ed133d6531a16f2afaa7b93f7d8ca6fc0f107fb1c0d8c7414f924ed51da160f0

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
popup.html
Size 505B
Sample260815-cqmlnaxyey
SHA256 ed133d6531a16f2afaa7b93f7d8ca6fc0f107fb1c0d8c7414f924ed51da160f0
MD5 d065ab8655f23f4769233f6d5a0ae89e
SHA1 ea1e4ab96af019db57eb679d2c630a53fe009f93
SHA512 c69ae386453bc7bb627e390ee5c080e426c291d9392f5ad48bc7f03627de0d9a73bfa91c1d69445c8e4d684019c5aab75451c10585d750f02b1f267905f25add
TLSH
T12EF09EFBD10544065200C3C1ADD0BA16CC47860B0B889690B3E180AA9AA52E6846795E
MD5 SHA1 SHA512 TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4488	firefox.exe
Token: SeDebugPrivilege	4488	firefox.exe
Token: SeDebugPrivilege	4488	firefox.exe
Token: SeDebugPrivilege	4488	firefox.exe
Token: SeDebugPrivilege	4488	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4488	firefox.exe
4488	firefox.exe
4488	firefox.exe
4488	firefox.exe
4488	firefox.exe
4488	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4488	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 4488	3340	firefox.exe	88
PID 3340 wrote to memory of 4488	3340	firefox.exe	88
PID 4488 wrote to memory of 3028	4488	firefox.exe	90
PID 4488 wrote to memory of 3028	4488	firefox.exe	90
PID 4488 wrote to memory of 3028	4488	firefox.exe	90
PID 4488 wrote to memory of 2660	4488	firefox.exe	91
PID 4488 wrote to memory of 2660	4488	firefox.exe	91
PID 4488 wrote to memory of 2660	4488	firefox.exe	91
PID 4488 wrote to memory of 2660	4488	firefox.exe	91
PID 4488 wrote to memory of 2508	4488	firefox.exe	92
PID 4488 wrote to memory of 2508	4488	firefox.exe	92
PID 4488 wrote to memory of 2508	4488	firefox.exe	92
PID 4488 wrote to memory of 2508	4488	firefox.exe	92
PID 4488 wrote to memory of 1072	4488	firefox.exe	93
PID 4488 wrote to memory of 1072	4488	firefox.exe	93
PID 4488 wrote to memory of 1072	4488	firefox.exe	93
PID 4488 wrote to memory of 5792	4488	firefox.exe	94
PID 4488 wrote to memory of 5792	4488	firefox.exe	94
PID 4488 wrote to memory of 5792	4488	firefox.exe	94
PID 4488 wrote to memory of 5792	4488	firefox.exe	94
PID 4488 wrote to memory of 6020	4488	firefox.exe	95
PID 4488 wrote to memory of 6020	4488	firefox.exe	95
PID 4488 wrote to memory of 6020	4488	firefox.exe	95
PID 4488 wrote to memory of 6020	4488	firefox.exe	95
PID 4488 wrote to memory of 2540	4488	firefox.exe	96
PID 4488 wrote to memory of 2540	4488	firefox.exe	96
PID 4488 wrote to memory of 2540	4488	firefox.exe	96
PID 4488 wrote to memory of 2540	4488	firefox.exe	96
PID 4488 wrote to memory of 3780	4488	firefox.exe	97
PID 4488 wrote to memory of 3780	4488	firefox.exe	97
PID 4488 wrote to memory of 3780	4488	firefox.exe	97
PID 4488 wrote to memory of 3780	4488	firefox.exe	97
PID 4488 wrote to memory of 248	4488	firefox.exe	98
PID 4488 wrote to memory of 248	4488	firefox.exe	98
PID 4488 wrote to memory of 248	4488	firefox.exe	98
PID 4488 wrote to memory of 248	4488	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\popup.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\popup.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1924 -prefsLen 27097 -prefMapHandle 1928 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {e7e8be65-1a26-4926-84c1-b566f0a301c1} -parentPid 4488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4488" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {5ab8c0ff-54a5-4ee7-a1db-c7e63362d37e} -parentPid 4488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 27274 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {081f7fc8-db37-48f8-9106-2315215fa6b5} -parentPid 4488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27274 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {7a654fa5-65eb-4867-bc3a-ec50af4c8c1a} -parentPid 4488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4488" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2940 -prefsLen 34773 -prefMapHandle 3128 -prefMapSize 270279 -jsInitHandle 2912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3028 -initialChannelId {9352f506-34e7-473d-9003-0723e0530cdb} -parentPid 4488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5056 -prefsLen 35010 -prefMapHandle 5060 -prefMapSize 270279 -ipcHandle 5048 -initialChannelId {fb825986-250c-4f16-9822-5a616aa6c719} -parentPid 4488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5456 -prefsLen 32952 -prefMapHandle 5504 -prefMapSize 270279 -jsInitHandle 5508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {192187e9-ea9a-473b-a274-86e985ede349} -parentPid 4488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 32952 -prefMapHandle 5636 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5644 -initialChannelId {24eb0a4d-efaf-4087-b8f9-d0a374a01314} -parentPid 4488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5820 -prefsLen 32952 -prefMapHandle 5824 -prefMapSize 270279 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5836 -initialChannelId {60f8b792-6d1e-41b1-a183-2c5feded66cb} -parentPid 4488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 6cc599d05eb2efc1167c00ae479345707ec0f4e3df8af2ee7abf9ad855b62fe5
MD5 bf08cb47df593c0eda821ec756453b7c
SHA1 a520f41970fc565a4afc32b879ff3167abbdff10
SHA512 1ae07b9c6b67af33b0e54493ec253abb8e68ab017d6a486c8cc7254dc1d60cd1401972b0d0a1f05b7f2c580fa17a81d66f4b4457550cddc1c9e517d958b1dbb0
SSDEEP 384:HXkRyiO024YPTDL84KKDL849B7SOEAd9KVRaAcP+AWRMAD:3mZYPTDL8lKDL8CB7S/AmVAf+hRMO
TLSH
T1D0728E3D5F003CAC25A7C0F8C5A982AA4D08B7A7DFE6C06D21183D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 47dcede0755e9e5768effbbd8b709677c9d05af5b856e78fe568f8e5b22918ce
MD5 df422a751f81e0494be11db08e500716
SHA1 593e8e293daf2547bf588bb721a2ac02a3cec441
SHA512 43929b471dfe454df44230b8bc22c46735c2603088e3084815464f86f3bc2ad2fecb9757bb0f0218a2983d316ee4ac84d400482ce12c739586051fa721c52a4e
SSDEEP 1536:jTrli9ySD8fYeaUVFhe0Nkwyj+vrkjJ5XnWq/Vg0YdNAcHKEUeWtyNLKX9SbQ7JH:j3lHYeaUwTSIjTnT/OHAy0eWE+pMGbt3
TLSH
T1B1A3BFF6DFA2CD6D65FFD02DAAD2853EF9122400B3A72009D963236462C2FB47775609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 3183bb58b881732fc20b702c8ca345e8df7d812451e1d85a45fd829168a14def
MD5 0b40af707cc156e4d3a34b68dc5489c6
SHA1 67913cefbf7944936095ee8f1fd1a879a50df9d0
SHA512 dd2a3cbb2693f0418058d8b8e48cd22fb5a648f3c252026b2e975b7277df63303c523e59acf196a962eb1ca089d39c4912655d20ac3706d3b13e3b1d13f74075
SSDEEP 768:111D2535/3/LGcm+u/BRYBJV5XbVbIb+bK:U535/3uBX
TLSH
T167D21284EB2E953FD42512BBDCA517002F79B889590D2FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 50fc5e15f6bd5255b23f2f92ea39b10041b3a1a6ee31b89a32331fc56bc55f34
MD5 accbe5a797f076a1fce59822f7f8bf77
SHA1 cf91dd50317d5ae5a2d67b3dc74713021d0679d3
SHA512 e92eccf4741d5386ef24f570926251497cf2973871b766221c9acf197349df7157b6b416ace06ca54ad07ac7d257ab23e973e6d0f4ab74ef9488c064e762bd86
SSDEEP 768:H6K535/3/LGcm+u/BRYBJV5XbVbIb+bKL1/:h535/3uBXZ
TLSH
T124D21144EB2E553FD42512BBDCA50B002F79B88A591D2FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c4ccc5f52b2defc755ce971b90b565c1bc5b1ef6d80775321b7f5c8f354be081
MD5 c8232f068e8493887351340e82faf700
SHA1 3fd29489f3888e11ba455e86245f4db3f602ded1
SHA512 6082ab89cca46bdef2c4c6fe5358634fc7227bb3d0d4efc9301a413fb51b01937c7b7b4dbcc10be0bb1da51d1ece6219dc0b8faab4cdbee483835e8ab26cb944
TLSH
T14E21375C39B94D7EEDCBF29C7581028E93558A0A44871D438E43EF8DCE91AD932AA478
MD5 SHA1 SHA512 TLSH

Submit Download

3ce1df59-7e89-47a0-a920-a5f93f9a4518

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\3ce1df59-7e89-47a0-a920-a5f93f9a4518
Size 235B
SHA256 6018aed18cbb3a84f5eae198017feb8bca0769c8637f768942e06e043d160bf1
MD5 0b01a87b2a3f4d840df7aadc8a37be34
SHA1 bda65068020d94322a5044475bce6803d8c2464d
SHA512 9780461a29d1d297f98e894f80896cd04e392683c0f874ed62c4e7069a35c53d655ef48fe607f093b81e06a1ccf1159d5b80fe4c4660faec57edb8143878c95a
TLSH
T1E0D023942CC86BBE08240F03F0E07AC330444C331072A820CA618134FAFCDC44153817
MD5 SHA1 SHA512 TLSH

Submit Download

58e55b01-ae16-49dc-b631-cf3621b1723e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\58e55b01-ae16-49dc-b631-cf3621b1723e
Size 2KB
SHA256 dfa374580a50acb079139265ba746d57a4ccd6faaaabbd4be7e4716161847488
MD5 d9cea1d2dab58162b55f546f114ae0d1
SHA1 d451c86d27c433f4b6657ad1781aae029899153d
SHA512 849464bd85b545d147be26b95cee8fa8db86eccaf37d355a6a0859dae0929f9e6d864b0826a27e6c21404911de551ea0b9342eee09ce35c598ff3f0e52f44f38
TLSH
T19941449C34784CB68CDBF15D9482338D93A49A4344C668432E63EE0C8ED67DE736A12A
MD5 SHA1 SHA512 TLSH

Submit Download

72ce6332-0a1a-48c3-a645-1c8838a5c7fc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\72ce6332-0a1a-48c3-a645-1c8838a5c7fc
Size 871B
SHA256 f77abbef03a3ac081dd7f7a6398bc1f319de188ca7b7b26b52c2292647466a43
MD5 c647869715b9d352bb52dc07923a6534
SHA1 ce9d6dce04bba1039e8896bd4ce40309dc3364d6
SHA512 f4baca86fba67942d00ba02412722bfca0b8a8d03ac4037b3d8e8c574d9aa1e8787070c1efe173f8ba4e56c211b9080a165c3406d78a896454d7e5b912f5abe7
TLSH
T179112781853075B2CC74D25BC995374187F4B51380CAC4143DB15D080EBE72EE756317
MD5 SHA1 SHA512 TLSH

Submit Download

7faa4ef0-4e7d-44a7-976c-2d0f528962b4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\7faa4ef0-4e7d-44a7-976c-2d0f528962b4
Size 886B
SHA256 79498382d2c69c3ea9075385e6fcf353323e9bfc974e441e55734ab1dba8e28f
MD5 1f1370264bb59dac67d6e370d17f7c54
SHA1 823cb3238dcb6dae838e014ff56be3289d2a2c10
SHA512 59f9760c0ddba2ca6244e891cc0e3bb7515da7916929b8b074cf8f7305694c0eb200e38f1a59dfa272fdcfbdc8ad21503ffd48dc7c72171d46d5fefa26b8f1ce
TLSH
T1FC1127C0893475B2CC75918FD9D1779247E4781380C559147D51AE080EEA62FB757207
MD5 SHA1 SHA512 TLSH

Submit Download

87d875d6-51dc-4cfc-9bf2-f25918c4a468

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\87d875d6-51dc-4cfc-9bf2-f25918c4a468
Size 235B
SHA256 1f90332fb0239240c817504ac9fd42c3cf54e7f54ee5dbf41de3cb717fc67cfa
MD5 6a16d9c0d73bc162a50b5ed80d81ea37
SHA1 01aff79de5d1b7385bdbdcb69f6f39d6ecdcba59
SHA512 7cafb7b68730007ce153096a2b6acc30bab6b695a460c915792b1aa1bf5892d342226351e675237b557f3cae088d42ce8463a7ab32159126b89da3ae3e0b27a8
TLSH
T1E4D0978458A8339C48240F03B0B2A9E630C88C3328F0982096628A7899B9AC80252C06
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\extensions.json
Size 16KB
SHA256 429a0e34b5f4314d7e80a3d994217bda541855681a2f633bfa7ac14c315cbcda
MD5 1c1e04d9a1b175cbedeed0b4a0ac3106
SHA1 93e8e7445be2c19eaf13475282acc1b26c3550f7
SHA512 e11d2b17c349e23b0293538ee13989379135aca9bb9766d9be58ab037a8cac3a58571184ec5e7b610c50f01366d42cb8a88da61c1576a0cfa66972c073397269
SSDEEP 384:lkI4vlUmldvB8dhWM94ze96oML4HIL4PqtL4H6tL4HxL4HjX4hO:2I4dRfSXJ42614q4St4at4J4r4o
TLSH
T15872531545049EB8298FA79BAA367E01C37D473B60845C38F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 7KB
SHA256 b7a38a253415f39a28270a7a298ed9084b67dce6631461bae844878ca806f2ba
MD5 89ceec5e74b0b70a75f84110e7c0d599
SHA1 3012b8046329c694be070a0fb3a68597711c415c
SHA512 b3b8a1b9ab81a358f3c2813f80813e890ebc8b84b7efe241f1ab1a924e6c9b007e5ad9c5aedbcf9eec9d0809d62f2393386e31d5da6b9df6a6caa52fd145966f
SSDEEP 96:xHLdTUhRqGqUfSU+ObzSfSSlcdv9jIhnTRH0wkys6Bw88NaY8L4cndBOR:BXRUfSU+NSSH90wkUBw884Pi
TLSH
T129F10E785004CF7FA4B677BCAC6889315AA2023BB7BF68D651B944C5051CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 753f11e1e19ce569e0da9d597d5b47212f224cff0e6d5db29265c0616ad638b6
MD5 a666dc85c30f27accd1e30e6bca8f1e5
SHA1 0bd9b13cb69b86114dbe9c6887bd055141ef1411
SHA512 7f1a3961d4d71095851913a064aae1cb83f44fac2f565ea5f3b1851da5dfed253b74fac8ed2330a78b2304a05ee10346974b4375a5558f73cc31264130463dc6
TLSH
T11F21FB87C4133FF2B15142B8A848CFF14656347389744CF092878F535C7A519B75B22C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 43bef9e581c62763de5893668f93ab75fb8a3105dc866ec812a15df429a2f328
MD5 140b17e9ca4c9a36c7adf7de661b47ba
SHA1 c38f39cd83fd5f63576c979ef7a0fbf7ae708fb3
SHA512 0cc198e10349a76680076659b6efcca5dde5581a434a59098e011e57294604769883b06f4df868d2297736abefae11bf48d837cb9ab51496297819465eb678d4
TLSH
T1CC21FB87C4133FF2B15242A4A848DAF14656343389704CF092878F53586A519B75B22D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 8fbf2b3a71d75a0a76fb3d6f684e8bdeb42e2130327ff374f980fadc5dcbf16f
MD5 fb0930d8a9d02fdf97741f0bf164d070
SHA1 a060469d89b135d5f7479adb514f748bb2a9e994
SHA512 e2d994abdef28f4fca629aee0265f04169dce54224c0cec4a081f8241c14136f14384a820ecbf4146832a9ae434fa7a07fb7ec3c590105cc6fbdfe9a2e8d21fa
SSDEEP 49152:efs/u7haIEoNYYcZ67Y4UoMRHpAH0k/9:Us5f604UoMReH0k/
TLSH
T1784629E860D1A257F3814033724993EB21EFD00D5037DA085BA95AE9A574CEF8E17B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads