hxxps://heb120th-giftcards[.]com/ihew9EDXh0O/zMrvUQkIUEB6HRbsBErq9df3b7

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://heb120th-giftcards.com/ihew9EDXh0O/zMrvUQkIUEB6HRbsBErq9df3b7
Sample260803-vbvmtsfn4t

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 3068	3656	firefox.exe	80
PID 3656 wrote to memory of 3068	3656	firefox.exe	80
PID 3068 wrote to memory of 6080	3068	firefox.exe	81
PID 3068 wrote to memory of 6080	3068	firefox.exe	81
PID 3068 wrote to memory of 6080	3068	firefox.exe	81
PID 3068 wrote to memory of 3368	3068	firefox.exe	82
PID 3068 wrote to memory of 3368	3068	firefox.exe	82
PID 3068 wrote to memory of 3368	3068	firefox.exe	82
PID 3068 wrote to memory of 3368	3068	firefox.exe	82
PID 3068 wrote to memory of 4076	3068	firefox.exe	83
PID 3068 wrote to memory of 4076	3068	firefox.exe	83
PID 3068 wrote to memory of 4076	3068	firefox.exe	83
PID 3068 wrote to memory of 4076	3068	firefox.exe	83
PID 3068 wrote to memory of 916	3068	firefox.exe	84
PID 3068 wrote to memory of 916	3068	firefox.exe	84
PID 3068 wrote to memory of 916	3068	firefox.exe	84
PID 3068 wrote to memory of 1604	3068	firefox.exe	85
PID 3068 wrote to memory of 1604	3068	firefox.exe	85
PID 3068 wrote to memory of 1604	3068	firefox.exe	85
PID 3068 wrote to memory of 1604	3068	firefox.exe	85
PID 3068 wrote to memory of 2240	3068	firefox.exe	86
PID 3068 wrote to memory of 2240	3068	firefox.exe	86
PID 3068 wrote to memory of 2240	3068	firefox.exe	86
PID 3068 wrote to memory of 2240	3068	firefox.exe	86
PID 3068 wrote to memory of 4792	3068	firefox.exe	87
PID 3068 wrote to memory of 4792	3068	firefox.exe	87
PID 3068 wrote to memory of 4792	3068	firefox.exe	87
PID 3068 wrote to memory of 4792	3068	firefox.exe	87
PID 3068 wrote to memory of 1704	3068	firefox.exe	88
PID 3068 wrote to memory of 1704	3068	firefox.exe	88
PID 3068 wrote to memory of 1704	3068	firefox.exe	88
PID 3068 wrote to memory of 1704	3068	firefox.exe	88
PID 3068 wrote to memory of 4412	3068	firefox.exe	89
PID 3068 wrote to memory of 4412	3068	firefox.exe	89
PID 3068 wrote to memory of 4412	3068	firefox.exe	89
PID 3068 wrote to memory of 4412	3068	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://heb120th-giftcards.com/ihew9EDXh0O/zMrvUQkIUEB6HRbsBErq9df3b7"
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://heb120th-giftcards.com/ihew9EDXh0O/zMrvUQkIUEB6HRbsBErq9df3b7
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {6b4b46d9-f336-4593-b9c7-bfb4ca686e9d} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {b6d73662-4b34-4c06-b88c-f06d143025dc} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3708 -prefsLen 25164 -prefMapHandle 3712 -prefMapSize 270279 -jsInitHandle 3716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3724 -initialChannelId {b17f5a52-fea5-4200-94fd-766ae159b2d6} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3872 -prefsLen 27274 -prefMapHandle 3876 -prefMapSize 270279 -ipcHandle 3944 -initialChannelId {5595d814-206e-45af-b7e6-06a098a0456b} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3088 -prefsLen 34773 -prefMapHandle 3100 -prefMapSize 270279 -jsInitHandle 3104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4408 -initialChannelId {89195650-23f3-474b-a353-f4e252a8802a} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3056 -prefsLen 35010 -prefMapHandle 3108 -prefMapSize 270279 -ipcHandle 4992 -initialChannelId {d93ec294-9c72-4d5b-81ee-16790d9870ea} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 32952 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5312 -initialChannelId {9e1c81f4-e260-48c8-9655-434dcd3ad951} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5296 -prefsLen 32952 -prefMapHandle 5300 -prefMapSize 270279 -jsInitHandle 5304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5320 -initialChannelId {21dc1c5d-ab39-4dd8-994a-0b1d77e79541} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4688 -prefsLen 32952 -prefMapHandle 5636 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5648 -initialChannelId {745e7c95-fbb5-4cfe-9b85-ad1f46411862} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 13e1e753bbf95adf1ce5241febdbc48622345c6d76c7ac75dfb4e7d667eb8cba
MD5 3f2d24eb041979f7e7310287ed580803
SHA1 4f7358543732934a10c6c2df41c7303d3bc791d3
SHA512 26fadd640b219b830cdf1c2a8f80230d5528ecd1e113b3c772f0c025bdf76399b3f20aad8969223c7b2ed1f8f8c675e24099a2eeb1fe4e0522e6fa9f80cb1896
SSDEEP 384:HwCe7iO024YJDL84KKDL849B7SOEAd9KVRaAcP+AWRMAp9O:QqZYJDL8lKDL8CB7S/AmVAf+hRMu9O
TLSH
T14D729D7E9F413CAC1997C0E8C5F892DA4C18B6A3CFE6806D21683D0DC798969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\AlternateServices.bin
Size 10KB
SHA256 3b5d811009d27fb745c49ee5163c3f647f92506614c5289e950596a8848ee665
MD5 9acf475ac95c89cdfe37dc24d05f44d5
SHA1 dedf842f87e2225cc0b1115d1ab4a8558d907c7d
SHA512 ce7e66a1bb39d52ef1a4617988164c1f040dd978763f7235554c57ea3440a87f094deff6fff5441f7600e7e45e9e2d71609984779576a26d150d3fa0b1d49cce
SSDEEP 24:XuhMZSEPq0ZVSPHtPtG0Z60ZlU0ZV0ZxiW0Z10Z190ZI0ZRbO0Z/0Zl30ZIZ2A0V:VTqJtDHAQgipFHy45B3TaI
TLSH
T14D22CEE367767851F52B8FF8405C7889DC73231D17509AE98A72A0E60341AA2D83EF9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\AlternateServices.bin
Size 12KB
SHA256 7c22a7ec69c8820dd239e03b9e0f88638169dff86bbeae11bf752c157a3b8f58
MD5 34a7d12bafd727656d2a7d467fee259f
SHA1 c883b320f22ecd9302fcbcebda6b6b725f6dc051
SHA512 b78110959d7a223c080d173134a24b25472bd735a6e51f604ab9147b58e7f589556c637f8a411814e8a4bf3fc7094e4ad03f3407b5780105920b5b35305df87c
SSDEEP 48:PHTqJTh7lGyWUoFS0mwB3Ta5jjoThomo5D4:PHTqJTh7lGyWUoFS0mwB3Ta5jqWD4
TLSH
T1394200F362367892F4270FB814587849DC77231E1B50DAE48A62D0E20345B92E83FF9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\db\data.safe.tmp
Size 60KB
SHA256 df925818bf17f82b6568be565b154e2f4dfda2a37bf583f6c6cf3d98ac36b47f
MD5 5c655995c9502e8c42738d4628b3c3ea
SHA1 0c7f4ff811ef8ebc42f6d432d39179ddebda1a17
SHA512 54c7a0285ca03e0d29634a4718b05e4cfefdef29cd17eebfdd622535664caec8f4109e90fab08a5ca589ab67080be3e6cc759604a5853d4b648b1cae9b2385be
SSDEEP 1536:VpEnP28onWjV5dB5X01GYabb8QwB95ROP4Fw/tlnD:VpEn+8AKV33X0ETEFzzq6w/rnD
TLSH
T1C3532340EB1E553FD82802BA9C911B103F79F8895A0A2F6B375C54386D873ED3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4172837e9f7e8258c3b120ffe9f71bc2f96f4cbec615a5311717b04b8786180a
MD5 07f0f6e9d18d75096d1bee0a3b4a80b2
SHA1 1432662496d305f01768ba7a59fff68539843db4
SHA512 c17da75dd076f0d4920038046b5eeb83d99b4422a863d6a7c0eff7620f346e3ca2522c5bfcaf02d7ed9fa16ba370a578c2272d8eabcc0a0d1e4086f5c73e1419
SSDEEP 192:BwI1d66Joz0dzgCl6mc0djFgOv5zboHUZTbGyjPy51:+id66JozQzgC1jNFLbo0ZTbGyjPI
TLSH
T102E12CA4F628863FC408437BCCA61B400F39388AD84E3F2835AD641D2D576DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0f4c2c426ae1f68054e1aec6726058d55a9e2cedf30f572041ca72de9674c2aa
MD5 4333000580fe926f6dba745a085dfa45
SHA1 2012f3d8d8a3f85eab0f25be4af27b0150582cf2
SHA512 91f432bc33707c5612df8b6a24384135d6bfc7081403fa4f09650e7da1fbe940bfb96ebcb2cf6f27314d14c4a78850daa019370333b90186022c55447bca0485
TLSH
T10D21379C79B98D2BA8C7F39CB841028E67554A0705871C938D02FFCDCE91AD9326A97D
MD5 SHA1 SHA512 TLSH

Submit Download

3ccd73e5-8165-4f66-ad41-fd410f1bfd8e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\3ccd73e5-8165-4f66-ad41-fd410f1bfd8e
Size 931B
SHA256 56ed28981895e0b7c2b7fa34a9324f3cf06525a99a9e8892de39d3b2ccfe376e
MD5 2a7808d02442e2e1879ce73a7cd5c6f0
SHA1 7493a58b76c28e2b5d51041192d4400627c47f22
SHA512 9b2ea3927412191b41bc4c5335de369adbe2ef0b157a404ec89c1586f18a9a30326e578e86d590a1f135f39bbb4443373d73e036ad5f2da97c6663edac26b461
TLSH
T199118450D66576F2CC3CD2ABE4A13742A7B07823C0C60D043DA00E080CFBA5FA35A60B
MD5 SHA1 SHA512 TLSH

Submit Download

6aae3562-f0e8-40dc-9c1d-33d026c4d821

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\6aae3562-f0e8-40dc-9c1d-33d026c4d821
Size 235B
SHA256 bfe491dffec02f85b3c180b2e06d6d2ae438bcf936ea444e17e04ea3f7e3b769
MD5 2ac5e4d35f58bd153b82044183fa5069
SHA1 d90974d6dc42318afc6012ed8b354b59986a5268
SHA512 329838c753d1641a09ba2d3ae0bf791894f5ac3908afba67cc43f2cc391b7c50a09060aa5ec5d528bada57b78061c9496e69a09ecd36cf94e4e4eff22314f4dd
TLSH
T14DD0978414E877FC49180F03F0A07CCA35C84C3310A55810C7A005389DFEDC48391807
MD5 SHA1 SHA512 TLSH

Submit Download

7a88b77a-7ced-475f-8410-61f0df41da64

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\7a88b77a-7ced-475f-8410-61f0df41da64
Size 2KB
SHA256 16d94a90aae71537e12999c7abe83e0488de737fa57b29cee91c8e9c264b4422
MD5 78d67fd275f3aeecb9732b2aff444a1f
SHA1 7c01290c41ab3929f52ad756b31d6d45c3d8335e
SHA512 bde52a2161da347d09c367bf3da8e965236dbecbef07ae806089594cc327a7dd588b5d09e5a4886f46e310efe420b1844975e6da0032fb38ed0b33baf2ae478a
TLSH
T1A641375D36789CBB9C9EE59DD592374D53608A0300D61C432DA1DF0C8CE679E336A53B
MD5 SHA1 SHA512 TLSH

Submit Download

8812f067-a16c-4904-a9b3-3254346b96a3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\8812f067-a16c-4904-a9b3-3254346b96a3
Size 883B
SHA256 20e685b32176f812ba5523b31629cebd775e6951f9da4edc636770506d33a4af
MD5 9b8a9377075008a1d0fe14b91c800d56
SHA1 3a676af2e4bd6de475a48055649676f8c21d8e2d
SHA512 7eb29c245dc016a07a09fd9f6e3de84e4d98c961c4d6811ad6dc802715db89b203da601e594956b2962eddc3ce200c48c6015c4f426955daea36e74e616f7d90
TLSH
T137110081A225BAF2CC3CC25BC956770247E4B923C0CA44143DA149184DBEA5EA36A60B
MD5 SHA1 SHA512 TLSH

Submit Download

91b84779-cb22-4bdb-91fc-daa39b534e0d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\91b84779-cb22-4bdb-91fc-daa39b534e0d
Size 2KB
SHA256 2723e4a66c27cd1fb1eee2a7c61d83bd0d92948ac661aa8f04142ae668baabb4
MD5 a610e1c8e923f31ef6a902a297fcb0dc
SHA1 ced95b00266032190c7b0571882a5a5883f51210
SHA512 2d29814f3f4ab1e53d0270f00b9bfbfc40048ae62095d06afd94324a7317435326df0bdb647d4c6a2d7cb3bd4143dd0698a5a4ba19bca355fef3c022adbbf701
TLSH
T1355197665160CCBEC87DA31AD92137828BF2180B409F184EAEECAE0B157FD5EA359645
MD5 SHA1 SHA512 TLSH

Submit Download

cc5aa021-7a31-44b8-a18e-3da22f445b14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\cc5aa021-7a31-44b8-a18e-3da22f445b14
Size 280B
SHA256 45dd99f3cd7d8bd01b25645305d57ca588061b948bbbd581a010953996cc15be
MD5 564e1af509062e9d952c379604efbb30
SHA1 8169f90f71aa7fc0d4d79cdaf160c02b1f7f0c5b
SHA512 f17c1cd6b9a5374cd33af0669cc5ba7f52327444c646f3de3705b9ef9741a055a7fc7ddfd1d7f418c515c60388443052f2c27528145c770b730f4205535e5cd8
TLSH
T177D02BD56C88676D0C681F1BB0B07AF771754C33D1F29810D6910534D5FEDCA8195D1A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\extensions.json
Size 16KB
SHA256 5b539db622aa83d15005d93eee9ca3c7073d15c8a903e52bf724548501dacdab
MD5 c701d692dfd59c85bfad8eced8447557
SHA1 ed05c6faaf554d52535539d5940a5cd5d337d22c
SHA512 0a73c5baa44d66db3f30fdf7b992cee0bfb745b5677bc8afa81dea4e892ddf431c3e0e70f447000c7755d031bc3ea4f04baafc63956eccf3d52b06ed79146d49
SSDEEP 384:vkI4v2Umldv58dhWn94zs96oNL4HbL4PnL4HpL4HrL4HjE4hL:cI4+RfqXy4E6m4n4j4h4X4Q4R
TLSH
T14472421545049EB8298FA79BAA367E01C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs-1.js
Size 8KB
SHA256 55b99a16f2e9098829d7752cf7c3feec0c709b32ffb251ec620b57f3ef19e0c6
MD5 8435188ea63173954749b8e2c9436d5b
SHA1 88e4d6b7fad1ddcd4660dc1b3d7d19f775722fe0
SHA512 6278561ecf8a13a614ac70647a9ab1afe1e1abf54a29133e53bc612821c844d559d7c352cc57ac5c2ac6d27b73705ee21d82d4f6de38996f611a6d4800d7ac1c
SSDEEP 96:xHV9TUYqGqufQPGObzSVFSSlZdv9jen2WRMejbgBw88FJh8L4cnYuoOc:LORufQPGhSSkRXvgBw88rV
TLSH
T1D802EC389004CF6F74B677BCAC2489716AA2023BB7BF6CD610B95485455CF3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs-1.js
Size 6KB
SHA256 90638a78cd5edff90feacc487bd460e00151d19654129b4076fa9cee5f7b83f0
MD5 4c0810b46ec60255a2031829b3028463
SHA1 5719da06efb0de34437b503c23a463fc111cdb25
SHA512 e66a8f50465b8f5a2b5a089412ec64379808e85af84c0bcaca2a13593c58780ef709f32ec5eb5239614306171316e813b181c2073167affe082900f349744b42
SSDEEP 96:xHVUTUYqGqufrPG1zSVFSSlZdv9jen2H6jboBw88H8L4cnYuoOc:LjRufrPG6SS16voBw885V
TLSH
T13EE11F789408CF6F74B677ACAC6488316AB2013BB7BF68D650B95484055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs.js
Size 6KB
SHA256 34f9ba3e316a27217b93ed2817b883afd8d6d6cebcd03e5cdc9edf3eba446f35
MD5 48980f1933d39a0a5da6aeb4e5766512
SHA1 ba5a915a990edd5f80dace12ff294ab584c89728
SHA512 b5b99c57a96228b6ede5ee983acd2b280df3181bfb7c74a7a29589c78a1202cef43fb62622c8fee1ad0ed8d7838034d80ba44ca830a5eaeee9d5d74fb76056ca
SSDEEP 96:xHVUTUYqGqufroMv1zS3MgSSlZdv9jyn2H6jboBw88H8L4cnYuoOc:LjRufrLvqMgSSp6voBw885V
TLSH
T1F4E120789548CF6F74B277ACAC6888716AB2013B77BF68C710B95484055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 f959aeb68983d6fb029484f2a33213632ca034263e8b032d9230a1ec6731e9c1
MD5 5532f4199bb0b3583d81266dd5b43b9f
SHA1 5841c3632df67a0770116715f937fbc1ca13e5a0
SHA512 6925f9d27f79d6e478ef3729b4956ff3bad1657da0b0666d1142d25d86ec9f36febccd6a28dd97aa78ddc65ee03e24cc045492f745fdecd3b25cf6896c4d2d9c
TLSH
T10F412A93BDB63EE1B576A12C548B4FB3D392242305AAD8A0C166CC821ECED66B248409
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 d37afb0fa6f67ce37b46e56da8647bf9b4d4e95d6a252f5f1f0c2cfcc2278c16
MD5 aec0ec542131ae9feef8bf50fea9abe8
SHA1 91c93f3c450f7123f9b6d857a1b76a8490012e60
SHA512 b858cd5944c166104f2df235ba1a2ab03c94dad7b8fdbcc0119dba327d2fdcf5533418a927b7ea95fdb182dd29b3fb7a0b1be16fcd21a7244f4df7982bbe7e6a
TLSH
T105412A93BD763FE1B566A11C14878FB3D392247304AA98A08166CC821ACAD67B24840D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 583bf6ba8a03145ea2df63b99c05a01b19903aa0a840e34ba2b1525dedeab77f
MD5 e27dd32501e16b817b728c5e733490c8
SHA1 97ad434e25d68f46fdfcce99c7f5d520d1bc053a
SHA512 e80bb88a539f08275be6f56868d44c19b5c6b6946ac72ef0da864ea0454116961d6e0ea2f99399d37c7d431f5076a5656affcb896a4969d8f46e36851ada0a50
TLSH
T1DC410A93BD763EE1B576A11C54874FB39393247305AA98A08166CC921ACAE7A724850D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 fc20e3a454c20d4b326f6962cadf8c4123cd6fe1fc01262336b4d27269edf451
MD5 0008f829daec02e96fd348e4b8db900d
SHA1 5507669d0cff829da5c5cb51b30555049f659320
SHA512 7c9a04259a7bac4bbcb51515b8bf2c222a50c466d83132da6b7c7bf97fe63040c1874cd51f4747e45851604e65746edfea1316b70c17d3a0759ab6befd82dc6e
TLSH
T134312922987D3EE1B5466239888B5FF1C391211306B96CF081AECD7215D930AB28D98C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 75000277d6a29ee6d1714b50c5211d43bdee05a608110603061cf23ad937755e
MD5 3fd6eea0f1451ca7430b88847e935bda
SHA1 bfbc2e01125e0589949f6c325ce2d9863220e560
SHA512 0a8235baac6fb4635d0f6923efd2a636a359410fdd96fa831e5788a40da305f6e96933ae91f86f53378ed1c637f0bc49a275e3dccf7aa2842f94982c481277be
TLSH
T161411D537D763ED1B576A11C54878FB3D393247705BA98B08165CC821ECAD66724850D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 c7d724ac4f490a2046d851ab4a28487a96449e1dd1e1386113e562fdf228410b
MD5 92798c399455a39cb61f90cd60b515c4
SHA1 160f2df629c78791416849197208560e62a75e9c
SHA512 51c5ec1a3bbdfad28cca754bf3c315ef49b09ced6cda70463ea3731d1cf2ea9c8f62e716181580ca62204db12610be07e35a65213ce069d6b97933708f91ea39
TLSH
T10F410AD6AD6A3EE1F669D11C54478F73D397216704A688B08266CC832ACEEB6B28440C
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 cc45fcf9a9d77a09681ac79e0f75af27a5e1c2cb80a122e92cd24e27aa848563
MD5 b532fb286796e16188857d041b7265b8
SHA1 89f07d325831fc2a58eb1911f0ba2874213d5302
SHA512 c3e2cee0c8c704e852a488e4f4f1d21ca8b2e09358ff52d459a6073faed2cd58dbcfe22f80cee3db79f36730acf40d6cde67ffb783a659cd771b9475e44f6c3e
SSDEEP 49152:IXq3QWjgmKR7bgYYv/FhGwF1+BXzwaz9NEn90i:Mq3QWjghEFhGS1+xzwaInii
TLSH
T1A42639E860D1A257F3814073B64553EB21FFD00C6037DE084BA956E9A4B8CDF9E16B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads