hxxp://efet[.]gr | Triage™

Analysis

user interaction
yes
max time kernel
142s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://efet.gr
Sample260810-1blb2stxcs

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	firefox.exe
Token: SeDebugPrivilege	1720	firefox.exe
Token: SeDebugPrivilege	1720	firefox.exe
Token: SeDebugPrivilege	1720	firefox.exe
Token: SeDebugPrivilege	1720	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 1720	5808	firefox.exe	86
PID 5808 wrote to memory of 1720	5808	firefox.exe	86
PID 1720 wrote to memory of 2912	1720	firefox.exe	87
PID 1720 wrote to memory of 2912	1720	firefox.exe	87
PID 1720 wrote to memory of 2912	1720	firefox.exe	87
PID 1720 wrote to memory of 1380	1720	firefox.exe	88
PID 1720 wrote to memory of 1380	1720	firefox.exe	88
PID 1720 wrote to memory of 1380	1720	firefox.exe	88
PID 1720 wrote to memory of 1380	1720	firefox.exe	88
PID 1720 wrote to memory of 560	1720	firefox.exe	90
PID 1720 wrote to memory of 560	1720	firefox.exe	90
PID 1720 wrote to memory of 560	1720	firefox.exe	90
PID 1720 wrote to memory of 560	1720	firefox.exe	90
PID 1720 wrote to memory of 4748	1720	firefox.exe	91
PID 1720 wrote to memory of 4748	1720	firefox.exe	91
PID 1720 wrote to memory of 4748	1720	firefox.exe	91
PID 1720 wrote to memory of 2076	1720	firefox.exe	92
PID 1720 wrote to memory of 2076	1720	firefox.exe	92
PID 1720 wrote to memory of 2076	1720	firefox.exe	92
PID 1720 wrote to memory of 2076	1720	firefox.exe	92
PID 1720 wrote to memory of 4496	1720	firefox.exe	93
PID 1720 wrote to memory of 4496	1720	firefox.exe	93
PID 1720 wrote to memory of 4496	1720	firefox.exe	93
PID 1720 wrote to memory of 4496	1720	firefox.exe	93
PID 1720 wrote to memory of 5584	1720	firefox.exe	94
PID 1720 wrote to memory of 5584	1720	firefox.exe	94
PID 1720 wrote to memory of 5584	1720	firefox.exe	94
PID 1720 wrote to memory of 5584	1720	firefox.exe	94
PID 1720 wrote to memory of 3656	1720	firefox.exe	95
PID 1720 wrote to memory of 3656	1720	firefox.exe	95
PID 1720 wrote to memory of 3656	1720	firefox.exe	95
PID 1720 wrote to memory of 3656	1720	firefox.exe	95
PID 1720 wrote to memory of 4136	1720	firefox.exe	96
PID 1720 wrote to memory of 4136	1720	firefox.exe	96
PID 1720 wrote to memory of 4136	1720	firefox.exe	96
PID 1720 wrote to memory of 4136	1720	firefox.exe	96
PID 1720 wrote to memory of 1248	1720	firefox.exe	105
PID 1720 wrote to memory of 1248	1720	firefox.exe	105
PID 1720 wrote to memory of 1248	1720	firefox.exe	105
PID 1720 wrote to memory of 1248	1720	firefox.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://efet.gr"
1⤵
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://efet.gr
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {e3dc166a-afba-41d5-92ce-a0c300f85452} -parentPid 1720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {6273f623-af5d-44d3-b1c4-05ff61db2982} -parentPid 1720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3764 -prefsLen 25164 -prefMapHandle 3768 -prefMapSize 270279 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3780 -initialChannelId {6e1f17d3-d9f9-4a70-9699-948cafa4b892} -parentPid 1720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3924 -prefsLen 27276 -prefMapHandle 3928 -prefMapSize 270279 -ipcHandle 4012 -initialChannelId {5603713a-76cf-491a-b9bf-dfb20bef94b2} -parentPid 1720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4288 -prefsLen 34775 -prefMapHandle 2756 -prefMapSize 270279 -jsInitHandle 2760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4300 -initialChannelId {a729ee8d-886a-41ac-a76d-08c934b6a18e} -parentPid 1720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4896 -prefsLen 35012 -prefMapHandle 4892 -prefMapSize 270279 -ipcHandle 4864 -initialChannelId {cb7c0986-86b5-4b64-90d8-9e64a21b48de} -parentPid 1720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 32952 -prefMapHandle 5116 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {9a232082-ccaa-4c7c-a459-0cff5605ee68} -parentPid 1720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 32952 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {915d771b-eed2-4bd9-b984-35d8714ec9c7} -parentPid 1720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32952 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5508 -initialChannelId {3b5eff05-d9cc-4e70-99af-9ec32222499c} -parentPid 1720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6160 -prefsLen 39788 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 2980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6004 -initialChannelId {7b633f07-deeb-4c18-b13a-89fa7f3fc0e4} -parentPid 1720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fqkq4vem.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 382fc88b3f1da17edaeb089d90ab70dfc260478d350d01eb673470ce277930b8
MD5 4e63e83266dab72711fc5158d8625133
SHA1 3586b227d71d5679591183528fa35c8b341a39cd
SHA512 c8fd770d685d1fe532e63264356c90a4a444eb4dee5ced6a03d3b04d48ded6b74da23d72f1df92f498cac1b47d29d3a5572c63b4f85965ffaa7f6f104813e8aa
SSDEEP 384:HwCe7iO024Y5DL84KKDL849B7SOEAd9KVRaAcP+AWRMAPRN:QqZY5DL8lKDL8CB7S/AmVAf+hRM8RN
TLSH
T1B4729E7E9F413CAC25A7C0E8C0B982D98D19B7A7CFE6806D21683D0DC79496971F544F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fqkq4vem.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 c4f5f063e6acc37eafa2839f4b4cda2a9b28c7f23565196cef54449d0cf20a1d
MD5 3324caad0073a6fbfd26f39ad77aba1b
SHA1 ff2ef8136c9a71dcc2127e662e3a11213acda7bf
SHA512 c8f34dede97209b775710b73d5b6899a8e294f307504717ad2d5dade12caf33e93a62a3b82e03c63edfb1fa5fd81362265678a475952b3398c4ae4a239f8555c
SSDEEP 384:HXkRyiO024Y7DL84KKDL849B7SOEAd9KVRaAcP+AWRMAn:3mZY7DL8lKDL8CB7S/AmVAf+hRM+
TLSH
T183728E3D4F003CAC2597C1E8C5E992AA4D18B7A7DEEAC0AD21583D0DC798969B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7f6e977d46beffb90ee34782e9e4cc097ed0ea633fbf1073dae46db06a5999ae
MD5 013160cf7790dd2e557927042b9f2548
SHA1 73fc8f4b1d3d15d02c630be33f0b1889a74bbda7
SHA512 f26c5179fff02b690fd129e7d76fceb3ef080d1359e17be499302d290545b7fabf062b8869147d5cac8082f5bb41e0148be3142ddb9878067bb029d034679ec0
SSDEEP 192:q+O1d66JozGzgCl6mc0dXOv5zbowbVTyjD/:Bod66JozGzgC1j2bowbVTyj
TLSH
T150D1EDA4EA2C863FC444123BCCA62B810F36395B984E3F69369D651C2C5A2DD768D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0ed8de0be4d41fdb0f467b1c02d1046aeda197a751fda85ed92b2d7ccaf8305a
MD5 0ba192ab4587b2ed1477780617eda91b
SHA1 896619adb45284f6e2555f22d170ed20492092ac
SHA512 12770539a757594c12cc27079b1457c6255ccd33d61b38c4c0a6e15be2ecc4e9518fc9ebf02ccd438144935fcf22979437e8d34779cf759f8d84f3836b8076b5
SSDEEP 192:q+O1d66JozGzgCl6mc0dYOv5zboPlZVTyjD/Q:Bod66JozGzgC1jxbo9ZVTyjc
TLSH
T186E1FD64E62D863FC414127BCCA62B410F3A398B984E3F69369D641C2C573DD3A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ab3d3b9ee58eb63228f3fb683ecd66e76c58ee4f6be11cdb9a1e93f956ffa857
MD5 8afa3180ea5b62ade0cfd49b40c112ed
SHA1 3f84342e4c15372b3bf3b5018b3fa0a3dd48057b
SHA512 f8bd9486d2699a8920c7b27069c751522a4107ca6cd8a18b21dbf2ebbe3b3fb7728e8c0eabfe01a0b1c164dafdd98bb6f0930410fb90899a581688bce45be9b9
TLSH
T164216A5C39B84D3A9997E2AC78C1038E53514E0A058B5C438E52EF8CCEE1ADD317A87D
MD5 SHA1 SHA512 TLSH

Submit Download

177a627b-4e89-4204-b430-a2929e74ec57

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\177a627b-4e89-4204-b430-a2929e74ec57
Size 16KB
SHA256 4162a758aeba207dbfb92be9b78ffbac7f14a7f3ec6dbe701f58704f53babd85
MD5 ce792ff01c0e81a152cc8c1f16cfd201
SHA1 761857c493bf9d0e2cab7c8a7c62db18f60b27e2
SHA512 325792452863738c6561ad53c6bd1d14ca594584ae3c70799a1a03b9a0e8f720cadf1c5db8268410e426be13dbade93ac37e2e6b920786e32df02b39e0f71411
SSDEEP 192:Tx+8nJg0j3VTVz7PxTzVfjpvffHXDuvdLEsiiz0SucNcibtFQ2TLBCnBfmT17F9N:UPaRzDuFLTii4SucWiZqELYBfqQu
TLSH
T14E72BA16286049BA8691E36894F8BFC3E6F538CF4C419FCA97E47D0479DF06D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2829c102-2723-48a9-a2b1-7e26ef48d05c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\2829c102-2723-48a9-a2b1-7e26ef48d05c
Size 883B
SHA256 4b2b00ab9998cae452281ee046a86be06c2464f3aeba58065b49d7b3b697ecc7
MD5 d25c607e5fa71e1748f82de2d909569b
SHA1 db7938681ff3b2cb6ca6aa4ecd0c043d4b0f6792
SHA512 47a354939c90ccdcb147fd2773b2af0bdf5f8e3bb8257d549e07366d959c1e0018ac622f34690ef1ebb05e96b909bbff99228db6e8e851ce7bad8e4b369b4e25
TLSH
T1FB112341E638B9F2CC7C820F8A9577024BE4663380C654143EB15A0C0DBF62DA3AA74B
MD5 SHA1 SHA512 TLSH

Submit Download

62430bd5-b4b4-463e-9b25-045b2a304573

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\62430bd5-b4b4-463e-9b25-045b2a304573
Size 235B
SHA256 ade94f71ad7aade21a9fa33299b93c73dc39ebee7616786b04c6525cdf5b69d4
MD5 bb3e6b83bfbf9c0d62e36584ea3baa93
SHA1 e35c43f4295809f03d897e9bd5a4e87cf569cdb1
SHA512 132826a124e95855bf10cec1452a10ec49cbdc2736aab2a06ead0bf88c7ea59c6d29bf32606cbd9e60b77c93aabfac1a9d7d84534875aacad241630c2c2e7450
TLSH
T162D097843498A72C08044F07F0E069E632948C3360B8A820D7A2423499BDEC54122827
MD5 SHA1 SHA512 TLSH

Submit Download

8c0ff6fa-2dc9-4ea6-9b4e-a26da583de4f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\8c0ff6fa-2dc9-4ea6-9b4e-a26da583de4f
Size 2KB
SHA256 f294b6335a913abfb24e87c237a24e31982384d114d63eb39b86932caf13dc82
MD5 f7cd52f81eaa9c6af69c5528db0b9665
SHA1 e7feac480106c13f604a2a28d8a2977bc8020ed8
SHA512 cafdda2e1c5b0bc952e6add6fc3ed28f01933c4f33f6ddd3f225253f17b47904b407db6d0b3ea98981d9193d10525bc673d4c2c89fe4620f22841cfe0cabadfc
TLSH
T18941245835785DF68CAAF69DD482338E53644A0350C638D32E53EE0D8C9A79A337A53B
MD5 SHA1 SHA512 TLSH

Submit Download

b3989330-9c94-4f45-8597-cd0baba213e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\b3989330-9c94-4f45-8597-cd0baba213e3
Size 235B
SHA256 255a21c7e5e40bbdbcf135b06ffe847ea9620203e914e40eb8fd1fd4470c0cc9
MD5 8268a2e9488e8f3c229aa3c3611b286d
SHA1 a9345b1979642a2e8d43071134af7ff53c433591
SHA512 c820779bfb1b051b46a91111053249dc6a7d5f218422faaf42a18db864fb9f3fe1bd6e190fdc94d565f420fa31bacfa02e702ac656e5915770a54928e9344103
TLSH
T145D023C01C88776D0C045F13F0E02AC63096CC332478E810E672023899FCECC4312C97
MD5 SHA1 SHA512 TLSH

Submit Download

fccbb666-08e5-4b62-927c-e5e0ddbb7747

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\fccbb666-08e5-4b62-927c-e5e0ddbb7747
Size 886B
SHA256 bfb4afa7f58067b8be5a43b12a1bb94f311cadf12b6453b05e633f0b6b51d28e
MD5 83a29aa9a194eea702c5d8e4551d9c21
SHA1 e84a426c94288a831f49ad5a9377427508015f54
SHA512 f1b0c351b9fdb0848c56e2147222d08d8f2e605d853e85d683cfc6326e3c651117472f2aae6baeaa0bd49d2f79b7be7190f544d2fad7fc22c5a819e32a317509
TLSH
T111114081D97CBAB2CC38924B98D2B3428BD4601380CA19143E515A1C0CFE21E63AB70B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\extensions.json
Size 16KB
SHA256 6af613a00e814ff8e84b4353cffad38b99816d261c976f9510d3b191cdb352a4
MD5 5fb40ad63d006d5c339d6503942f3818
SHA1 c8d26f5338e7fcd4689fce5fd62a694f67b4cd0c
SHA512 1c372fa924f00e7fd605e885c7296acc1cd8c09e7db947c421cfd6c2bd868ad7447f110d4f0becd4f469f623ab1185cdd282afa2adca5dc7093d7aa7ed1eb648
SSDEEP 384:vkI4vJUmldvi8dhWR94zE96oj5L4HtL4PDL4H+L4HRL4Hyl4h0:cI4BRfHXc4c6G4N4H4k4p4i4e
TLSH
T15472521545048EB8294F979BAA367E01C37D573B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs-1.js
Size 7KB
SHA256 555bf0fd62eef0599a984c8b593442ca5da6ca8862c450026f36875dbb0336b0
MD5 71f96e0c3ce6a88f22cf1e2cf7443b7a
SHA1 9068f32fb705faec5b58eb3777cf6495220c2f5f
SHA512 afedb3b97bb2394110b97c40f10831ec91c35699f2d796d969af4786d2e70e9f3acc1d4f56915343861ec29cc58e1b05571510877c0736173a54fcded314d54d
SSDEEP 96:xHXUTUDqGqd2EfNWjObzSOSSlDdv9jtnhHOZYu9fBw88n8L4cnaVQeGS:teRRfNWjASSZ8ZxBw88Dj
TLSH
T14EE1107891088F7F75B676ACAC6848316AB2413BB7BF68C710B554C4054CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs-1.js
Size 6KB
SHA256 9cccbb35eaaf1f2345b01eb492dd18cff8c380fabbc0741c25b7823f47c893f1
MD5 80e900d0d07974770fd4fe74aa31db2a
SHA1 7aec7157d7f1f2faa72c994d02d1bc5ed5c737ba
SHA512 daf7ba3391651af8e5d0ede554392f9e54cb450411119a8c8b49fa5ca155dd20df62142a4ad19cc9cda701de28ee19defad968fb5c19343c4d251ed4f62dd8c1
SSDEEP 96:xHXUTUDqGqd2EfNWj1zSOSSlDdv9jtnhHOZYu9fBw88n8L4cnaVQX:teRRfNWjbSSZ8ZxBw88Ds
TLSH
T1BDE1007890088F7F74B6766CAC6848716AB2013BB7BF68C610B954C4054CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs.js
Size 6KB
SHA256 d46d6da31b95788558545a7bddfededc80a232c90d62a2b9a711e78499be61cf
MD5 22709ca14199d2c3c8be16884d710344
SHA1 5414dcd7a9b134cf2ce34aded4c4c8903aae94f6
SHA512 ffcd958cafa20765854097a693273027467f231e96864d4c4f907b4cdcd30bc6e1038d305c26a2bf778abd4d6e55ecaeae45029d2f3a635aac9b4bb3f95b3bbd
SSDEEP 96:xHXUTUDqGqd2EfNt01zS4gTGSSlDdv9j0HnhHOZYu9fBw88n8L4cnaVQX:teRRfNt0jgTGSS68ZxBw88Ds
TLSH
T1C2E10F7890088F7F75B677ACAC6888716AB2413BB7BF68C610B954C5014CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs.js
Size 7KB
SHA256 2c3042397568ef2f4e71d4e3bea03d224ba7cbc1dda1150734debfa426bc8d88
MD5 3127f73971bf6ff25fd0f1961143c8a6
SHA1 bb740b4c60728fc93f02c4de27bf575a4ceebe5a
SHA512 556164bbf4f14d43b46e061a00858d7012d1703ee22109bb98334827c6f0563cb25370b322eca0b7f9005f9b75a8c09ff8f9ce1728ac961cd13aa7da282fb14f
SSDEEP 96:xHXBTUDqGqd2EfNWjObzSOSSlDdv9jtnhHOZYu9OBw88u8L4cnaVQeGS:trRRfNWjASSZ8ZcBw88Yj
TLSH
T1E8F10F785008CB7F74B276BCAC6849315AB2023BB6BF68C311B954C8455CF3445FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 9c1e514a77a81f384e7a23aba2ac14d02a61407bda7048fbbfdbd6d01dc7077a
MD5 b8be9b95f08868de5a35601d725f7c6b
SHA1 bf0ad7be9214688fb58a1b3072fdb2548d53c3b6
SHA512 2233f07fdec5a625cf6e219896e1549f6a602ae6ead5c0b553af103512e775bff9f3eccd6163b08a236b67fca62f492384e117f3b6d67a4b015c0abcad1781b5
TLSH
T13521C8C7B8191DEAB73741AEC8894BF09703303644B448E0E98E495191D9AAE2589419
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 2f7294a99f41cceae872eea30f1d338de97c965716206ced2703a98e9597014e
MD5 c4db0b01547fbb1ce642b2e8e4125081
SHA1 99353a89b21533de62f99bc25645346fbcc89b6d
SHA512 0075aa08bc57018acd42666e9feaf30e8482596af633fa244f33ad1fec2fb5833d6b3954301bc14f9d9f06f4a876f86876cb12a4e6dbc0b51af7f75493746146
TLSH
T15A31ECC7B82D1EF6BF76C2AEC48D1BF08A5630264CB801E0ACDD4D4591C7555258A309
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 f31afa44b47adfb5346a750e0335e32491b6dedc5bce0975a5ff22853960066c
MD5 ba5b603698c123e4bb121ee494148d35
SHA1 9091ae7df707776c4b399ec62b139305527f8618
SHA512 e95b9443b3877d2a48691f3ef3701ac0891864b61a21c007d7f1173e68c792d9c2a323b84c62582faf1ca3041f3e720f416af01d4fc93e94b4cd25aefca47b9b
TLSH
T10E21C8D3A81A1DF7FA6392AED8894FA0C217303748B444D0E8CA495651DA66E764E119
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads