e5c9694d1fe637018d3dc07ec34cacb51ffaf6b9eb666b91ba4fc18b2ba3c06b

Analysis

user interaction
yes
max time kernel
132s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
[Goldberg] Metal Gear Solid (Master Collection).exe
Size 641KB
Sample260806-gvffcsvbrg
SHA256 e5c9694d1fe637018d3dc07ec34cacb51ffaf6b9eb666b91ba4fc18b2ba3c06b
MD5 72a138fcd5af4bc2d7362b1f922a2bd1
SHA1 e5206016ea82d5b4749f292e8b0103b9d5540b6f
SHA512 203dba5f41a2244b80058d22eef7afbe999dbc7e481a099c87248f3ca0babf792b960d54d19cd94c640c842aca3863d76135d7b39b2f0c2beb9b8d9cf3dca667
SSDEEP 12288:kjG/L1a2t7QC17sbmrCCgo4wjzRHlbCNBWrhrE02:kjG/L1PhrQbmRgo7RHRCNBiO02
TLSH
T12CD48CA1E6804431EDA217360873AE7A957FBE702F7594CFAB8C757A9F331C26131906
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[Goldberg] Metal Gear Solid (Master Collection).exe

Checks processor information in registry 2 TTPs 29 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	firefox.exe
Token: SeDebugPrivilege	688	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
688	firefox.exe
688	firefox.exe
688	firefox.exe
688	firefox.exe
688	firefox.exe
688	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
688	firefox.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 688	4652	firefox.exe	90
PID 4652 wrote to memory of 688	4652	firefox.exe	90
PID 688 wrote to memory of 3328	688	firefox.exe	91
PID 688 wrote to memory of 3328	688	firefox.exe	91
PID 688 wrote to memory of 3328	688	firefox.exe	91
PID 688 wrote to memory of 2768	688	firefox.exe	92
PID 688 wrote to memory of 2768	688	firefox.exe	92
PID 688 wrote to memory of 2768	688	firefox.exe	92
PID 688 wrote to memory of 2768	688	firefox.exe	92
PID 688 wrote to memory of 5236	688	firefox.exe	93
PID 688 wrote to memory of 5236	688	firefox.exe	93
PID 688 wrote to memory of 5236	688	firefox.exe	93
PID 688 wrote to memory of 5236	688	firefox.exe	93
PID 688 wrote to memory of 4092	688	firefox.exe	94
PID 688 wrote to memory of 4092	688	firefox.exe	94
PID 688 wrote to memory of 4092	688	firefox.exe	94
PID 688 wrote to memory of 4324	688	firefox.exe	95
PID 688 wrote to memory of 4324	688	firefox.exe	95
PID 688 wrote to memory of 4324	688	firefox.exe	95
PID 688 wrote to memory of 4324	688	firefox.exe	95
PID 688 wrote to memory of 4164	688	firefox.exe	96
PID 688 wrote to memory of 4164	688	firefox.exe	96
PID 688 wrote to memory of 4164	688	firefox.exe	96
PID 688 wrote to memory of 4164	688	firefox.exe	96
PID 688 wrote to memory of 5012	688	firefox.exe	97
PID 688 wrote to memory of 5012	688	firefox.exe	97
PID 688 wrote to memory of 5012	688	firefox.exe	97
PID 688 wrote to memory of 5012	688	firefox.exe	97
PID 688 wrote to memory of 4812	688	firefox.exe	98
PID 688 wrote to memory of 4812	688	firefox.exe	98
PID 688 wrote to memory of 4812	688	firefox.exe	98
PID 688 wrote to memory of 4812	688	firefox.exe	98
PID 688 wrote to memory of 5424	688	firefox.exe	99
PID 688 wrote to memory of 5424	688	firefox.exe	99
PID 688 wrote to memory of 5424	688	firefox.exe	99
PID 688 wrote to memory of 5424	688	firefox.exe	99
PID 688 wrote to memory of 5808	688	firefox.exe	100
PID 688 wrote to memory of 5808	688	firefox.exe	100
PID 688 wrote to memory of 5808	688	firefox.exe	100
PID 688 wrote to memory of 5808	688	firefox.exe	100
PID 688 wrote to memory of 3012	688	firefox.exe	101
PID 688 wrote to memory of 3012	688	firefox.exe	101
PID 688 wrote to memory of 3012	688	firefox.exe	101
PID 688 wrote to memory of 3012	688	firefox.exe	101
PID 688 wrote to memory of 3248	688	firefox.exe	102
PID 688 wrote to memory of 3248	688	firefox.exe	102
PID 688 wrote to memory of 3248	688	firefox.exe	102
PID 688 wrote to memory of 3248	688	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\[Goldberg] Metal Gear Solid (Master Collection).exe
"C:\Users\Admin\AppData\Local\Temp\[Goldberg] Metal Gear Solid (Master Collection).exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {86492963-4dad-445e-b8e8-c799fddc9669} -parentPid 688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {3540690e-2d49-4fcb-8439-065ad9647bd6} -parentPid 688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 27274 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {2e3e8181-b2ea-4568-920c-43e696805711} -parentPid 688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27274 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {38e347fc-64f5-4237-9eea-54e60d68453f} -parentPid 688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4632 -prefsLen 34773 -prefMapHandle 4636 -prefMapSize 270279 -jsInitHandle 4640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3196 -initialChannelId {3e3b179b-291a-41de-8d5e-64100c64efd0} -parentPid 688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4936 -prefsLen 35010 -prefMapHandle 4940 -prefMapSize 270279 -ipcHandle 5032 -initialChannelId {9a3ee754-27bc-4a76-b6af-452c8cb9f266} -parentPid 688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5672 -prefsLen 33031 -prefMapHandle 5676 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5688 -initialChannelId {0632011d-3c3c-473f-a86d-a272d5b4ba05} -parentPid 688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5844 -prefsLen 33031 -prefMapHandle 5848 -prefMapSize 270279 -jsInitHandle 5852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5860 -initialChannelId {82076a89-3f3e-43fa-a3cd-700eaa82389a} -parentPid 688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5992 -prefsLen 33031 -prefMapHandle 5988 -prefMapSize 270279 -jsInitHandle 6036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6044 -initialChannelId {2f0a1b31-6b17-48cb-b3d8-522f899db4c8} -parentPid 688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6372 -prefsLen 33071 -prefMapHandle 3264 -prefMapSize 270279 -jsInitHandle 6348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6388 -initialChannelId {b9adac5c-2a72-43c4-aa03-6d097567cb7c} -parentPid 688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 3392 -prefsLen 35198 -prefMapHandle 6420 -prefMapSize 270279 -ipcHandle 6280 -initialChannelId {d562b251-df18-4c75-b03f-29a22fca6954} -parentPid 688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:3012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6804 -prefsLen 33851 -prefMapHandle 6796 -prefMapSize 270279 -jsInitHandle 6784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6828 -initialChannelId {ccbce36c-6bd8-4a27-904f-8633409d3d13} -parentPid 688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 0c1613e2486f58861104e9767622c8c7d79f2e5b8233b3993c999b5c294a5725
MD5 3e695fdc9a5e33f11218235cd602a559
SHA1 0f240bb6413b5b1aee50f0c37f46aa88934f4d69
SHA512 0a6db9c4dd9e8af3177f36bce4641411f1e1900f831029a7692b186e9527e487290db5e2059628a0ad8281be0746283734f4c3b3be76e6606f03992f87346137
SSDEEP 384:HwCe7iO024YfDL84KKDL849B7SOEAd9KVRaAcP+AWRMADHv:QqZYfDL8lKDL8CB7S/AmVAf+hRMsHv
TLSH
T124729E7E9F003CAC1597C0E8C4F982DA8D18B6A3DFE6806D21683D0DCB98969B1F544F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\AlternateServices.bin
Size 10KB
SHA256 e838ec853c7acd7637977bfb729dfdada1967f4768755185d962d452d92ac66d
MD5 41b56a905339e13beaffed7ed7069de7
SHA1 63da71a37473a4f024de979c261e7a0e24bfe81d
SHA512 e58daedc44b10bfa05b35e0c6547a9fe4ebad05f9a7cc07d655a2117728beae710974538d7da06914e1592fd92c91712a10fb2b88e7d4a41592bb9b24307fe43
SSDEEP 24:nuhMZx91zA8F9xnAB9B1jCe9VvLN9Bd79F3G5q9F55A51W:hm8vGTXjCkBLHPZNsI561W
TLSH
T12A2272E36B76E472F1A28FF09059759C9C33173915BD8584C64480F316E2EA9913EBBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\AlternateServices.bin
Size 17KB
SHA256 63b6409de827ec269a3f6f9498262d1d5915aef59c11a1d15142d92edd9d1b61
MD5 6dd578c1088a56df7963dd367b845dca
SHA1 b79fc57aa79ed8370681f8aa12b3722e22926127
SHA512 c4b2ffc62417a707abd1d8ad104f547abada26f5b2bc710ab5573925b748ca7859e3092fceaf51cf0c0570c7c45513ea5756242c9e654a6984ecc714602ab213
SSDEEP 96:vgbI56TTTCkBLHPZNIM/pZBpgMSyx2cFyuZlG4ky8te:dQa22kZZwFt
TLSH
T13E8273F37FB1A8B2F1A2CFB09068745C9C33172945AD9584C64490A702E2E99907FBFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\AlternateServices.bin
Size 17KB
SHA256 92791c7f3e96592cb66439d1a184b4d4b336a15ad40f381763a0d4f6cf368eb4
MD5 f1bb6dda11eedf88c9c6ab615a732b8c
SHA1 859b74c356d2320045423981517a966bd998bca7
SHA512 63dc603fec01111cbdccadbc7eb0f30785c390f531fdd4a0b1b00790bc12ed77efcc49decf296abc9b28ce2ffd5361ba1850fa0b2cce38da94b3f3ace4a4ef0c
SSDEEP 96:8RbI56T6dA2B1A2hAGDA1M/p1A6XAexATyx22AjyuZ2A541Hy8te:UQO22PZZCFt
TLSH
T1FA8280F37BB564A3F1A28FB09068748C9C73173944BC9584C64090A712E2AE9D03FBBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4fa871a1b0355067bf30800e802d164f63643d1fc2b88364a4e78e94eccdb1bf
MD5 e8f9f767645ae0f8f630be49f3650122
SHA1 417236fd8e6aac02f7c8bf3156bf2bffcbb6a837
SHA512 d8aad7506cc53da510c226cc064bf58c899a1c387716170cb79513434057fb7721b13aae66b1af56111d2baae03ad0dc87001adbcc620c79787a24befa894266
SSDEEP 192:3H71d66JoztdzgCl6mc0deOv5zbopbJnyjL6m:pd66Joz/zgC1jHbopbJnyjm
TLSH
T147D11C64E629863BC404437BCCA61F414F3A394BD84E3F1935DD65082D5A2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 bdfdd31134546724fcecedaa8c3b9f6c317c1eedfd4b1a13bc003cd944f789e9
MD5 d7f760109928d5c24ba4ab00b68b0757
SHA1 b2570c854815c4fe4af89c8497eb468dfabcab82
SHA512 900278386d16614c08dcf67b1b051d28462a2c2a9f3e24dfa58cc6194f21dad9994966d0f86d14b95e7a4b19d1c66c76ced27bf4df4c223b083829826019b0e6
SSDEEP 192:3H71d66JoztdzgCl6mc0dUOv5zbo74ZJnyjL6m:pd66Joz/zgC1jlboMZJnyjm
TLSH
T153E10B64E629863BC408437BCCA61B410F39398AD84E3F2975DD610C2D5A2DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 f7e0bbc2f624316ebd63661a8e66b7777e12c6c3faef57c5b42376c3ecf59878
MD5 ffb75d84e45dc651cafe3a5fceec6b45
SHA1 3aa4c5e1ec92c21e4c2a46b4923eb9d163f6c75e
SHA512 4b554957eceadfc32c0ce400b582e5cd8d770b942c70c823b61332fc896c663f4055c8a63ecf087aba8c7042126df345aa06568e84bd73ed7662520ce6984d95
SSDEEP 384:ZboQJnyjm3d66Joz/zgC1jKKgCijLLfwGcm+u2Fr0KD7LGqbTbnyI:5zs1MKgdvwGcm+u6QKD7LGqbTbnb
TLSH
T196C20F44FB2A953FD41552BBDCA50B101F79B88A58192FA73A4C606C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4924a7749c926fea8103e24c40f04f6de03a47cef4fbf024d8f93daa23d3619c
MD5 918a13d37aeff1c767f8fa587b454bf0
SHA1 e88f84f58820894273c7ab2432a642f52fa11c82
SHA512 e80c89fbe4985267fadf3549631c9a849651fda093613060f49319240dfff63c030b8b711e712af2ca5561cf7ea61f007ffa68bbc157034415ef6638ae16e081
TLSH
T18B219A4C79B84D6A59CBF39CB481018E53544A1B048B2C438D12EF8DCE91ADA316E43E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 5KB
SHA256 bcc38db02f75b67257eb84f20085aabafdd942cfb2b1e2bacbbac2efe6c64239
MD5 ae4fcd9ba5ae3d1c71bc4130f99eada4
SHA1 1e48b2eaed3abfcb95c2ebb614433e790a1711f7
SHA512 4249c7a7fa673bb8e91af7d7cf922c013243d959752289e1f1ff230885ab206db4d6a62a48479850128a3b8d217fd05ed136067c5771363db385bd8e1960486f
SSDEEP 96:o1Wx/V2D0s4rYrfttRrvr7TdxIrwde98ZH:ocW4svr3BxIGuUH
TLSH
T11CB1111C75B90C7F2BDBD38DB881068E86DC4B1291CE28474C9BEF49C985B9A321E13D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

034593f0-9319-499e-8a37-abadec623d75

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\034593f0-9319-499e-8a37-abadec623d75
Size 16KB
SHA256 495cbe4980ebc99a2b4505e6bec13f19a06743f4a3b11edd6f8379897e23c4d5
MD5 ef5b070c0ea092c3e8b93171c5ea99c8
SHA1 5d4a381bf2710e4de17dc61e520825a01e8e0847
SHA512 045238f0ebf08939b1fe96e13dc2030dfb1b13330648d4091cd3d7bb9c4b26088dda259f3b3ef34b8a8113c10997d867e28d14cb2d32b1268090e0348bee1536
SSDEEP 192:mAa8900A7eE9G6u+sewfBS11LMQClVJA/JkvS79AGjJuzhDBs84O8e4AyQCLA:hmeEg6upewfcxkvS79AGj4FD5
TLSH
T1EE72FB5668605ABE8651E3A8D4FC7FC3E6F528CF4C019FCA87E47D0859DE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

243d5946-c26f-4024-ada7-340f4c0c7fba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\243d5946-c26f-4024-ada7-340f4c0c7fba
Size 18KB
SHA256 a21e9d136502d16b2bc15324154661fb8aa2acaa6cc7ca862ff81bcaa760a016
MD5 a5d93a8134766523d76d69908e681a9b
SHA1 f327bd20f7565cb04acf149fe98c7cd99e904a18
SHA512 137d4beab258783aa0d853b4016a36e045858dfaf34e6a7a25aa5144eca5c10647f3dc1a64f3128c065ff42f32dab67e7d17418139372693121f85e1d478eec1
SSDEEP 384:Jcjtlax0St2vcwicDjgs/sn6eV4Ansms206WoaO/JSHtkeKHUK1o1CTxN8tybuxc:Jcjtlax0St2VicDjgs/sn6eV4Ansms2T
TLSH
T1EA92ACFDCE1240473E65E51EF2E6ADAB2057193209CCC79E69FC483A27D697B1227318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

274e604b-edf6-45df-b555-35638ff2f763

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\274e604b-edf6-45df-b555-35638ff2f763
Size 883B
SHA256 cb797f87673358c00abf9cfa6aa0f3ba4754327df40b33dcb554b450d94cfd83
MD5 802cda148aa2a84304dae8d3e02fb5ea
SHA1 0454dca63b2a4ee4abc67e8380bbe3a39f2683b1
SHA512 eedd4035f3737895e21bb2e2116f62aa7c667f73652f56bbd4bb6bef93dc5e7a592db5682c5ec63000ca3797de8f522e2d1f68de4622ee0581a3104f7545767d
TLSH
T1CD110040E63179B2DC38D35BC99537129FF4A91380C655007DE54B084E7965FA367247
MD5 SHA1 SHA512 TLSH

Submit Download

32a24f2d-55cd-4ef7-aa5c-f832057af22a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\32a24f2d-55cd-4ef7-aa5c-f832057af22a
Size 235B
SHA256 814cc89d4e3e7bcfeaf3d95115383d50ae33b113f9cdbcac549df4ccd3c91e10
MD5 969cf2424e9fa341a5d9f33b045de3e4
SHA1 e5a005266bf52beab985ada1c4d6fa4d3a30db18
SHA512 1da6351ba8e452899d8b4901730dce41d6845cc5f90d9b6332f0a669dd20dbaca16455fe6c12b5405db8125d3625ace4d577451cb3d2304b03f0bbf5c4b3346a
TLSH
T102D09790188873AE48240F0BF0B0A9C230994C33286AA8109D910038AAFEAC802A2807
MD5 SHA1 SHA512 TLSH

Submit Download

72a43496-9022-46ac-b824-f0980e49dc0d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\72a43496-9022-46ac-b824-f0980e49dc0d
Size 886B
SHA256 860013c44f1f39b9c1f838462981ca374addbbf1c2d3656fbcd8910053a24e54
MD5 2773c9c786915e8c6ae0efb4e1424002
SHA1 6e8f406cfda6a10755f679dfbc37733354502bbc
SHA512 a9fefb7cea39c7ca59e8fc8206bb601b17928f941fb220c0d6d0c7868389b7d4d4ee6c818701d932eff01b262505331adc209b82f71f51901b278cc90819afaa
TLSH
T1EC110040C635B9B2CC38D39B89A577528FA47513C0C61A10BEA15B084DBA25F676B607
MD5 SHA1 SHA512 TLSH

Submit Download

7337dbcf-f743-4ce8-abc1-51d5c449c81c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\7337dbcf-f743-4ce8-abc1-51d5c449c81c
Size 2KB
SHA256 c7f9249ed37d4a84452c05c89bd25b67282cb8effff6d26293793da4abc7db6c
MD5 aa6f299ad9b7d2e90ff643ff9b756b41
SHA1 867246c0a11e8b70630ab4a535a0ba612f5b041f
SHA512 50fcf75c90628c323343d86d392309dfd4aa4258ea7c903e820438370d3762151d14a4a17433b867fd10262e2a0f171633b6ccf995f8f7711ac366c9b17a44d7
TLSH
T16541265C36785E369C96F15D9952338DC7A08A0300831C835D51EF4CCE96A9E736A41B
MD5 SHA1 SHA512 TLSH

Submit Download

7f926f6e-69a6-40c6-9500-e5dbf1cec809

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\7f926f6e-69a6-40c6-9500-e5dbf1cec809
Size 235B
SHA256 05677bd0a6c69297b0b676730e54b99a6029072d179b3027c8c5c622f975fc33
MD5 9b9c05db45548be1407f5cfafe261e68
SHA1 8974f2d1ed5b1629ba37c8e1999df1caedf3e05d
SHA512 5c114f155fd17c70c59c4b96f14f7fee4490970a51822872344d532e920f50c77337129e49a7f1d59955069e55624ca1e40365343445b91bf5d321046450cebe
TLSH
T1FAD097846498231E4C100F27F0F0ACC230884C33A4B098A0CA620938CAB9FC41126906
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 6891f37265786346f205294c0f7b9c76980509662488159ca0170b7a9380c323
MD5 4dee3e1d9b113dedfc3d7bfa6f366c98
SHA1 95a2494db831a8a728787338c5ae33a86d8d6808
SHA512 49daf37766b452d8132b72e66e4a215b4c2d6407d9b8d617410497e9605ba00ba0705a6f60feacc927a145f1704a529548ecb3651f0e351d633bc8a90693a8fb
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4H8w4hX:NI4fRfsXH446+4V4Y4N4Q4h4t
TLSH
T13572521545048EB8294EA78BAA367E01C37D573B60845C78F4DD8FC842FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 7KB
SHA256 23378d76dab1f9f022bf167b2c8a6954ee9dd6ec69a02d7cd1078ab05ce598f9
MD5 569a7f6409fa81578cb24e6eb8d6e34d
SHA1 d8c7da2c7adf87f693d5f54c7a104fb14109537c
SHA512 03e5f7f66f9982a0bcb25fce8fc3c9389c025fa39c71fdbc35629488831f4d823fc650b0e2989e8660be22c2fc46668f3b287aac9a9223dbaf496aa552cdaff1
SSDEEP 96:xHpUTUWqGqPf2BBWNbzSRzSSlvdv9jmon+cHjCa/Bw88u8L4cnAV7wyGS:vRRPf2BBWczSS5j7/Bw88q7
TLSH
T164E1107891088F7F64B6776CAC6888316AB2413B7BBF58C350B95484015CF7841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 7KB
SHA256 ab774bfc19925bec1a3c2ac5fc2fbca7e2e5c6ef805aa384ec864648655f8f25
MD5 5795c67d6e982a57b0afb5fd59fe25c2
SHA1 9d0589fcde2fa6a2622328313ac59ca5fb1c9b5c
SHA512 0e8c1db107582bcbda4329c54daf512e005d384d87c49ec436072dbc5dc5cb297f0a145508b5500b35df3ccc6f0baf7a5ea6b8b14cbe65357570b88517067142
SSDEEP 96:xHpUTUWqGqPf2BBWmbzSRzSSlvdv9jmon+cHjCa/Bw88u8L4cnAV7wyGS:vRRPf2BBWPzSS5j7/Bw88q7
TLSH
T144E1107891088F7F64B6776CAC6888316AB2413B7BBF58C350B95484015CF7841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 df40011ba98b8322df3cffae3a0441f2bab7be135b977f999d491bcf5a5af5d4
MD5 e683c7a2c2e1970ab77f6faf1dc892ae
SHA1 b5fdc10c58b4ca80e3c3fd409ed72649e347d5cb
SHA512 ba3275de8d077dbbbcd56f4f410ebce29f8823a9928b3625d28acbb92b5505f7dffb0f70d5596ea0204aa2ea7d25b1b5dd560c0eee94faa508cfee2ae87dd21d
SSDEEP 96:xHpUTUWqGqPf2BBW1zSRzSSlvdv9jmon+cHjCa/Bw88u8L4cnAV7wyGS:vRRPf2BBWAzSS5j7/Bw88q7
TLSH
T13FE1227890088F7F64B677BCAC6888316AB2413B7BBF68C350B95484015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 2645894858804c2b1905562a928cc2f27384ef99c0ba7fa4578643caf1af4ad0
MD5 8fb143666631b79f07118ac292a3b584
SHA1 15aa546a34828dac308b4be82240817df1baa4c2
SHA512 a60f343bc7bb69d425a131063bbc60a415fe994fee607ce06814add4572c55ea8155b56befedb1090cd29d7ad65f03c3d3bfebd5b0c4f315e83bdda27c06d211
SSDEEP 96:xHpUTUWqGqPf2BfV1zSKBSSlvdv9jjUn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BfVrBSSpaj7/Bw88qU
TLSH
T1B1E1217890088F6F74B6777CAC648831AAB2013B7BBF28C750B95484015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 8KB
SHA256 bf606b59866c6efe6870e1b9c4cf63985881867dce806373feb336939962a6b6
MD5 65e6177b5d8b3fd1c6be59bd817d1c91
SHA1 f33287aafd6a8bcffbd63119fd63f7a0b714cf5d
SHA512 8a0464e14d5de3d236245db5d02bcd631262ae8fdb41bcece6a153ecb64ae3de1ccaffb8b936a91ff33064d3e960917c2be2498743d1476353693f2fd64dba7f
SSDEEP 96:xHpNTUWqGqPfoBWmbzSRzSSlvdv9jmon+cWRF/CaxtBw88H6cm8L4cnAV7wyGS:vARPfoBWPzSSwRt7fBw88Hw7
TLSH
T1310210389004CF7F64B676BCAC6489305AA2027BB7BF68D350B95485011CF7845FEAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 7KB
SHA256 f46b029ef8cbd580fee1cb1c7bb8c79a81e3326b8ac13116e98880ff98eab1e6
MD5 421734960a95bd5f1cf3201c1860e37b
SHA1 c08cf33d854efb29fecedf02875c7cfc3939126a
SHA512 0402fc845207a562249bd696534f6640a4ff75b0ab0db2720c90479ae5eb1b344ea7e07cac742e97e492bf65043ccde69ecbf02c84426b6ade1ad9dc47ade6b0
SSDEEP 96:xHpUTUWqGqPf2BBWObzSRzSSlvdv9jmon+cHjCa/Bw88u8L4cnAV7wyGS:vRRPf2BBW3zSS5j7/Bw88q7
TLSH
T1C9E1107895088F7F64B6777CAC688831AAB2413B7BBF68C350B95484015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 4adbc49918cc7d182025ac4d107b0f5fd815be786f5a06b5837cc7a4015e4fe9
MD5 2d9604216df012e372d0f65271d7a5ee
SHA1 7e0506681df4d7e92333870599a0c8c1311a14d4
SHA512 ef38e318c55590be38313d78baf79ce68e6599867905542daa7970a5215c4ba18a745a42d0a47a603fe8a5b60b5bbfdbfd7091620b6b606f183095d4b768ea4f
TLSH
T1BF21C656E8271DF13A31A29BE14A4FF1CBCA3022C17950F050DC4B1666ED90CB68622E
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads