c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f

Analysis

max time kernel
148s
max time network
164s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.7MB
Sample260804-lkyleawhqa
SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
MD5 edaeffe92dbfd973958c9d2267201b32
SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
TLSH
T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
54	bitbucket.org
19	raw.githubusercontent.com
20	raw.githubusercontent.com
27	bitbucket.org
41	raw.githubusercontent.com

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	firefox.exe
Token: SeDebugPrivilege	2804	firefox.exe
Token: SeDebugPrivilege	2804	firefox.exe
Token: SeDebugPrivilege	2804	firefox.exe
Token: SeDebugPrivilege	2804	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2804	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2804	3424	firefox.exe	89
PID 3424 wrote to memory of 2804	3424	firefox.exe	89
PID 2804 wrote to memory of 2912	2804	firefox.exe	90
PID 2804 wrote to memory of 2912	2804	firefox.exe	90
PID 2804 wrote to memory of 2912	2804	firefox.exe	90
PID 2804 wrote to memory of 4600	2804	firefox.exe	91
PID 2804 wrote to memory of 4600	2804	firefox.exe	91
PID 2804 wrote to memory of 4600	2804	firefox.exe	91
PID 2804 wrote to memory of 4600	2804	firefox.exe	91
PID 2804 wrote to memory of 3176	2804	firefox.exe	92
PID 2804 wrote to memory of 3176	2804	firefox.exe	92
PID 2804 wrote to memory of 3176	2804	firefox.exe	92
PID 2804 wrote to memory of 3176	2804	firefox.exe	92
PID 2804 wrote to memory of 4348	2804	firefox.exe	93
PID 2804 wrote to memory of 4348	2804	firefox.exe	93
PID 2804 wrote to memory of 4348	2804	firefox.exe	93
PID 2804 wrote to memory of 4120	2804	firefox.exe	94
PID 2804 wrote to memory of 4120	2804	firefox.exe	94
PID 2804 wrote to memory of 4120	2804	firefox.exe	94
PID 2804 wrote to memory of 4120	2804	firefox.exe	94
PID 2804 wrote to memory of 3844	2804	firefox.exe	95
PID 2804 wrote to memory of 3844	2804	firefox.exe	95
PID 2804 wrote to memory of 3844	2804	firefox.exe	95
PID 2804 wrote to memory of 3844	2804	firefox.exe	95
PID 2804 wrote to memory of 3728	2804	firefox.exe	96
PID 2804 wrote to memory of 3728	2804	firefox.exe	96
PID 2804 wrote to memory of 3728	2804	firefox.exe	96
PID 2804 wrote to memory of 3728	2804	firefox.exe	96
PID 2804 wrote to memory of 260	2804	firefox.exe	97
PID 2804 wrote to memory of 260	2804	firefox.exe	97
PID 2804 wrote to memory of 260	2804	firefox.exe	97
PID 2804 wrote to memory of 260	2804	firefox.exe	97
PID 2804 wrote to memory of 4872	2804	firefox.exe	98
PID 2804 wrote to memory of 4872	2804	firefox.exe	98
PID 2804 wrote to memory of 4872	2804	firefox.exe	98
PID 2804 wrote to memory of 4872	2804	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {d90563da-90a8-4ba9-b9a0-81d151c601cc} -parentPid 2804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2804" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27133 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2464 -initialChannelId {7f987f71-df5c-4d87-9e2d-d4bca70f023a} -parentPid 2804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27274 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {64496465-42b7-42ca-8da8-652417d47144} -parentPid 2804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27274 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {3b1c9a13-ad7e-4ede-b8e1-6a89f88c1e86} -parentPid 2804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2804" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4336 -prefsLen 34773 -prefMapHandle 4340 -prefMapSize 270279 -jsInitHandle 4344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4352 -initialChannelId {3402578f-1f36-4926-9127-e7b7c0bf87be} -parentPid 2804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4964 -prefsLen 35010 -prefMapHandle 4968 -prefMapSize 270279 -ipcHandle 4956 -initialChannelId {e2853947-ae18-40b4-8727-6ce6d438c8c2} -parentPid 2804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5408 -prefsLen 32952 -prefMapHandle 5416 -prefMapSize 270279 -jsInitHandle 3040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {0e35c3c0-c5a9-47b4-878c-ceadcc2c1601} -parentPid 2804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5444 -prefsLen 32952 -prefMapHandle 5448 -prefMapSize 270279 -jsInitHandle 5432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5472 -initialChannelId {8fb82ed7-dd29-4391-bdf5-38c7b05a7deb} -parentPid 2804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5796 -prefsLen 32952 -prefMapHandle 5800 -prefMapSize 270279 -jsInitHandle 5804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5812 -initialChannelId {61df69d4-b3e4-4f6a-b2bb-e5aa94b574f5} -parentPid 2804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 93eb7ecbeca0861d10f5faa77517e25968821c742d8dc3c3f2ebc873e2b70cd0
MD5 0665c00223c2db79dbd9c1ccf17da96d
SHA1 95f7407b6cfa8fe29af78df100e0f716fd6e7199
SHA512 68659e8453d94950c5dd69a38ac4a72e29016653f67e9094de1f305aa3cdb8f24fd664cdb5aa9db27225c46452f34e97880f3b0476efbd53b81c2a3998ed478c
SSDEEP 384:HwCe7iO024YODL84KKDL849B7SOEAd9KVRaAcP+AWRMAwE/:QqZYODL8lKDL8CB7S/AmVAf+hRMrE/
TLSH
T19F729D3E9F013CAC1997D0E8C1B992D94C19B6A3CFE6C06D21683D0DCB98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 fa2e15676e4e815835c2747f7a8c48ef99c7ebec8c33475c8d08c68e0d38a6d3
MD5 4283434a8ab8051859485f5ffcab3d50
SHA1 5374587c2aff77900d168ed5e272e809f2bd4820
SHA512 5b6d80d43f2e529111c29f29d1a9e530c6b09570bbc3f5807cf1e77e459bbc7682a6fa08fbb5e91ef138179e628682ebd8144ca447a75e1a6e8c9044cf723cc0
SSDEEP 3072:j3l5OVK9stU7S+EYGlHHRiskl386yqeHLZ7RNUg8:p5e7UmFYGlH4Ds6yqidUP
TLSH
T196B3AFF6EBE3893D65FFD42DAA92C43EFD322400B3A73009C853665056C6FB466B5648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d562b3ea37a4065731e1a81cb75267755d7ccbf478bb52a9c635b0e11881ce20
MD5 4ead614700555fa92544fd2b394cd06d
SHA1 1e2427e81658a5579cd13447471c0f8c8c2b6bc5
SHA512 378ae08301a8d159ea3c205ffe2a4b9e827aabb0004d32cc9449048328640cba4d2190b89cf488bab05f3a6097917103b5b610295c7375d360c2d9224b7de7b6
SSDEEP 192:BOv5zbo7xZJnyjLyDHB1d66JoztdzgCl6mc0dz:ebolZJnyjKd66Joz/zgC1jd
TLSH
T158E10D64E629863FC408027BCCA61B414F39398BD84E3F1575DD650C2D5B2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3067ad37ba5b56283b55fe94ca4bdb266833f0451179d45fa8a0f2a097d30b7b
MD5 a3b973b72f1993ba1ce40d487390a542
SHA1 e3a6f2f4b5a69440667c8702701abd71d0971362
SHA512 07779781d8475ef59408e0fa381e23cc79d5bf30de4521106b42e0cfbafa46c86540051293a4fc86c011421ae2452b416405a97c418c1df3adb4f81a62ce45e8
TLSH
T1E821795C3FB88D6A98CBF39D7451068E53918E07288B1D431D03EF8DCE91ADA326A43C
MD5 SHA1 SHA512 TLSH

Submit Download

1275bcc0-96d1-4781-bd7e-b45b869da0cf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\1275bcc0-96d1-4781-bd7e-b45b869da0cf
Size 235B
SHA256 c6db6e5ddcdbad4cdcdd96c306d2a27666f13a5ba7b6e493c006d770f90a491c
MD5 dd230441c2920ccf0173f8c54e879d50
SHA1 13129de4a1e6b4e43cc2dc5cd552dafa0ce1f1ab
SHA512 4b579bc38d71734a201b7ecd62f447375fe0019152591b25ee90c9c461dc8fcdaeb0589533430dd285bc956ba5ea94ea2e75093185b487a15512cf0fb3ff9b27
TLSH
T15DD097C43488773C08284F06B0A428C6308C4C3361B468A0965646B489BADC84162827
MD5 SHA1 SHA512 TLSH

Submit Download

19aa233e-fab9-47d2-9989-084228918d95

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\19aa233e-fab9-47d2-9989-084228918d95
Size 883B
SHA256 7088cce3708aafb9da54b19d73cb332ea4e0d2389a7a7ec365b80848a3ca31f3
MD5 0d3ffeeef84e17f425124950959d5e97
SHA1 b4478e06680844552a9fe9bb1f901ec06e383ee2
SHA512 713d4ea80e872cdba00966b189abf3d0f48165ec67e4157ec8af53b21565faa42f74720916613065a8e0aa90ecffd5d9acc82540934394669709fca64e4c2476
TLSH
T18E110040D271B9B2CC28834F8A9937119BA87813C4C645147DA44E084E7EA6FABAB64B
MD5 SHA1 SHA512 TLSH

Submit Download

5cf62234-7f52-4b7a-8e93-0ce13e120c09

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\5cf62234-7f52-4b7a-8e93-0ce13e120c09
Size 886B
SHA256 4a44ea75827fab32f1462ee5648d2c8a8343bbfab8afa11bc6250cbbeeb3772b
MD5 0db328a166b019066d4501bc7904597c
SHA1 6a67d895f7edbf476a7fa4f10716a391dbd90f1c
SHA512 2b2acd698d3b356b7189f08f38723d7e69f4dc0a436fc88b7eee15978648aafad9b8da5c03153c05599c3e0c7a7cb46188b750bfea8e558b346fc1eaf801446d
TLSH
T121110080C67579B2CC28929BC6E5B7428FF47513C0C64A147DA49B184DBB25FA76B207
MD5 SHA1 SHA512 TLSH

Submit Download

8c5693f7-ccb8-4ff5-904d-d5aa906dd418

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\8c5693f7-ccb8-4ff5-904d-d5aa906dd418
Size 235B
SHA256 0886fa52fb5bc444787d6ffb56780a6dadc4823689eb9a05752095ae92a632a2
MD5 3d650a8cf37de14166fe31054ff24135
SHA1 ea045a65099f80c8ce63955e5f5bad62e9ece9af
SHA512 b3f264c5cfee5f5ed8873ab95c66b8e48667ca1b860c574102eabf84feffa7d5a0dc10c6ac35af11e997c30215d1fc317f21854c763b0c54d3ca62b81ff811bc
TLSH
T17AD09780A488A71D48140F03B0A039CA30984C3310B99820D6905079C9BADC4826291A
MD5 SHA1 SHA512 TLSH

Submit Download

b12edd98-3581-4852-a425-7a970cc2d594

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\b12edd98-3581-4852-a425-7a970cc2d594
Size 16KB
SHA256 9516327e80157a763a8910f316477cf7d56ce1569878d687feb5e33066d1eeb1
MD5 a85f48bc2619a31fec097fd293a0cc53
SHA1 c3ea445ac1e9ee2c1e2e6e75513fb5a40da1da82
SHA512 d8c7b8f9064d91a1c104ab716bd84ef0c910026473bb2691b24c493a65bad641afa294199db0346c2a263dbd9b474bed6fb303bbd76521e1383f66e0f7b3e04d
SSDEEP 192:otSySxzxIcRybRhur8Ccr3DJiEb4QJMm3xuJk8ZodNU3Irlm2lsPug10c94BMM1X:aSxlIcRy1hur8CcsK4QeKgxu3c4icX
TLSH
T13872EA56686056BA8151E3A9D8FC7FC3E2F538CF4C01DFCA8BE0BD0859DA06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efa8683c-8c9d-40b3-b296-142b9c8ba13e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\efa8683c-8c9d-40b3-b296-142b9c8ba13e
Size 2KB
SHA256 b0c9c8b0b6c2b24883e9b3f0bed4f681ad38cfa016c9abf70093f6634a7a175c
MD5 00f0ae60fbe579c65ab2370f8a83a756
SHA1 6203404a0ec890004dbd23fb31715bb891595741
SHA512 1d3e6dfa8667bf7bed7d30989e775b9b76f0801a18c8bd4d125422d00f41ca8e09495fdce212b8e615b5ac6bcb7728c739d5b37f30bbcfe0287ee9915b001868
TLSH
T18741532C35785D77DCCAEA4CA082238DD7649A03848228936D41DF0CCEA569E336B41F
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 7378ec94c7c1b193e8b1dc0378c9e9ad4a40a627ea97644f5b02ac5c2362d675
MD5 7d5c4a78b731f81c764ef8368f448b90
SHA1 3ab7750acd75b2952aceab9f711807702f046307
SHA512 4f6431ae59ab95f4aacc7065494ab801d4c86183fe39653ea0765bab18e050b3a4749b080573a07b4926a889ff3d4958229f36a35031dbdb664022a3592aec6a
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4HZS4h5:NI4fRfsXH446+4V4Y4N4Q4E4b
TLSH
T1DC72421545048EB8298EA78BAA367E01C37D573B60855C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 f437ab74c50d26c99909f510b47eba9941f5edb4b115da2a70691f594c00fd61
MD5 378bb43ac295f390bfe11f7bedd79510
SHA1 808d383bd8969a4487b8727a988b2796f90f5504
SHA512 18782bca58eff78bd003a6254a209f3c935b5b2203d08bb55e46d1192c6a628a457290f079ce5c48475aebd1d2f9d28acebd5b12210175a1f41391b9b2c9e0d6
SSDEEP 96:xHpUTUWqGqPf2BpNObzSDSSlvdv9jDn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BpNZSSHj7/Bw88qU
TLSH
T1E5E1107895088B6F64B6777CAC688831AAB2013B7BBF68C350B954C4015CF7845F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 5ba947b2a1b4011e90f010b68cd92c032b018ab73d3bfbba6d76f66a148e6740
MD5 84de38ec2acb7a002d4d361663df261f
SHA1 475c5005a5b740f2ec559377844cd4fc94eff73d
SHA512 0dd25a03a6770cd4eee3736c92fec8bc6d65dec8b952e37dab53968bc2f91567fa5b171ff3187ebe2ae0a9593a596be47d875e7759a7b49054b8e9a337c0a7f8
SSDEEP 96:xHpUTUWqGqPf2BpN1zSDSSlvdv9jGn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BpNGSSOj7/Bw88qU
TLSH
T1ECE1217895088F7F64B6777CAC688831AAB2013B7BBF28C750B95484015CF7845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 d14dc97d54b34e4726a675dfa562decefde92af0b7acbe968b9eb8a4ed861878
MD5 836f96d11edd2dcc6a033625c39ebee0
SHA1 8660d05146d1d5abbc249ab143feb2f03e0d9662
SHA512 a33e6a1265c673de104bf4afa00d676759abcff0ba732a0d9c1742fc1ecbe585b284107306453f0c11f7fcc819f862f92f65f4afa4dde70d867d48c1117aa285
SSDEEP 96:xHpUTUWqGqPf2B0a1zSDSSlvdv9jGn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2B0aaSSOj7/Bw88qU
TLSH
T197E1127890488F6F74B6777CAC648831AAB2013BBBBF68D750B95484015CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 7KB
SHA256 1772d4fd97146e83a8d92f772447ba3eb7f88edbb28ed2574639f87841e13359
MD5 2f0479aa1ac8ce80248755b9bf2ff398
SHA1 84161bd6af6c73c5520aad5b98a2c5e91cfa7999
SHA512 5c849eeeaa27f10ab40b3cfd76103491728035abbacbcc2f37cbd363c6d7a19be070f351f8d10bb8aece00c74032e6400df4b0f790838be64812384533466741
SSDEEP 96:xHpJTUWqGqPfEpNObzSDSSlvdv9jDn+cHjCaqBw88+IW8L4cnAV7wb:vcRPfEpNZSSHj7qBw88EU
TLSH
T1F6F11F789504CB7F64B6777DAC6448346AB2023BB7BF68C310B95495014CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 2634551efa58f3c9c3e061bbea1ee4900a8eb3485f33cdac7b7bebbf92d23bd4
MD5 1ef8ceff7383a310c11a57142e717606
SHA1 2b3073f5a3a9aee61ce877e08d105d6a4e9014b7
SHA512 89b87e4d352581cfc4d13ada9929dde44614b32e9530af0f9ccd29865cecb41a21cb9244e53a71f6228915613a599429fdf9fc861694ce40a4e2d535a42ba1ea
TLSH
T14C2108C7A6A73D777626468EC4414BE9CEAD3022823E34F080C9AB5075CC40CBA4FB0C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads