fe7f34471ff959f755509dc03c3ec200370f0de86437103bbba503c142c27dbc

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
horsey-game-genome-mapper.html
Size 44KB
Sample260801-tevxbsda99
SHA256 fe7f34471ff959f755509dc03c3ec200370f0de86437103bbba503c142c27dbc
MD5 4fc772b91c41f2069cf27ad1e2f1616b
SHA1 f608041a2eb1f47b1371992fcc9c9db53a419bfc
SHA512 c5d9b02f3b9c78295329cd0fc8f47c901f1be86a8c1bfc6a300a7044adbecb73ddb9c828d7268ff1da7a3ffb572f989a4645cb7820730507d132e84e9153e834
SSDEEP 768:NlURMGtTOnXSel694Kdg0iwVGqnOGChyQIcphXEGONM3MiO9k9USwEShU81/h5dw:YJdiG3n7ChfIcphXEGIM3MiO9k9USwEL
TLSH
T13C13733681BA1053F027C5DEEBA7D7823229F442715456EC3AACAD548FCD924F4BB178
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	firefox.exe
Token: SeDebugPrivilege	1680	firefox.exe
Token: SeDebugPrivilege	1680	firefox.exe
Token: SeDebugPrivilege	1680	firefox.exe
Token: SeDebugPrivilege	1680	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1680	firefox.exe
1680	firefox.exe
1680	firefox.exe
1680	firefox.exe
1680	firefox.exe
1680	firefox.exe
1680	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1680	firefox.exe
1680	firefox.exe
1680	firefox.exe
1680	firefox.exe
1680	firefox.exe
1680	firefox.exe
1680	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 1680	2464	firefox.exe	84
PID 2464 wrote to memory of 1680	2464	firefox.exe	84
PID 1680 wrote to memory of 4532	1680	firefox.exe	85
PID 1680 wrote to memory of 4532	1680	firefox.exe	85
PID 1680 wrote to memory of 4532	1680	firefox.exe	85
PID 1680 wrote to memory of 3848	1680	firefox.exe	86
PID 1680 wrote to memory of 3848	1680	firefox.exe	86
PID 1680 wrote to memory of 3848	1680	firefox.exe	86
PID 1680 wrote to memory of 3848	1680	firefox.exe	86
PID 1680 wrote to memory of 2052	1680	firefox.exe	87
PID 1680 wrote to memory of 2052	1680	firefox.exe	87
PID 1680 wrote to memory of 2052	1680	firefox.exe	87
PID 1680 wrote to memory of 2052	1680	firefox.exe	87
PID 1680 wrote to memory of 4808	1680	firefox.exe	88
PID 1680 wrote to memory of 4808	1680	firefox.exe	88
PID 1680 wrote to memory of 4808	1680	firefox.exe	88
PID 1680 wrote to memory of 3932	1680	firefox.exe	89
PID 1680 wrote to memory of 3932	1680	firefox.exe	89
PID 1680 wrote to memory of 3932	1680	firefox.exe	89
PID 1680 wrote to memory of 3932	1680	firefox.exe	89
PID 1680 wrote to memory of 2508	1680	firefox.exe	90
PID 1680 wrote to memory of 2508	1680	firefox.exe	90
PID 1680 wrote to memory of 2508	1680	firefox.exe	90
PID 1680 wrote to memory of 2508	1680	firefox.exe	90
PID 1680 wrote to memory of 3988	1680	firefox.exe	91
PID 1680 wrote to memory of 3988	1680	firefox.exe	91
PID 1680 wrote to memory of 3988	1680	firefox.exe	91
PID 1680 wrote to memory of 3988	1680	firefox.exe	91
PID 1680 wrote to memory of 3928	1680	firefox.exe	92
PID 1680 wrote to memory of 3928	1680	firefox.exe	92
PID 1680 wrote to memory of 3928	1680	firefox.exe	92
PID 1680 wrote to memory of 3928	1680	firefox.exe	92
PID 1680 wrote to memory of 3252	1680	firefox.exe	93
PID 1680 wrote to memory of 3252	1680	firefox.exe	93
PID 1680 wrote to memory of 3252	1680	firefox.exe	93
PID 1680 wrote to memory of 3252	1680	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\horsey-game-genome-mapper.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\horsey-game-genome-mapper.html
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2036 -prefsLen 27099 -prefMapHandle 2040 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {cf4e4923-0129-4db9-816d-f93d9b2ebd19} -parentPid 1680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1680" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {41447fd4-f00f-4a6d-b949-3052af9bf32f} -parentPid 1680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3512 -prefsLen 27276 -prefMapHandle 3516 -prefMapSize 270279 -jsInitHandle 3520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3528 -initialChannelId {3a6826dc-68d7-4cfa-a475-a6458254aecc} -parentPid 1680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3676 -prefsLen 27276 -prefMapHandle 3680 -prefMapSize 270279 -ipcHandle 3748 -initialChannelId {a4e059ee-c6f4-4aab-8152-6f06e1352d2e} -parentPid 1680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1680" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34775 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {3bf37f73-1c24-4ffa-b254-ddf6fff5006f} -parentPid 1680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4776 -prefsLen 35012 -prefMapHandle 2916 -prefMapSize 270279 -ipcHandle 4848 -initialChannelId {575aa299-fbd0-41f0-92c6-211e69d4d141} -parentPid 1680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4932 -prefsLen 32900 -prefMapHandle 4936 -prefMapSize 270279 -jsInitHandle 4940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4956 -initialChannelId {00aebb21-b610-4e48-95f3-6a28f420769d} -parentPid 1680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5048 -prefsLen 32900 -prefMapHandle 5052 -prefMapSize 270279 -jsInitHandle 5056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5024 -initialChannelId {cf69c3a6-d6b7-4f18-bfc0-84060c0c5508} -parentPid 1680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5456 -prefsLen 32952 -prefMapHandle 5448 -prefMapSize 270279 -jsInitHandle 5444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4940 -initialChannelId {27a106ff-19c1-40ff-bfe0-5eb22b4e5e70} -parentPid 1680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 81394974baf986cdbc776c829f11bdcf6573fa73b785f99edfa669aa701490f1
MD5 f32c6a6357ff58f776b1810a8c44bd4e
SHA1 c96dfd9112d5c282bb94ecbd570e3ae9a6f1a2af
SHA512 8902ab7547c7275f3591ec13454cce828961e2b6c1687cc33be7eb9d1a7ab039cd1736591ebcb31182ae92fe1d0195ff54b50e9429a5ce14375ce01715800025
SSDEEP 384:HwCe7iO024YiWDL84KKDL849B7SOEAd9KVRaAcP+AWRMADt1:QqZYZDL8lKDL8CB7S/AmVAf+hRM4t1
TLSH
T18E728E3E9F413CAC1597C0E8C5B892D98C1877A3DFE6806D22683D0DCB98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 291b461e5400e361c6fb951ece1e587f49086d7a58ab26be158508edba46fa20
MD5 fc1bf9574883e06276f11802faf731b6
SHA1 c0ce1c4cdf7a499fea37bd1fdc804dc5b5d6f628
SHA512 099da9da9a9090087a44cfb62509e6a544a51ab79a5943f906d211f4f50865f67b6d089510b33c6baa33c84002ff896c3c77b2d1277e1ece5a5a3308ccb377fc
SSDEEP 192:ROv5zboTbbWyjSx+1d66JozGzgCl6mc0dz:OboTbbWyjVd66JozGzgC1jd
TLSH
T160D1CC28F329863BD415023BCDB61F810F36389BA84E7F1935DC64482D5A6DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 146ac8b398f0ef99729a1c89c66e0401e1fa8ce9096e95e61f66e76d7bfd7c0f
MD5 587bab2f9dfead5de0d67549444ff5e7
SHA1 16c8d3906c8966eefc82e9e6f826a57da0e44604
SHA512 5945d60e43a97a6adce7bce60577f3fc8fcbff34758512f8fb8cd749cd411f8d9b47f1b2ad925f221f2bd0c26f0e02a4aae52e435a5e360fb6f0b71888eb54b2
SSDEEP 384:+d66JozGzgC1jQbodbWyjeVKCsSR3HkGcmhucY4TPMTKWxrhabTbev:vEi1RgABkGcmhucTTkTKWxrhabTb6
TLSH
T1CED2EE44FB2A953FD41512BBDCA50B002F79B88A581A6F973A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 65e705ad918dfb9bfb3128eb29236ab98e0b3ae8c26c32cecb4f2c35fd23c2cc
MD5 834fb783f7524c4f291a74ac56b022b6
SHA1 6c1e6b673d5436da51acf5103545634aa3c81244
SHA512 3e06f5513620bda49703602b2ad6238f04aea490494d415230a53c79931413c1aa7bad9585b895de85ef5cdb1bf4cebcc02e003ee5306e7ce556b25db17ae5fd
SSDEEP 384:lVKCsSR3HkGcmhucY4TPMTKWxrhabTbev/d66JozGzgC1jQbodbWyj1:lgABkGcmhucTTkTKWxrhabTb64Ei1u
TLSH
T137D2EE44FB2A953FD41512BBDCA50B002F79B88A581A6F973A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 9063fd5e8348bbd621540e5b506db54cce592032f4f1c5d00242d3db63d14328
MD5 f7ffb9faa635285f931d9f90287f118e
SHA1 70ca7e2af7542a2c3471365b5fb331b1bb11f2b9
SHA512 a08d17913f4e834d0a86286cbf7f45f08d37b4a8e626bfc2cb0c3d4e25f819742fb581802f826f43a25ad2f1b8d0c67cc61ef7aefc49814484175f7cce80cc88
SSDEEP 384:+d66JozGzgC1jmVKCsSR3HkGcmhucY4TPMTKWxrhabTbevSbodbWyj1:vEsgABkGcmhucTTkTKWxrhabTb6W1u
TLSH
T174D2EE44FB2A953FD41512BBDCA50B002F79B88A581A6F973A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 1134064eaefdecb5c3e8bb9f1ef946229a822ede6b64604b2dd42cef9a141dd2
MD5 99861856991801edfca6580553abcc2f
SHA1 6b97bee4efeed5e5eeab241d50dd4f27b8590bf6
SHA512 63e6c7e9e114c77ec7a288c4819f9063c729e8ea366ca9bf6a9dc46cfcaff108987c5abd3ced31e705ec875ba640f3e964b6df3563de75de61dab9a6c8da60da
TLSH
T11A61C758F229863FE445413ACD961F421F347456A8AF7F2A39ACA08D1E0B2CD36CD47E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ddbdf95c575767e27428a27f5524d2ff56ca6e7a21928b5af35573f9812ea605
MD5 9aaa01c1e7c9908325593622da6511e4
SHA1 023b77eefceb678e3f41056fbc3c816e60d61e6f
SHA512 d3d30aaf2db94e55be7761f89d834e143204911e85f09c1bb693b0fa93e1a861bf30a74040348d932ef95fdf75212bb1a9a8bf9148efff2f936e6d8be89a3065
SSDEEP 192:V1d66JozGzgCl6mc0dwOv5zboTZbWyjSxI:Td66JozGzgC1jlboTZbWyjF
TLSH
T1D0D1DA68F229867BD409023BCDA61F810F36389AA84E7F1935DC644C2D576CD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 57e62c7fb2faeea0c3918555b5d894480d39ecf768c5a8d3bdaf56fd984819b7
MD5 002c5e961c1a989e0d19f6e4dd5a84db
SHA1 6e7d00034d72ad8adedcdd61cadae3e5d75f567c
SHA512 451653ccd97f9e608770be17346fe47a21bfcad2eda65ac3885efc618c3d9d90b2452dcf24fdf4df85d9d73f574d7c1fe3e1d50c50b6f7385f5eddc8274da3b4
TLSH
T17321499C39B94E2A9DC7E3AC7441028E67B54E0709871D434D52EF8DCE91ADE326E43D
MD5 SHA1 SHA512 TLSH

Submit Download

0aa1ddd9-b14b-4548-8e35-7879b71caf92

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\0aa1ddd9-b14b-4548-8e35-7879b71caf92
Size 235B
SHA256 2f6968ef801cbc8a364819e457312b60d16dccd2651df5b5ecc48040a28fc777
MD5 1c40db9e624e4aa3224287d2d957a4cb
SHA1 a323f58ea5b2d46e91d48fb85ba44be57db95124
SHA512 df9a221b6d576597b81d333c1256a909688417999aa95b24279e959218654cdcf6ee29ac97569260c13259d01a9447310da6324bc9047b684139539a1be308c3
TLSH
T119D0978824E8AB1D08104F03F0A029D331C84C332474A820D59982B8A9B9AC8021191A
MD5 SHA1 SHA512 TLSH

Submit Download

73050971-da63-4d92-9d13-93467002d690

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\73050971-da63-4d92-9d13-93467002d690
Size 2KB
SHA256 8604fda81eae480bc7ff1a060bd40d4fb8d1f97c7fd25250cdd4ad24b03f48fe
MD5 cc510845dbf12d95e3b46ce03b3afe80
SHA1 8db2b1b77cc0c7e976b88a78fb941da710d9baf5
SHA512 6fe8906c30587f747e67e0f83ced9864b1eb3a0ae8507a1eb69a84fdf6e1ab1d14c7b23c16fe8a57041982f7f1079bcc088867af80ff8142511555593f48ccbc
TLSH
T15E41302C7B785DF69C96F1CDD492338E53A04A0200C62CC32E91DE4C8C9A76D736A52B
MD5 SHA1 SHA512 TLSH

Submit Download

8137451b-d9a8-4566-8a14-7e77336ea131

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\8137451b-d9a8-4566-8a14-7e77336ea131
Size 235B
SHA256 035721f06859431c7a83c0425afb447193cb42c6099f314bd319540577221bf4
MD5 cefd3529ebe3665abccff2226145ba0f
SHA1 e1c1f618d9b21a907c052856bb41d582e10a9034
SHA512 047c9f41f75ae36cd8ff4e68a9fc4f6d13722deaa49dd5edbde195259d972f301cee8b2222745fbc25e3fcf5fdf06ee67f4d256c7b7434d1bc3dcca1b0e49708
TLSH
T105D097D018A8239C48204F06B0A028E6B0444C3728F07810CA5104B89BB9EC5015280B
MD5 SHA1 SHA512 TLSH

Submit Download

ab7be661-7763-4aa4-af15-a09924b39b9a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\ab7be661-7763-4aa4-af15-a09924b39b9a
Size 883B
SHA256 ddc99a2363cd789eb980914f87e61e41a59ecea9802649c85f34381eb1ac6480
MD5 a8e6ba181ff5f71aa2f4aa945869a2e1
SHA1 a54b2e5d2c94553f0e9a896e7d5c7d8bb855d9ba
SHA512 a5a200250a59f46f44110564908e63064f4a7115642da62bd1500bf9f43cb0c88e3edf2046dba0a54959196352b3a51672766d1a0e4fa5b269b2e28735033f03
TLSH
T1DD110041F639B9B2CC68924BC9953B539BF87463C4C955443EE059040D3FA2EA7BA60B
MD5 SHA1 SHA512 TLSH

Submit Download

caf775d7-ccf1-44d0-9b43-466017b4bbe5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\caf775d7-ccf1-44d0-9b43-466017b4bbe5
Size 886B
SHA256 7494e469f6a742b3137a200b6f0dc2c000600a4185d306b2b4fa7b3c87b295ea
MD5 59f2b49c8a623bfaa3e07593ae3a90f2
SHA1 953df96f6ff88795f86f02a3f8e1f9fe43d19328
SHA512 bd743e4851e1359da8a161a33c3671ce290ddbf7fa609a45e96aba769cec34edf3ff373776ff0400034b8c3aeb70cfa909461233998b428766735f31a5a838ab
TLSH
T1D5112341D779B9F2EC68D2CBDAA177838FA0B123D0CA5C447E905E180CAA91F5367707
MD5 SHA1 SHA512 TLSH

Submit Download

d998bd93-73c2-4ff1-a63a-b35a51b5a28b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\d998bd93-73c2-4ff1-a63a-b35a51b5a28b
Size 15KB
SHA256 d0115bd357325f3ddf922e574c78d93dca1c1a4b3101ec6880b1291534157a3c
MD5 e252e2de354318896f3e49b9a4ddacb7
SHA1 f757d2ace4dc3bdf2dafa49a115ee34d9cd7d3a7
SHA512 c257390aae28a17414a1636f9dedbec0301fdcd03bc43988bf6383edda1770cbe80f6ba7846221949f7d8f1cb1565415d9afa432514dd63b03fe60a181aa829f
SSDEEP 384:ZG4PBxc9YOsomT4rTR1noiKlST8/4h4W3/3:s4nsbG7A/3
TLSH
T19672B8166820497E8691E36894FCBFC7E5F528CB4C419FCE9BE4BD086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extensions.json
Size 16KB
SHA256 751eff7d1d73706f3e19303a81dc864b7ca52bd088d98b6b01473246a77266fa
MD5 d02e8c85f46088724a318194d63424d2
SHA1 ffef568099eada14cc165162ff1c9a2a0a3fa57d
SHA512 fe2300fa1423cd8cde38f6ecc41f3847b7a3673980223036de6f94f270a89feeac77dafc59ac1751d5196dbc674bff10d5ac6dc87f31acaebe70229aee983d6f
SSDEEP 384:AkI4vyUmldvXf8dhWnV94z6196opL4HBL4PlL4HDL4HfL4H8+4hV:nI4qRf/0Xen4K6W454d4P4j4X4b
TLSH
T1B972421545048EB8298FA79BAA367E01C37D573B60845C38F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 8KB
SHA256 7c0a473f7e363c4d77772813940a78dd964b042e56ac1a51ca9b02991d1efb16
MD5 26dfade5c01a40d618883bd71d538695
SHA1 ad502e7b245a3e9310222ac9b3fe7e9abdaadd4e
SHA512 b1cb167ecd227bf7c5ca742358be2bf7284048d446caa92cc98a2953e8678a6dd36dbb30a0fa91d38dc2fa996d2c7801f5fcc31bf6fcff619911400e0e2c5704
SSDEEP 96:xHHdTUZfvqGqqkfY7cObzSASSlDdv9j4nLWRMSL4/3iIBw889FN8L4cn/MVzW:9dRFfY7caSSTRMa4/3NBw887g
TLSH
T1C4020D389004CB7FA4B637BDAC288D305AB2023BB7BF68D750B95885050CF7445E96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 1ab64b33e1c854442c61d96b3ca08b4df5697e113e1213a828d8d2d2e64b32cd
MD5 f9840296b3f1652de629561e4d8ead9f
SHA1 ee6bd34731535f18bdf34052f4b9edce6ff64c5f
SHA512 88b94db6ec48d4a569dab867f84db4d70b21cdaf60af96f6b5c1c85f6b4370fb2cc6503c6e40c5168c2417d589b2e1105061a345fd26a15aa4014acdc2635155
SSDEEP 96:xHHUTUZfvqGqqkf+/m1zSuKSSlDdv9jABnLHH4/39Bw88n8L4cn/MVzW:9QRFf+/mTKSSSH4/39Bw889g
TLSH
T159E12E789108CF7FA4B677ACAC688D316AB2013BB7BF28D650B55484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 81fb9537a3c5734997655c2180b732a68d0af87afccc981866f2489910957a74
MD5 c7e20c3e0bf5e854b483ba2a5b5eb5d4
SHA1 6ddca09a98b7ed2ac397a8ab1c858d3dc85b6483
SHA512 4fa068f00bbb0bcd810119dd7d602db07ba82962897b4287677af6a93b420286af56d0af618414c71667432090fbaf409054df5ccb5e75d8f35ba5e14824c750
SSDEEP 96:xHHUTUZfvqGqqkf+/m1zSASSlDdv9jABnLHH4/39Bw88n8L4cn/MVzW:9QRFf+/mZSSSH4/39Bw889g
TLSH
T174E12E7891088F7FA4B677ACAC688D316AB2013BB7BF68D750B55484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 0134cc6452af29bffd86342ccaa98a5ed0888007407a0cd5e2676916b1b16230
MD5 e1540eba407a8449f0e6318379ac1dda
SHA1 3ad4f7e50bc9a4b2cc5833b95dfc78c457e2f945
SHA512 6809badabd22ee4969f0ccf9e288b6bac55180a24dc912e5a2d5542579e07952d8f066909c17d24cb31c84c03bdab66ddd0762f1cfaee5c65a5f0fb026a5a22a
SSDEEP 96:xHHUTUZfvqGqqkf+7c1zSASSlDdv9jABnLHH4/39Bw88n8L4cn/MVzW:9QRFf+7cZSSSH4/39Bw889g
TLSH
T1D7E12F7891088F7FA4B677ACAC288D316AB2013BB7BF28D750B55484054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b100b91e064fc0363eafe277af94cb0016da63b0029aede5e640f0ff6c2de751
MD5 44e432c906a431b464ec07918a42a397
SHA1 2122943402392a7a73a2dc3590307e8654e00c11
SHA512 af3e2dff97d7e6d4a3d5a1fc28f0120bb71bfab4923bfc98e7bc31ff567e745af5c97e0fcf529a9f02dd7dfacb0bfc04a6b86161b2a29e2ee56b66a586a90706
TLSH
T1F9210B43A9DB2FF5BA558249E8C4CFE64B2531344431846881899E8963CB4BEB74F51C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 851abae97061a560bdc243d7620842fbe50878978c41f46d4d6d916c3e44fa1c
MD5 8cb3d6b339a916fbf35f3c87c2897539
SHA1 a2efbfcacbd69771b72caf94db48bfa85e246c1d
SHA512 d9012898d5e26264b907de5dc259b1f5e192d64729c9a6a0e7c8e4c2a975d907d9bc27b680abb878e8fd07dba4f5839b60f58ef3850687b392ac2f60af19034a
TLSH
T16B3119436C9B3FF5AAC68207E4C4CFF59B2032308071406481898D45278A8BEB70A909
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads