b46730249bfd0592fbec4331bbc1afb6dd8e57d90162842c790d050ecea0356f07726c15
TLSH
T156110091E670BAF2DC78835BC5D137424BD4B023C0C64A247D645E180DBB11FB7AA607
MD5 SHA1 SHA512 TLSH

Submit Download

0443b604-bfde-4891-8449-855afe26130c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\0443b604-bfde-4891-8449-855afe26130c
Size 235B
SHA256 f075e81dbc845a94a23d71b0945fd79e629ba97aa353976c628ddeb352c025f3
MD5 8a709935ee5274f4256e4cc89bcc800e
SHA1 d01177c64183f403a657ba96a5669b37e61b45f8
SHA512 6fe8e336c8951152904eb0a84f1b911d21fd1bdbf59503d3012e5a190696860fd2dd2a592a842d941703359022ed90b48a0d8053d65e1aad82ae59956afdb547
TLSH
T1C5D0978028CC636E08180F87F0E078C270444C3B9560E890D96140749ABAAD80222916
MD5 SHA1 SHA512 TLSH

Submit Download

0bb5f06e-0e28-4195-aaae-a09cfac60e1d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\0bb5f06e-0e28-4195-aaae-a09cfac60e1d
Size 883B
SHA256 845b48c265a7afd48f71e04ed3e18581307e2cf5aa8e0d551b631c0cf9ce2fb6
MD5 57e75feffa4ba9fd37c70f7f6db6bc50
SHA1 39eb49351c8bb7b8743fbb3b73c14730bcec4785
SHA512 46d62e4e27d417da4a58db0b15dbde2421aa934145b066e8e64add0267cc42ddd794fd692f04f4482b1ea776fc6f70ae7d6b5261e81abfceea0011d9afcab140
TLSH
T196110094E630BAB3DC78824BC595370287F47423C4C646143DB45F040E7B61FE7AA20B
MD5 SHA1 SHA512 TLSH

Submit Download

470774e6-5507-4f04-915d-8c7e2bfb04a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\470774e6-5507-4f04-915d-8c7e2bfb04a7
Size 2KB
SHA256 12f443c508754d94b633e08b44d9ea2caef32a8fb3d4c3f7efbcb533b0adeb5f
MD5 618b4f04c441e18a337c9611f54a6040
SHA1 81045cfc64f5eb134440b933f964b0ce686e9f69
SHA512 737affd9d093f75519fed0ffc823cf48fa9a34b79c70fe3837420fb2aad1c9bfec6213227657fecb985e51d2fd50f4382ec6ccee36ae8e84f3e80ac7e1073c44
TLSH
T1EC4173AC35784D779CDAE65C9182328A93A0891344821CC32E41EE0C8ED666E336B42B
MD5 SHA1 SHA512 TLSH

Submit Download

76e0e801-3653-41e9-8e81-c270826cb503

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\76e0e801-3653-41e9-8e81-c270826cb503
Size 15KB
SHA256 7e0a0864bee93ce76afd54f7c65d2de117d7a2b74984fecf26eb725ed4523b7d
MD5 86e9e3f00dd9626524af16785e92ab1b
SHA1 8fcaaff17487970b962c4feb6f93099778e4df01
SHA512 21f62b3bc3a273f09c14778841d72f3859637a2e1759c7cbe9faf7ec3d282f040b8f7c3518da636c3cca2e41e8f40b963baa3657bd93747fe645861b8dfae11a
SSDEEP 192:TzUbirjkz4CuF/nCd/JgPRb140ARm1fSBRcjOv6hCv6qy7LuP2yVzJ8Lf3SeqG:EbirjkkNFvrRb140Owzu8Lqy
TLSH
T19F62D9596430497E8691E368D8E97FC3E2F618CB8C019FC9DBE47E0869EE09E5127C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0ee6c7e-be14-46ec-82a5-35af0a9380c0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\c0ee6c7e-be14-46ec-82a5-35af0a9380c0
Size 235B
SHA256 153eaf0ab5437b133b68f7843df342105bb53e96cad14744884fbbb0b2552cd5
MD5 a26a24998fd0ae5c720da8fb041c879a
SHA1 0d35f66b705df56b055deb911073d5f0b86ee2a3
SHA512 5ad49d437395f34eb7dbcd54701c66d6e774a6039c071b7272c1c4b7669f5dddd1dcea7aadf3a4c8aaf1fac3effa9f094ce65e8c599c27614a7271d90194a166
TLSH
T1C1D097802498375D0C200F0AB0A07AD632894C332060AC208A948634DEFEAC401AA807
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\extensions.json
Size 16KB
SHA256 0871ade3bb0e5eeeaa7634e8296273b8fc139b27a925eff3cdbbd0b6df1df26b
MD5 ebca03e448bfdcbd4ede0d5c2e7019ce
SHA1 29501739f15f629f873d123faa2ce68acc0d204b
SHA512 1a3ec3d8b59cc330b0dd1dbde290bc3b3b5ef2e857093f29a9d71c3bcb9fd95518ae4410f241108435a1d0dadeef397be35d322a1adb53dfefcc8dd3462f27ee
SSDEEP 384:9kI4vcUmldvD8dhWr94zS96oJL4HZL4PGL4H7L4HML4HCX4hi:+I4kRfQXC4q6+4x404H4m4k4Q
TLSH
T1F772521545048EB8298EA78AEA367E01C37D573B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 6KB
SHA256 9691b433d2df9692688c59052c62c186e97cf9c3ce9fadc893bed1e0031f615d
MD5 ad4116e9d29a9ac6ada680e7244f3a12
SHA1 125e3b60f172a2c8f402ef43c1d5987b6f0411b1
SHA512 313af7d8cb882f1c355271416fd644bea52303211e401af8d6fc197735c6c0e6c688b53f477bd61983907ee298e0a9ea6fa3cd1c9d705bae395c2e14f514b7e4
SSDEEP 96:xH+UTUQqGqsfynq1zS0zSSlvdv9jgnAHdA0ScSqBw88u8L4cnEVgR:ArRsfynqFzSSTdA0ScDBw88e+
TLSH
T1D7E120789108CB7F64B6777CAC6888716AB2413B7BBF68D650B554C4014CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 7KB
SHA256 1fc08e6940642468c431a1bb73c9e459c716aa107e94a991410b80f980a2c191
MD5 9fab53a1fe99ebe769ad80afe774f6f0
SHA1 c7d4e23e5c94e78966fc5a3bc17e52bcf26a274d
SHA512 7b9acd5d7019c8c999e683e1c54a1a01a06d42b491688565c04f5f0b033c0d6c45ace68b4ff4b705b3fc28b2672b59452bfe22e5009946c34a5e853870a2a2bc
SSDEEP 96:xHE5r4/lFGTUQqGqsf28nqObzS0zSSlvdv9jgnAHdA0ScSPBw88zt8L4cnEVvR:GmRsflnqOzSSTdA0SciBw88L3
TLSH
T17BF1FC789004CB7F64B677BCAC2449715AB2023BB6BF68D711B958C4050CF3942EA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 2a6cbda422e170f8364a006ed04a3e8545c3d71891c5c6e18e0fc710ffdd907f
MD5 5c8dd75afa1ba8bc67269d1c6cae8067
SHA1 fe35352d5a78c7b977b5015db9c19cd69cf7343c
SHA512 b65c26d841ac109e1915f74da8fd4a42740e8dfe8e3dcc0113c87bd5a395cff6052f5b06c8c65129dda124fce63a1c39c77a5842983eecee6cddff57961327d1
SSDEEP 96:xH+UTUQqGqsfynqObzS0zSSlvdv9jgnAHdA0ScSqBw88u8L4cnEVgR:ArRsfynqOzSSTdA0ScDBw88e+
TLSH
T14FE12F789108CB7F64B6777CAC6888316AB2413BBBBF68D650B554C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 d5c1bc4183b166a0880c7fbee36c2790022fbcb26fe0f75de3c145528cfb784a
MD5 9d700b10b10aaec9623218a39ecf0d64
SHA1 befd990e193ce08f45941dbe5461c298e7c25089
SHA512 45234019a65d46a279465d2c203786e6ad95633292702d8b240cf9b5752bfaad5420a90ec9d380fa732b6da8d14efd7f72950bd1b1a8f2a2882ce93e165e3691
SSDEEP 96:xH+UTUQqGqsfy611zSUoSSlvdv9jzl2nAHdA0ScSqBw88u8L4cnEVgR:ArRsfy611oSSzdA0ScDBw88e+
TLSH
T131E11E789008CB7F64B6777CAC6888716AB2413BBBBF68D650B554C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 39f3bc0afad6a267740d5f168b5e4d136d538bacf02d95cf75ba5c104a34a3ba
MD5 659c0838d64786a717b7a8f9d972416f
SHA1 98557a53b96aef10176b2781305d30a488e75b33
SHA512 dd3bce7428ca7504efcdd2061ee1aa15feff7287ac5aec31b087fbe3fa6028b8eea1cacb9d0dacca3a33093beb6578ae3c59ba5e1fcc0c242fb2d78ea70420e0
TLSH
T11A21DB83AD632FF17603D64EE4854BF84269323246740C70999ACF49A69D80D7256314
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 ccaccd8a61c8c977311fa19b0aa215661fa6e1b0b614f70b0cd4a8fb9d399bd0
MD5 8e9d18a5f3d63c7a30b90bd7fcb55d10
SHA1 af5bf57951dd56d1aac4e1cc37f381b80917a491
SHA512 1857f529eff28fbda3f0a15ed134799ba2daddf7d63361153e8b694efdea355542720536d4b218bab77dd8c14d467123abc7c5dc756ad6fefadb4589e84803d6
SSDEEP 24576:o8o8DMF8EZ95J8blmUOW8hb+YdsnJRxFMoWE2K5HJWo+lgN5qQzuV8nCRqyORcCl:o8o8DUqM+YMROERUo+lgN5qQzuV8vMzk
TLSH
T15F4639E820D1A297F3814073724593EB21EFD00D5037DA085BA95AE9A574CEF8E17B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 13.8MB
SHA256 e8b8a9950f7d1261fe0223a07bb881141d9151f6a059300ed61e3ffe1be503d8
MD5 8f018ca19542a6c63e3b54fe0e6be520
SHA1 dfe00ceefe03193914259e96138330ce24ff5688
SHA512 0876a753491bc4aeef5e2fa55ff252e98350a4cd30ddecd78d8ac55a878281c1a9976206dd1c31c4425f8f98f6f09f9dd7d804202a120494879a557f37d07c53
SSDEEP 49152:BVI8DCqizYtJzRuMvZY4hBjcyMC7vhI8FTfP5fNLkvCoURr4CCUkT3Ia9mt5zmeQ:3jVRuMRRBjcyMClFfNNa
TLSH
T1F2E63A9270E0D692EB0186F2B31F43EB317FC1DC20E589941678B95C596329BEE6F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads