fe7f34471ff959f755509dc03c3ec200370f0de86437103bbba503c142c27dbc

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
horsey-game-genome-mapper.html
Size 44KB
Sample260801-tevxbsda99
SHA256 fe7f34471ff959f755509dc03c3ec200370f0de86437103bbba503c142c27dbc
MD5 4fc772b91c41f2069cf27ad1e2f1616b
SHA1 f608041a2eb1f47b1371992fcc9c9db53a419bfc
SHA512 c5d9b02f3b9c78295329cd0fc8f47c901f1be86a8c1bfc6a300a7044adbecb73ddb9c828d7268ff1da7a3ffb572f989a4645cb7820730507d132e84e9153e834
SSDEEP 768:NlURMGtTOnXSel694Kdg0iwVGqnOGChyQIcphXEGONM3MiO9k9USwEShU81/h5dw:YJdiG3n7ChfIcphXEGIM3MiO9k9USwEL
TLSH
T13C13733681BA1053F027C5DEEBA7D7823229F442715456EC3AACAD548FCD924F4BB178
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 2564	5020	firefox.exe	90
PID 5020 wrote to memory of 2564	5020	firefox.exe	90
PID 2564 wrote to memory of 2372	2564	firefox.exe	91
PID 2564 wrote to memory of 2372	2564	firefox.exe	91
PID 2564 wrote to memory of 2372	2564	firefox.exe	91
PID 2564 wrote to memory of 5012	2564	firefox.exe	92
PID 2564 wrote to memory of 5012	2564	firefox.exe	92
PID 2564 wrote to memory of 5012	2564	firefox.exe	92
PID 2564 wrote to memory of 5012	2564	firefox.exe	92
PID 2564 wrote to memory of 5828	2564	firefox.exe	93
PID 2564 wrote to memory of 5828	2564	firefox.exe	93
PID 2564 wrote to memory of 5828	2564	firefox.exe	93
PID 2564 wrote to memory of 5828	2564	firefox.exe	93
PID 2564 wrote to memory of 3608	2564	firefox.exe	94
PID 2564 wrote to memory of 3608	2564	firefox.exe	94
PID 2564 wrote to memory of 3608	2564	firefox.exe	94
PID 2564 wrote to memory of 4900	2564	firefox.exe	95
PID 2564 wrote to memory of 4900	2564	firefox.exe	95
PID 2564 wrote to memory of 4900	2564	firefox.exe	95
PID 2564 wrote to memory of 4900	2564	firefox.exe	95
PID 2564 wrote to memory of 2584	2564	firefox.exe	96
PID 2564 wrote to memory of 2584	2564	firefox.exe	96
PID 2564 wrote to memory of 2584	2564	firefox.exe	96
PID 2564 wrote to memory of 2584	2564	firefox.exe	96
PID 2564 wrote to memory of 4776	2564	firefox.exe	97
PID 2564 wrote to memory of 4776	2564	firefox.exe	97
PID 2564 wrote to memory of 4776	2564	firefox.exe	97
PID 2564 wrote to memory of 4776	2564	firefox.exe	97
PID 2564 wrote to memory of 5088	2564	firefox.exe	98
PID 2564 wrote to memory of 5088	2564	firefox.exe	98
PID 2564 wrote to memory of 5088	2564	firefox.exe	98
PID 2564 wrote to memory of 5088	2564	firefox.exe	98
PID 2564 wrote to memory of 2456	2564	firefox.exe	99
PID 2564 wrote to memory of 2456	2564	firefox.exe	99
PID 2564 wrote to memory of 2456	2564	firefox.exe	99
PID 2564 wrote to memory of 2456	2564	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\horsey-game-genome-mapper.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\horsey-game-genome-mapper.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {b843d6c5-0511-4aa9-948f-4e776e64973a} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {08459f29-3b7f-4e8f-8290-0e618550ac29} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 27274 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {5ad78184-9d82-47a8-97e3-282f63a70219} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27274 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {9fec81c7-9468-4e11-8d12-a3a40ba706c3} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4364 -prefsLen 34773 -prefMapHandle 4432 -prefMapSize 270279 -jsInitHandle 4436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4444 -initialChannelId {e03f3ec5-ae1f-4d3c-9856-55e3879258bd} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4772 -prefsLen 35010 -prefMapHandle 4868 -prefMapSize 270279 -ipcHandle 3296 -initialChannelId {266b58ef-35c1-4004-af96-d1eab175ac90} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5468 -prefsLen 32952 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1564 -initialChannelId {286aae0f-f6fe-4d47-8282-214c143576e1} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32952 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5508 -initialChannelId {acb68253-772e-45bb-a9e9-ac5db99d1a7f} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5828 -prefsLen 32952 -prefMapHandle 5832 -prefMapSize 270279 -jsInitHandle 5836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5844 -initialChannelId {a037fe5d-c240-4946-94bb-e990f7cfa8ee} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 2fd904e5a89e6013cbef5ae1c8d89bbe1c37dc4d526f57ecdaceb50f232b3ef7
MD5 965b52841f2d1a04c515fefdffa40864
SHA1 fb9b9c340d4ebe7a1a808980ce61937dddcbc210
SHA512 82795fdf37bbe47bf4e2a026cc7e43483e989ce973dca065014dfea7642531d7074ae0df4f8c67572e7bfa7f3cfcda34955692fffb9bad6baf940f86f54c1d7c
SSDEEP 384:HwCe7iO024YbDL84KKDL849B7SOEAd9KVRaAcP+AWRMAsC3:QqZYbDL8lKDL8CB7S/AmVAf+hRMDC3
TLSH
T185728E3E9F413CAC1597C0E8C1B852D98D18B7A3DFE6806D22683D0DCB98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 deaa8415b4163de64f7d4b254b353ee9e0763053c0333cd342bbfe25ef07fb93
MD5 71873f4cd8004f5ce28d5832b0fa1dab
SHA1 2f69fd054bd72a70bfa00b46140e31d8ac94847c
SHA512 e355c380544b9b7b73b713d251abaaa0ad1cbb10a1e6929bbf71bbd3f3e9b3e8cfea8b0439edcf2c26cbc9ff9a1b11a384b4a688e24ba96b9f316605d632398f
SSDEEP 192:Ls1d66JoztdzgCl6mc0dkOv5zbo7o+ZAmyjvi:6d66Joz/zgC1j1boBZAmyj
TLSH
T1FFE10FA4E629867FD408427BCCA61F414F39385A984E7F19759CB4082C9B2DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 56ce8a0b697833cc65aa5a46576fc648f7477fe28012fd028c2525527dbf50d6
MD5 f88bc88cfb404ab4431a2ed27c19ef27
SHA1 82f022ed71529cc54833fded405c25bbba86a2fb
SHA512 d6c0105528b038737d16ed9109b6192c1b99e3ae123044ad3d5b5eef44830d83998971b77e538a43b3a2d7e1075c1fb77f63875a69e146f061e8009c430750e9
TLSH
T1C421495C39B88E2AACC7E79C7491128E63B18E4704871C434D52EE8DDED1ADA326E43D
MD5 SHA1 SHA512 TLSH

Submit Download

059773e6-3674-4dac-a462-80902042de0a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\059773e6-3674-4dac-a462-80902042de0a
Size 235B
SHA256 4f0f6687383cb7b9aa569e06eb400ce846b4d720fa4d5bbbe084aea5024c1567
MD5 eaaa6b335d9322718c0750d5053dce7a
SHA1 7efcbacbcb18664cd575c2e6c985a7416d7e2a55
SHA512 771f0940061cfbede580f1080f015452b218cbe442e580e450eac75063607ac733f1eba5b1014e9f4510b1ef43b1242e113d535bae80669bc7fb5ee1cdec71b2
TLSH
T1D8D0A78528AC677E08291F5BB0A469D6315C8C3754659C50D6A24974AAB9DC4439281B
MD5 SHA1 SHA512 TLSH

Submit Download

5b6c9507-02e1-4ecc-8270-3d8d5add6473

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\5b6c9507-02e1-4ecc-8270-3d8d5add6473
Size 2KB
SHA256 51e86d08ee2e1c192fddc90c3db7bccb57c3d39d801b12dc8bf4cfbf1d56ff42
MD5 b62830bcaa12acbadeb55465ef3ac358
SHA1 3898e1bdfab59180dfacbb71c5afe567c321453e
SHA512 b344fbb3a4d48bda00344bcdef1ff8ddc20261e4e0fdd6b14964d216803ba6857f0f1a34d3eba81fe2188610848ca042fabe1a01816a2a988206b4ee27969a46
TLSH
T1AB41345836B85D779C9BF24DD492338EC3A06903048628476E51EE0CCDD66AE336A52F
MD5 SHA1 SHA512 TLSH

Submit Download

755e5786-0e52-45f9-a38b-dd9b7a1ad2c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\755e5786-0e52-45f9-a38b-dd9b7a1ad2c9
Size 16KB
SHA256 ecbad8a37263d4df7438dae5c2ab2a1939c3950f971792c505209ea34f58fc8c
MD5 d6b9c4d41316a3d028bac684af6d543e
SHA1 cd4bd1a8087d48f06fbe27aa80f21e9ca89b451e
SHA512 188fa616d4ea4c43dd0982c0c3d83d95116d89bbc65f57ba2d9d92e3a18c169b40e72c297ebe6f07e8b43bda33cf84fa631ce5bc063a85683e1ce872b288e737
SSDEEP 192:x+qgzJBhaKDt2XHEGNw1w829JxRBekItdvy7e+yKfxdBOmAKVg1ZNXzxXSJEnS7T:1zK8u2BsbtKfzVA7NXlXSGS79EDB1+
TLSH
T1F372B656286046BA8251E3A994AC7FC3E6F638CF4C019FCA97E4BD085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8259f6c-2b9f-4576-822b-f5618a9be3d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\a8259f6c-2b9f-4576-822b-f5618a9be3d7
Size 883B
SHA256 aa685680cd9344c53918e446b5620e4bccb27b086241bb93cf7635ed4bcffa04
MD5 de37de8f7dbca2191b756fed2df66340
SHA1 7cc5c52c5bef10928339da2cd4a415d1ec3da570
SHA512 d502a875b3689048899c833423a2dbb538c7baa87f8f82dbd8c20b685e47198ee112b4c00c26fdb32f46ca42739f69b4a0b94be29c49c4da8f01e7eee2c9b174
TLSH
T1AB112780D635B9F1DC38C34FC965371287E8742380C6551C3DB59E044E7E52E93A570B
MD5 SHA1 SHA512 TLSH

Submit Download

c8a7fbae-a29a-459e-a5fd-320c4bbeb4d9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\c8a7fbae-a29a-459e-a5fd-320c4bbeb4d9
Size 886B
SHA256 c9b8d5793bd84a85cee4d0c32b34fe1e49ad901c436954207c1c4ec13e84c377
MD5 518b154ccb09add18d8dda5ab3e03371
SHA1 a8aa7cc2f992559ae7571433dd214371353d8250
SHA512 79265d30bbecaed865ecb600ff35dd47ab6cc1e0793999485fef6d602c9eff62abfdda94f13b1733db9426f6f78860eaceab9d780eab7b3dfc1fb4ee4b1e5dd2
TLSH
T1831144408565B5F1DC38C24B85D5775287E4702380CA190C7D549E180DEB51E53A6307
MD5 SHA1 SHA512 TLSH

Submit Download

da06fce6-5eb0-406f-b22d-3355b8e921c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\da06fce6-5eb0-406f-b22d-3355b8e921c9
Size 235B
SHA256 5eef6eddaacc989963f31b0b1f011cef2956d15915fed0f3672855ba2fd05784
MD5 1e3fdf8398d263ec226a48783ea9afe8
SHA1 392f9b4c72c94e98faa784338456f98bdfec8f32
SHA512 27727b59a9692d53253878d30d9f06c94a2c739273bc9030c56e06d0b52f7d94825fb24414d90cc506a44c115eea3f8a625bfd4e80833adf702b257c4a993938
TLSH
T1A3D097945898735C08180F02B0A069C63088CC3318A06890D69257B4CDF9EC81361846
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\extensions.json
Size 16KB
SHA256 ec5fc651614f36a3b4a0ee336f149bf4e9e1a69cfedea54ee8e10929ec046da4
MD5 8a70f809cc0bd9261bdd3e96f7808a3c
SHA1 b402ec195864b95e55523600666da3c4cffcb97e
SHA512 ed3cf5e321837367b59bbba1ebf1071eeab8070e90231638f7a1eebcd923945d53b8fa7cb62a03392d116d92914bb29aa1cb1e0340c6792acdbe230f8ef20a20
SSDEEP 384:CkI4vnUmldvO8dhWd94zt96o8L4HTL4PfL4HKL4HZL4Hti4hV:1I4vRfjXM4H6F4/4r4Y4x444/
TLSH
T1C672531545049EB8294FA79AAA367E01C37D573B60845C38F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 8KB
SHA256 981e9c96038bcaf1e014d5eaf16811dfaa34c979372a932e60d5ed73ba981a24
MD5 edb2fc590a7940a375dd182d2d0902c2
SHA1 76b7806b985d84d55ada61e7794b21720ce390e2
SHA512 65a39e52f49cd18b2995b692884ed37d854d74fca6ed4bf1f855d628e448c22a92b54d1975b219f759b9cec476570e427353b9f02965390d9c49c4e03d93b7bb
SSDEEP 96:xHSNTUNqGq1Df6hiObzS3SSlvdv9jNnNeRWRzEcSqZJg6Bw88touZ8L4cn1VnAx:cBR1Df6hipSS48RYjQBw88XOM
TLSH
T11A021F389004CF7F74B676ACBC6849306A72023BB7BF68D650B95485055CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 6KB
SHA256 2dc75043c72141827cd97b2b03d5679bebf46e3d0402f8180d3608c90983005d
MD5 057707dc9460c82c7f15a088560b0a2d
SHA1 504d977e0b00a5eb81dc34fb4686bb3eb28eeccd
SHA512 1f65952bf9730f0fe7e48c947dc91b188dcd68ab74566d5894dc046ecb66371e69a2275a8a1cdbb01751cb5f911bf4d27ca9594e4ca47dbf4ff4f92e44ae9a70
SSDEEP 96:xHSUTUNqGq1DfGhiObzS3SSlvdv9jNnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfGhipSS49IjzBw88jM
TLSH
T1D5E1107894088F7F74B6776CAC6888316AB2013B7BBF68D610B554C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 6KB
SHA256 6a59d35e1a5f1b6670498300168780651749eb4daf5ac900dd7ef9c95921113a
MD5 0006936c7216883a551885832b2820fc
SHA1 b837dd1ccc8eec166c22b9e7d5a192acfb1f6f8d
SHA512 3a21a7525097380fde3e3613794abf85f5d03ee955e9fc1e52ff6c6f26a001f1937fd9a68c6286a953760c8ac896e4616b5d11eee08f4d37b586be7735746782
SSDEEP 96:xHSUTUNqGq1DfG45G1zSzSSlvdv9jVnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG45GeSSw9IjzBw88jM
TLSH
T145E1117890088FBF74B6776CAC6888316AB2413BBBBF68D650B554C4055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 48b0c775a4080b1c8afd8b95593a1717bc153e84581d43436336921fc9fcc22f
MD5 d1d6ae9155c3627942d9704cf5513fd3
SHA1 9bbd526ba7d78a61e3293c562c6e14e2d93fc182
SHA512 9693dd922162a7d360bca3cfec36531953aa230960df9a4fa2415e72664ce4913bcd63e1de0aa05c78f7888dfd1b1b1159fe18bc39b0cdd0983010234d658b94
TLSH
T15521D8835CD73F75BA05951A48C75FFE876B30720532187098C89BC719AC449B6CD52D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads