8eb5f7849d6737937aa0d40e60ae35075a51850dc761a13f6154bdc493750ad5

Analysis

user interaction
yes
max time kernel
149s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/08/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
memreduct.zip
Size 356KB
Sample260822-wlcqfaap7x
SHA256 8eb5f7849d6737937aa0d40e60ae35075a51850dc761a13f6154bdc493750ad5
MD5 581954e660dc490bb859acc6112a398b
SHA1 e40adc71cecc9b17b751ca4617eecc97c3859174
SHA512 1f19e11acbdaf4fa23ad0b3e41faf3cac8c8675257811c4ae55f829b602bdf4b8c3bae88abef9cedf8c1e449dcc4da6891f9213d88c753da984964b537cd78e7
SSDEEP 6144:BJBGLGKwGwVhmJuNIKrNe+KHGDaZQTsMmIPkKLf6c0v64LSqYPEWRiOnkDd:HiG/Gw/mJuNI+Xo2T1hkPc0pm3Et
TLSH
T1927423771401E5B95E450EA40CE3C75CBBD8CB30E29371A6B05F809B0E77696CA2D8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3152	firefox.exe
Token: SeDebugPrivilege	3152	firefox.exe
Token: SeDebugPrivilege	3152	firefox.exe
Token: SeDebugPrivilege	3152	firefox.exe
Token: SeDebugPrivilege	3152	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3152	5076	firefox.exe	81
PID 5076 wrote to memory of 3152	5076	firefox.exe	81
PID 3152 wrote to memory of 3584	3152	firefox.exe	82
PID 3152 wrote to memory of 3584	3152	firefox.exe	82
PID 3152 wrote to memory of 3584	3152	firefox.exe	82
PID 3152 wrote to memory of 4372	3152	firefox.exe	83
PID 3152 wrote to memory of 4372	3152	firefox.exe	83
PID 3152 wrote to memory of 4372	3152	firefox.exe	83
PID 3152 wrote to memory of 4372	3152	firefox.exe	83
PID 3152 wrote to memory of 4076	3152	firefox.exe	84
PID 3152 wrote to memory of 4076	3152	firefox.exe	84
PID 3152 wrote to memory of 4076	3152	firefox.exe	84
PID 3152 wrote to memory of 4076	3152	firefox.exe	84
PID 3152 wrote to memory of 816	3152	firefox.exe	85
PID 3152 wrote to memory of 816	3152	firefox.exe	85
PID 3152 wrote to memory of 816	3152	firefox.exe	85
PID 3152 wrote to memory of 2704	3152	firefox.exe	86
PID 3152 wrote to memory of 2704	3152	firefox.exe	86
PID 3152 wrote to memory of 2704	3152	firefox.exe	86
PID 3152 wrote to memory of 2704	3152	firefox.exe	86
PID 3152 wrote to memory of 4664	3152	firefox.exe	87
PID 3152 wrote to memory of 4664	3152	firefox.exe	87
PID 3152 wrote to memory of 4664	3152	firefox.exe	87
PID 3152 wrote to memory of 4664	3152	firefox.exe	87
PID 3152 wrote to memory of 3064	3152	firefox.exe	88
PID 3152 wrote to memory of 3064	3152	firefox.exe	88
PID 3152 wrote to memory of 3064	3152	firefox.exe	88
PID 3152 wrote to memory of 3064	3152	firefox.exe	88
PID 3152 wrote to memory of 3820	3152	firefox.exe	89
PID 3152 wrote to memory of 3820	3152	firefox.exe	89
PID 3152 wrote to memory of 3820	3152	firefox.exe	89
PID 3152 wrote to memory of 3820	3152	firefox.exe	89
PID 3152 wrote to memory of 1256	3152	firefox.exe	90
PID 3152 wrote to memory of 1256	3152	firefox.exe	90
PID 3152 wrote to memory of 1256	3152	firefox.exe	90
PID 3152 wrote to memory of 1256	3152	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\memreduct.zip
1⤵
PID:1456

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {804c7eb6-22e1-4b28-8dd2-9417f113d901} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {d0195bdf-54fc-4f33-9ccf-0009f3957d86} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27274 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {45e49180-e494-4d0b-937c-ca20a31b0094} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27274 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 3968 -initialChannelId {b609b256-7213-4d42-b601-2ec807ccbbfc} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3000 -prefsLen 34773 -prefMapHandle 4468 -prefMapSize 270279 -jsInitHandle 4472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4480 -initialChannelId {76b4332a-09c7-463e-8087-8191c92afa76} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4960 -prefsLen 34929 -prefMapHandle 4964 -prefMapSize 270279 -ipcHandle 4876 -initialChannelId {492983f3-a2cd-4c40-9058-92e3a429f8e3} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3096 -prefsLen 32900 -prefMapHandle 3224 -prefMapSize 270279 -jsInitHandle 3120 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {d6831df1-72fd-4af7-aba2-17915b09eceb} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5384 -prefsLen 32952 -prefMapHandle 5388 -prefMapSize 270279 -jsInitHandle 5392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5400 -initialChannelId {93d456ce-aeed-446f-b71b-ab7375007090} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5416 -prefsLen 32952 -prefMapHandle 5420 -prefMapSize 270279 -jsInitHandle 5424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5432 -initialChannelId {3a04fc6b-8c64-4c3d-8e30-b46317b47cdb} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4DDF99D0461C50BB47DC9EC040A8AD4C9355497C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu37ckd4.default-release\cache2\entries\4DDF99D0461C50BB47DC9EC040A8AD4C9355497C
Size 3.8MB
SHA256 2aa78556d65fdc3736f8f08755bed4ea62043841b9eed8a1936ad78cece25a9b
MD5 4689236cc79265fbd361e48a19f806c9
SHA1 5f5ac1db3fb065268d0f3dced55a2f4e5bef111e
SHA512 a5de6d1db538be2a9d04f15988e747c9314022df87b0cfc238a6127dda1de816f12c48ebcf1f4f2084338d21247d7f23d336960e9aabd430dcc6ff4486787147
SSDEEP 49152:1Ga84n/7L8vRDQFj8kww+DHBshv34yvSDOHPIUlI8R6k+hX9e8oxi6BYCaPO30um:ca8oF7W1shXRQUlIQ6kwe+DW30uPu
TLSH
T16A06F175E69C1A09CDCFB3BA850D2FC2D84C4FA680E4A96F7A6BD9715CA31E61F44C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu37ckd4.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 f64bef7e09f9ee8792ce4534a0d0d5476dbf67f7923cb51b950880d887fecb11
MD5 809949c24bfdb1219b2b8804a0538a40
SHA1 ecf2d016adc3476e53b093efb513b5fd5e0e0701
SHA512 04e0c7695c590950fa2c4356fdb8169fb43553382e9e5a98c6fe6913228a31fe2782f1bfcbbdef8dccadb9934e7ce8fe042976dd91318a60c80294846f0c2892
SSDEEP 384:HXkRyiO024YQDL84KKDL849B7SOEAd9KVRaAcP+AWRMAF:3mZYQDL8lKDL8CB7S/AmVAf+hRMo
TLSH
T132728E7D4F003CAC25A7C0E8C4E992A98D18B7A7DFE6C0AD21183D0DC698969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 4a8d5e44f8acb6403703f57a293574a782fbc9133d8435437a734413abc17498
MD5 c3e595730197b1b40f785dee4686729b
SHA1 ee500f4391d179bbd751c0fd1a7d912af7582d66
SHA512 30b9a226d78dbafddfb7109a695270b9ac4874b00de51562e598eac076229b86cfa4d6af1b70e0c6466c9a9f1f7ad366d14ce786c0929576b356f67d8ae2bce3
SSDEEP 768:xtwmJX6sQ9HA/tGcmhuwuKiGJH3nr58iE+bhbYbsb7bnbpbBbNbA0+54f9teU1FM:xX6sQ9HAquD0+54f9teU1FjQ
TLSH
T15113FF44EB1E953FD42812BADCA60B002F38F889595A2F573A5CA4786C872DC3D5E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c5fcaf0a49e85a340e135c43d590dfc5ffe4d480fcd80e29f4a287e93758a66d
MD5 750c1f028876f8dec32e2470ab15957f
SHA1 0f539f9855b174e2c8b88dbbe4be21309c975548
SHA512 a22effeef617d2a57e315a79a98408c1b0c8d8108361fa78f1e35bd322b8c31502b88b00467cbf53bef58dfa004a45ef6c66120cc7e5592b6bc1330890d7d26c
SSDEEP 192:zOv5zboQZQgyj9xp1d66Joz0dzgCl6mc0d:cboQZQgyjHd66JozQzgC1j
TLSH
T1F9D1BC28E639463BC458023BCCB20F410F36395A988F3F2531DC64192D972DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 46c399746118c1815f8264971990f8b2d89364aba7e30a50192c9a57302cd859
MD5 95caddd749ab982e6ed059c8fd412b82
SHA1 3c529686f3b6c73c0b666e42d0af08dfdb64959b
SHA512 cdfac4bd8496251d76fd9f9b9adce956810ec03b811fca44f3700db9f1f24a62a3f4d085f233cb780e71dc544ce41feb6b8f78df94a4e19c4d65b7b33ac226d6
SSDEEP 768:iX6sQ9HA/tGcmhuwuKiGJH3nr58iE+bhbYbsb7bnbpbBbNbA0+54f9teU1Fj/iwE:iX6sQ9HAquD0+54f9teU1Fja
TLSH
T1D813FF44EB1E953FD42812BADCA60B002F38F889595A2F573A5CA4786C872DC3D5E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 172915aefa75ec7638a084130e034bb9cb829a743eaabc8e3f4ac216641f3a73
MD5 6d0e58156a7a610897536f5cbc236de6
SHA1 f76a1946d8648e08111fe1a2000053fa39082300
SHA512 b1394fdc8a8440c123478d6c2a4a3e5f3d4c752165c0fdc916b721843326f64742060a27ae83fb73ff2e1da2f44c6780f59bb5b49862ea3a2529490e0a7d936b
SSDEEP 768:xiwmJX6sQ9HA/tGcmhuwuKiGJH3nr58iE+bhbYbsb7bnbpbBbNbA0+54f9teU1FM:kX6sQ9HAquD0+54f9teU1FjQ
TLSH
T1E113FF44EB1E953FD42812BADCA60B002F38F889595A2F573A5CA4786C872DC3D5E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 349c4216621a9314e83d470aadfb1e14b0f7b5de66c0fb36385a4d1cb26f21a0
MD5 55182a7687bdc020f06f5f5b8a714b3b
SHA1 ffdd3ef2ddda4d9f39bd9aacc2049b2c7125cac7
SHA512 ce77ed8c9fe2532102fc03209760bff56fcc50b2810d066870794a61ead2b0e571588e69fd1cf44927de2eda0514689533f07ac444a07eddcb3a3fdd3a8c64de
SSDEEP 768:KmJX6sQ9HA/tGcmhuwuKiGJH3nr58iE+bhbYbsb7bnbpbBbNbA0+54f9teU1Fj/d:rX6sQ9HAquD0+54f9teU1FjV
TLSH
T1C913FF44EB1E953FD42812BADCA60B002F38F889595A2F573A5CA4786C872DC3D5E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 03918ab7054e11e6558a6f91cd5c5ed91da6d658b1d7a7a93c40e2867867df1c
MD5 538363190ce419fadd8681a545a56aa8
SHA1 c9388c539ec2ba07c0e6c02ae405244d015874fa
SHA512 22275052d04283ec1d7a25904eef135bf051f31cde6513a5ec27ebf686ca02c127717f54fd0390c83a0816084c5e8eef38077867f6085048f00a558edc4083a1
SSDEEP 192:f1d66Joz0dzgCl6mc0dEOv5zboHBZQgyjt+:td66JozQzgC1j9bohZQgyj
TLSH
T1F0E10E64E629863FC458027BCCA20F460F35395A988F3F2935DC651C2D972DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d622a6de1b3fe766c2c43436a46584f7b61b68ea66568f3b620a58fab5ed15ad
MD5 43346785421da9ac478c97e3bdf2c38e
SHA1 8017e64151cf5aa24e16a611a9709354f73339b2
SHA512 8cf427fa1036f4854f58dcba267af63d94a6bfc530d114128b0a6053697ed6cb851e9ef435ed3e86054761000cff0f0fda2663e65afe4a891b0dc20b7818ec38
TLSH
T19A21375C3AB98D6BA887E2AC748002CE53158E1A45971D434D02FE8DCE91AD9327E82D
MD5 SHA1 SHA512 TLSH

Submit Download

1bb21efa-7e21-4fb0-ba11-64fec450b15e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\1bb21efa-7e21-4fb0-ba11-64fec450b15e
Size 883B
SHA256 aa8aced820b9e93f367de94b8b7f6bcda3806f5c7a88d66128b6ffa4d6eef90b
MD5 70227629359693036b07a29ba780e46e
SHA1 58229da530f6c63d6306bd71def09de0064f624f
SHA512 f69bc5bdf2efd700ecf7f2f65b89f6aff94b7321d3fac38e6f0625484795717f9fc2f4188bbf91b4c4e2f31a865b44620a9f329ac69ff0ad179ab5db52add1e3
TLSH
T1ED112741E535B9B3CCA8815BCB523B438BF43533C0C668143DE19E144DAE52EA31B707
MD5 SHA1 SHA512 TLSH

Submit Download

96e6f3ef-b8f6-47af-9e94-dfdd820c0f2a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\96e6f3ef-b8f6-47af-9e94-dfdd820c0f2a
Size 886B
SHA256 25eaf1ae7fee8032796bf9fdcfa1b3a3ade47024d1133908da754c724d54132c
MD5 2eb742fc200a2fc9a67446fbdbc3259f
SHA1 11dd51930aba1dae72928455235d9f62d2780d3d
SHA512 75a3672e0387a81ca79206b21f9a9adbb847ec87961ccf1a3ed8a8e311df8a819980127628d64988c38e88af88abe19102d0a9d69acd13b87184c811c06ee1c1
TLSH
T136112341857576B3CCB8D29BC9A27B874BE07233C0CB6D047E915B184DEA51EA257707
MD5 SHA1 SHA512 TLSH

Submit Download

a7a49ea6-52ef-49ea-95ef-31504b3bcaf3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\a7a49ea6-52ef-49ea-95ef-31504b3bcaf3
Size 235B
SHA256 ccedfa6ff0e137e166610938a52c73f61ad5a8a2719c4218d585658d88b41712
MD5 35ad59511f516f656b4c939c57f43a2b
SHA1 e075facd469b3af0179003abae13d496af07962d
SHA512 816511875df1fdb63954142fa51f8456f31d033e8ef7ff45c586cd517421894ebda0519aaad9b300be8c8aefb7e280f50f074464a229172fb73ef5b27d09d8e1
TLSH
T172D09784249C27AD08211F07F0B028C630944C373A769820C9D201388DFC9C89261827
MD5 SHA1 SHA512 TLSH

Submit Download

dbc63bb8-7507-45f3-a736-5efc77a606ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\dbc63bb8-7507-45f3-a736-5efc77a606ba
Size 235B
SHA256 fe3656587b1b5fdef15355b3787f7b47a6468daad6eaec1d516d7f4888afe7c6
MD5 a947265cd7865d0703d7ec34a1ac2e88
SHA1 8b912164c397643293ffa92b857918231979626c
SHA512 e1a0c6092308aab40f0e5bab51c4530a0ceaf8014e7f8e430783b019459d8175dfbd474a290d5eaf42166d79c45c9edb2338c3130a00f40cd477a0b599ec9bab
TLSH
T1F8D097902C88636E4C240F1BB0A1A9C630984C332470A860D9A114788AFC9C95211806
MD5 SHA1 SHA512 TLSH

Submit Download

e934a7f9-5933-4459-97ee-67efe5c45166

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\e934a7f9-5933-4459-97ee-67efe5c45166
Size 16KB
SHA256 f423b8ce1f04f7e9bede5ee068d5835717dc63f7c722a7902dad09f1ee2e7315
MD5 73c3a0af8c20a0eaa1df516b786607f2
SHA1 d7cac2127c63fb26d37326b03a13fb4a5aa15194
SHA512 c1cded0220b6b7d64a269b6bebaa661bc97a84a0d9d1f46361d6e7ee3d1dd7ccb01a47865a7773d2a99b64b9c980a45d7c346e651ad7b3d69e08d28a72eb86ab
SSDEEP 192:d27ETRmKfbnOR1zBsSi7ueyxG8XXTgXN3z3SIrNU0VilHa1Bhk1Y/TfjlpBYaDMy:d27enbn619sSiCeyVqfj/yYF
TLSH
T14172C816682055BA8251E368D5FCBFC3E6F528CF4C41DFCA9BE4BD0869DA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc17f84a-6a62-40c7-aad8-d97d0a3bc4ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\fc17f84a-6a62-40c7-aad8-d97d0a3bc4ad
Size 2KB
SHA256 3473350668d287b876c2dcaae8f391504da4935164f74f4fd6f11dc8e46e5d34
MD5 c13b47ed354ede9dc2dd5e02d204a04c
SHA1 17f9a012dea4f256b1d684df49b94ec7f23b9a78
SHA512 3cbbe0de19e42331ca28545eb521a2d5d1d9a004a258919573930dbe7394e14b26c8151ed55e6bb3dc5e17eccf523b4d5be8dc850fbab0a63565f3b42655dec3
TLSH
T1EE41516C35784DB78DEBF59DD582238E43654B1300C22C436E51EE0CCCC66AA332A43B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\extensions.json
Size 16KB
SHA256 1a3494df230afeb712b2807490e5aaac26f0c9afa5e9ecc12330aa0126315f6f
MD5 e20903feaf06e9422b00d341d120622f
SHA1 3a2641cb60e9209146d2e62a80b98d16af9601d9
SHA512 96a29e60d5444f783efb388f7d97704f4f32b972f6989168efafd5c5599733b44239e1a7bb3b40fd019031fd3a3059dbf991d43d3195898e16c995cfdc7213cc
SSDEEP 384:mkI4voUmldvw8dhWh94zw96o6L4HhL4PCL4HUL4H2L4HpU4hr:pI4QRfJXg4Y6T4Z4I4u4c4W4F
TLSH
T1D672531545049EB8298FA79BAA367E01C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs-1.js
Size 11KB
SHA256 03ce5e71c3614f21ec02c5b739dc78ce864806f4eef107b60ecdb613670d17f7
MD5 bb9867d13bc06586b23dee751f9aa1ef
SHA1 bcb9d588da9200f1e0e41b1e1a7d6a3d7d385402
SHA512 f647caef64eadf65f2079d4c05040f1e9fe1d0b31af3e8ebf59722979bb078fbde43662162683aef682afd04b567ca6445c545c1605886e5258178a017c4cdc2
SSDEEP 96:xHutTUgqGqLfPKxObzSjSSlPdv9j8nOWRP5qmYzeOBw88yaLnliE2k8L4cnURqF9:0CRLfPKxNSSQRRqeOBw88/nliEM
TLSH
T1EE32DD3C5144CB7F24B6327DAC254DB059A10237BABFBCD305B9A481450CF6482FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs-1.js
Size 7KB
SHA256 acef5de9dbc0575fbb2b9e83944fe4456f0b6df9c511c7f5b7f7450dba938266
MD5 a28a6ec3a07defe3ffe69aa8e7ea08e2
SHA1 3a5c3feb189cdf0e2c65274c7f6fbd4a300e9a21
SHA512 88c3af50ec55aa52c37a2df0ec48ed4f47a717752098a8672f2e4dc1cf94bbabb18a0e476b48eea178f0969b9aaf96bd1bae48f48dd960469cb896573afebf03
SSDEEP 96:xH8tTUgqGqLfPKxObzSjSSlPdv9j8nOHtqmVBw88S8L4cnURqFGS:yCRLfPKxNSSZtqUBw881
TLSH
T16EF10D385104CB7F64B677BCAC648C715A72023BB6BF68C710BAA485451CF7442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs.js
Size 6KB
SHA256 4103554dbe33f7fdc29d2110856841ae1304a31c5d12df65606c73547fba3923
MD5 bd04cb57276647184cefca16442fd640
SHA1 cb678d2dbf3e741222bb6defc35dabb269ed04ef
SHA512 06add823d18aabc446c8dd4d72c4a5558946a7d7b0f3430f31f2216de5ace0ddfbfd993db73ee9443a73aaf19ba0e13792ca913b9bcff2125976f9df5a1c339b
SSDEEP 96:xH8UTUgqGqLfQuO1zSuSSlPdv9jdnOHtqmoBw88H8L4cnU9q4:y7RLfQuO/SS4tqFBw88b
TLSH
T167E12F3890088B7F64B677BCAC688C315AB2413B77BF68D750B99485054CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs.js
Size 7KB
SHA256 e21a7414a3e6407007f1ddad3426fe4bf18f82eaa0e5c3e43e244e3917cd460f
MD5 58d9bdc7874e29a0eb41bb0dc0066879
SHA1 a7682065f9d0c91791e14e7f079f98f51b17ecc6
SHA512 f04ec34dd1114e8aeef5b742b69d1a8c0231219d954fb0b4b50a299a94206fa0832ebd4421eb8d99c96cceb6089df220725ddd27f78b9b771f8a60c2a8b21f06
SSDEEP 96:xH8UTUgqGqLfQKxObzSjSSlPdv9j8nOHtqmoBw88H8L4cnU9qFGS:y7RLfQKxNSSZtqFBw88c
TLSH
T13AE1307890088F7F64B677ACAC688C315AB2413B77BF68C750B99485055CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs.js
Size 6KB
SHA256 96f9674fdfc22de7d5d04900207916294c9fd9fa9f3afc53673b2d16e7c7e8ca
MD5 fc50b3201bb91a84bb54edc9b70563a4
SHA1 5bb3e43ae18955e112a0d1c7b30f523531e2646e
SHA512 c9487700e40be0aff5cb2fbc9e1d23526d9d1900e0e3eab4473a8f39f04acbec15b3c144784ef5991cfb82ea8ab45681ebbd0148ee6cdf35a68e6ec255e22f6c
SSDEEP 96:xH8UTUgqGqLfQKx1zSjSSlPdv9j8nOHtqmoBw88H8L4cnU9qFGS:y7RLfQKxuSSZtqFBw88c
TLSH
T1F6E13F3890088F7F64B677ACAC688C315AB2413B77BF68C750B99485051CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 5b824a0b40052bc793a0f3f95d8ca68a6a8e3190e20f196ddab494b1d6e92dc6
MD5 8f1f2d05d508fc7da8597b93f882b09e
SHA1 148b84dc4037013ee0fb5d037fb492ab769abb9b
SHA512 26a6ee64fa067a9169a70d244fa5144f0a4c3f59e4c019afeaaf50e5d67a5a8064dfc7d1971fc5dff942d92852bb9daf33eb76e189b52f6cbf5382480f604134
TLSH
T17D21DAC6FF7F1DA23346C40AC0C91FD5EBA16091426CF8F0DD2A7601369892A72AD70C
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 7ce99ffb2d1232f1bbe97e705b3b9c6be6fde3436c15075074b68f881bce8707
MD5 b35017ad509c5fd3174b4d4721f1f407
SHA1 93e0b6d4493ee46aa82e6c84c22d498038712827
SHA512 f39c10c52528be2578023548add8c514d0d69fa6930164f488a84bcca3dc581cc57d2bdeb4ae89a2bd5f0b3b8da798e5f4495f3efee40c522f88fce9d4410be5
SSDEEP 49152:mXq3QWjgmKR7bWrYXluFGwF1+B9/TRli4oYnc:uq3QWjghduFGS1+//TRCYnc
TLSH
T183163AF824D1A257F3818037668563EF21AFD00C6467DD444BE966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 afb21912eba2f897f9151abb98f475f8391691411a11e18ab0ff5ca89c8f870f
MD5 a614499272c8f27f81a63edcdc22495b
SHA1 601b9148766569377182313f0ca08b02e5ace05c
SHA512 5675708db5e837128b440b92647042a7301e3afc6b018faa55df37d0fba6fe1274fc30c6d1627084cee327866dcc1a9f5794fd101e80b69d2124da2b8968a495
SSDEEP 24576:1XH5aNajADe9cUEhTYkgEhxZdbpEfFXGwF1+B+fiej5qpT34oYLFeeN:1XHeUEhTYkfCfFGwF1+BO/UpT34oxe
TLSH
T11D264AF424D1A257F3818037668563EB21AFD00CA437DD444BD966F9A1B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads