09c2265fb69335cc933f575a03d2a94974e5db5da41e617ac1f595c8c1b2be4d

Analysis

max time kernel
148s
max time network
82s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
salinewin.html
Size 218KB
Sample260814-wdyypsyang
SHA256 09c2265fb69335cc933f575a03d2a94974e5db5da41e617ac1f595c8c1b2be4d
MD5 cdc51381d308dbdf71b17fb9d245de2d
SHA1 7c5622a5af697f56165e13ddd0724bb2bf7b473b
SHA512 d8b83e3d25b70748a0142ff4ca1d183dfe268605acd05fbb5b65542e4b1745b21255b3c04576a3fe63457eaaec87571bc60018085f41f9e5904af1ecbbfea3a1
SSDEEP 6144:KDUk19XM7kJUREMl82xitp5P3pL98J4XyfBcrPnF2NyNhSoWDg/f7t0b4pJMmvPY:IUk19XM7yUREMl82xitp5P3pL98J4XyD
TLSH
T12724C8B1B071E33E019F229BF1B05B50C3D3969BC6566DE6C02EC6A846C2CD8F7A3156
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4572	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 4572	4100	firefox.exe	88
PID 4100 wrote to memory of 4572	4100	firefox.exe	88
PID 4572 wrote to memory of 4884	4572	firefox.exe	90
PID 4572 wrote to memory of 4884	4572	firefox.exe	90
PID 4572 wrote to memory of 4884	4572	firefox.exe	90
PID 4572 wrote to memory of 4932	4572	firefox.exe	91
PID 4572 wrote to memory of 4932	4572	firefox.exe	91
PID 4572 wrote to memory of 4932	4572	firefox.exe	91
PID 4572 wrote to memory of 4932	4572	firefox.exe	91
PID 4572 wrote to memory of 6116	4572	firefox.exe	92
PID 4572 wrote to memory of 6116	4572	firefox.exe	92
PID 4572 wrote to memory of 6116	4572	firefox.exe	92
PID 4572 wrote to memory of 6116	4572	firefox.exe	92
PID 4572 wrote to memory of 1052	4572	firefox.exe	93
PID 4572 wrote to memory of 1052	4572	firefox.exe	93
PID 4572 wrote to memory of 1052	4572	firefox.exe	93
PID 4572 wrote to memory of 1608	4572	firefox.exe	94
PID 4572 wrote to memory of 1608	4572	firefox.exe	94
PID 4572 wrote to memory of 1608	4572	firefox.exe	94
PID 4572 wrote to memory of 1608	4572	firefox.exe	94
PID 4572 wrote to memory of 4208	4572	firefox.exe	95
PID 4572 wrote to memory of 4208	4572	firefox.exe	95
PID 4572 wrote to memory of 4208	4572	firefox.exe	95
PID 4572 wrote to memory of 4208	4572	firefox.exe	95
PID 4572 wrote to memory of 4360	4572	firefox.exe	96
PID 4572 wrote to memory of 4360	4572	firefox.exe	96
PID 4572 wrote to memory of 4360	4572	firefox.exe	96
PID 4572 wrote to memory of 4360	4572	firefox.exe	96
PID 4572 wrote to memory of 5124	4572	firefox.exe	97
PID 4572 wrote to memory of 5124	4572	firefox.exe	97
PID 4572 wrote to memory of 5124	4572	firefox.exe	97
PID 4572 wrote to memory of 5124	4572	firefox.exe	97
PID 4572 wrote to memory of 5420	4572	firefox.exe	98
PID 4572 wrote to memory of 5420	4572	firefox.exe	98
PID 4572 wrote to memory of 5420	4572	firefox.exe	98
PID 4572 wrote to memory of 5420	4572	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\salinewin.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\salinewin.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 1924 -initialChannelId {3a7c296e-411e-422d-a229-2f93837d9287} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {60f13481-ad21-4cd7-b888-63d4a3db4d77} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3872 -prefsLen 27274 -prefMapHandle 3876 -prefMapSize 270279 -jsInitHandle 3880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {c23fc96c-5831-4ecf-8840-452ac2d0e955} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:6116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4040 -prefsLen 27274 -prefMapHandle 4044 -prefMapSize 270279 -ipcHandle 4112 -initialChannelId {acd9e89e-564b-4f06-816c-1d6131f60cfe} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4480 -prefsLen 34827 -prefMapHandle 4484 -prefMapSize 270279 -jsInitHandle 4488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4496 -initialChannelId {3d9d5c11-2703-4708-a9c2-eb03ab7db72d} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5284 -prefsLen 34957 -prefMapHandle 5288 -prefMapSize 270279 -ipcHandle 5264 -initialChannelId {7d139944-71ea-4c32-bebd-a4bf20c06a92} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5776 -prefsLen 32899 -prefMapHandle 5780 -prefMapSize 270279 -jsInitHandle 5784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5760 -initialChannelId {f4bcb9d5-98af-4741-99dd-bf428a568230} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5800 -prefsLen 32899 -prefMapHandle 5804 -prefMapSize 270279 -jsInitHandle 5808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {184c58ac-d12d-45eb-bf77-eef088959a0a} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6128 -prefsLen 32899 -prefMapHandle 6132 -prefMapSize 270279 -jsInitHandle 6136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6148 -initialChannelId {5c3bcd84-ea8b-4314-b210-5218fca8b95f} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\activity-stream.discovery_stream.json.tmp
Size 75KB
SHA256 e02fca229c52bc75fb7a69fb8d0bc09d4765975cbdaa2a6269f935434012062e
MD5 585fdfc99bf63ef74ec2b74dd7a4b7dd
SHA1 cd410b06910a35fed67e562b62c8940b3f00af78
SHA512 1676c3093453cfb3eee350371744b50020756c9b40bf49985e06cb512a556a37b6ff199ed944fd2dafaa320062d252f04b376d9ecb52c6cddf7607b2a2bdd4f7
SSDEEP 1536:zh0JGuk+rKaQQNH8OuY05WH9/I3DNqW4n:zGu5CQWHmN+
TLSH
T1F37308A3A7A4B1FB1F9137DA1C4FB5DB66D1018AE74505C8ECEDC61C818C758023A9BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ae225acd987eabadb3cea721281106dd83ab03ca9c5410c9ebbe610687cbf703
MD5 d952911cf8db22f96a1922ee9080e708
SHA1 f2198b68ef592198e6772dd27cb4d6e188e0f2d6
SHA512 f805e4492c726417419aaaa326b9594de6f2fcfcdac01087244b0dca111848ef6364d91feece60856017856bf38b075ef5ed957c7e66e0d59910e478e3a6cfa5
SSDEEP 192:3Hd1d66JoztdzgCl6mc0dBOv5zbo73ZJnyjb+:rd66Joz/zgC1jgbozZJnyj
TLSH
T111E1EB68FA29867FC418027BDCA61B414F39398B984E3F15359C640C2D572DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 310da07370751474712a658cc558db39fcdb949c352cf89636389c9bd51925f6
MD5 810cfca7d1ee316b7219c96ea6868d72
SHA1 bb30978e55e8c7afe5e1ca1d112bbd2db7f238d1
SHA512 16830dafbe21e6a2e81691393caeead353cacaf015eb5aa14827b495bbebb8dbeee5caffa36daf724be5c4e5c7becb84ca6053e4505b23f363d26c1b11704c64
SSDEEP 192:yOv5zbojbJnyjb+VHd1d66JoztdzgCl6mc0dz:xbojbJnyjUd66Joz/zgC1jd
TLSH
T171D1DB64FA39863BC418427BCCA61B414F39794B984E3F1935DC640C2D5B2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b6def41a58eff4d173b347a294884d349744602a94c530833b7d2ada44e9bfbc
MD5 56b1f5dfce29f502d1f1d36ff0f210db
SHA1 5ea6a8dc49cf26b7ced846a1440c062779747f35
SHA512 ecc38d7816d472549d47872eb4cc1010dfe43e98da710fce2416c310de6245e69fa3f529534c352a96d69c521202ef6d024ed143aa27e21e1582848fb1d02a65
TLSH
T15621458C39B84D7A5C86F29C7441068E53698E0A04875C438E12EF8ECEE1ADE326A46D
MD5 SHA1 SHA512 TLSH

Submit Download

09ec2a85-d7d6-40e1-bca6-9219d0fb23fc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\09ec2a85-d7d6-40e1-bca6-9219d0fb23fc
Size 235B
SHA256 9468f616e763d61abc003284edcbb0e824c3d5b83e8c7447764ac7100f415d0a
MD5 40ba95e0593343dc29e7b726f84a47e7
SHA1 11aec51dce34ca3effadbf86d2f653b199156560
SHA512 7915cce9857c4c4fc76b371fa39fd350350428ad301f203f9639737fa331f776074ee8d6ee5b1565558729bfa431fe9efd532ddeab794698a6288704c2b5bb5f
TLSH
T174D09790B8A8272C08240F07B2E0ADC3308C4C3314B0A811C6A24974ADBA9E42351C07
MD5 SHA1 SHA512 TLSH

Submit Download

2095fd2e-f83f-4716-8355-d299d8f9d775

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\2095fd2e-f83f-4716-8355-d299d8f9d775
Size 235B
SHA256 102c964921085d13f302856e0acdfd7f765f22bf28ad00e27b0e5dfc982b7f10
MD5 15119c7ba65630ec28b027398140ca49
SHA1 86b042173805a9c425ccdfd0aa16804f680b3300
SHA512 08eaa7dc338a41482440f1cf318bea36e7fc22346e7374010ad13a934ac7b52ee41e45f58ce63fc3a3eb957ef45ff18477afe0523bd982b7755eb823a6f6db97
TLSH
T16BD097C0B888231D08140F07B0A1A8C230884C3360B99C30CA910878A9FE9CA0192C06
MD5 SHA1 SHA512 TLSH

Submit Download

2a0e80f4-3467-4100-a93d-f52615a5b813

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\2a0e80f4-3467-4100-a93d-f52615a5b813
Size 883B
SHA256 4aa84546f350bb4464eb2bd261c95b00064346dbbad0e0bc20fd0dbc2be21756
MD5 fa67fa8ae57eca25df26a943085a8d2d
SHA1 876f6a94a9376b75b922d87b646df0f17ef5b536
SHA512 21ac63331fcb45ac28e778161ada8ef546cfd6b5c6adc694a6d4eee2da771257b51486ddaf46fe999e1b52ca3520243bc7f13fa10aad2d4d1ed280c5f07f69dd
TLSH
T168110040D73576B2CC28824F89AA7716CFF8B51380CA51043DE59E184E7E65FA3A614B
MD5 SHA1 SHA512 TLSH

Submit Download

7760688b-4a22-4372-a31c-8c0dc3a797ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\7760688b-4a22-4372-a31c-8c0dc3a797ad
Size 16KB
SHA256 291549cd2a58eb997b4df4bf312887252981c34b0a124707c991016e3051cd3f
MD5 2af26678012fa0c6a9a25fe6a2966f8d
SHA1 40e13e9e37c6d115daf7ed195f1fc3c1402b7423
SHA512 7af0ada2931755eada4f49e8a69811758077ffbf85087235cfe2909f7aaa607aace13e4e7b1df10d3334679a82a5e511f5b36a3176497720101a8cbe049238ce
SSDEEP 192:HdEbVaurEkP7OhiBaYZtSkOABiwSai0zs7KISqBVx21tg0U7o5U8SJGG4ibLt0yP:GVFtZiwSai0UKISqRsU7qbGjXt0yP
TLSH
T1CD72EA56686055BA8591E3A8D4BCBFC3E2F528CF4C419FCA8BE4BD0859DA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb62707f-b5a6-4b2e-9f15-28deff2f7111

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\bb62707f-b5a6-4b2e-9f15-28deff2f7111
Size 886B
SHA256 8567203e3fdd5a08430037a5a755a92d28a3e36753ebbe94c31a048ca1668717
MD5 4c51ce85190da4de1c6d20d2b42f6ea0
SHA1 441448b1a16b9986480ce8ef711cd2d02431a140
SHA512 a809138d62f3b113d0ba8c259569808d25f8e5d5fe6d9e3df3f736a1a8d9850e7ef889623446e9c24bc7e91612709787dbdf36f28892387cb2386cdb7dc50e2e
TLSH
T1A2112380CA317AB2CC38939BD9E677428FB4B51380C60A047DE95F184DBE65E636B107
MD5 SHA1 SHA512 TLSH

Submit Download

d6a9696d-b9dd-45b4-ac89-b795e29141d4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\d6a9696d-b9dd-45b4-ac89-b795e29141d4
Size 2KB
SHA256 09f2a74eb8c212067767108ffc082f210ed49fb7f3861dd45d77e95c33b58c14
MD5 bd487460c6872d51410b0cca78b04918
SHA1 bc755889c9ec3b7b96625b49e1fc100494f66a1a
SHA512 b8ff0a01d69db00ef6434c850502e8dbb38a14e9c250972bdaacf2cdf59a5da9500e266d3e4a3b15240182b3d618c293f090f94a24f6e90b0e6e72d29fc5f4d6
TLSH
T1CA4133AC35745D369C8AE24D94D2338EA7A09A1304D61C432D51DF0CCEA669E737B42B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 7KB
SHA256 349cc90c8a83f00006a74496e8835b35eb5a34ca59a0406382336b7cec924f7a
MD5 877d68c7e9a917854bd3411bf809bd6c
SHA1 681e01b9d342d4d5d83a5130943674caaa339613
SHA512 5d7e4e194ee8037379a4fdc2744aa375ae55e227752ce077a5065c9b7b2533f4d55f2b1138d9cd5d27a9c55271dad7b66a5fdac05398033d05537931d79e2074
SSDEEP 96:xHpFTUWqGqPf2BMyObzSGSSlvdv9jIn+cHjCawjsjWBw88u8L4cnAVlb:vYRPf2BMyESSQj7EBw88qL
TLSH
T12CF11E7C9404CB7F64B677ADAC6849315AB2423BB7BF58D300B96485051CF3842FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 67a264d4c5adfff9686ee3b066f1d715e8ba25941a956fac138f8a73b5b20cfb
MD5 16752423746d2e3ce56143b74512e042
SHA1 da6373ca983767e6bc80fd28ce40c4ec8e3a2cb8
SHA512 65eddefc3a64c2839afc297b82564b870eaaeed57c595f7051019c26e8cc7eb52478966bfb3c6f16d8eb3318e8d592a5f6da12b3e54bef3bc8d0527d568755d8
SSDEEP 96:xHpUTUWqGqPf2BMy1zSGSSlvdv9jIn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BMy3SSQj7/Bw88qU
TLSH
T14FE1207890088F7F64B6777CAC688831AAB2013BBBBF68C750B95485015CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 3562b2104042c198d4685cdaf2725f266707fe578ec34bcde51c19dfb303fecb
MD5 b98898ef7d556668b6c09546b4607880
SHA1 f31f6bbdc56ea014d0f038a479ccb1800a8bb9e0
SHA512 3d80dd1ece7c030e18a1a24e81893858297c1c7c60b12f7c8a780b8d8017b40db3fa137fa3d721e2104a8dd4d63406c58e77261b4bc65b51bd686a265532a32b
SSDEEP 96:xHpUTUWqGqPf2BRg1zSgOSSlvdv9jIn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BRgnOSSQj7/Bw88qU
TLSH
T117E1207890088F7F64B6777CAC688831AAB2013B7BBF68C350B95484055CF3846F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 158524309a4c6069dfef6485482ae563d033fbfcbade9cf4f125dcb2383ec370
MD5 418290190b60383964b4be7031403ef2
SHA1 ac5752ffb544c6aaf872c87322ad0f3bf2fc4cf2
SHA512 8b5c6e9531b62ee2f82acae4644ad01771bb8c29726b6e697ad5700f559156628d54004af4219d9632047dc3dbb2a977d733b382948e2b4aaba2d6dc90af1d3c
TLSH
T19021E967982B3EF63B52205ED0459FFBCBAD3121827965F040C96B41614B96CB2C561C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads