hxxps://discord[.]com/channels/@me/1533940485851185232/1534178099128832080

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
32s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://discord.com/channels/@me/1533940485851185232/1534178099128832080
Sample260804-ptagqa1bka

Score

6^/10

discovery persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	discord.com
14	discord.com
15	discord.com
16	discord.com
20	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6016	firefox.exe
Token: SeDebugPrivilege	6016	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6016	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 6016	3972	firefox.exe	83
PID 3972 wrote to memory of 6016	3972	firefox.exe	83
PID 6016 wrote to memory of 6052	6016	firefox.exe	84
PID 6016 wrote to memory of 6052	6016	firefox.exe	84
PID 6016 wrote to memory of 6052	6016	firefox.exe	84
PID 6016 wrote to memory of 3364	6016	firefox.exe	85
PID 6016 wrote to memory of 3364	6016	firefox.exe	85
PID 6016 wrote to memory of 3364	6016	firefox.exe	85
PID 6016 wrote to memory of 3364	6016	firefox.exe	85
PID 6016 wrote to memory of 2216	6016	firefox.exe	86
PID 6016 wrote to memory of 2216	6016	firefox.exe	86
PID 6016 wrote to memory of 2216	6016	firefox.exe	86
PID 6016 wrote to memory of 2216	6016	firefox.exe	86
PID 6016 wrote to memory of 3476	6016	firefox.exe	87
PID 6016 wrote to memory of 3476	6016	firefox.exe	87
PID 6016 wrote to memory of 3476	6016	firefox.exe	87
PID 6016 wrote to memory of 5644	6016	firefox.exe	88
PID 6016 wrote to memory of 5644	6016	firefox.exe	88
PID 6016 wrote to memory of 5644	6016	firefox.exe	88
PID 6016 wrote to memory of 5644	6016	firefox.exe	88
PID 6016 wrote to memory of 4716	6016	firefox.exe	89
PID 6016 wrote to memory of 4716	6016	firefox.exe	89
PID 6016 wrote to memory of 4716	6016	firefox.exe	89
PID 6016 wrote to memory of 4716	6016	firefox.exe	89
PID 6016 wrote to memory of 6092	6016	firefox.exe	90
PID 6016 wrote to memory of 6092	6016	firefox.exe	90
PID 6016 wrote to memory of 6092	6016	firefox.exe	90
PID 6016 wrote to memory of 6092	6016	firefox.exe	90
PID 6016 wrote to memory of 984	6016	firefox.exe	91
PID 6016 wrote to memory of 984	6016	firefox.exe	91
PID 6016 wrote to memory of 984	6016	firefox.exe	91
PID 6016 wrote to memory of 984	6016	firefox.exe	91
PID 6016 wrote to memory of 4244	6016	firefox.exe	92
PID 6016 wrote to memory of 4244	6016	firefox.exe	92
PID 6016 wrote to memory of 4244	6016	firefox.exe	92
PID 6016 wrote to memory of 4244	6016	firefox.exe	92
PID 6016 wrote to memory of 5048	6016	firefox.exe	100
PID 6016 wrote to memory of 5048	6016	firefox.exe	100
PID 6016 wrote to memory of 5048	6016	firefox.exe	100
PID 6016 wrote to memory of 5048	6016	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://discord.com/channels/@me/1533940485851185232/1534178099128832080"
1⤵
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://discord.com/channels/@me/1533940485851185232/1534178099128832080
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {4d4a1f00-ef26-4325-a831-d63e815d1a16} -parentPid 6016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6016" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {48cbfd6e-e251-4314-a2e8-7f9bb85fa0d6} -parentPid 6016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 25164 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {2f00f732-42d1-413d-8d95-495581aaca05} -parentPid 6016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3984 -prefsLen 27276 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {531f04bc-7429-4ea3-998e-38ef34224a69} -parentPid 6016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6016" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2684 -prefsLen 34775 -prefMapHandle 2992 -prefMapSize 270279 -jsInitHandle 2996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2756 -initialChannelId {6ecc62e1-845b-4dc7-a086-d225bfab4781} -parentPid 6016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5160 -prefsLen 35012 -prefMapHandle 5164 -prefMapSize 270279 -ipcHandle 5136 -initialChannelId {300f4a44-8294-4c64-aee4-5a19def77634} -parentPid 6016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32952 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5364 -initialChannelId {0c8caebe-aaa1-44d0-9deb-f298c7abf42c} -parentPid 6016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5376 -prefsLen 32952 -prefMapHandle 5384 -prefMapSize 270279 -jsInitHandle 5388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5396 -initialChannelId {be6405c0-9e5d-47e4-a8f6-b3dc57627258} -parentPid 6016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5428 -prefsLen 32952 -prefMapHandle 5432 -prefMapSize 270279 -jsInitHandle 5436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5444 -initialChannelId {4c7089f5-803a-45d3-a467-b83df126c43e} -parentPid 6016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1660 -prefsLen 35131 -prefMapHandle 3080 -prefMapSize 270279 -jsInitHandle 6168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6464 -initialChannelId {3e2a9450-313f-45d9-b021-660690d44d72} -parentPid 6016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 6b28570698f994e905a4a860fad24bf642eea44989836cad6c2c32b536cef6d4
MD5 d701238e533a6bfb76ebaa4ba0d96129
SHA1 dc736bcf58c4f1124c96a606ed051c3bbf4a4e9b
SHA512 833e155328bb58d5ae447086bcf10989576ba51fce46733ddec615c44ff871236053c3c625001e278d226c7488548b83f789de8d3df17dd1ad582972a471723d
SSDEEP 384:HwCe7iO024Y9DL84KKDL849B7SOEAd9KVRaAcP+AWRMAfhg:QqZY9DL8lKDL8CB7S/AmVAf+hRMIhg
TLSH
T194728D799F403CAC1997C0E8C1F8929A4D19BAA3DFE6C06D21683D0DC7949A9B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 b2a5514248e58d14534edd962a659c3b40f67d86cb89555f92f9c9939ecdfd0e
MD5 e890cee328ad55206c13d17c7ac1838f
SHA1 33509d42237cf6e8a981489b1052a63cd86b6d82
SHA512 47249cde3b2814e0ee3ce4ecdb86c76df046d60fda6475e54ab29f78301872b105e75c010dcde1d64fa242aba2ee74fd1c927f3ee804ba2baa4bb9f2fd498ad5
SSDEEP 3072:j3l/IsarBKsC9O10HljWQh+yRw6qBLMuZoe:p/I/IszaHljWQhtqdMur
TLSH
T175B39EF6DBA2CD2D69FFD02D9BD2843EFD262400B3A73009C923671551C6BB86679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 98179c8fe87d0a1d81cbb193250f03d231c3f8d264430f3ee508f2d016ae8373
MD5 f1e698cbb2f9469120789c7428587b46
SHA1 f91e8aeaca5bc0d2db5442016a526031f107b935
SHA512 baa27b4d1e1936da1e7c4a1961d963bb07510593ef61501470066136ecb76f01b3f2d522e20c064bd2c5e39b50e45963d2a9e39140224d32fb2c2262425f90db
SSDEEP 96:JZSdF95/7bkW60rcE+fyUR65WZfFT2FMFgFjet/dd66JozGzgClKtmc0d/UK:7Ov5zbowb+fyjIvt1d66JozGzgCl6mcM
TLSH
T1F6C1EB28E729563BC808423BCCA60F510F36795B9C8E3F1531EC641D2C562DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 d0810016eb568393b3eee2afc5474b2a7047738a39301957ca92ab27d6581f3c
MD5 56bfe7ece13fea65e036350e1a29feab
SHA1 7af9447e1682136a9e5c216c3df4388b511d9eec
SHA512 c6298dded153dbb0c52cb7400116d1bdadd53cf30ccf4746b808b8697ac3ea6a5a9f16373bb9ce60990f312bca82204931cccae4fad07d3fb4ac55ad397d610e
SSDEEP 384:Lbo0+fyjod66JozGzgC1jDOPJCkVECLoyGcmhucmXEaZrK+KNDnbFbXgfFS:PWyERSJZBLPGcmhucpGrK+KNDnbFbIFS
TLSH
T178D2FE44EB2E553FD41413BBDCA50B002F79B885591A2FAB3A4C64686C872DC3E9E47F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 835a15238de67b92c2cfd4ec0ffd0e20dfd246f76dabbfd92d74ac6fd77d6887
MD5 99d97f43d774b6119484902db0b25b8c
SHA1 1c284fbfdc0a8111117e71ccaa5c003f0d39d268
SHA512 f5978c45cc646b1fe556a709885b849cd1b7d1a91add1c7cc94946bbd9c92f96ca25be580b79f680a13ced09b0efd06ae80d2fe25e62d681a93c2aae52e17a18
TLSH
T12161C958F229963FE445823ACD965B412F307502A8AF3F2A35AC604D1E5B3CE76CD47D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2de0a0b5bac21bf2d84d4b39bc74db92bd5104308cf3d06bfd4829d709ba776d
MD5 586d5fdfc358db2d41954d20e18cefb9
SHA1 68d14c4c864b926fa77329b6b09d71d9d7183685
SHA512 e08da6bdf4f078b25fa55441afac6f8e2075795a02f18474e689d60f0a1132de1a9e987196ea05019984190fe10689308f61dc7833aa5a07c1f34e0f6f8dd31e
SSDEEP 192:ot1d66JozGzgCl6mc0dtOv5zboIZ+fyjII:ud66JozGzgC1jYboIZ+fyj/
TLSH
T1DDD1DC28E629923BC808023BCCA60F514F35394A9C8F3F1571AC641D2C572DE7A9E57E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 1KB
SHA256 778564434a6ac1b664ae52408ce94df1850b45fec81b8a02cee1cb972ba4f4a6
MD5 d34b914bc383f3e3df71e2dcc14a96df
SHA1 84af176914e1eda731551e806a971035582e8bd5
SHA512 71153218e5ada0634ca69c4734378af2126bf731b042535fcbe22f711d601d878d1653c6d87d7dec7c92b81626d9c54546f71de374f55ebc68f90d23771683cc
TLSH
T12C11575C3BB84D6E99C6E39C748106CF53968A0704871C575D52EF8DCE90AE932BA429
MD5 SHA1 SHA512 TLSH

Submit Download

89fb31ab-23a6-4826-90ea-149dfe9c7d35

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\89fb31ab-23a6-4826-90ea-149dfe9c7d35
Size 886B
SHA256 8b679115fdcd452b28d30cbc1d6688f99fdb162c6a75cc53a8ecb84b3234af0b
MD5 cb5f48aeae45ffc64351f30394dd71b8
SHA1 6f37cd44aa6c5438965fd32dc305350e0359f5b3
SHA512 bf7397b5eebeab3a0ec6752c9f3ee5ba697a05742d2e83904d55b2e2917f3c397b629b09b4147b9a63252c64e147928bbc5c1dee0e3d141f68accee969c909b7
TLSH
T1031104418A65B4F2CD2C934F85D6B74287E4722380C60504BE615E180CBA61F7766A0B
MD5 SHA1 SHA512 TLSH

Submit Download

ba202e12-0b74-419a-be22-a212b105a2df

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\ba202e12-0b74-419a-be22-a212b105a2df
Size 15KB
SHA256 6cb833c5987d82e94b8e246883e78c2fc43c16e99f7710304963729824fce991
MD5 0deb278ce104ee4cef42a0c204d5a273
SHA1 67c653bc49f12db20b9e6d3a4fde624f6ad78594
SHA512 0d751223c57aabee7550e7e75d4a5ea36089840b2f62c8ceb28829c352fff6facb6d8520a5ec339716fb1e698f61049a0b94b612728a807f7e2a550adc54b68c
SSDEEP 192:X3WH3hvc0Yr7zxaJEH12WyXOQxuXB+1m4gy2CS0+v8yKpEXVF0sei9atXHjUvv3C:XGXhU0Yr7lac1hyXOmuXr4lgVg5
TLSH
T15C72DA566820457A8391E39994ECBFC3E5F528CF4C415FCADBE4BD046DEE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6dfda8c-5921-4705-b9c8-bc9600e74ebb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\d6dfda8c-5921-4705-b9c8-bc9600e74ebb
Size 883B
SHA256 776525fc009e3b959270435b0f32629429819a2e2a05c4c528ae1daf40847d47
MD5 e8e6deb07fba818e9e7c6459ae61cb41
SHA1 c9103bff50bfafc1ae1cd4a6b650ae9f29926105
SHA512 1053a13ee02dacbbfe0fb5d958b7bbfe045ddd2a34877164b0b1a0f979a1a6fed0b849248a09f9d919033cf8aacd1537df971a81ff77cd4ea87857f68bfba6f9
TLSH
T1551100449775B9F3DD68D34F8A9537028BF8732384CA48043DB04E280D7A51EA36660F
MD5 SHA1 SHA512 TLSH

Submit Download

e3f84640-cb69-482f-a9db-a3e8e620afee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\e3f84640-cb69-482f-a9db-a3e8e620afee
Size 2KB
SHA256 2025b3167c4df2ac77616c6a3e79dfe178380c67abef7b389e6bdaf2177d5d9c
MD5 70940538db4c06143218c633a807b406
SHA1 77c25af88cd08df5622ac1a5c0eab626c70dfc86
SHA512 029c1fbac71a426e153804935a62da4a69e19f2ad82fb0df92534f208752cff9b5e354a034c598ebbe70acce4711dfc26e2e2d6e138178dc2d49618274a11e05
TLSH
T14841345C39789CB78DDAF58DD882238E536C970300C65C432E61EE0D8C9A79E336A53A
MD5 SHA1 SHA512 TLSH

Submit Download

f6f28730-81a1-4623-9c0a-1513784e79ce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\f6f28730-81a1-4623-9c0a-1513784e79ce
Size 235B
SHA256 575b7461dc303bc490242fc67b559930fc734d59689a5b1361648f531cbee3aa
MD5 8e95830131330acc3a3170dd2a988f50
SHA1 3de0aefba924628127b37bc52cf377d92493d805
SHA512 a68e1ab80f5b6f72b1bb3854a642f546e20db677655101d16e695e4546a8aab6a1d88b0f3b75823716e290d2e0d049f902619f724a9008014a161f9d7cab584a
TLSH
T1B7D095812888535C04180F1BB0B065C631554C3324B06814CD51053485F9DC51152817
MD5 SHA1 SHA512 TLSH

Submit Download

f94f2288-3853-4cea-8d5e-4ba27bd69c80

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\f94f2288-3853-4cea-8d5e-4ba27bd69c80
Size 235B
SHA256 f9a6041bda7126666a496f217e47f4b8bdf8088001f4b879bc23e6edda08ac60
MD5 083ab8cecc1874d6d58c01d60d7fce9c
SHA1 3422947dffa788b10a0dad9d528e457e9653cea4
SHA512 670391a150320bad1d33f9f16680fca35f7d225046c1853dd9bf2e0b90af0e37b16e8407fe9aac1ae1c1969f88ed3c9bceaf4c0350d1debccd25ac0a2c3de07c
TLSH
T10CD0A78468B8676E88144F46B1E079C636CC8C371464A8549595867899BDDCC5262917
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 6KB
SHA256 ad25bcbeb109b57f3793db27fc2ce833393b0618b694c23dfc79637e3a62ebc1
MD5 fae7c4efe50ab295ca9402ff288f46d6
SHA1 d15c89489ba017d90f9a7c66b8836ee30e3f9080
SHA512 61891d2e076d8a0107529dfc31a88809fbb5737193c4b3230596c4aaadf39495717fae2ff290f5698f04f1b5259c064e1863ff8c3eb459a91d36dceaf3f943da
SSDEEP 96:xHrUTUmqGq6fztT1zSNSSlfdv9jPnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fztTISSn9NWBrODBw88Jr
TLSH
T1A3E120789508CB6F74B677ACAC6888716AB2013BB7BF68D710B554C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 7KB
SHA256 bb4e3a84be8609791f6831271e5dadb793218ad79877636077bddcf4c556223a
MD5 93d51c01c8336fdfe6a559f93b4ed5bf
SHA1 e2618232a67af9a37702548ce33d205760be99ec
SHA512 09d2324c3b22e42695a0a56893592ad14c796609748219ff53532a093b017325100fd672b796c9fe9a11950cb77cc616e5cc82d62b9e0a6a6b39935b3585dff3
SSDEEP 96:xHrUTUmqGq6fztTObzSNSSlfdv9jPnpRHNWyS9JODBw88n8L4cnuFNqGS:1BR6fztTPSSn9NWBrODBw88Js
TLSH
T18FE120789508CB6F74B677ACAC6888716AB2013BB7BF68D350B554C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 7KB
SHA256 67e7344153eae15b0d571b3437bc8b9466416c683efd67fd54b3f66da4e1f9bc
MD5 9cb6674b698e9d4e16ad2b566d0ab6f8
SHA1 5dc66b2aae65e697f266defd4941cdffd5ab971c
SHA512 74106a2f0127f6a32a5195e90179229826c46c63687830647332e21dd2ca942dc40cad0e6cd3b9b4135ec851e0c06239e9a737738645a192b306c237a38affa6
SSDEEP 96:xHrtTUmqGq6fztTObzSNSSlfdv9jPnpRHNWyS9JODBw88zB8L4cnuFNqGS:1AR6fztTPSSn9NWBrODBw88Ls
TLSH
T18CF13F789518CB7F74B276ACAC2448716AB2013BB7BF68D710B954C4015CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 4e099eb060b1d2f55a7c19f14a3267d51904cb5250c7b0a0816b4f4a552a087f
MD5 de8d87593b927c020cd215da276e2842
SHA1 d0c57dc7d6b379a942db7236b5df95266bb9e8d7
SHA512 7874977c6da9e7e3289a7938dc775b24b2b357a7a5b2236b98824d277dd4e539da1748c1af83a20c0aec52d6e5fc87388da7136c80cbbb3e68624481c19818a9
SSDEEP 96:xHrUTUmqGq6fzUL1zSuSSlfdv9jAnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzULXSS69NWBrODBw88Jr
TLSH
T194E11F789508CB6F74B677ACAC6488716AB2013BB7BF68C350B594C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads