hxxps://archive[.]org/details/ptu-collection

Analysis

max time kernel
50s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://archive.org/details/ptu-collection
Sample260812-e2a34sydqf

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	firefox.exe
Token: SeDebugPrivilege	3848	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3848	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 3848	1552	firefox.exe	86
PID 1552 wrote to memory of 3848	1552	firefox.exe	86
PID 3848 wrote to memory of 944	3848	firefox.exe	87
PID 3848 wrote to memory of 944	3848	firefox.exe	87
PID 3848 wrote to memory of 944	3848	firefox.exe	87
PID 3848 wrote to memory of 3156	3848	firefox.exe	88
PID 3848 wrote to memory of 3156	3848	firefox.exe	88
PID 3848 wrote to memory of 3156	3848	firefox.exe	88
PID 3848 wrote to memory of 3156	3848	firefox.exe	88
PID 3848 wrote to memory of 3932	3848	firefox.exe	89
PID 3848 wrote to memory of 3932	3848	firefox.exe	89
PID 3848 wrote to memory of 3932	3848	firefox.exe	89
PID 3848 wrote to memory of 3932	3848	firefox.exe	89
PID 3848 wrote to memory of 4572	3848	firefox.exe	90
PID 3848 wrote to memory of 4572	3848	firefox.exe	90
PID 3848 wrote to memory of 4572	3848	firefox.exe	90
PID 3848 wrote to memory of 4480	3848	firefox.exe	91
PID 3848 wrote to memory of 4480	3848	firefox.exe	91
PID 3848 wrote to memory of 4480	3848	firefox.exe	91
PID 3848 wrote to memory of 4480	3848	firefox.exe	91
PID 3848 wrote to memory of 1572	3848	firefox.exe	92
PID 3848 wrote to memory of 1572	3848	firefox.exe	92
PID 3848 wrote to memory of 1572	3848	firefox.exe	92
PID 3848 wrote to memory of 1572	3848	firefox.exe	92
PID 3848 wrote to memory of 3244	3848	firefox.exe	93
PID 3848 wrote to memory of 3244	3848	firefox.exe	93
PID 3848 wrote to memory of 3244	3848	firefox.exe	93
PID 3848 wrote to memory of 3244	3848	firefox.exe	93
PID 3848 wrote to memory of 1960	3848	firefox.exe	94
PID 3848 wrote to memory of 1960	3848	firefox.exe	94
PID 3848 wrote to memory of 1960	3848	firefox.exe	94
PID 3848 wrote to memory of 1960	3848	firefox.exe	94
PID 3848 wrote to memory of 4588	3848	firefox.exe	95
PID 3848 wrote to memory of 4588	3848	firefox.exe	95
PID 3848 wrote to memory of 4588	3848	firefox.exe	95
PID 3848 wrote to memory of 4588	3848	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://archive.org/details/ptu-collection"
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://archive.org/details/ptu-collection
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {c33bc604-4a71-494c-8aa8-cd0a44ad34e2} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {4b5ba5d1-4d91-4d18-a2cf-b88a3eee2866} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3832 -prefsLen 25164 -prefMapHandle 3836 -prefMapSize 270279 -jsInitHandle 3840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3848 -initialChannelId {a834cb17-6b9e-4a67-9796-12f8efc09687} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27276 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {ced994c2-565e-4948-8cec-c0d544d0a1b9} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3112 -prefsLen 34775 -prefMapHandle 3128 -prefMapSize 270279 -jsInitHandle 3200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4392 -initialChannelId {3d86a215-745c-40c1-9317-86c65561c6fa} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 35012 -prefMapHandle 4920 -prefMapSize 270279 -ipcHandle 4904 -initialChannelId {cb738f86-9791-4356-99de-2c078bebd7ca} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5040 -prefsLen 32952 -prefMapHandle 5044 -prefMapSize 270279 -jsInitHandle 5048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5056 -initialChannelId {4a83bdbb-727a-4c08-a000-ce9852cf2de3} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5180 -prefsLen 32952 -prefMapHandle 5184 -prefMapSize 270279 -jsInitHandle 5188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5196 -initialChannelId {917e921e-6282-486c-a696-05311e7833e3} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5516 -prefsLen 32952 -prefMapHandle 5520 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {effb6195-8e53-460b-a82f-939f11f54b93} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 8a9a1635fb34548e3f5fe7976dad15d93a3d6fe4b6ea200463fde83c5beb532c
MD5 70c0cc0660435144580c798636e7805a
SHA1 a55c027f5ed883d5b482ad44e100261ba0fb81e1
SHA512 a5679e6f6da01698e743d5dfbb76735a59ffd2055097ad2b977805e93936fadd8855bfd4de7064811ad7f92204c23257291f6072a0dd657d9fc99dc3ce8998f4
SSDEEP 384:HXkRyiO024Y3DL84KKDL849B7SOEAd9KVRaAcP+AWRMAp:3mZY3DL8lKDL8CB7S/AmVAf+hRMA
TLSH
T15F728E3D5F003CAC25A7C0ECC5E982A94D18B7A7DEEAC0AD21183D0DC798969B4F458F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 3a1fdbdbdfe8fbcddad2551cca2fe476d5854de9d861369c9cb10b70736dc9cf
MD5 aaa142d069046419fa3c39bfb61208e1
SHA1 2244f15a37602c22b72b4d6c168d5a674e82e72d
SHA512 1eddb8d6c4771f31d0eae72e9da63c00c79eccfc848855c704d05370757d72136f588a4532f7fd5f5447fa33833b0c6fef241b0e8a10371988eb9105285bd435
SSDEEP 1536:jTrlippi0DG6ER/ib9sLzVctPM9n+oXX9etRD3A8qiJ6cpd5a1+Bjrg5dRKIgRZ6:j3lSER/ib9a8PMga6MniQI5awG+uz3x
TLSH
T1F7A3AFF7DFA28D7D54FFD4196B92C83EFD222800B3A72009C967671461C6BB87279648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4b899dc8a547964c6107dc5caeab9b2c4c032a5d353318703e92767dbf03d241
MD5 25c3d738c56e5380e851c1c2fddcdafc
SHA1 2857b6c29ec95a596b4c9c6668f1d5ad1db2f916
SHA512 f3109f18144f7cd7842437a2095a7b3f88d323fe88bbbec5530cccfe5c3278bf773802fc584435e9207452d0f3beb74c66ef4268b11cdcea5bbb4375fdbb9a7d
SSDEEP 192:y1d66JozGzgCl6mc0dSOv5zbowb+fyjm3:8d66JozGzgC1j/bowb+fyj
TLSH
T19AD10E68EA28463FC808533BCCA61F414F39355B9C4E3F1931AC64182D5B6DE3A9D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 597b5da271c8b81dc9136b8153b860cb2ed8598536aa0e5ff23f00b22d797e5f
MD5 fcf4307db986be7a5319f3f4ffcc4755
SHA1 59b815a854f65dd0f97d005b92df599f47d6961c
SHA512 7c19b9d6a1f1dafbc7591301ffe5b655e892fc14dda188033634cf3f057500785ce7bf69dca776e28f1ae65cb6f992d7a0d3d998a5ee5386afbf3b3d3e0ee851
SSDEEP 192:H1d66JozGzgCl6mc0dJOv5zboP9+fyjq3x:Vd66JozGzgC1jUboF+fyjA
TLSH
T182E11F68EA28463BC808537BCCA61F454F39399B9C4E3F1835AC641C2C576DE369E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 fa18cf34c11eccd8a704af00792d5bb0c751b729888b2decb73d393a6a04c830
MD5 c28a298263bd23642c667e601902b651
SHA1 3fcf31ac744b51d0cc035ab5d6dd387159f4ba10
SHA512 e13ea95fd25e67a96e4e46c91088a3624abdf23aab19a9d6ffcd5033dbcba813af711667999c7633939d6efb03328eb272cff6fcb5433047eac890cff8fac402
SSDEEP 192:3Ov5zboPVZ+fyjq3W1d66JozGzgCl6mc0dz:IboNZ+fyjrd66JozGzgC1jd
TLSH
T1DCE10E68EA28863BC808437BCCA61F454F35399B984E3F1875AC641C2D572DE369E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 e38b19eb2865d68ed301000c60e439ef08d80dd5c122ee93cb19de5759870bca
MD5 ec98142b3d85e33ad95ef35dba967198
SHA1 1e4f6ff88d7df0293be77abc9c834973d48dbd2c
SHA512 21ad76ec026f337ef35f6b46554c04dfe3cce6f08e99883f399200bec3eedb739303ddcceb5ff71fef3fb53e652dab055191d8f960dd72758ad0f880677dcf8e
SSDEEP 96:fFGQFlFZFoF//dd66JozGzgClKtmc0d/UISdF95/7bkW60rcPyUR6:M1d66JozGzgCl6mc0dTOv5zbowCyj
TLSH
T1E2A1DB28F629423FC849423ECCA21B100E76384BA85E3F1532EC74492D6B6DD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07653a2f-ad55-46f2-b47b-c7582e303b83

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\07653a2f-ad55-46f2-b47b-c7582e303b83
Size 886B
SHA256 7f17b5dbaff9850e4ad3a4a5522ac18d5bee86749810f877b6ca72299a3f1636
MD5 8b1d4df8abc2a5bc1ee38eff102bed74
SHA1 94c123efc7163cd60edd256ca36e27919ac2fc84
SHA512 8467d25b9639a22a23257ef77d7b0828ffae2b1c3173f992a2e701f02a0097f972c77be407500113956c0b55747646a9863bbab98bb829d976fbe730f654ea3f
TLSH
T18711C0549EA4B8F3CC6CD28B99D577428BE47123C4C615147FA09A284D7E52E77A230B
MD5 SHA1 SHA512 TLSH

Submit Download

2d88ed4d-02b1-4340-83cd-56c264a2c566

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\2d88ed4d-02b1-4340-83cd-56c264a2c566
Size 883B
SHA256 27b4bd06250e26b7f1cee4e97eb96fe543ad7eb1f040d0f4049eb0583291443a
MD5 b18686c3e9e0b23960c0ac7933d8437e
SHA1 9f1653b40c6db875508d5aa164879317a2a3ec7e
SHA512 e453a7821c4898790338651365a7e179007b97304b1a62653c44917fc8419137066c53fbe2dae960732ec2a9eddd664f8ad9e775f814c5a783cfc9ca2ddb3885
TLSH
T1791100549A64B8B3CC6CD34B8A9637068BE4722384C654143DA05D280D7E92F67A620B
MD5 SHA1 SHA512 TLSH

Submit Download

40d7e3b9-e662-4fe5-89ef-98e440a4b2b7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\40d7e3b9-e662-4fe5-89ef-98e440a4b2b7
Size 235B
SHA256 931134cc3ab2677d622dff4cfe3bf619365f122a5ec68c0cebd5849ab6c44326
MD5 9637c881f520cd8864a49e174d05294c
SHA1 484b374501b381cf29966176b5155e20fb1dec0e
SHA512 2505b0b32ab9fef30916f6a4556bb219461c744226a5b390f1096777f10b4e058a35b1e0df4edba27cc1edcc88f9f56cb755a620af97257df5f61b5a9cc99e68
TLSH
T15FD0978128A8276D0A040F27F4E0A9C230448D3318615C10A6A245749AFCDCC03A5807
MD5 SHA1 SHA512 TLSH

Submit Download

49312e6f-1df0-4713-bb4b-6c15f8755e9f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\49312e6f-1df0-4713-bb4b-6c15f8755e9f
Size 15KB
SHA256 64f9c9d11305e5bb8af750e1709692048828d5450b5ac7aafbe5cf5a43328d9d
MD5 61dea4193e1e71e1c1c520bff1361821
SHA1 0461c8e53972d899452cff3928e5826f96460739
SHA512 223c451ca1bcec7440ffed6b0399a00ab4c59cc8f9ba008914f587391790f18618b7d165678306c5d8a735b468c674d8abd4c8005685c40d21e7769667afe3cc
SSDEEP 192:IGttxfRdNsMydTQOC2ddjaMjRVD4sdvKhXfMi1W1zYq30ybB15GBX41ZftSzeaZ7:IefJ/+5ri1WBz0ybY94DtSiaT6nit
TLSH
T14F72D956682045BA8291E3A894ECBFC3E5F538CB4C415FCAD7E4BD046DEE06E112798B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87e13a1a-9bfd-4a9d-8419-79badc7c9abc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\87e13a1a-9bfd-4a9d-8419-79badc7c9abc
Size 2KB
SHA256 22da199be6a9e30bfcb68552d5ec6cd70bfca1d18497256faa74f5915baad0fc
MD5 392eb4f66ab5feab452a921e0d09bc65
SHA1 fb0b19ae9dd655638b625afc163dc9084f7b68d9
SHA512 7549409e75bd26971ecea2c1f151e83cc23df31a7e99e7ca9c137a0b7f124fe05cba7419f38a20eaa461c0db7c1e7c6c85e4906ad417219513c0cfaf7ad7f7f2
TLSH
T18141246C39B85CB74DDAF58DD483234E57A4860744C628832D61EF0CCC9A69E737A53B
MD5 SHA1 SHA512 TLSH

Submit Download

cf8ee4dc-0a2c-4d60-aedf-d2662ef793c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\cf8ee4dc-0a2c-4d60-aedf-d2662ef793c9
Size 235B
SHA256 3215f21f51daab203d1932cc6fec7ae34c07ebce8bd0a8d1039318f729e3e849
MD5 1ed4909fe50a0b8fcbec856fa4613965
SHA1 785198901ca1e23437999ee85ef4a6962e24c54b
SHA512 33596f5e580e404a282aadabba823efb029d34256f204b05ee5d834aa748362d7613c2209df1730994dae090756f49dbb675fa46395d223be4f2ad573e506196
TLSH
T1F2D023C02CA8272D18104F07F0E068C730D84C3324F07810D6911178DEFEECC4262D27
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\extensions.json
Size 16KB
SHA256 538a9769bae6228e9d8c7fa31589e79b29b278c9ab41b2e432e21f96625faf88
MD5 ea5c3b46d85465e59ecb2be09c089bf8
SHA1 5104cd1869a17fb368e958b0b595beb621559851
SHA512 84009c41dffb1377aa561fe4968c336c6dc7a2be3c8ecebc8b6590f5266c77ebc38c42b02e42beaf570559764f156d9896869df58b9857597612c26dee0acb80
SSDEEP 384:HkI4vYUmldvL8dhW894z/96ozL4HHL4P/L4HdL4HsL4Hu3M4h7:EI4gRfoXV4J684L474d4G4H4R
TLSH
T11472431545048E78294FA78BAA367E02C37D573B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 6KB
SHA256 6efaf8ef90995acc7d11cb839c597fe3b5be6add374c3c785448c53348fbfaac
MD5 a2e9777553749ec5a00a542d206020fa
SHA1 33efb9fa456f825dbc1efc9e23e1a0936648d5b0
SHA512 a735be2886f936a11c329ad6bfb28dcee965d3b6101ea9331d1ead004027529aa9f47909f76c5929da2eee71ec2e03449d9f916e118e4e734fcec62fc140cf33
SSDEEP 96:xHrUTUmqGq6fzYu1zS8TSSlfdv9j9j/npRHNWyS9JODBw88n8L4cnuFNj:1BR6fzYuPTSS/h9NWBrODBw88Jr
TLSH
T1E7E12F789508CB6F74B676ACAC6888716AB2013BB7BF28C750B594C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 a3beec81de595a90d073f38bde225bd9f1f734e1f7b76c6d9f43618153f404ee
MD5 383f00c1e8774bcc245eef373322a583
SHA1 e5a5597a1f2c1492e7bc57cfe58a5a4faccf44f5
SHA512 95aa28e15d4e81f99c7b72b639244c4908ee4ea8bc65bf0eba06f6af1daeac02dcd26fdd9b57c67cbc9395e614a2f391d30467ea0a6d78a109e4cb307c642ae1
SSDEEP 96:xHrUTUmqGq6fzUL1zS7DSSlfdv9jHnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzUL6DSSH9NWBrODBw88Jr
TLSH
T151E11E789508CB6F74B676ACAC6488716AB2013BB7BF68D350B594C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 349d4fc7d39269f9b93e0d9c3b6f31891ef940a7dd21f315f1030c6999e301ef
MD5 05ea228b6e825281e19a1de001df6ffa
SHA1 aeb1ebed8399dbf74d40d06d4da09c3470b68632
SHA512 a83c2e16172d8ca7e375007741ede7fa017b368db68c2fa45ba6ca1aea0b623d6d0de9f44199c8f71d12c60dcf990d59d4d9565eed42eb69157d524ac3597157
SSDEEP 96:xHrUTUmqGq6fzYuObzS8TSSlfdv9j9j/npRHNWyS9JODBw88n8L4cnuFNj:1BR6fzYuuTSS/h9NWBrODBw88Jr
TLSH
T155E130789508CB7F74B676ACAC6888716AB2013BB7BF28C310B594C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 7KB
SHA256 a549b2e903d2255d571f6e58b7968db3e4ae94e3ede083cad3c2e3f6c4de652e
MD5 5227fd0bdfa89cd9808254b8006a82c3
SHA1 2ffe280438bef37437136e066e9af1b8f5c61df2
SHA512 cf29e52134d087a98a1223456271d365464b3588ca6b09b05cf81ff6596fd3ff50963d8b81294a871dd08fc2f8a54ad3579fcbf454350238f59e0c39e3397f33
SSDEEP 96:xHrlTUmqGq6fOYuObzS8TSSlfdv9j9j/npRWRZVhWyS9JO+hBw884QcQL/Q6QJ8a:14R6fOYuuTSS/h8RZWBrOkBw88dhM7vr
TLSH
T175F1F0789104CB7F74B6766CAC648D716AB2023BB7BF68D610BA54C4051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 005c662c2f950a63a0989493dfa63bf5e51c6019923b56e987fd488e1eff58c6
MD5 51b96af7675d8845ddb399c1674087e9
SHA1 934cf80beb45bbcb5d47e85112bdc1f58b72d5fc
SHA512 55a3dd8d7bb8ac603ba7dc478cbf145a599f3d621fffc1c234b9d825e6d6783987da4e9d57ff88a4b63474d2cc29f8a5818a2bb6410ce5abdd39b08a0730d356
SSDEEP 96:dfflWpfwVNht1lus4JLjSonx+inwc8Ryv6ag4RYt68xHhhc:Vl2YVtoZx+inwKCad78Nzc
TLSH
T1DCA16C22394F3EB2DE57620945883F80965718BBD6F904D8209F5D8374E6906136B3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads