hxxps://api[.]pastes[.]dev/pcHNWhQBMw

Analysis

max time kernel
599s
max time network
477s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://api.pastes.dev/pcHNWhQBMw
Sample260806-smm11sysat

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2564	4232	firefox.exe	88
PID 4232 wrote to memory of 2564	4232	firefox.exe	88
PID 2564 wrote to memory of 2492	2564	firefox.exe	90
PID 2564 wrote to memory of 2492	2564	firefox.exe	90
PID 2564 wrote to memory of 2492	2564	firefox.exe	90
PID 2564 wrote to memory of 4144	2564	firefox.exe	91
PID 2564 wrote to memory of 4144	2564	firefox.exe	91
PID 2564 wrote to memory of 4144	2564	firefox.exe	91
PID 2564 wrote to memory of 4144	2564	firefox.exe	91
PID 2564 wrote to memory of 4260	2564	firefox.exe	92
PID 2564 wrote to memory of 4260	2564	firefox.exe	92
PID 2564 wrote to memory of 4260	2564	firefox.exe	92
PID 2564 wrote to memory of 4260	2564	firefox.exe	92
PID 2564 wrote to memory of 2508	2564	firefox.exe	93
PID 2564 wrote to memory of 2508	2564	firefox.exe	93
PID 2564 wrote to memory of 2508	2564	firefox.exe	93
PID 2564 wrote to memory of 1812	2564	firefox.exe	94
PID 2564 wrote to memory of 1812	2564	firefox.exe	94
PID 2564 wrote to memory of 1812	2564	firefox.exe	94
PID 2564 wrote to memory of 1812	2564	firefox.exe	94
PID 2564 wrote to memory of 1700	2564	firefox.exe	95
PID 2564 wrote to memory of 1700	2564	firefox.exe	95
PID 2564 wrote to memory of 1700	2564	firefox.exe	95
PID 2564 wrote to memory of 1700	2564	firefox.exe	95
PID 2564 wrote to memory of 4072	2564	firefox.exe	96
PID 2564 wrote to memory of 4072	2564	firefox.exe	96
PID 2564 wrote to memory of 4072	2564	firefox.exe	96
PID 2564 wrote to memory of 4072	2564	firefox.exe	96
PID 2564 wrote to memory of 4676	2564	firefox.exe	97
PID 2564 wrote to memory of 4676	2564	firefox.exe	97
PID 2564 wrote to memory of 4676	2564	firefox.exe	97
PID 2564 wrote to memory of 4676	2564	firefox.exe	97
PID 2564 wrote to memory of 1400	2564	firefox.exe	98
PID 2564 wrote to memory of 1400	2564	firefox.exe	98
PID 2564 wrote to memory of 1400	2564	firefox.exe	98
PID 2564 wrote to memory of 1400	2564	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://api.pastes.dev/pcHNWhQBMw"
1⤵
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://api.pastes.dev/pcHNWhQBMw
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27097 -prefMapHandle 1944 -prefMapSize 270279 -ipcHandle 2016 -initialChannelId {62861c09-422d-4b20-91c8-b991bc7d9827} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {74b5d47e-3150-43ad-b455-8cda73fabd54} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3864 -prefsLen 25213 -prefMapHandle 3868 -prefMapSize 270279 -jsInitHandle 3872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3880 -initialChannelId {8ca03c7a-6d0a-4e64-8353-eee327f75408} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27323 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4132 -initialChannelId {050315b3-ac85-465d-87e9-7309c962b4a6} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4380 -prefsLen 34822 -prefMapHandle 4384 -prefMapSize 270279 -jsInitHandle 4388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4396 -initialChannelId {50a24059-7d88-41ea-bd1c-907a52ee1e7c} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5140 -prefsLen 35010 -prefMapHandle 5144 -prefMapSize 270279 -ipcHandle 4604 -initialChannelId {e84f90c5-4c75-4b5f-9eff-c84621bf7693} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1180 -prefsLen 32952 -prefMapHandle 4932 -prefMapSize 270279 -jsInitHandle 2604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5516 -initialChannelId {143da743-91d2-4080-90ee-5594438707a0} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5652 -prefsLen 32952 -prefMapHandle 5656 -prefMapSize 270279 -jsInitHandle 5660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5668 -initialChannelId {98474763-5226-4475-94f0-a273143854d5} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5844 -prefsLen 32952 -prefMapHandle 5848 -prefMapSize 270279 -jsInitHandle 5852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5860 -initialChannelId {266e119f-266f-4e72-ae4d-65803c5690e5} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\activity-stream.contile.json
Size 5KB
SHA256 74b77c2ad974100178e8e6e09b3f727d0cb606585c9d858248116fa569ac69bf
MD5 b946455266386ab0c4450ed53adb12fd
SHA1 89b6c953d92d6b94ea2488d62ab5d875590177e9
SHA512 85750d85153f116d4ba929c37ee55aca4aa5aabc1a0e9f57baa07fd4d22b94759150dc0666c4c6997c6f5fe300d558432a218bb61e674e033e04ed79f5cfb179
SSDEEP 96:eQfeoWQ5Fui95CE7jLwkFNWpjAxM7xg7ejCo8PNy/5w7NPCb:jkQ5V5nsqW0ieqpIK5wBCb
TLSH
T12DB14CAB4DA4D0A387A2A6E12D9F3B48F143724F9BC88B8DB385DC01E3553BE117D545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 0960792fcff6cd3b531caf6fb9dd6401809efbea3c37af20725aa1a9e46a24d9
MD5 88baffe5ea9e59c148b732a9e6a4f4f3
SHA1 1ae1d7706de8b926208b5506c34a59775fa891ed
SHA512 99d21fca8e78e8a1adb38096556da185c28cbdb6430bf37dec84b343b9360b3ba8dd81f2b854699f25b9ce92e24e937173a1b065d4dc88c546ea14978e797223
SSDEEP 384:HwCe7iO024YkEDL84KKDL849B7SOEAd9KVRaAcP+AWRMA7z5:QqZYkEDL8lKDL8CB7S/AmVAf+hRM4z5
TLSH
T129729D7A9F013CAC1997C0E8C0B882D94D18BAA7DFF6C06D21683D0DC798969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D22TMWNEX2KTUU6LS1V.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6D22TMWNEX2KTUU6LS1V.temp
Size 7KB
SHA256 7df3973e96edef4fb88ebbc3260ac1fe2d0d53318f4900c0947a4d2486436a93
MD5 0d76c1734c26071ad38c72f7f0f2cc9c
SHA1 74fcca9148e60901de0359918cb0508d7436e08a
SHA512 a374bbf3e23440a78d73b0155e3e5550e7c1ab05e18e6c7048bcb2fe7a0bfb9d6cfacaff3d61dced87c26d0deb47421607bd0f475b842a95ee49dc98e16f7de2
SSDEEP 48:0f3cdFJ5UgdwoNNzek3cdFJ/6BdwoNrei3cdFJ/adwoN5gXW3cdFJhiN1iN7isix:u0L0/Y0/G0AN8NOwHNk
TLSH
T1D8F1CB011BF6094AF6F34A3266B1B7135B77FA011B1A4A3DC18666454E32370D9BAFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 778f5adfc13ed519f4ce0501173c28dfff2a34689a56f5f70e4eda5721b96040
MD5 e3e04ac001587c6b13c276a3a3d00a2b
SHA1 109396b22848d1e3f415daef1347e9ca7d18c423
SHA512 d2301f58ebd852d2c140dddc314c7951dc3da28ecd26855a6430b623e29cb1837d3381a433f10ee07a8f7cad4decfa6d73fa0ebebf7928d364a860ffb396275e
SSDEEP 192:jOv5zbo7iZmAyjBto81d66JoztdzgCl6mc0d:sbouZmAyjAmd66Joz/zgC1j
TLSH
T198D1FD68E629823BD418423BDCB61F410F36384B985E3F2571ADA45C2D572CE7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 97cc16b559b5384c0f581c01f1a01d2fe449d843c05f08de0bdd2622fba5b05b
MD5 80b02d5f595e39e0b71791f8180ee48d
SHA1 771c540f445a4cc4ac3fddc5532a9e28e269ef03
SHA512 49e864dcc498ddabb27c336ade005fb99d901961e0d016fc0d6571210d9562eda0de67e38edc23930d5c02c6306bdd1c4d0d6418416144b84e20f709ce0c4a44
SSDEEP 192:ROv5zbo7iZmAyjXlMGo81d66JoztdzgCl6mc0dz:ObouZmAyjgmd66Joz/zgC1jd
TLSH
T1F1E11068E628863BC414427BDC761F410F3A384B984E3F2971ADA45C2D472DE7B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 55acd34d71e534b9a682f7f593f9ef816a7d6762df699a0798e791e8960282df
MD5 0ee80f1cd8b3f8734a57dc24d838a1b8
SHA1 4afcf27eadceace0153499e6084a48ca8f92ce2d
SHA512 a3db9da1ba349c0fdc87b10a66599c9c55a0f457b0fbd244613d0e1f857b78ae5476b2a7a3ce3692574b6d788b483e0fa3ed98ba578930c63d1fc27e568721f6
SSDEEP 192:mOv5zbo7njmAyjXlMto81d66JoztdzgCl6mc0d:dbozjmAyjpmd66Joz/zgC1j
TLSH
T10EE12064E628863BC414427BDC661F410F3A384B984E3F2971ADA45C2D472DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
Size 1KB
SHA256 25241d741abd75b0522eb25e2a689ebdea63afdf0b79ca145985291d72e8baa5
MD5 9f1365f1f496a9dd8aa4cc99e19ea5d4
SHA1 9cdb78849eb819c91ff15722e6cf6795d6fbf488
SHA512 9c2153bcd4e18430767284ce8c67ca2614078f825f8354a69aabbf9e4f5c6230c532fad47fb5cdf79f214e1da2c31b3d22c60b4c1c5678f650620b0e3aea966a
TLSH
T16C213D9C39B88D3A7887E29D7490128F53658A0A08871D534E52EF8ECD916D971BA43C
MD5 SHA1 SHA512 TLSH

Submit Download

1b37a147-cbc9-437a-a66c-3c3dc95e102b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\1b37a147-cbc9-437a-a66c-3c3dc95e102b
Size 883B
SHA256 f9ec5a30d146d0da98da68c326cc9549fbad4783b8c019c2eacc41e72a4b768d
MD5 c91a1a713a1f5617e74b2ebed2780c4c
SHA1 ee0c78c3a5be0a825f3e84330c3251a64861cf40
SHA512 2ef58add78ee6cc9afc4778511edfaa6b0eed4ec1e36c95fb772e44b2a82aacd9861178cd384b655d005c90a7b6213ed608c1c3e40b05afb79522b4745435685
TLSH
T14D110054D539B9B2CC7CD24BC9653B028BE5782380C654143DB18A140EBF61FD75A607
MD5 SHA1 SHA512 TLSH

Submit Download

5cb2f696-8a2d-453d-a4f9-fd435a20c7ac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\5cb2f696-8a2d-453d-a4f9-fd435a20c7ac
Size 235B
SHA256 605ab38c08bfd39da73b26917ef14439da6d7137a6a56c30126a79a5a04bf3ae
MD5 43df2191f5ad6a3309ff823467f3116e
SHA1 7999a55e39f1347502fb251c74929f02d1950e60
SHA512 22774d346f98ad7a10b9baaa857c94642b503fece5c791a992840cef4227c9f29fcb0a5da4492986b04622276100310202cdcc6c69595a3f5344f8e08136da66
TLSH
T17FD097805898631D48180F07F0E0B8CA70888C3310745C24CAA082B4B9FADC4022189A
MD5 SHA1 SHA512 TLSH

Submit Download

7498a8e2-26d3-42ea-9e71-f80ca3f6e2e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\7498a8e2-26d3-42ea-9e71-f80ca3f6e2e0
Size 235B
SHA256 1954a75efccde82f78b3bc2166612b6074064f8ce3a31adbd52341d520239d8f
MD5 cc947d2cc58b6a27bcca2fd8a2839983
SHA1 0c6e30daf5fbf886c6e6bb939142b680e795a6bf
SHA512 c4215e3211120b615f82f33cdf08d7b564c13af09a2edf7ab9b4a112193ea52a6880251beb355a34dc23ceb7bedc0b422c367206ed45dfd401c2a956b2b8478b
TLSH
T199D0978024A8671C08100F0BF0B128CE30888C3358E15820899285388AF9DC8136282A
MD5 SHA1 SHA512 TLSH

Submit Download

7bf26f54-26de-4348-a0df-2cb0973c3193

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\7bf26f54-26de-4348-a0df-2cb0973c3193
Size 886B
SHA256 3db31cf36cf1ef382e6f76d5f5ed6f15aa92e9eb7eb6dbfe3bdb03af6f009fd0
MD5 c4c17c6105dc5473db0a227551d7525f
SHA1 000fa87eafa2d347c8ce06eea9200ac9482edc43
SHA512 b48b02e403abf083df325c88de3c3317735a9bf8bf3ecc7a2555d77070db86a7a92143462d9803daf3873f66db56d00bc0090de5e5724e19d3abf7342971f855
TLSH
T1171104518569B972CC38D14F94A17F424795745380CA09147CA1DE580EEF61F9756307
MD5 SHA1 SHA512 TLSH

Submit Download

e6d0bf79-ce3f-446d-853d-9241590e7b27

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\e6d0bf79-ce3f-446d-853d-9241590e7b27
Size 16KB
SHA256 0a717493332c49f0dafd3914a96381a93c311d724a789fb612679418c41ee34a
MD5 031bf7685ce8d2b5e3cf9b5fbbb4ac4e
SHA1 4310f916d3a0bc1746c2d89af2737741e2c70f6a
SHA512 ac89ddc5c0507b53f2b96e97ab9f5f7b723afa034ab41351218c8a2afa5e8753aa68f3042f63e7e1f015b7a4bad482025013180c28a83695a40e2b9a7acbc164
SSDEEP 192:sq7ZvQz5J6eE53SRFAVB9CEBQu+UNq1fEIscQx65zMZRNQBDWGUhTjTqDYMBotaK:zZv2EJEFAVBUEy1UEsNx65AZRNQkd
TLSH
T16272C956686055BA8591E368D4FC7FC3E2F628CF4C019FCA9BE0BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebcb461b-15df-4d1e-af28-1d053bd6a7b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\ebcb461b-15df-4d1e-af28-1d053bd6a7b8
Size 2KB
SHA256 974da6d204887a7fb547976d6ef6de4e86ded28e841b3dddffaca2ad0baf39ca
MD5 50fac3aa7772c38503e67fca84d3351b
SHA1 5f76b1adfc040421a4eb9a2875f78cec0f4224ea
SHA512 de932a937457da8d6d7798884fa1f9e60474f88c7769773100e8aacd46f4ee4e923d266f5416665b4dd59064c65a5cc62498c4393672ef1ca7352d34e2f75571
TLSH
T13D4133AC36785DB69C9AF54D9042238E93609A4300C21C836D72EF4C8D976EE336A537
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\extensions.json
Size 16KB
SHA256 532570418a192cee3251c8f0dc5bde52722d88e70a379d7bce2da407e7b3bc3f
MD5 0d5d8e5c89ef9b019800421fec11bd45
SHA1 0d4e92a14f9b59734e75f210b370e73edd37ebc4
SHA512 b092c5c3f63c2676c721a2bcbbf119024543c6ebf9d115b2b35a116fce1b9be9984c74d086128db84941e5f286db8e818dac8d90e4f46a5382a784e3a6c99356
SSDEEP 384:ckI4v0jUmldvX8dhWS94zk96oDeL4HSDL4PupNL4HpL4HHL4H4J4h8:zI4gRf0Xz4c6Wk464WN4h4L4o4e
TLSH
T16672531545008EB8294FA78AAA36BE01C37D473B60855C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 7KB
SHA256 ee5e94421d7ffe918d0a1c2c16cfba08eb34ddf9678013087bd225bf22777600
MD5 0303f6925c944407f3aebaa2d00dfddd
SHA1 7c3f344f83e7444abb9dd996456aa824063bd141
SHA512 a318fe04eeb834c62ac5f4c76353cafc9197c7383ccab18edbbb327b715ba2ae4396c4b79d6836e2d8b8ee9b5969357e061e22c29a39d72ceddfe60beacac604
SSDEEP 96:xHdajWXjrjTUZqGqofDu+tSObzS/0SSlcdv9jYnUWRO0YEUKyBw88rg8L4cn7yTM:PhRofDu+tSJ0SSxRdYjFBw88p
TLSH
T128F1FE789004CB7F74B676ACAC6888315A72413BB7BF68C750B58485050CF3486F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 6KB
SHA256 c878aabfa111f0c1f286e0e5902b393bd8216d019d76c6c93573855c6bae082e
MD5 135f8b0be36f51ef78e631335aef1b5a
SHA1 007b1c673f8cb21e9d53235aaa53986efcd1a653
SHA512 ceae2c8b69aa1d67afc817604ece9448dc98d5a0dddfe3622ccd564f50f9d1c5f332b9990ba7acd133c820e3ca48fd64789e0aa0884a0c75b60fed73c98ed591
SSDEEP 96:xHdUTUZqGqofytS1zS/0SSlcdv9jYnUHgYETBw88u8L4cn7yTM:P0RofytSO0SSUgYeBw887
TLSH
T11BE12F7890088B7F74B676ACAC648C316AB2413BB7BF68C710B544C5054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 6KB
SHA256 56fb62e7a5334aaa0282763149d4925394082a939fd89c7714be460623a176c1
MD5 cdeed6341ec01a58f57f4496dfe37537
SHA1 f26dfeb0462f8b041d96c95c3f75ecf482b6cd4d
SHA512 dc71185db86e758322243619a8bcb491a10575643762210b996c25c45123558bc7a533af26020587f40a9ee816f34a607085e9df9bc1c47dceda5f8071579d98
SSDEEP 96:xHdUTUZqGqofyP21zS3SSlcdv9j0nUHgYETBw88u8L4cn7yTM:P0RofyP2qSSIgYeBw887
TLSH
T107E11F7854088B7F74B677ACAC688C316AB2017BBBBF68D710B54485054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 a9b42c65ba2f6757e925f9feedc45c7d501c958eddadf4266609b664754d6cc3
MD5 0be87e99f6a4318c3b56bcc05f7bb6b9
SHA1 56a1d837cfbc14acaa7fa85bcb0deb0235f5ac0a
SHA512 8d17c75d8b3f92c38c60a32ccfac595a71281780568c649ad73c4d7779c564a5114bd4554e490877d00110fe4e60b095cc6fa9cc2325b0d24206117afda401a4
SSDEEP 96:RFfC9g9df2SKlWI0OWt5S+PazxeiA7mskRQ22uezuLQXWTOPQ+:7Cg9US9H5S2ceiA7mskQ22sLQXWSo+
TLSH
T108A16D93B42D5E7A773182628189CBF13F6675C3425B78B00B42438142CF95D62BB219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads