c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f

Analysis

max time kernel
148s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.7MB
Sample260804-lkyleawhqa
SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
MD5 edaeffe92dbfd973958c9d2267201b32
SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
TLSH
T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
211	bitbucket.org
230	bitbucket.org
250	bitbucket.org
43	raw.githubusercontent.com
66	raw.githubusercontent.com
111	raw.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	firefox.exe
Token: SeDebugPrivilege	2008	firefox.exe
Token: SeDebugPrivilege	2008	firefox.exe
Token: SeDebugPrivilege	2008	firefox.exe
Token: SeDebugPrivilege	2008	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2008	firefox.exe
2008	firefox.exe
2008	firefox.exe
2008	firefox.exe
2008	firefox.exe
2008	firefox.exe
2008	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2008	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 2008	728	firefox.exe	84
PID 728 wrote to memory of 2008	728	firefox.exe	84
PID 2008 wrote to memory of 5036	2008	firefox.exe	85
PID 2008 wrote to memory of 5036	2008	firefox.exe	85
PID 2008 wrote to memory of 5036	2008	firefox.exe	85
PID 2008 wrote to memory of 4248	2008	firefox.exe	86
PID 2008 wrote to memory of 4248	2008	firefox.exe	86
PID 2008 wrote to memory of 4248	2008	firefox.exe	86
PID 2008 wrote to memory of 4248	2008	firefox.exe	86
PID 2008 wrote to memory of 2028	2008	firefox.exe	87
PID 2008 wrote to memory of 2028	2008	firefox.exe	87
PID 2008 wrote to memory of 2028	2008	firefox.exe	87
PID 2008 wrote to memory of 2028	2008	firefox.exe	87
PID 2008 wrote to memory of 5000	2008	firefox.exe	88
PID 2008 wrote to memory of 5000	2008	firefox.exe	88
PID 2008 wrote to memory of 5000	2008	firefox.exe	88
PID 2008 wrote to memory of 1844	2008	firefox.exe	89
PID 2008 wrote to memory of 1844	2008	firefox.exe	89
PID 2008 wrote to memory of 1844	2008	firefox.exe	89
PID 2008 wrote to memory of 1844	2008	firefox.exe	89
PID 2008 wrote to memory of 2800	2008	firefox.exe	90
PID 2008 wrote to memory of 2800	2008	firefox.exe	90
PID 2008 wrote to memory of 2800	2008	firefox.exe	90
PID 2008 wrote to memory of 2800	2008	firefox.exe	90
PID 2008 wrote to memory of 5060	2008	firefox.exe	91
PID 2008 wrote to memory of 5060	2008	firefox.exe	91
PID 2008 wrote to memory of 5060	2008	firefox.exe	91
PID 2008 wrote to memory of 5060	2008	firefox.exe	91
PID 2008 wrote to memory of 1084	2008	firefox.exe	92
PID 2008 wrote to memory of 1084	2008	firefox.exe	92
PID 2008 wrote to memory of 1084	2008	firefox.exe	92
PID 2008 wrote to memory of 1084	2008	firefox.exe	92
PID 2008 wrote to memory of 5048	2008	firefox.exe	93
PID 2008 wrote to memory of 5048	2008	firefox.exe	93
PID 2008 wrote to memory of 5048	2008	firefox.exe	93
PID 2008 wrote to memory of 5048	2008	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:728
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2028 -prefsLen 27099 -prefMapHandle 2032 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {e459faf3-9e8e-41ff-bdc0-be856bae846c} -parentPid 2008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2504 -prefsLen 27135 -prefMapHandle 2508 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {5de2c258-6584-4d3f-a5fa-568283639164} -parentPid 2008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 27276 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {86039ce9-2d5c-4173-b487-23f1b04f7b75} -parentPid 2008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27276 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 4104 -initialChannelId {0dd34b48-0e28-4a83-8bcf-df61268ba149} -parentPid 2008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4332 -prefsLen 34775 -prefMapHandle 4340 -prefMapSize 270279 -jsInitHandle 4344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4352 -initialChannelId {621d73ee-aeab-4d89-9842-8436ad67ed36} -parentPid 2008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4800 -prefsLen 35012 -prefMapHandle 4712 -prefMapSize 270279 -ipcHandle 4744 -initialChannelId {749cd92c-eea0-40b1-9c25-41e5cca696b2} -parentPid 2008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5056 -prefsLen 32952 -prefMapHandle 5060 -prefMapSize 270279 -jsInitHandle 5064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5072 -initialChannelId {d68dc39d-4cb7-4f27-92ee-e896294128a0} -parentPid 2008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5088 -prefsLen 32952 -prefMapHandle 5092 -prefMapSize 270279 -jsInitHandle 5096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {2a97e5f5-2866-4041-8265-daed3e45d891} -parentPid 2008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 32952 -prefMapHandle 5484 -prefMapSize 270279 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {605ba645-b971-4141-b1a7-bff5794be441} -parentPid 2008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 accd6e57d2a960e9f9cf7055c141a40f954e5ad3548539261eda28d1d54ad560
MD5 24aeb427824d29fa6516bd191431b757
SHA1 ec1b8c0ca49281143cd04d43753f80f8093bf626
SHA512 13ac0688c7767a47620c19bb3be98446c5e10e6165df45324a91ab1acfb1f98be8e3353f97f6131e86fc2f462d214a0a7567d8f64f828a0a7e7f77d142ae453f
SSDEEP 384:HwCe7iO024YFDL84KKDL849B7SOEAd9KVRaAcP+AWRMAW6L:QqZYFDL8lKDL8CB7S/AmVAf+hRMh6L
TLSH
T10C729E3E9F013CAC1997D0E8C5B992D94C19B6A3CFE6806D21683D0DCB98A69B0F544F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 7b2481eb76e5c6ad16d05d61700dc9b645d4c64fd4588cad5ce78bf53573eceb
MD5 d19bb90553f8ca80b90252b383fe9aaf
SHA1 e8f3e4780fd250f04670892bcfe1ee025d92607e
SHA512 90836d963eb48f709cb958cd31128a646c3beed01312641c629840aeb708ec50cbad4e71dfea6e14a5b0a45a1630b5c046ddea2c4d75bc606123e7c9e64a2724
SSDEEP 3072:j3lccnmEK0180GZ7ZX7LOvEaF+LMjkx4o:pcGy06pXCyH
TLSH
T101B3AFF6DFA2C92D94FFD01DABC2883EFD266410B3A33409D9137314A1C6BA47676649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 35fb17e426ef126928ccb6dff800c2876d90dbc4ad9f86055cfa83d4cf30cdf1
MD5 7206b5e7738301551e5c614828f5affd
SHA1 67322b5fc452d4742b8b1a3aa5ad1bb01ccc95d8
SHA512 b0d93474eb50d4d286f7386ab39c25780f992cb74798ef33ece1cce7673f2375f5befc45ebf250d7ac47a8a1e50d8271bb6fe0c8915b039176d4f7b6cab8ecc9
SSDEEP 192:6Z1d66JozGzgCl6mc0dnOv5zbowZVtyjlxI:6Xd66JozGzgC1jObowZVtyjQ
TLSH
T10CD1CD68E728963BC444023BCDA61F400F35799A9C4E7F2532EC640D2D576DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b118ae4299113efe7a8e5eee70498b0a8c4f23742f51704cc78da904b851195e
MD5 90ed482ad369cea9ddd349008e921bab
SHA1 1c7fa00cdc87883b2e40e55756474e1411baef70
SHA512 4afc78d697b1201959246f97881c2ff685a318f18d533a9929f1e729d030549826749744aeb6f0cf61c24b0b256bcd10a6f8f34c784dd71bff345fff41e71af5
SSDEEP 192:6Z1d66JozGzgCl6mc0dnOv5zbowZVtyjlxBxI:6Xd66JozGzgC1jObowZVtyjE
TLSH
T1C8D1DB68E738963BC444023BCDA60F400E35799ADC8E7F2532AC641C2D576DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 65358e2e21e8d9705882d0c8916b51582968b2efe49f12fb366aaa53206ab61f
MD5 882763e4942f7e082cc49471e23b9a59
SHA1 039a426017ade49a524ad0ca7ac5795f5e64a697
SHA512 576d61367513212028d0d4d5887d5b878837e27130eb584b2b4a6efbf45b3a5e383ba2360782d90c6174fbb0259623afccfd641fec3ce8be0ebed7557b50a4c5
SSDEEP 192:hZ1d66JozGzgCl6mc0dkOv5zboPlVtyji8w:hXd66JozGzgC1jBbodVtyj4
TLSH
T1E8E1FE68E728863BC414027BCDA61B404F39389ADC4E7F29359C640C2D576DE7ACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 8457b5e20111c96627a1aa49a4608c361b8e5c6f6b942117e4b3ffdc1c1465a3
MD5 003590d9fa1538865da0bee66147f3cd
SHA1 ccc3b0e20a9ab0993514a7638bed49b1c637d1a9
SHA512 fa9650de1c88e62ec322628ddbd5f5eecdb80ec0e613e5b3fd5d50006fbf7e6a30e7c160655978af8c0517f7627e1bc5df5e43b8929d5ec694c8de6ac200a196
SSDEEP 768:hgEf/4H+T8vGcmhuc4u3KShR5wbfbpt0b:h5/4H+TX3UO
TLSH
T1A8D20044EB6E953FD41512BBCCA50B002F79B88A59192F973A4C646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 cdd65fd48ae29754ac5aa2185b0f232f0d5daf4cd7e189435e8aa7d9905d6914
MD5 f5bb0fa9e3756befc2bede92bdbf7338
SHA1 a2f0927a495aa50c2033348ec14a126222bbdc6a
SHA512 46e030568246f8363c1bdaa060457b316803146a07864c650fb74229f2517eb4d1b158d13fdc1c5addf26ba64c132ae0a0bd8dabe5985cb5b144c7278139ba36
SSDEEP 768:+/4H+T8vGcmhuc4u3KShR5wbfbpFgEw0b:+/4H+TX3UFp
TLSH
T1EFD20044EB6E953FD41512BBCCA50B002F79B88A59092F973A4C646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 0bb318575e03dee5db55611465ffe16fa47062c53e6ae835430773e15af0c0c7
MD5 1423929dd67f34475e1b338ac03ff9f7
SHA1 45b7b3b6cacad468ed8a5160bff08b5682009752
SHA512 2c37399ea9a2d8852b7674b3b1109a121ccb1501577b82f1a13b67da4a1f8400e01a25eb52f2d66f6b268ec286f2293673b54e876a8fd8721701b9b202cdf55e
TLSH
T17B61A858F228863FE4454139CC9B1F411F347446E8AE7F2A35AC608D6E5B2CD7A8D13D
MD5 SHA1 SHA512 TLSH

Submit Download

058f03a0-aadb-4e39-9ffb-9a6aa33d86cb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\058f03a0-aadb-4e39-9ffb-9a6aa33d86cb
Size 2KB
SHA256 d17686334db8c09b4af396163618e90718ca8c21cbe6e2bcae3d846e7c44aecd
MD5 6ba4d9ccecf7121e8084ef3fc8934e02
SHA1 efe8f4573120094f9a63c04de6bf67ecc0df1a17
SHA512 c1b6601927685078b008173909790186a959d655920ec19965ba5ad13e19617c3651577aa70d9ed2f1a537c11d610ba943cdcb95c6ae8d2dd86c714eabe430b2
TLSH
T12341235C3578ACB68CDAE59DD5C2374D57A0CE1340C628832EA1DF4C8CDE69A236B46A
MD5 SHA1 SHA512 TLSH

Submit Download

3ee0ec54-f617-4670-a15e-9ce8be3d3af4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\3ee0ec54-f617-4670-a15e-9ce8be3d3af4
Size 883B
SHA256 0ecc4477f6881021ffd78f334d9333e3a11b4245c942eb7d99e1dc46c01e53ea
MD5 2d27b591d0d8948941914c439a0183d7
SHA1 655f99d92776e33aa6305a6a692c0fb65819912d
SHA512 4f3af71d4b915f122e42edae70e0f18e187b3580049568b50cb84ae65ea78d70d8356862a0539038d86004e8c8d275d3e1e167fad124c877c63eca8f8cea165b
TLSH
T1701123519774F9B2CC68D35FCDA237015FE4752384CA90243EA55D080D3B92E939B20F
MD5 SHA1 SHA512 TLSH

Submit Download

66024971-dfce-4bc3-b394-1ed3d7865520

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\66024971-dfce-4bc3-b394-1ed3d7865520
Size 886B
SHA256 5390c9756de2e218400b7656999d1d1ddffb744d846bb560df2d9c88c0a34eb7
MD5 790d5f51073568cc1f0ed6b4f0502b8e
SHA1 02923a03a9c266cee50c0c1063acab605df29638
SHA512 5dfdfecb0aaefd5404c64569e219175fba46a77ee14fde482862c75ad37628e8aab6857372b701bfb474f0a35e8ca8facf92d35158f672ac2b362c7781134715
TLSH
T13011045047747AB2C874D25BC6E677015EE47513C4C558143F544E081CAB91B536B70B
MD5 SHA1 SHA512 TLSH

Submit Download

dee96f05-b5f9-4797-a3c6-79d6ebe37a56

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\dee96f05-b5f9-4797-a3c6-79d6ebe37a56
Size 235B
SHA256 8d182b19e1860bcd527106b6efe2c8b4c1e396ca7a5d8fcd119cd37f9d1630ed
MD5 4d5e9bae0f3b3c7fa4e17fea9c4dee89
SHA1 d3942877b92f6ca5ace41dff9b9362c0a93282e1
SHA512 f293f8cf7dd9c4d02c31ba9f0d0710f5de273e8fa80371a3f106ed39e88481b10e8ee9403c87d57699dc9f081b9a5c755d2f765a94fa6e5c14fb7af691dedbab
TLSH
T1D2D097D06898276D08180F13F0E079CB308A4C3320705CA0D9A090749AF8DC8415381A
MD5 SHA1 SHA512 TLSH

Submit Download

e35ae674-17a6-47ac-856c-70d7b399e5e5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\e35ae674-17a6-47ac-856c-70d7b399e5e5
Size 235B
SHA256 c244d2b06cf2bc00b4e0233787f1b09ef9e12e30ccf42d53cb490573815a49e1
MD5 f79e62efcc89e6f7e0fbbbb771b1b51f
SHA1 83256fcae6b1d0aaf776b86f9d89aafbf00459ed
SHA512 f93d1d498fefdf47b888e21e1f6fecf2f69543f40283aef74ca802129bcc32cc8e91e402f3b970c8a17e3796a3682b1cdcfbf6256c2e447da9f6e8d02d631e9b
TLSH
T1BED023C06488B31D18341F03F0E02DC730E84D3314F098A0CED001748EFCEC99292847
MD5 SHA1 SHA512 TLSH

Submit Download

e461841e-3193-41f5-b02b-c04d6c492c7d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\e461841e-3193-41f5-b02b-c04d6c492c7d
Size 15KB
SHA256 d5e1c3e770ad07adc310b96dd94211fb3515db085a606a6b3ef5c0a71bcd93d6
MD5 0827ab2af946d7780c5a0f3cdee3b69f
SHA1 085cf3b5dc1222ee4a14209749b7e677b23fecfd
SHA512 e0b18465d56ff8d704a1fac57d14786efa2157c60054fbfe1db2a3ff68a2ff150ed3b0e2885b68877522988b6e12d5e8e99c7a0b0dd53b442240ca504783ede1
SSDEEP 192:ThUuT85Zrtr3DxY11zKfyzPpBN8iXekKW2yEw48VagBaVlH6dAvPoKcoLXHG4zxj:TLT85dtr3DxSmfesS9284lHUaXfdR/
TLSH
T1FF72C816686056BA8251E36898FC7FC3E6F528CF4C019FCEDBE4BD085DDA06D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json
Size 16KB
SHA256 0792dddf0531bd5aa9b6bb4d65db06c8b171ef101b5a51329e966d91a72642dd
MD5 ab3d10a21d2914c30fe03adddf52750e
SHA1 e9361dc36f0e3aea58e96924ac6b3e156768c2bb
SHA512 e59243806a584dd62f3c89cdca7f06c9fa0e661d56dd7d193435b11803e51f165c30eff902d27adbd8537c06e9d0455d4070512b3021d110d8927b2557863177
SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4Hfr4hW:mI4dRfFXQ4d614d4D4J4+4T4c
TLSH
T10772421545049EB8298F979AAA367E02C37D533B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 6KB
SHA256 6eeab089bc9122bd75bdbab166dfad6c160bb9c859cbd0f2e7e6baf721802e0b
MD5 00280f1be6e53f2fe17b69aff255d47e
SHA1 b803546a2c5a7603bdfa21da0d7a67a368e8d804
SHA512 6d12a94383cc30cd3c046933f76ce739cc9c946b872acf33f360bb5d1f0c8bfbc3e3f36f6d620b9d50cdbb45161d5696bf4241f9cd76b726771f9bed86883990
SSDEEP 96:xH4fUTUOPqGqsWf2V51zSLsSSladv9jFOnIHeABw88n8L4cnTDEx:mf5RsWf2V5esSSqeABw88qY
TLSH
T1AEE120789518CB6F74B677ACAC6888316AB2413B7BBF68D710B954C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 7KB
SHA256 e426dfc4ab1b081b1ce1c363fff161694df417c41fc5d937cad08d1e2174a531
MD5 fcacedf8c2ca460a6de712d1f965a090
SHA1 c9051385900a2e64671c505913a87fc9cb28d097
SHA512 4f7ab02be7160d7c6cc38ae041752f73141bf9c6313bd7949cf7933cb0b3a9bc21e6674192229a7d7931b0ee544b4c8fa93c369406f1db33a8371a25d17514db
SSDEEP 96:xH4fJTUOPqGqsWfEV5ObzSLsSSladv9jFOnIHetBw88APz8L4cnTDEx:mfIRsWfEV5JsSSqetBw88LY
TLSH
T122F10E7C9504CB6F64B637ADAC2448356AB2023BB7BF68D710B954D5014CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 55b33940e702d3daa2272ac82d1d7dc5f8c03cfe1e405a108999a6d7aec4c1a0
MD5 a9f31c7211c795943077a22d6d1820c6
SHA1 3abe9b0cd44afab2cd43cdf4c8ffc8ad0360d9fc
SHA512 c7c487d89113b449d95c256a2e79a4b938ffec40cdcfa6f12b34275072532d1e6148483d4e2b1a5f0f2336a456776d01a8c4a44d61df408473376ab42ee4a159
SSDEEP 96:xH4fUTUOPqGqsWf24P1zS0SSladv9jmnIHeABw88n8L4cnTDEx:mf5RsWf24PtSSoeABw88qY
TLSH
T1AEE12F7895188F6F74B677ACAC6888316AB2413B7BBF68D710B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 23a562e76478084cb39a8f04831709140e1b9a34dfcdc0f5a6fceb35b0453c64
MD5 1b0229e994aa9af6562ee0da2a53e042
SHA1 d1dcd0f25d75facbeca3098e83ee8d58d8f6c80b
SHA512 68dd2fea96aaedda482563206490335e2312923cca164c008e5642c42ac8664f10f3dbfd9456815005a5de67e6e9941ddb04afb992e9c870af470f2699b2896b
TLSH
T1C521084352E33EB9BD13015E8C8887DAC19C342946317CE0E148BE4936B984E3B8F21D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 7113fe925839619c88fe4de5dd0d20f7364c393d5e7c3c1c38cd0f0c429e1518
MD5 45587bec5ea81a130520c0dd20452f79
SHA1 6164d58bc00b7ea6139d887ffcba379f3bde4c4f
SHA512 4beed6258d147e8928ef78764b5ce361a77f41dab0395104056ac641aef33370982079b31df4888c9962cd63fda419aa7b4e4ff95f3b194cfa73163a15ed32c4
TLSH
T16821084354E73FF5FD17006E8C8887DA859C342946356CE0D158BD0936B980E3B8F21D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads