f95e4e7d7cf0e8ea6b20121e91b970f01432ff4a240781b3ff83b87e946f68e2

Analysis

max time kernel
899s
max time network
792s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
search.html
Size 282KB
Sample260802-mxj48agh46
SHA256 f95e4e7d7cf0e8ea6b20121e91b970f01432ff4a240781b3ff83b87e946f68e2
MD5 7a371bbef11b6a2c21f32034b8658ca5
SHA1 7ec9f43774ffb5a13db6879ed59e48c4b28c1813
SHA512 1195b10b16d66ad39a829ad8d9161c606b71fd480f6c0df6d93be830f6f5c26673e45b3ce4dff7bd469b1854cb8383609ae207c240f06d3ab18dbaff272d6725
SSDEEP 6144:0J4yPbQ3ihZBZUMKVt5hOGtD/C7itvcCvrDOxJv7uRlGyGIfVJCB7VHctfwEfCM:zZRZwsCM
TLSH
T1D9542B26CA00572F0213C6E8B977775AB27E0C6DDA4F4894DFBB875802F5CE1B51E2A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	firefox.exe
Token: SeDebugPrivilege	1560	firefox.exe
Token: SeDebugPrivilege	1560	firefox.exe
Token: SeDebugPrivilege	1560	firefox.exe
Token: SeDebugPrivilege	1560	firefox.exe
Token: SeDebugPrivilege	1560	firefox.exe
Token: SeDebugPrivilege	1560	firefox.exe
Token: SeDebugPrivilege	1560	firefox.exe
Token: SeDebugPrivilege	1560	firefox.exe
Token: SeDebugPrivilege	1560	firefox.exe
Token: SeDebugPrivilege	1560	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1560	firefox.exe
1560	firefox.exe
1560	firefox.exe
1560	firefox.exe
1560	firefox.exe
1560	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1560	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 1560	3188	firefox.exe	81
PID 3188 wrote to memory of 1560	3188	firefox.exe	81
PID 1560 wrote to memory of 3164	1560	firefox.exe	82
PID 1560 wrote to memory of 3164	1560	firefox.exe	82
PID 1560 wrote to memory of 3164	1560	firefox.exe	82
PID 1560 wrote to memory of 2512	1560	firefox.exe	83
PID 1560 wrote to memory of 2512	1560	firefox.exe	83
PID 1560 wrote to memory of 2512	1560	firefox.exe	83
PID 1560 wrote to memory of 2512	1560	firefox.exe	83
PID 1560 wrote to memory of 2776	1560	firefox.exe	84
PID 1560 wrote to memory of 2776	1560	firefox.exe	84
PID 1560 wrote to memory of 2776	1560	firefox.exe	84
PID 1560 wrote to memory of 2776	1560	firefox.exe	84
PID 1560 wrote to memory of 432	1560	firefox.exe	85
PID 1560 wrote to memory of 432	1560	firefox.exe	85
PID 1560 wrote to memory of 432	1560	firefox.exe	85
PID 1560 wrote to memory of 4796	1560	firefox.exe	86
PID 1560 wrote to memory of 4796	1560	firefox.exe	86
PID 1560 wrote to memory of 4796	1560	firefox.exe	86
PID 1560 wrote to memory of 4796	1560	firefox.exe	86
PID 1560 wrote to memory of 5308	1560	firefox.exe	87
PID 1560 wrote to memory of 5308	1560	firefox.exe	87
PID 1560 wrote to memory of 5308	1560	firefox.exe	87
PID 1560 wrote to memory of 5308	1560	firefox.exe	87
PID 1560 wrote to memory of 6076	1560	firefox.exe	88
PID 1560 wrote to memory of 6076	1560	firefox.exe	88
PID 1560 wrote to memory of 6076	1560	firefox.exe	88
PID 1560 wrote to memory of 6076	1560	firefox.exe	88
PID 1560 wrote to memory of 6088	1560	firefox.exe	89
PID 1560 wrote to memory of 6088	1560	firefox.exe	89
PID 1560 wrote to memory of 6088	1560	firefox.exe	89
PID 1560 wrote to memory of 6088	1560	firefox.exe	89
PID 1560 wrote to memory of 6096	1560	firefox.exe	90
PID 1560 wrote to memory of 6096	1560	firefox.exe	90
PID 1560 wrote to memory of 6096	1560	firefox.exe	90
PID 1560 wrote to memory of 6096	1560	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\search.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\search.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {5ad21a03-6559-41a4-987e-0e32e4dd1652} -parentPid 1560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1560" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {bc18cb71-29e7-4557-936b-3ae3a829da62} -parentPid 1560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 27274 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {3f1117ae-0fcc-44c1-bf6a-241703e1e76c} -parentPid 1560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27274 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 4028 -initialChannelId {3c635dce-0118-4c72-8e47-f3f98b5ef2ea} -parentPid 1560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1560" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4556 -prefsLen 34773 -prefMapHandle 4560 -prefMapSize 270279 -jsInitHandle 4564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4572 -initialChannelId {8d772b87-04b8-4ee3-b344-10a10eeb6acb} -parentPid 1560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4948 -prefsLen 35010 -prefMapHandle 4952 -prefMapSize 270279 -ipcHandle 5176 -initialChannelId {e6fc1a8b-a9fc-4ffd-af6f-a87378be0316} -parentPid 1560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5196 -prefsLen 32952 -prefMapHandle 5736 -prefMapSize 270279 -jsInitHandle 5740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {25e5a663-5a1d-4cb9-b6bf-26f7dd184197} -parentPid 1560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5632 -initialChannelId {fb863e86-182a-4569-99c7-9a3ed18c5382} -parentPid 1560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5972 -prefsLen 32952 -prefMapHandle 5976 -prefMapSize 270279 -jsInitHandle 5980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5988 -initialChannelId {9784d7bb-3665-4c76-b2b6-f550927c77a9} -parentPid 1560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\activity-stream.contile.json
Size 5KB
SHA256 bd8830a6fa088a25a334c81e8418e50ab36daaf351eecad62ef39bdf3f9a1e4b
MD5 bf7d5bda55eed30dcff7583a80530358
SHA1 d3be019213101de9a4d835fff2d9aa707b6234d9
SHA512 d67596770ab9466633f5033deb9ab1f7422f50958ad8b836b6c2708fc46e19d812a40983d365d808680a9fbbd923e11f06173d3da28d634a9c7de1064d6a1aff
SSDEEP 96:TOO0/LL7oEA0PlYQUmT+mRErQAScQWMFSiob:kHswPlomRErQ1cQTg1b
TLSH
T1A8B11C9BD86488621323F7E42D1B1F15D1C7B057D6D9C6DCB3AAAC12626C31E80EDDC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 b3a788276f5518d037dab5bb1e72f87bd98d1bf4aa2a9773e1f7237d1f031315
MD5 518f4738c5ef527f9925500d537d025b
SHA1 399a13f383b765b86a787d0d1154c85feeee2c88
SHA512 99003a158d44e97ce09aa7b2409f762eaeb4e884fb4b73b3644ec5ead99668eaea8644d547896b7623b7ff2440bc91053850eea341bd16068640c53eb178ba03
SSDEEP 384:HwCe7iO024YDDL84KKDL849B7SOEAd9KVRaAcP+AWRMAjbv:QqZYDDL8lKDL8CB7S/AmVAf+hRMQbv
TLSH
T117729E7D9F413CAC1597C0E8C4B892D94C19B6A3DFE6806D21683D0DC794A6971F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B0HU89TJ4HLTONKH34NC.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B0HU89TJ4HLTONKH34NC.temp
Size 7KB
SHA256 b7c0abac46583fbf3a4cfa7fcc3c5aa24b19d8620ccfe5b03c81639534c6e139
MD5 4b4d530fa23030c761a51b5881a4a5b1
SHA1 4c52be960251cd962ee1fb3f0fb93a2421d17d38
SHA512 91ba50b17e14d77eb7afc7479e1d77f69b8e78fa0e58326e0cd619c1f6d3ae1559b8ad9a45ee0f7b2e26fe5589cc0ef5fbea6ce479b75d4004c42b3225f2dba3
SSDEEP 48:DYR0d9i1J5UgdwrVZzLYY0d9i1J/6BdwrVvLYi0d9i1J/adwrVNquYP0d9i1J/z8:D2YVlX/DVzd/TV5g/k0V+T
TLSH
T184F1BB010BF609A6F5F387327B317712A773FD00962B565E8246274D09337A481AEFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2e7d262d2d450b11c40ab8c58e1195297bace0870f63e4e4dd6813966f21a6cb
MD5 14321aadac9b5d229aac9a2cac2da011
SHA1 93791640d1dcbe61d099743bceb20b61322c6b95
SHA512 a3afe6d8ab3d419fa5e94cb3af28d35e4d481543bb4b754bec9285b2f5746b3171de0cc41e66c82b79ae82c405ff75ec483ae8eabeb5d34eaf3d48fe450eff01
SSDEEP 192:IOv5zboHCLayjS8T1d66Joz0dzgCl6mc0dz:zboiLayjZd66JozQzgC1jd
TLSH
T1DFE12FA4E629863FC418027BCCB61B544F35389A984F3F19719D741A2C472DD7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1e4f1597728f5d77538b5dbc9f0108212378247382d6b3f2c94885a2b88d84b2
MD5 e094e3f075f23ad4d8b8dc871bec3382
SHA1 b88aaef70bfa8ab579834a8e0dd679a6d13eda43
SHA512 877fe44c522d252274bb0d39d640564094b61e4c8724463b5886d2375f61972a52f783f8b5cbb7c272c37b0704c0e4d713e6df173c85db4ba1b667fd7a7de55c
SSDEEP 192:V1d66Joz0dzgCl6mc0dIOv5zbooZLayjOxI:Td66JozQzgC1jNbooZLayjh
TLSH
T183D1EC68E629863BC458023FCCBA1B501E35389A984F3F19719C745E2C972DD7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 fa9734c4e5ccf414d0f3332882a38b2e5d0993a421b3feeca2f6144a71328e16
MD5 e88ad988f30b485996e95624b4423291
SHA1 540a6b9d045a2937732c1ebc63bc1ce16eb3959a
SHA512 17505a81005b27edbfd9094df0f820d1b18d26b18c21cc985c542cb1d4707d7298d447f5b7d74a51fbfca42fc2f6929db889ee3140a6b0a7835bfcc242fbe44c
SSDEEP 192:V1d66Joz0dzgCl6mc0diOv5zboHVZLayjSyh:Td66JozQzgC1jPbo1ZLayj7
TLSH
T192E12FA4E629863FC408127BCCB61B540F35389A984E3F19719D74192C472DD778D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 9f998c8ce39c9f6263990dbecd5c8c266bb2cc10d9c1941273226aba9828ca7e
MD5 b202784aecd6b8196f2c80a3fe9c990f
SHA1 9e58c4465050f526bbd978727892f46edd848e8a
SHA512 e45635e2568106077806ce8d389098481097108a7e3b8e41dea02057a724a17644116c3e9071a0295fbc1172e3693273828a8918e422def13ab09cd14c8bc375
TLSH
T15121ACAC39B94D6AADC7E35C7440028E5B644E0B58871C538D02FF8CCE81ADA72AA43D
MD5 SHA1 SHA512 TLSH

Submit Download

0e0f3543-3c31-4c83-ad14-0d069380d903

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\0e0f3543-3c31-4c83-ad14-0d069380d903
Size 235B
SHA256 97e469ffdbf5807dcd765dca67c7da3171ea1117b27c3c3e25763d3d40021702
MD5 393aca53ef9f36319d7b40be9c7cdbb8
SHA1 6d7c670593e9b8cf44ccb7f43045673223b957f6
SHA512 d9ffb2b06db54fc9c9e34fb011f58638ea262b4a52547fddc69012f185177a9b613c5e6bdc2f1a6676cb7e3a4c38509799bbe4faf90bfce5f6345a04693f859e
TLSH
T12BD0A7813498775D5C285F17F0E579C630598C732464A8109A614578ADBEEC94292D27
MD5 SHA1 SHA512 TLSH

Submit Download

122e9e8d-f5ba-4141-a54d-1b1b6da0e2f1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\122e9e8d-f5ba-4141-a54d-1b1b6da0e2f1
Size 2KB
SHA256 56e427b84a32da6a39a7dd137a81c916a413c48f018e3730d06973466eceaf89
MD5 9361b595332a0c31b4b8ff0e2d079dda
SHA1 13fbcd4ec7c109a13b73082c2b21c6b1bee0af64
SHA512 10f711382f0d41555bdbf6de1dfc835afe3fc68312b5a6a8f7e3c19e05c9aa36fe842aedacb32f1547a4abca552ace30ef95921504557d248a7f62d5792710fc
TLSH
T1E541105C75798CB78DAAF18DD482238E57A0CA1300C628832E51EF0C8D866AD737E53B
MD5 SHA1 SHA512 TLSH

Submit Download

43587411-df3c-4936-b03b-c016002457fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\43587411-df3c-4936-b03b-c016002457fa
Size 235B
SHA256 0f7883d8d8b7837957b2c1f95b6d4af8ab40b08b0cc0e205401843c8363386c7
MD5 9726f8ed9726106d1404cc91656f0afe
SHA1 be6224baa28b812504288c44a4770972e4f7938d
SHA512 4ec032cacdc0fc33a4202e820b05dd1aa087ba6d4fb4884fb68becc70c19688bac49407f259e25347215914729fb6131c715fe7b413b426190f04d196acb21cd
TLSH
T148D0978028887BAD08142F07F0A078C670488C3364B46814C6624574AAF89C8425281B
MD5 SHA1 SHA512 TLSH

Submit Download

5a65a3ee-d857-4a05-bd43-cd7c34ffa08c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\5a65a3ee-d857-4a05-bd43-cd7c34ffa08c
Size 886B
SHA256 0fc6c2b990c1f508238772cc3f2f77366b64d17a21d10a92b3f700bd81d416cc
MD5 9c2a07e5b553624ed4c9947045617fa4
SHA1 5d87ca916b557d4cdb67f7a43cec72d41974fb74
SHA512 8f688d8c705a7dcad60662a6b313ef92e0399f07b669278e68b605db051ef0c5af4c0336d7a01205736e6b2f9c49333f92b69404e487abbd2cebb18eafccd1ec
TLSH
T13B110491D621B8F3CC28D15F89E6775186E4703380CB1A147DA96E050CAA51EA36571B
MD5 SHA1 SHA512 TLSH

Submit Download

c97d5a74-a6de-466f-9ff6-937d387be31c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\c97d5a74-a6de-466f-9ff6-937d387be31c
Size 883B
SHA256 0eb3b4fe26451d05c3d9bcb9307eeb967ea93ff090faae7afcfdc08865da2511
MD5 354353a7ddbe087529554cfb96cdf19c
SHA1 ac6e2f1de8c3075bc8d02a2950b340f3960ecb4b
SHA512 3d2fb61b85d7c44a0da946ff204a17627fbb836a87be9165f0a8ed9ed9ea537fa95f5c36569e00bd045d517916c1d6b0f0104dd62707148cb80a9637b28c6a4f
TLSH
T13411C4819531B9F3CC68A20FC9A677119BF4B52380C655143DE65D150C6E51DA3AA70F
MD5 SHA1 SHA512 TLSH

Submit Download

e1cdad79-e61f-4c14-943c-c24c1d2dee8f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\e1cdad79-e61f-4c14-943c-c24c1d2dee8f
Size 2KB
SHA256 434702fed34488e51a1b176067681033dee5c5a23f1f3aa925f340ac75829c70
MD5 2da886297494d1825503660dd61a3406
SHA1 a14d1a59e9a7c65dac2c7284474a6312b3f4d244
SHA512 13d7f474883419f726dfc86dc07705d4579a240274512e73a2278de857776af200b2681d8d6dd467a0fc58ce1a02ed1bd756e61426bb369efe858c897c5de32c
TLSH
T17951876A8160D8BEC879A31EDD3537928BF2141B408B184EAEDCAE0B157FC5E9359605
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\extensions.json
Size 16KB
SHA256 006ffc7a0c1c34663691fe47bdfbc92a9acdeb2ddc1902b40dc2fba6f7e91e4f
MD5 c72c607d6f8d2964efc7902bab79c80a
SHA1 ffac308e79e149c8496ac64e01e7c54eb25c1593
SHA512 cc45bce1af8b4fb8cb20dc2d44a1148a9ae9827194e105160366e4cbf3bb13f1c8f2c73bd76d3e7eb059c8e97f7d197161d321eeabe9e6ba9856c1477a24854a
SSDEEP 384:0DkI4v0Umldvg8dhWSD94zY96owqL4HgL4PuL4H5L4HNL4Hnv4h2:0AI4cRfJXHp446Q4i484R4t4P40
TLSH
T1E172401545049EB8298EA78AEA367E01C37D573B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
Size 11KB
SHA256 c63559ce7249d8369746cd4c78f656fa70675a5a22a63c9f23baf386556508fb
MD5 c04a6b5663ff6b18d92664ec027fd485
SHA1 a4c8aef406f87fba7752cde663deb7a3986e17f2
SHA512 c6a0f2aad26ef96bed27f7ac6c5b7bc8c22c37a17bca61ffb156b0027d0783a14250ebca00e2df1c08ed7ef6d5d358982097d0f8e9128db7a6b1e0be9a77da40
SSDEEP 96:xHc9TU1qGqQf421ObzShSSlZdv9jAnJpwoDROZzKL835OBw88Ox+CwrSXD2x8L4V:CZRQf4213SSGLR0zfOBw88oArSXDDM
TLSH
T1A742BEBC6144CB3F20F2367DBC2549611AA1422B7ABFBCE345B99482445CF3581F6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
Size 6KB
SHA256 4314971d059f3c7982cc7278548028b82d85ea9d9870ce5546a2d40a7fd1d385
MD5 fa287c05c53d28f0b80f05e9aab8c666
SHA1 6be404165ff7bff67d579e1af8f167264e92f778
SHA512 1391cfd767d33617f274a72ef4d9e1ade3a2ac6af5f9b06f7a232d9d63937d20b427e9964bfe049b483a1ae5dda9f7a9e677a8831f1865979710ecd959305ce0
SSDEEP 96:xHcUTU1qGqQfA211zSZSSlZdv9jgGnJH9zzBw88H8L4cnc1qGq:C4RQfA210SSIk9zzBw88e
TLSH
T1A7E12E789408CB6F74B6776CAC6888316AB2013BB7BF68D750B954C5054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
Size 8KB
SHA256 7840fee6b423430864de4a9e4834cb06cc5db332f753c5cfa0348651771390c0
MD5 fed26d37f8f3d7b68574e4a7d59cad2b
SHA1 cc64764106a3648197c7018026700e6da01cb37e
SHA512 74e9a0f4925bc471ce9980dcae484f90e4e0620b16daad4c7661aa21cce5353c0f36ed3c153a5150e9df1a58b7ddac9372d72796c86b63f3dbe046b8c12a094d
SSDEEP 96:xHc9TU1qGqQf421ObzSZSSlZdv9jgGnJWROZzaBw88O8eMm8L4cnc1qQQtq:CZRQf4217SSIBR0zaBw88VLM
TLSH
T19802EEB86004CB7F74F2366CAC2449715AA2023BB7BF68D750B95485054CF3486F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 6KB
SHA256 8b25c84141dff6b86dd6c9f4c42ff42c39cf2050922dde25b64404076251bb28
MD5 d16c40c8434400be46c52931f12605b4
SHA1 ed1623ab212912f47bac95fde115233478f0bb7a
SHA512 302c59b3a5464cd2e859fcb78c8663434d94366c11a21af25d64e8b9cbbc90bf0de7c47e74970b0760f0fa0e0ae41829fc4bb25fdda9b962dedf293d4fd0c5fc
SSDEEP 96:xHcUTU1qGqQfA151zS8GLSSlZdv9jWjnJH9zzBw88H8L4cnc1qGq:C4RQfA151GLSSeh9zzBw88e
TLSH
T1D7E12D7890088F6F74B676ACAC6888316AB2013BB7BF68D310B55485054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 6KB
SHA256 dde56139520dc27bcb3d0b2fe9280c40bd5b26d78872ee8e6ba43242fa6ad732
MD5 d927f85b1a7b5f6b3af51887f009961b
SHA1 a015f52794354f2f18c45925c68664866c2c2ffc
SHA512 083964e4df9711011b7582de9a95c606df1f589e286d1ac75a65713648b3fbdd104906bc3e72d2bbb01bad795a12c8356350dffd21403e5ff21c56ca5bd125b7
SSDEEP 96:xHcUTU1qGqQfA21ObzSZSSlZdv9jgGnJH9zzBw88H8L4cnc1qGq:C4RQfA217SSIk9zzBw88e
TLSH
T144E12E7894188B6F74B6776CAC6888316AB2013BBBBF68D310B554C5054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 709d32ba4af075817afba4a3b133f0c99f02f0b401ad918205c00f959bd75765
MD5 5b802b626bccb1e19f291013d3b2299e
SHA1 0a9ca7d2f7779df2be2ac37b4319781c140baf12
SHA512 e7a0152072de6b3c223e9076efb0b7cf3c07a301993dcc61eec8cdec1dc74c5504ec856ecd71f3e7c8b8a4be37a4662ca12a751c815d50efa7a7f7ec14a4c9d2
SSDEEP 96:GLfzd9S8CI5q6njUH3SkX1QvYahxcNV0ErvKu0jw9:25911QCrYahyNVdvK9jA
TLSH
T1F0917D1749EF3F6639209D22E89C1E3E99FD950344B06CC0CA400EC25B1B58BBB9E09E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 777149736e5eabaa2979407d07620cbad1016d012aa75d6b637c7827b6f9e262
MD5 103cec62b4213c60babe9321ba0c59b3
SHA1 c5b46c364c335bba66852c97b39a42ba569bd9ca
SHA512 b3ac9f15cc3e7c51220d4d03688c7660310098a77f6fbbe0fd1544a017f55c9a3c602e1dd2113e3a3fe6b45e5c319850795326bb01d2ac4fbcd2abb7d4340350
SSDEEP 49152:5IbfpQBfzagT0lbDoYs/1gbiHbZMblZITt1v8UOcS:abfpQBfzagx1iiHbZGrIZJ7Oh
TLSH
T1F22639E860D1A257F3814073B64553EB21FFD00C6037DE084BA956E9A4B8CDF9E16B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads