12bbf7998c013baa12e71b6badf68c29319bf2624369c4cc4173d85049cb91cc

Analysis

user interaction
yes
max time kernel
8s
max time network
20s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
unsubscribe.html
Size 13KB
Sample260804-mlxk6shf32
SHA256 12bbf7998c013baa12e71b6badf68c29319bf2624369c4cc4173d85049cb91cc
MD5 17e8669295a95ef8faba99694331b3ae
SHA1 31ab75b6d51a51769b3267e497cdddf7e875c563
SHA512 2b490e052d6f5ea0fb8852c4a8f652f0ae57ddce96db628ccedcdd00d483d9816a336bd656967d0d918d1905f7de3c1e7b90ec14d4f71e53661c405b70554f03
SSDEEP 192:nrJCdyaYoqWkc2cC1caUiy8CZp6yeHiPa145aHTalmBiw6Rb3BZodiFtnOao+MiA:nrJCGoqVXUH89PYbicLMz1
TLSH
T1D052611115F2104199E3E1BAAF93AB1E37358703260DCA583DCD27A0DF8EA994DA37DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5344	firefox.exe
Token: SeDebugPrivilege	5344	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe
5344	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 5344	5280	firefox.exe	80
PID 5280 wrote to memory of 5344	5280	firefox.exe	80
PID 5344 wrote to memory of 5352	5344	firefox.exe	81
PID 5344 wrote to memory of 5352	5344	firefox.exe	81
PID 5344 wrote to memory of 5352	5344	firefox.exe	81
PID 5344 wrote to memory of 2060	5344	firefox.exe	82
PID 5344 wrote to memory of 2060	5344	firefox.exe	82
PID 5344 wrote to memory of 2060	5344	firefox.exe	82
PID 5344 wrote to memory of 2060	5344	firefox.exe	82
PID 5344 wrote to memory of 5740	5344	firefox.exe	83
PID 5344 wrote to memory of 5740	5344	firefox.exe	83
PID 5344 wrote to memory of 5740	5344	firefox.exe	83
PID 5344 wrote to memory of 5740	5344	firefox.exe	83
PID 5344 wrote to memory of 4168	5344	firefox.exe	84
PID 5344 wrote to memory of 4168	5344	firefox.exe	84
PID 5344 wrote to memory of 4168	5344	firefox.exe	84
PID 5344 wrote to memory of 5880	5344	firefox.exe	85
PID 5344 wrote to memory of 5880	5344	firefox.exe	85
PID 5344 wrote to memory of 5880	5344	firefox.exe	85
PID 5344 wrote to memory of 5880	5344	firefox.exe	85
PID 5344 wrote to memory of 2964	5344	firefox.exe	86
PID 5344 wrote to memory of 2964	5344	firefox.exe	86
PID 5344 wrote to memory of 2964	5344	firefox.exe	86
PID 5344 wrote to memory of 2964	5344	firefox.exe	86
PID 5344 wrote to memory of 5260	5344	firefox.exe	87
PID 5344 wrote to memory of 5260	5344	firefox.exe	87
PID 5344 wrote to memory of 5260	5344	firefox.exe	87
PID 5344 wrote to memory of 5260	5344	firefox.exe	87
PID 5344 wrote to memory of 3100	5344	firefox.exe	88
PID 5344 wrote to memory of 3100	5344	firefox.exe	88
PID 5344 wrote to memory of 3100	5344	firefox.exe	88
PID 5344 wrote to memory of 3100	5344	firefox.exe	88
PID 5344 wrote to memory of 3496	5344	firefox.exe	89
PID 5344 wrote to memory of 3496	5344	firefox.exe	89
PID 5344 wrote to memory of 3496	5344	firefox.exe	89
PID 5344 wrote to memory of 3496	5344	firefox.exe	89
PID 5344 wrote to memory of 1040	5344	firefox.exe	90
PID 5344 wrote to memory of 1040	5344	firefox.exe	90
PID 5344 wrote to memory of 1040	5344	firefox.exe	90
PID 5344 wrote to memory of 1040	5344	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\unsubscribe.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\unsubscribe.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27097 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {15be5eba-b840-4da2-b318-0af12346b5e9} -parentPid 5344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5344" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27133 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {16ab14e5-e387-4d56-b199-0682f54fc30c} -parentPid 5344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3776 -prefsLen 27274 -prefMapHandle 3780 -prefMapSize 270279 -jsInitHandle 3784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3792 -initialChannelId {0eb48436-b931-45d3-aa6b-bc55ecb6f604} -parentPid 5344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3944 -prefsLen 27274 -prefMapHandle 3948 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {55863717-6c7a-4738-b050-8230fd1c9fa4} -parentPid 5344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5344" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4464 -prefsLen 34773 -prefMapHandle 4468 -prefMapSize 270279 -jsInitHandle 4472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4480 -initialChannelId {4cf6b266-8938-4351-98ea-10f6f67aa8b3} -parentPid 5344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1692 -prefsLen 34929 -prefMapHandle 1540 -prefMapSize 270279 -ipcHandle 2600 -initialChannelId {e7d33906-2e7d-4066-9972-bf1a0044db6c} -parentPid 5344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5424 -prefsLen 32952 -prefMapHandle 4032 -prefMapSize 270279 -jsInitHandle 4036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3056 -initialChannelId {03aa6cca-be3d-4b2e-96cb-2e0332af1e04} -parentPid 5344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32952 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5588 -initialChannelId {5331b620-d3fe-4c58-9fc0-bc0a3afd3db7} -parentPid 5344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32952 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {7d836525-9334-457e-aa39-2067027e841c} -parentPid 5344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2832 -prefsLen 35062 -prefMapHandle 5916 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5920 -initialChannelId {49f9192e-39e2-4c77-9fe6-63b772d80509} -parentPid 5344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1040

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
1⤵
PID:3944

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

APPX.lqmwjm8etljv34q69h4czqr5d.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\APPX.lqmwjm8etljv34q69h4czqr5d.tmp
Size 2KB
SHA256 4112d529734d33abda74478c199f6ddc5098767e69214a00d80f23d2ea7291ff
MD5 530f1945913c81b38450c5a468428ee6
SHA1 0c6d47f5376342002ffdbc9a26ebec22c48dca37
SHA512 3906427ffb8f2dfea76ba9bb8cac6bd7dece3ebee7e94ea92da5bbdb55d8859c41260a2bda4e84fab7e1fb857ad12a2e286694ea64d00d0aa6cab200fbbf64f0
TLSH
T14A51FAA0163DBC36418D4BFD8F94B1002C7158372727AE5ADCAF91B618BB9A34F630E5
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.lt1v16hwef0cw0ss7isc8vc4g.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\APPX.lt1v16hwef0cw0ss7isc8vc4g.tmp
Size 9KB
SHA256 92a7d7d3b0bfac458ddcef07afcdad3646653ba7f4ad048fdd7a5ec673235923
MD5 24ebdb1228a1818eee374bc8794869b7
SHA1 79fc3adb42a5d7ee12ff6729ef5f7a81e563cd2d
SHA512 63764d99a0118fac409327d5bf70f2aa9b31caf5277c4bc1e595016a50c524cd6c3d67924321b0fcad12cd968de1a62bd292151e35fd907034efd0f40b743d6a
SSDEEP 192:vWULwu0Sc2HnhWgN7aIWuAE/uuOiqnajls4v6:dD/HRN7q1ilm4i
TLSH
T157124AD28D6C8847DD673C4053E8E89B7C3C93C72810955B196EFAA51DE3BC2E72862C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.ug5_xxlbub_u55gbcylx6jf8c.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\APPX.ug5_xxlbub_u55gbcylx6jf8c.tmp
Size 1KB
SHA256 b64efcb638291c1e1c132ed5636afbb198031cee44384f3ecf67d82b73accecc
MD5 4085b7b25606706f1a1ad9a88211a9b7
SHA1 31019f39a5e0bf2b1aa9fe5dda31856b30e963cc
SHA512 9537559523839e3e708feabe8c04f40236add7d200ec36bad00c10a69337a15001103c17093dcc0d8cadb4713d911f39a6411624c1db4cbf1ea1af272a716168
TLSH
T126210046F0C40AB046B3646517759657F73E93C7346D0184FCED724B2F6938A0227364
MD5 SHA1 SHA512 TLSH

Submit Download

localhost[1].xml

Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZSNWVCK2\localhost[1].xml
Size 13B
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 736358b195ff4f5a69c1a46d89411e6369aa1b7075dee0634b8970a410958506
MD5 819c565137623a41f795e5afec74a402
SHA1 cee7535cafca844a741cb8f6753e8d7e0c30c9a9
SHA512 c60ac0d60c55d91c8368406fc526177b15ac86470a403b38a6f5b41fcb5716052ec0028050a8577d4af3c21d33c940b5f48152d5bb6a722dabbcf33f0641f2ff
SSDEEP 96:/SdF95/7bkW6QXjrcPyUR6rWZAFQQFHFZFVFJ/dd66Joz0dzgClKtmc0d/UK:/Ov5zbooCyjC61d66Joz0dzgCl6mc0dz
TLSH
T1CDB1ED28F229863FD455423ECCA11B500E36388AA85E7F1A36EC744D3D572DD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1a85410b4243d27b60cac0d2c08399384e8b70a99f5987dd59a2c83234adafbb
MD5 6c2b062047fc9b7b03f58f88cb698b15
SHA1 db57e0469418e8eba49fbb0f653cdf186227e1b6
SHA512 0ae5da54690e372859ac4847e763215a76655643252e7b5b445e11c8969c81ab5a52b6e5b4fd5ec464e2aab429ec058f7cc5732a92ca655547a2b25230bcfdea
SSDEEP 192:af1d66Joz0dzgCl6mc0d4Ov5zboHDZP2yjWxI:atd66JozQzgC1jxbojZP2yjJ
TLSH
T142D10028F629863FC414123BCCA51B400F36358A9C8E7F2576AC741D2D572DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 2bd82dd7796c316b955727ac52c360a0e821ed6a3a98284e766fd417c625cdb4
MD5 f1336f20b8d1c0f31744630ef2ff0f54
SHA1 766580585c3e1dd580bf158bcedc297d65485cc4
SHA512 f813338cbdd6040c785316d292037454a9939260d6c42df5ac7203fb5ecfe3426efb4abde1d103a4d1580945e3f83e3e74b0f37346075776e3797ce4f8f077c5
SSDEEP 96:cdSdF95/7bkW6QXjrcEP2yUR6JWZ/F12FeiFZFVFJ/dd66Joz0dzgClKtmc0d/UK:SOv5zboobP2yjY341d66Joz0dzgCl6m5
TLSH
T15FC1EC28F629863FC418123FCCA51B400E32359BAC9E7F2536EC64092D572DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02d87206-92de-45be-a38b-8b9a015857f1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\02d87206-92de-45be-a38b-8b9a015857f1
Size 883B
SHA256 b84ca8a67b35508a5f9959a056ff45bb9788d5a89662aa562fe856f5b59f1b3a
MD5 a5ccf3395f448557bb62cd884f40bff6
SHA1 4928713892def6efe2f1aea5f5170341c25bb0b3
SHA512 fad28ba937aa0a2e5511b1c9c26bc7b61a2fd2206d615271e2b4966827bd7931fc3ebe89311c1e10deefda7478d57af5039c5f7f366a94a23262dabd2a5812af
TLSH
T16011C050A620F5F2CC74D20FCA5577164BA47523C4C948242EA55E144C7AA1EF76BB1B
MD5 SHA1 SHA512 TLSH

Submit Download

2017a665-1be9-45ec-923e-07ba725879be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\2017a665-1be9-45ec-923e-07ba725879be
Size 16KB
SHA256 69d7a022a5b4315150568e2831c0d5b967e57097385c4ff7e1ad2f4a12ca2767
MD5 8bb42d418e2a4e00073cb7101e3c78d6
SHA1 4ff7745ba8d6fdeef73333a988a2c0e34cc433bc
SHA512 84a01967ed75a726cd80a526ed70f3f4e3e64f180ecf20f31e6f05105b7d1d7b6d3875d6fe7c9f418e5db8bab94af39aaf6bd93679dbc45306a118714f29d695
SSDEEP 192:GaF4tiQ5It3puTxBg1rjqakPJ5hVJdWUJXYgMCamhi/OmzCMdWXOJ/Jkzili0dKl:0q3pulcePzhVV5eCFNn6i0dK+n+J
TLSH
T16E72B856282045BA8251E36D94ECBFC3E6F538CF4C418FCA9BE4BD086DDE06E512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31105b3e-6026-498a-a0e3-962fbd999c5c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\31105b3e-6026-498a-a0e3-962fbd999c5c
Size 235B
SHA256 ea72d6782f67ee3646fd9eb0512926e73da190eb5a780da2dec51dd210ca5855
MD5 137037ef47ef074049ee54da9181032f
SHA1 f560a4ef68b8c373c91169b39b2bce47ac6108ac
SHA512 5d0a44cc367bf3f5eae5d95b47bf7b211593806d31d86c4d644338ec94c46f44c8c7de39fb98f42b9fdcf58de40781bf924005363b18cc0d42392fe38abc5690
TLSH
T17BD09782A4A8635D08280F0BB0A07EC230C98C3724A16890C6A000B49ABE9C8026680F
MD5 SHA1 SHA512 TLSH

Submit Download

81488738-9189-4bb6-8783-6751208a98cb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\81488738-9189-4bb6-8783-6751208a98cb
Size 2KB
SHA256 c4e209fd23f3f47bedf643b117171d01a155e71e2809eb05c10b4f5975a8fa49
MD5 f8352ef8c023eaa8d5735f9f829216ed
SHA1 f9c31bc0676dea51aa4c1953ee882b451d01a365
SHA512 ba077f088d12fe48995e3b25f79b037626c2a898152ba15c12f2c230d1350fa2819cf98b6efdc212b29ade0172b875291b1f5d28fcb98c26d5f87d3d0f524b21
TLSH
T15A41217C75B89CB79CA6F59DD882238D53604A0344C658832E91DE0DCC9E79E336A93B
MD5 SHA1 SHA512 TLSH

Submit Download

b832494a-1ec1-458b-9a69-c44224dce8bc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\b832494a-1ec1-458b-9a69-c44224dce8bc
Size 886B
SHA256 84d45374bd7ddc95dd9ae824c066705b660a968934dd368f40a1ecce7417c2b5
MD5 9e7515b8f1bcf03882b4555a92f97cfc
SHA1 fd05cfc82ff356f9e4a196bb2a41b662ad011e0e
SHA512 f0f4f8f9f282726b6b5c1b192cb7ad6ad6325e6acc468a502378f03a2babe17056238ad55a182a58553cc4003a25cea8323cb8c99cf3e06d6f613f59cb85000a
TLSH
T12A1140408A60F4B2CC78E25FC9A577018AE07223C4C90C147FA85E140CBA51EE76BB0B
MD5 SHA1 SHA512 TLSH

Submit Download

c730717b-c325-459f-813e-ffe05da1f23d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\c730717b-c325-459f-813e-ffe05da1f23d
Size 235B
SHA256 c33441f85d58eb13dcfabf6b52998b9bbd630b0ec1cf80e4628a8b353ecdb2f8
MD5 fc102c103e264b2603a8bf5b4af23fcf
SHA1 9710cd824ee30b0041e55e56343a0395ba9d9bb4
SHA512 580f0ddc0a5c318ec952eac850dbc40c672374e6cfc9cd76347586085331eb6b3d34f2b32374f95d427689c26613c60e0d2fa6cfd4c1d44574d94dc40d83c01b
TLSH
T1B0D097902888733D4C240F07F8B2AAC63184CC33107458908AA04438C9F8AC85259C56
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
Size 6KB
SHA256 94f3c6b350d790063bf429e607a3b1d88e77ddce77909bb7b8873cf152138d08
MD5 4dc55581cd38a8412a5ffc8e83b8416f
SHA1 3538f88f6a34cf4f51e42f0bc1fdcda2042dc46c
SHA512 1053ae2cacc22f903a9fd846a9b451123697597e99d74c586a5b2881b0f5a3d5655c306f232b9fa779ee7ccf9a64fb4d48a439483630620a23763db58b24440b
SSDEEP 96:xHNUTUVqGqznfkWA1zStlSSl5dv9j/SnGSRHyuCRBw88H8L4cnHNq:/4RzfkWA0lSSdS9QBw883
TLSH
T1DCE11F7894088F7F74B677ACAC6888716AB2013B7BBF68C350B55485050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
Size 6KB
SHA256 46a58664abd3f29c0451895775b1b6d72aac2766660d414e673a89be7653ffd1
MD5 3ad27d8d74f8ef99fde978be9bc1464d
SHA1 0b27b6e289ab78c5276e8a0d9af00fb08f6c506e
SHA512 34411f579af927259c0c0ccd1f4b6905ac79e298f7318b8ee8c03f8a5af4a4794b7ce81149c1cf2ce62c964db3e375c40db1e2e8b5713c33eaeadd78c35104a7
SSDEEP 96:xHNUTUVqGqznfkd71zSxSSl5dv9jonGSRHyuCRBw88H8L4cnHNq:/4Rzfkd74SS7S9QBw883
TLSH
T1EDE11E7854088F7F74B6776CAC6888716AB2013BBBBF68C350B95485051CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 2d0e52e76e96a6ac8794c484d08af83d81570534de106050e958243bcc801949
MD5 242cd240cfc82782a808821ccae9e4b2
SHA1 5ffb30be8f2e948eaf95b98418b5ff8019f4d1e1
SHA512 5a6fd2ca74fb7c35833dad86dd1eee0c33d14cbe80652cd5818b51027c6d564cf3a247667df853f16afbd16a7c1085e661771f3f9c082a83560b78e2b2e5befb
SSDEEP 49152:llPbkMngvZR+Uh3YdAgfHQ9hJNHkda5Zm3Fit:PPbkMngRefHQ9hrHkdMX
TLSH
T1E12639E820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4948-634-0x0000017593FE0000-0x00000175940E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads