06ac5b34f03e98be6e56edfbbe12d0bacacc7f06b28e6b8fa7ea26b14cc9fff9

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bigwalk-trainer.html
Size 32KB
Sample260809-16lajaem2v
SHA256 06ac5b34f03e98be6e56edfbbe12d0bacacc7f06b28e6b8fa7ea26b14cc9fff9
MD5 fedbc1c5ecc8e0c4495f6136f9ba7584
SHA1 cf7d78dd969969c42afd253d122d785b1da4cd4c
SHA512 4eef47662e8abe576f71d6bb508fae8201d8f51b4389fbeeac18566f9667a0c886c610635aa201616abfba66ad3df081d6ad49647564cc844989fd3d484fd6ac
SSDEEP 768:4CKSlfRHSL1piD5JbeGKN/Y36TaqktlRXmPYEfmbeGKFJy:4CKSlfRHSL1qTkA36TaqktlRXmPYEfMV
TLSH
T16FE2FA72E3D0952E313341E8AD42BB6DB923004FAA414D2C747DA1B9BBDACE5993774C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	firefox.exe
Token: SeDebugPrivilege	2784	firefox.exe
Token: SeDebugPrivilege	2784	firefox.exe
Token: SeDebugPrivilege	2784	firefox.exe
Token: SeDebugPrivilege	2784	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2784	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2784	2852	firefox.exe	88
PID 2852 wrote to memory of 2784	2852	firefox.exe	88
PID 2784 wrote to memory of 2940	2784	firefox.exe	90
PID 2784 wrote to memory of 2940	2784	firefox.exe	90
PID 2784 wrote to memory of 2940	2784	firefox.exe	90
PID 2784 wrote to memory of 1084	2784	firefox.exe	91
PID 2784 wrote to memory of 1084	2784	firefox.exe	91
PID 2784 wrote to memory of 1084	2784	firefox.exe	91
PID 2784 wrote to memory of 1084	2784	firefox.exe	91
PID 2784 wrote to memory of 1592	2784	firefox.exe	92
PID 2784 wrote to memory of 1592	2784	firefox.exe	92
PID 2784 wrote to memory of 1592	2784	firefox.exe	92
PID 2784 wrote to memory of 1592	2784	firefox.exe	92
PID 2784 wrote to memory of 3496	2784	firefox.exe	93
PID 2784 wrote to memory of 3496	2784	firefox.exe	93
PID 2784 wrote to memory of 3496	2784	firefox.exe	93
PID 2784 wrote to memory of 5100	2784	firefox.exe	94
PID 2784 wrote to memory of 5100	2784	firefox.exe	94
PID 2784 wrote to memory of 5100	2784	firefox.exe	94
PID 2784 wrote to memory of 5100	2784	firefox.exe	94
PID 2784 wrote to memory of 4368	2784	firefox.exe	95
PID 2784 wrote to memory of 4368	2784	firefox.exe	95
PID 2784 wrote to memory of 4368	2784	firefox.exe	95
PID 2784 wrote to memory of 4368	2784	firefox.exe	95
PID 2784 wrote to memory of 5916	2784	firefox.exe	96
PID 2784 wrote to memory of 5916	2784	firefox.exe	96
PID 2784 wrote to memory of 5916	2784	firefox.exe	96
PID 2784 wrote to memory of 5916	2784	firefox.exe	96
PID 2784 wrote to memory of 2416	2784	firefox.exe	97
PID 2784 wrote to memory of 2416	2784	firefox.exe	97
PID 2784 wrote to memory of 2416	2784	firefox.exe	97
PID 2784 wrote to memory of 2416	2784	firefox.exe	97
PID 2784 wrote to memory of 1252	2784	firefox.exe	98
PID 2784 wrote to memory of 1252	2784	firefox.exe	98
PID 2784 wrote to memory of 1252	2784	firefox.exe	98
PID 2784 wrote to memory of 1252	2784	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\bigwalk-trainer.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\bigwalk-trainer.html
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {2b39bab7-54ad-4b0b-929a-ccb6876ff0b4} -parentPid 2784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2784" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {f3541539-96af-478a-93e6-a5d0651c291f} -parentPid 2784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3704 -prefsLen 27323 -prefMapHandle 3708 -prefMapSize 270279 -jsInitHandle 3712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3720 -initialChannelId {a350c7de-f7b6-4c54-aa75-9c79133351b0} -parentPid 2784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3872 -prefsLen 27323 -prefMapHandle 3876 -prefMapSize 270279 -ipcHandle 3944 -initialChannelId {f558f06c-5e93-4906-b93a-6a4174f2bd64} -parentPid 2784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2784" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2992 -prefsLen 34822 -prefMapHandle 2648 -prefMapSize 270279 -jsInitHandle 2828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2836 -initialChannelId {5ed46bbc-f4c3-4cc8-8d5c-ff7e6f048f90} -parentPid 2784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5000 -prefsLen 35010 -prefMapHandle 5004 -prefMapSize 270279 -ipcHandle 5012 -initialChannelId {ab51dbc5-b621-45d3-927f-53ac458f8391} -parentPid 2784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32952 -prefMapHandle 5616 -prefMapSize 270279 -jsInitHandle 5620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5628 -initialChannelId {0e335c2d-8fab-475f-9138-184a48ccd15b} -parentPid 2784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5788 -prefsLen 32952 -prefMapHandle 5792 -prefMapSize 270279 -jsInitHandle 5796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5804 -initialChannelId {aab78354-f241-4c74-8dbf-c5ed8398079d} -parentPid 2784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5976 -prefsLen 32952 -prefMapHandle 5980 -prefMapSize 270279 -jsInitHandle 5984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5992 -initialChannelId {cb390877-9bad-4c0f-91b8-11c1ea4321fa} -parentPid 2784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wg40zd9z.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 0cb561771e2681793adc3aff8a0d355212726a86ff8eb001c7617595d5926627
MD5 b466666bb0f82ed5d3bb7afe39a84292
SHA1 a8804bc3b1e0bfa5e444b4c0346c78acc55f8391
SHA512 f1dea5c7a93834f24b562a42885f77af20aac76396f9301e705072bb9ffeab9a048fc4df9af6e2d0f7ac25e25299fe7c57b19b33f8d579f2071a6347b3a1d220
SSDEEP 384:HwCe7iO024Y/DL84KKDL849B7SOEAd9KVRaAcP+AWRMAVrk:QqZY/DL8lKDL8CB7S/AmVAf+hRMerk
TLSH
T161729E7D9F013CAC1997C0E8C1F892D98C18B6A7DFE6806D21683D0DC7989A9B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wg40zd9z.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 7dcbb3650adef61e19272430d353c57887b1acded956218966e105ad2d09d356
MD5 cba92bdfc022e4d548e84bff78244975
SHA1 23aafc15f31301db3ff03a4dc64d42e948797086
SHA512 e23fdb2e38815159745e3fb37a041326f27a9a09d2fb885b27f14145938d515d9e3041f940759bbdc01b22566598e11885456dda785bade7eb0e77e042da2962
SSDEEP 384:HXkRyiO024YCDL84KKDL849B7SOEAd9KVRaAcP+AWRMAX+s:3mZYCDL8lKDL8CB7S/AmVAf+hRMa+s
TLSH
T152728E3D4F003CAC25A7C0ECC5B992AA4D18B7A7DEE6C06D21583D0DCB98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 7701e292c79ae5d4ec7469254c45c361d07c8fced3f276e1ea5c0509d0b1a10f
MD5 b857f950116a7135e3aaf3497aa1291a
SHA1 12ed91245816309c3cb3988e8ca0e2a7e63df922
SHA512 157c962433d9453fb7b2badf98dd964cdf5d81763298097405c37774a81f4590c4fb742585cc5bded1985cd5a458097c3850cfb0991b3dcc305143f01a7cbe8d
SSDEEP 96:4FRbu2FSFhFRFPj/dd66JoztdzgClKtmc0d/UZSdF95/7bkW6ArcEpRyUR6jx2WI:cbUj1d66JoztdzgCl6mc0dcOv5zbo8bH
TLSH
T179C1DC28F638863FD449023BCCA61F504E35795B989E3F2531DC250D2D5A2DE7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ce6c633c8ecfcde6152e003e282fcf1cf20db715628e29b7719ca50d07fc728c
MD5 a06f7f75a9aa0f34c29decadbe02802f
SHA1 b56b0d356fd772a6f241c4b3ee0581f7f2d3c589
SHA512 0e04f45da1502d6a70d1c47ac9b17b59fa933ec9faf03d1bac9013d84ea4b4f99100c4c81ad8f638e0c13e2de03bb87e7bf2261b963fb02d3aabd5ec748c1cd9
SSDEEP 192:JOv5zbo7UZpRyjt9FbUj1d66JoztdzgCl6mc0d:Gbo4ZpRyjwd66Joz/zgC1j
TLSH
T1DEE11D64E628823FD008027BCCA61F454F39388A9C5E3F1975DC650C2D572DE7A8E2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
Size 48KB
SHA256 7e41085ae12195f62b6951923dbd66bcd434888b37edb17dd50e0ff40b7f4752
MD5 bd9abc4fe4ef78d54f26d074a1034621
SHA1 408de11704c07cc4ec087337a224f77173243432
SHA512 06b08cbe706be4c22de9d3d46540d3fc7e2daf093b5dfaea3ffa8ba62ef4d0143125aa93fda829bd92aab3e174007b194003a7c496f5256cad356361c3a08fb1
SSDEEP 1536:xK+A5MrhbOP6wNujLgW1K42bpBCZpGN85:xjAYhbmJujiNb22a5
TLSH
T14A231F44EB1A913FD42812BADCA61B003F39F8895A1A2F67365C64386C873DC3D5E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
Size 48KB
SHA256 6038d3a0ee860a2aa5aa25445b8e5299db282da8f8a0ea3f5e2cb9a2761495f2
MD5 beb73e138669db9e5724b6e6037030e3
SHA1 71002689a2f2863440d9659287812da685bb7ef1
SHA512 25f017532f2d53e483cb8ef7f4ca3f93bb725580cec83ad09d7e868dc918197e85f63ddf3fdf64ee12f2f578a16f74d89763c4ff08433c5f628b19847088ea68
SSDEEP 1536:kK+A5MrhbOP6wNujLgW1K42bpBCZpGN8q:kjAYhbmJujiNb22aq
TLSH
T11F231F44EB1A913FD42812BADCA61B003F39F8895A1A2F67365C64786C873DC3D5E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
Size 48KB
SHA256 2bde5c10d0dde3142e9450cfd355cd77eac2721295c1bdebf53851046d2711f4
MD5 0f75f55fd022be991fd05ffaf61d2cc0
SHA1 48e9978a7662cea206b82c0a637d9cf16b38474b
SHA512 ba092fe416a5fb8f086caf1a3d85a7fc81d2ef3916d738466be0783e08c175221bdc7550a9cf3bbbf9bbd403acc60d01ed119243dd0df376d0111202daa436c6
SSDEEP 1536:+K+A5MrhbOP6wNujLgW1K42bpBCZpGN8s:+jAYhbmJujiNb22as
TLSH
T1C8231F44EB1A953FD42812BADCA61B003F39F8895A1A2F67365C64386C873DC3D5E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7c4465af29e76b25f98d224208183ef01696017b3709538bd9b932e529a61b26
MD5 f69ee6ac4fee05e0553b88c1347a8045
SHA1 9705a718792e113604bfcb67a4e0b3c931b9a139
SHA512 22744f65c3e68bffa21757132b5312e5ed614abb46e01b4dc07e39c41c8e1f222c9c43e672ab5735d6b442ae9fe9bb6dfb30570bdc196395907cb99b743e70b7
TLSH
T1B4216A9C39B84D7AAC8BE29C744003CE93559E1B04871C439F02EE8CCDC1ADE326A429
MD5 SHA1 SHA512 TLSH

Submit Download

09a107c0-9390-4381-b698-1dc9141ae500

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\09a107c0-9390-4381-b698-1dc9141ae500
Size 886B
SHA256 fd32b92f53d2a5032c8a36425d3e59e654339f9f7ad2c86f7320092fe632b993
MD5 319c2c5a65b8d9de1c19bc07c9d1dca6
SHA1 0bf91710679f3bd0dc0547310b3bffc79aa0e562
SHA512 e57c32911a8d66a9c476c5b12056c137bd5c6fecb4e63d80bd45f15ab63592f80e5ce65cf4c8a4fcc6b8031ba6dc906a7d136353d7dcc2fc9f284fd2efd484a6
TLSH
T17E110441A9707672CD78929BD4A57F068AE4782380D908107E915F084DEA62F976A707
MD5 SHA1 SHA512 TLSH

Submit Download

09d46523-a56f-4f1c-b7fc-3a425e2aee8b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\09d46523-a56f-4f1c-b7fc-3a425e2aee8b
Size 235B
SHA256 044bcd5b1a13ea16505be9d9310eaf61b4d28eec475308e35dae2383c98d3e78
MD5 23b6f7a20ed7aa6ece5067149ff1ed3e
SHA1 385d103a719e78d95ae1a3134fedada651f74db1
SHA512 6f59d2424d976d661ef3a98350304816978339d10d084ac390c2da19334cb89017005d1f9750c112b649128e281e68b751d082ade56cf564819e903883484990
TLSH
T1EAD0A7947498676D08181F1BB1E07ED630644C3364BAA870EA51457499FEDCC5252D17
MD5 SHA1 SHA512 TLSH

Submit Download

26a6a829-c0cc-4958-a2b1-9796919b01ff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\26a6a829-c0cc-4958-a2b1-9796919b01ff
Size 2KB
SHA256 6e9f59603e87a81988f1cc8af8e6e0e445e4816f1f6d9c59f12ee90083647860
MD5 c9648f3691d2ed6ecfd22c0aab724904
SHA1 b901f794f6518daa26c8f8b391a6e671f706b6b1
SHA512 5e06bb1a6134dcd0cf19d7bc7eadbba43944f211ce8380bf80bb23e178623018e432fcfc772e3be4b5baac70012668d7fc32dbcea9def1c10ca7d60eecf8cf62
TLSH
T1D841535C38784D769CCBF25DD082378D83A09E0354C62C432D81DF0CCDA26AE736A91B
MD5 SHA1 SHA512 TLSH

Submit Download

431ea950-77c3-42f4-b391-2737f62e456b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\431ea950-77c3-42f4-b391-2737f62e456b
Size 16KB
SHA256 273c1c6b77b4a8e2666768d660b93eaf754efd697e54de38c41e195fc56f1291
MD5 57420e046a4645546488788086e3467b
SHA1 6d1c2d681d5805eae42b9b4391ea2831d0070240
SHA512 89b455b613a783b6ec65333ab162cff64c61ec06d784f6e7321d3fe098f12e5b23b9d0f2d309af546fe7f56372815bb3d4befdc7a2578be05d2984de0e074ed3
SSDEEP 192:GiEMv1DU9jB5VK7JJhJMRsHUL7mTug9an2h4Qx+78z8B3rc1ArcuJtbC+iKzx1BK:5U9j1KlG8wBwWrcuJtb5iKl1Y
TLSH
T15B72B9561860897AC651E368D4FC7FC7D6F528CB8C419FCA9BE4BD082DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7cabdc27-0fdf-4657-af57-b05623a44be7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\7cabdc27-0fdf-4657-af57-b05623a44be7
Size 883B
SHA256 d70875a825875bc34ad2f03e512e3b89b9884815af5d2bfe8c2325ba6e03ec56
MD5 dad3b8b75d842dd7ca7f10a7f3e8a9ca
SHA1 57e5a992c15f839eac0ceabbe30f3c6e543aa09a
SHA512 e4e73e539617b0ca8c89897c76ddee4b5295220a70c0b3c503eba4d659a98dfbbf3bd666b44b6f13b983f2092d7d58c4d712b9ea1d85260309b74f9e53121234
TLSH
T180110081A634B6A2CD28C24FC4653F058BF8782380D954103DE15F184E6FA2F97AA74B
MD5 SHA1 SHA512 TLSH

Submit Download

cf012eb4-eb3f-4dd2-89bc-8df8fb309e90

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\cf012eb4-eb3f-4dd2-89bc-8df8fb309e90
Size 235B
SHA256 916a4d52a4180c0ca7c1da561e782f461f230dc66937e65babc31bb35f942ece
MD5 13f492fc427926d9249c3e3c2f51c7ff
SHA1 17e92ffd487054ded65f82c5435ae71777f9de73
SHA512 f7d1f1304c90ecaddf4f8c0214d46dae4798c3fa91b50afcfb1945050b491a373c895f6ddde2d6410b0cb8fd199f46159e15fc8ae4fcdd8f6a7fe03c110714d1
TLSH
T1C8D097C01C9923AC08040F06F0E079CA70884C3328B09810F6A4113889F9DC5016191B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\extensions.json
Size 16KB
SHA256 30ea8c33c78e05ebab8333d886300d0c34f7163c20702bdce60db4c89904ff2d
MD5 617a736b05a1be1df355c4d177a1eeba
SHA1 f88f0248891dbcefc05bfc33a60f7186441edc74
SHA512 b599c5a1d2812e7848601af194eeb65e8ab381f4d983ad73f8af5910e3109dde8c9064574bf93d8c684ab77a9aba43dfec0253d0ae7f57af160768e80c4a3ee9
SSDEEP 384:OkI4vNUmldvl8dhWv94z696oaL4HwL4PV5L4H0L4HXL4HjevS4hxH:hI41RfWXq4q6D4S4tx4O474Dd43
TLSH
T14A72431545048EB8294EA79BAA36BE01C37D533B60845C78F4DD8FC842FB5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs-1.js
Size 6KB
SHA256 c4617768c74c40c13dd1688791ecf58000cf40be4113834b0c1a03a089782324
MD5 7e57be4bff0ebd58266d7b5b961faf12
SHA1 763bdaf52a5280e2f8b236553fdcf6510f6074ad
SHA512 3985339b0130065cf4e05cfdefae3710af4b148183c07926070f17bb81ca7b73c3d4432ffc17e6094057ff5f3b2bf43e5fa02f5de43d6d9535f892ca14ae72a0
SSDEEP 96:xHBUTU1LqGqTfQ0D1zSPSSlvdv9j0+n0H2BoRHHBw88u8L4cnUsF:bsRTfQ0DuSS42BoRBw88H
TLSH
T161E11E785408CBAF74B677ACAC688C315AB2413BBBBF68C650B554C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs-1.js
Size 7KB
SHA256 9063951c198be686114656df16368ec581158c8e94c16fa9b2c3d997f59dc3eb
MD5 0ce9b611ad25ad4294ea08076145b509
SHA1 29529b80bb144a1f1c56368cd2dbe3d7e8ab1cef
SHA512 de4828a9d8a5e2ba7a28a204a0552ef11f80e9d09d58c87a8d657fb978d9c13e45abe2503ad4d22bbd85b89fee994794c0ad5d2da6aec2ecbe43c093b791b375
SSDEEP 96:xHBlTU1LqGqTf00DObzSPSSlvdv9j0+n0WR0QeSBoRHfPBw88e8L4cnUBF:bxRTf00DRSS9R0QHBoNBw88k
TLSH
T1F5F1EDB85108CBBF74B6767CAC688C315AB2023B77BF68C611B55485055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
Size 6KB
SHA256 42e355385fc4ecebc2e899fb3c68a74163954993f02f027fffad1e0e1b971ba5
MD5 577ae2f15ee6649b09db6c6ba098da2f
SHA1 941d2043666dae5a46891731445942a1a51ca845
SHA512 a153b8cc717a266466bd92759c4e782aa32b01e1550168766d2e110b0d5d04b2767b6f1f87050fd59dad351a57c6b1230e0d3a9cd08fe1aac638780f713ff146
SSDEEP 96:xHBUTU1LqGqTfQOEHC1zSx6SSlvdv9jsn0H2BoRHHBw88u8L4cnUsF:bsRTfQziy6SSD2BoRBw88H
TLSH
T135E10D7891088B6F64B677ACAC688C315AB2413BBBBF68C710B554C5055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
Size 7KB
SHA256 33846555e9ab8c2b324f888c4624bec8db9df4a6e0b92f9dc7410d99ed49c78c
MD5 ff38dc20dfe735d453994a5ac6230918
SHA1 98393c7b362b84b2094ac54529655134253cd62e
SHA512 4a80ec7c587db922bbe4a423ca024aa12e56593f5ea35e2e872ec8ca33c0cf1e106aceac688438fed342639012cb5019b6cc9122293a8578f8cb1856b66e8d7e
SSDEEP 96:xHBlTU1LqGqTfQ0DObzSPSSlvdv9j0+n0H2BoRHHBw88+8L4cnUsF:bxRTfQ0DRSS42BoRBw88X
TLSH
T112F1EDB85108CBBF74B6767CAC6888315AB2013BBBBF68C611B554C5055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 65a631cb7e8a412bb5031aed86db771bfed9911ffe52f87467cf00537de0ceda
MD5 45f05674b91abdaa2e10705b35eae204
SHA1 81e6ae28212dde2116882e4b6bcd83db46730580
SHA512 5241d97edc08ac900946f50aff000d915104bd6e6cb8405d1e2e4a40c20c05894af9376cdfcb2d291b13d7a4f25ec3e07a3322c4b737466d7336d8056fc5d46e
TLSH
T1DB414BA33B021EF037D79419908A7FF0867A20A741F00CE0C1AC5BC198CFC44356671D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 174b049b1f231dd39cafc00a858bf953f78bd0addcdf204bb243fb17024c690f
MD5 b79c1a785f61adb6d23e2062cf9f6d42
SHA1 5276a1dd7ae0d030157637e8dd7bd58e7acff5a2
SHA512 daa9834a1979a17b1bcc8120d1ded4842da1965df39299098039a65af9394910a9b5f23bc76282046f969eb1820cc021a3ce59e22aa0bb9db77caf3a758d7480
TLSH
T1524129A33B065EF077D79459A08A6FF0C6BA20AB85E04CE0C1AC5BC598CFC44356A72D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 0de6544954f7cfa45d9151f44284d42e14902aa61284a213a4b5d2fa61f015a9
MD5 b75056d0e1677a13f87175cd88f2f9de
SHA1 18cfa7efb89f9d053289db2d62f24b3e4adb5203
SHA512 dcd23ecf75ce27efa6fa8a36d443eae7e30ee4fbdcc02ee4e445df17e492b43bb7e482a6408802f68639bca7c5454b390ee74db801cb34b5a7542e8fccad2abf
SSDEEP 49152:ggaHfgdhf1WjYWwQ55AvHTQ7SD2WSchI:xzzWmvHE7SCWScK
TLSH
T1893629F820D1A257F3814033664593EF21EFD00C6037DA085BA966E9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads