hxxps://cs[.]salesforce[.]com/successplanevents/expertcoaching#tab=Coaching&f[sitemaplanguage]=en

Analysis

user interaction
yes
max time kernel
3s
max time network
20s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cs.salesforce.com/successplanevents/expertcoaching#tab=Coaching&f[sitemaplanguage]=en
Sample260813-xrtftach67

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
264	firefox.exe
264	firefox.exe
264	firefox.exe
264	firefox.exe
264	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
264	firefox.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 120 wrote to memory of 264	120	firefox.exe	89
PID 120 wrote to memory of 264	120	firefox.exe	89
PID 264 wrote to memory of 4524	264	firefox.exe	91
PID 264 wrote to memory of 4524	264	firefox.exe	91
PID 264 wrote to memory of 4524	264	firefox.exe	91
PID 264 wrote to memory of 4916	264	firefox.exe	92
PID 264 wrote to memory of 4916	264	firefox.exe	92
PID 264 wrote to memory of 4916	264	firefox.exe	92
PID 264 wrote to memory of 4916	264	firefox.exe	92
PID 264 wrote to memory of 6444	264	firefox.exe	93
PID 264 wrote to memory of 6444	264	firefox.exe	93
PID 264 wrote to memory of 6444	264	firefox.exe	93
PID 264 wrote to memory of 6444	264	firefox.exe	93
PID 264 wrote to memory of 5128	264	firefox.exe	94
PID 264 wrote to memory of 5128	264	firefox.exe	94
PID 264 wrote to memory of 5128	264	firefox.exe	94
PID 264 wrote to memory of 2336	264	firefox.exe	95
PID 264 wrote to memory of 2336	264	firefox.exe	95
PID 264 wrote to memory of 2336	264	firefox.exe	95
PID 264 wrote to memory of 2336	264	firefox.exe	95

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://cs.salesforce.com/successplanevents/expertcoaching#tab=Coaching&f[sitemaplanguage]=en"
1⤵
- Suspicious use of WriteProcessMemory
PID:120
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://cs.salesforce.com/successplanevents/expertcoaching#tab=Coaching&f[sitemaplanguage]=en
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27098 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {c16c8f9d-7ecf-4a40-a1e8-1271e6263d87} -parentPid 264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.264" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27134 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {1e83b04b-82ff-4eb7-8fe0-61d12c6c9fe4} -parentPid 264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3904 -prefsLen 25213 -prefMapHandle 3908 -prefMapSize 270279 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {40fac38f-eac3-49cc-bfbd-cbb317de202e} -parentPid 264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:6444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4136 -prefsLen 27323 -prefMapHandle 4140 -prefMapSize 270279 -ipcHandle 4232 -initialChannelId {cad9e9f1-015e-4fc4-ad38-cb63a4c5a9dc} -parentPid 264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.264" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2760 -prefsLen 34822 -prefMapHandle 4456 -prefMapSize 270279 -jsInitHandle 4460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2892 -initialChannelId {da7d8ad5-7aa6-4fb2-9b75-d1897c749fbe} -parentPid 264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    PID:2336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5152 -prefsLen 35010 -prefMapHandle 5156 -prefMapSize 270279 -ipcHandle 5164 -initialChannelId {9e9c1da4-f555-4eb9-8d3a-1e9fa1871f88} -parentPid 264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    PID:2676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 32952 -prefMapHandle 5612 -prefMapSize 270279 -jsInitHandle 5616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {c06fac59-f82b-4f40-b028-faa70d0cd332} -parentPid 264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    PID:6260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5776 -prefsLen 32952 -prefMapHandle 5780 -prefMapSize 270279 -jsInitHandle 5784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5792 -initialChannelId {5f99af46-4f4b-4dac-a9fd-8e7ef3fce13c} -parentPid 264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    PID:6332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5952 -prefsLen 32952 -prefMapHandle 5956 -prefMapSize 270279 -jsInitHandle 5960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5968 -initialChannelId {2983ef5d-c140-4bbb-ae80-daa7bfaf048c} -parentPid 264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    PID:5820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6472 -prefsLen 32952 -prefMapHandle 6476 -prefMapSize 270279 -jsInitHandle 6480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6388 -initialChannelId {3e10aaa8-beb0-44ea-a90a-dc28fad17eb2} -parentPid 264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    PID:6184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8F19CE011E7FD135BB71A533EF15816E5D5842E2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6eagavx.default-release\cache2\entries\8F19CE011E7FD135BB71A533EF15816E5D5842E2
Size 25KB
SHA256 a144bab6719ab119bd6a298ee7245457473c21f33910116a6721a9e5cdbe043f
MD5 3caf623ab84a2cad507b5f418d28b570
SHA1 60c5699a7a13ddf3a555346dbeb128230a99af23
SHA512 f1f36b8870a2326fd8a3ee4625e2821f5406d2b105641251f84c63936195ba2dc9b5c7504e3ec1ba0175b7d258b97b55bed668886771ec9c1f5ddc74ec0284f7
SSDEEP 384:M8msWTW55MyQDKBjoYS/dcWPpvaLEs5F50gePx+9jA8W1X12:AWZBS/O/LEIvePx+9jw1X12
TLSH
T1B0C2E9F1A65420F0250797B8D93A6BE97E6934FFBF48CBC433D89D9496062D18ACDC81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6eagavx.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 3039aabebbec3629609a0bfcbc96a348663ef84f5fad459838d2b7a0ef1fb26d
MD5 af3cb11db0e53a8a8e13175b94440380
SHA1 74fb7147484b2390f6bc7a9b275a68fa76a8b849
SHA512 e97b8cc4e357ab783bdb52b86fff105d5216b777148ad1c20a02b6f5d09c8767c8973ce9b62e2e356a640a1e0c51b32789551b23f149377ff8b94d7775c526b6
SSDEEP 3072:j3l8dkn3CkVXJ7/ACHbqjAOzqNgab5/iyWYS:p9bXd/rHbqj6+aty
TLSH
T12DA3AFF6DFA2C97955FFD02DAAC2853EFD262404B3A72009C963770062C6FB87675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2219ea3e01c1f23e5ca08784697dc4eb1122d704ff79ea4d7ea78eecd21bf478
MD5 1973c9376943e5de874dc3c124e02244
SHA1 bf89a65bc660d25ac68a1017e04058b1355571ea
SHA512 5149bf6ecea8f7f9fb9690615e205b842c31eae1c80769e484559c0ba4eea2ae546fdb0613e1a50b9667c55cde29a7443e2e0ff94260088c9a0fcba7a4bc56bd
SSDEEP 192:Oh1d66JoztdzgCl6mc0dHOv5zbo7IZc6yjTsh:cd66Joz/zgC1jCboUZc6yj2
TLSH
T12AE10E64EA28863FC419037BDCA61B410F35389B984E3F29319DA41D2D562DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5fe5f919ec5877bc3e0cfe575e36aa58e9b53e2c0470f6ad23564da6678dfd7b
MD5 6fa4bbb2e91eb60a08b24f0f90ff4a56
SHA1 816a4e13e4e495710d3f8451edda794e7e319390
SHA512 2f6d6051c081be064b9936c84a4b25fbc1b223e707ee14eba7cb19e661ce9b3146556856774a915103740efa647d4596c8df452cf3b61408b75b4d885911c7c5
TLSH
T141216D4C39B89D6A5CC6E25CB440038EA3658E071D971C438E22EF8DCE815E9316E43D
MD5 SHA1 SHA512 TLSH

Submit Download

04eb50db-72bc-41fe-92d3-fffd537ad390

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\04eb50db-72bc-41fe-92d3-fffd537ad390
Size 235B
SHA256 2c5836cc3917c06a5f0b83b1558bf67cbff44fd980a7fab2c13fcf7f43e5b545
MD5 b50dc8cdcde5575f7538041ad58fedbf
SHA1 5a4cc18d6c685abb49b6e76b450e305baa72261d
SHA512 465cf16e9659b8a147a15177a4ce2a0fd65b324e75e34c97ee3c4550128493f61701aca903433578d57cf2c4fe68d54fc4c588cc46d81d964ace2767eb400405
TLSH
T1C1D09785A8A83B6C48200F0AF1E068DA30498C3314606810C9A24134D9FFBC802A280B
MD5 SHA1 SHA512 TLSH

Submit Download

0c8d88fc-fe66-4705-863b-9d8b57e1a001

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\0c8d88fc-fe66-4705-863b-9d8b57e1a001
Size 15KB
SHA256 cc6df96d19b19422a7b42d475aacd76f24e8f196a2e231c848042726d530e9e3
MD5 d59ea95fff2502711030362b45af39ff
SHA1 702a53b901be608de069213c9560a699b6cd7754
SHA512 a4e76c09bf432914b93da365b784c2b5c640b33d36fda00149b4749c700bb8c7af9b0ad7a43354b62aabdae38a2cf0573cbd0827fad540d633c1eb3616fadd31
SSDEEP 192:myztyqinCI0/HNw63R3HdU/Cw9+1ERL1gBAnEe2UErJR5pR1BzxBuKRb:ttyqMamT51gVZ9TR1BlBuKB
TLSH
T1B262E85A6820497F8650E7A8D8EC7FC3F1F518CB8C019FCA9BE47D0869EB06E5127847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d50e3e2-849c-4df1-b282-66e9c2220f98

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\5d50e3e2-849c-4df1-b282-66e9c2220f98
Size 883B
SHA256 6c5b74d3b87a1c7e0498a8d17d78a35fde4ac5c17d637952fc2f035c7198e75b
MD5 a5bf919494b2579dd2c8f09038dfc5b9
SHA1 7bbe25417ea7b94c2e99fe03efae25a065a2c4d7
SHA512 7d47fa30e3c9d64352b69949886a3c9618338ea719e21fb4d97f8c8fb1586c200a6a2faba51f08692fedabef7d0f628d13b49c0d47aa1c0c2aa32159b0297de3
TLSH
T10211C041EA347975CC3CD24FC5957B024BE4742384CA44243ED19B180E7E61FA76B64B
MD5 SHA1 SHA512 TLSH

Submit Download

700f88ce-cd63-4540-a892-1e671c23b77d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\700f88ce-cd63-4540-a892-1e671c23b77d
Size 235B
SHA256 f101f22b2ccbe729271987878e54894642d7350f499c490a537fa021f8617042
MD5 15336331f4922d92f3a6698d8efc5320
SHA1 cebe63f9367c69f8727d54b4081f01253c79ecd3
SHA512 e0aa843ff27a297c2e054881b72db7724a65d8ed9fbbed2e4fed8db36b0b5b6c5000bc3df6653ef60d70b9571a00cfb5cd8f279dfab50887584d41caf529c98c
TLSH
T18FD09780289867BC08288F17F0B06ACAB0888C3320B598A0A9A10AB4ABBDEC51161806
MD5 SHA1 SHA512 TLSH

Submit Download

abefc7f4-67a2-45cc-8460-d71d0df987e9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\abefc7f4-67a2-45cc-8460-d71d0df987e9
Size 2KB
SHA256 6fcad9102c8435272936f45793a940ff6968c58d9844dbf48805ffb7efb2756f
MD5 451f405dca062ed7a815af7d975d8631
SHA1 375e5fe47347e2a63a0504be1f5203da9d52abf7
SHA512 8dc263255692e29bd88b13858f60eb4b50cf073f81110a27a9da077760ccb8644cd05d70ce174f862b9b4a59d074b9100a5e8321814bfe9945abd94007ca95fb
TLSH
T1EE41321C35B85D368C9EE65D9082378E97B0991344C718432E92EF0C8D963DE336A52B
MD5 SHA1 SHA512 TLSH

Submit Download

e156221c-8f1b-478f-af84-d34684228191

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\e156221c-8f1b-478f-af84-d34684228191
Size 886B
SHA256 2ef48a3a29c5c66674567bb13c6d7c22f8f81c818bf0ebb2a74f137ca8f89f78
MD5 e11a3622612c0a1a379a4822f1c4751d
SHA1 07d0dfa98487f282afd53f926833a1f48736aefa
SHA512 41d5845e125ed5acf81a628a93bbe2440c3d802fee57eb7f071762a82585cd6eef371bafad4b727834f93f2a8592cf81a7d956350bcf3377483c39d6d8925625
TLSH
T1DE11C0518E747572CC3CD28B95A97B434BE4742380CA49187ED28B1C0DBA15FA76A60B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs-1.js
Size 6KB
SHA256 6f48da952446c519ac967a27587ca2636ba852be8d4cd64b8ec2d70fdc38ccca
MD5 ea2fe4fcb27db0a0ac4182891c9689b7
SHA1 ff582e8ebc8af0071b18d22c3bc5e47e18ae783f
SHA512 1128b56505bcc9280846ae1532528053132b7377dea434be2a7b5ebf35117bbad4cb1356da3dddd2656771cfce54c03a1d694debd6ca441a612091deafa34829
SSDEEP 96:xHKEUTUPqGq1fK3Z1zSASSlQdv9j/vnRRHnyzMLEBw88u8L4cnx3hezy:kESR1fK3ZlSSsZ9nyzM4Bw88TX
TLSH
T1E9E1207890088F7F74B677ACAC688C316AB2413BB7BF68D610B95484015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs-1.js
Size 6KB
SHA256 31821854d2a9acb389d39e1c22337e32d96a11f68021ed2dbc64e0cdb007ed42
MD5 732bb047c19cbe5828e56d756f80ccc0
SHA1 acf7263a268ce36b74aab8ae6d068e47312ede09
SHA512 be3dc0bdc4772b4b8c1abad80a5dcceba7613af035ccda95f58e4bd9336ea3f4f7e93996ea95fe7e5157e8ec15d4ee62e11af38a9b20519a3e3ff61a44a07156
SSDEEP 96:xHKEUTUPqGq1fK7+1zSjSSlQdv9j/vnRRHnyzMLEBw88u8L4cnx3hezy:kESR1fK7+iSSsZ9nyzM4Bw88TX
TLSH
T175E11F789508CF7F64B677ACAC688C316AB2013BBBBF68D650B55484015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads