bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mmwf5b.zip
Size 41KB
Sample260823-e3vh5ssfpc
SHA256 bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
MD5 1df9a18b18332f153918030b7b516615
SHA1 6c42c62696616b72bbfc88a4be4ead57aa7bc503
SHA512 6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
SSDEEP 768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK
TLSH
T12E13D028061AD50DEAC0CA78F3FE431F5B322E575F6D9AA5CD6D90968C14D803EB660F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

google persistence phishing

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
75	4800	firefox.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	firefox.exe
Token: SeDebugPrivilege	4800	firefox.exe
Token: SeDebugPrivilege	4800	firefox.exe
Token: SeDebugPrivilege	4800	firefox.exe
Token: SeDebugPrivilege	4800	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4800	4244	firefox.exe	92
PID 4244 wrote to memory of 4800	4244	firefox.exe	92
PID 4800 wrote to memory of 3552	4800	firefox.exe	93
PID 4800 wrote to memory of 3552	4800	firefox.exe	93
PID 4800 wrote to memory of 3552	4800	firefox.exe	93
PID 4800 wrote to memory of 5588	4800	firefox.exe	94
PID 4800 wrote to memory of 5588	4800	firefox.exe	94
PID 4800 wrote to memory of 5588	4800	firefox.exe	94
PID 4800 wrote to memory of 5588	4800	firefox.exe	94
PID 4800 wrote to memory of 796	4800	firefox.exe	95
PID 4800 wrote to memory of 796	4800	firefox.exe	95
PID 4800 wrote to memory of 796	4800	firefox.exe	95
PID 4800 wrote to memory of 796	4800	firefox.exe	95
PID 4800 wrote to memory of 1216	4800	firefox.exe	96
PID 4800 wrote to memory of 1216	4800	firefox.exe	96
PID 4800 wrote to memory of 1216	4800	firefox.exe	96
PID 4800 wrote to memory of 5600	4800	firefox.exe	97
PID 4800 wrote to memory of 5600	4800	firefox.exe	97
PID 4800 wrote to memory of 5600	4800	firefox.exe	97
PID 4800 wrote to memory of 5600	4800	firefox.exe	97
PID 4800 wrote to memory of 6372	4800	firefox.exe	98
PID 4800 wrote to memory of 6372	4800	firefox.exe	98
PID 4800 wrote to memory of 6372	4800	firefox.exe	98
PID 4800 wrote to memory of 6372	4800	firefox.exe	98
PID 4800 wrote to memory of 6396	4800	firefox.exe	99
PID 4800 wrote to memory of 6396	4800	firefox.exe	99
PID 4800 wrote to memory of 6396	4800	firefox.exe	99
PID 4800 wrote to memory of 6396	4800	firefox.exe	99
PID 4800 wrote to memory of 6412	4800	firefox.exe	100
PID 4800 wrote to memory of 6412	4800	firefox.exe	100
PID 4800 wrote to memory of 6412	4800	firefox.exe	100
PID 4800 wrote to memory of 6412	4800	firefox.exe	100
PID 4800 wrote to memory of 6440	4800	firefox.exe	101
PID 4800 wrote to memory of 6440	4800	firefox.exe	101
PID 4800 wrote to memory of 6440	4800	firefox.exe	101
PID 4800 wrote to memory of 6440	4800	firefox.exe	101
PID 4800 wrote to memory of 5908	4800	firefox.exe	103
PID 4800 wrote to memory of 5908	4800	firefox.exe	103
PID 4800 wrote to memory of 5908	4800	firefox.exe	103
PID 4800 wrote to memory of 5908	4800	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\mmwf5b.zip
1⤵
PID:5836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1908

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1936 -prefsLen 27098 -prefMapHandle 1940 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {5d49471c-4a75-4858-a633-a2f2dd3f5935} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2392 -prefsLen 27134 -prefMapHandle 2396 -prefMapSize 270279 -ipcHandle 2404 -initialChannelId {26baeddf-1dc0-4ecd-b303-b18aa713cd61} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 27274 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {dad1d676-d151-4d4e-9038-d9d586958c2c} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27274 -prefMapHandle 4016 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {96a937b4-1974-4cdc-a9f6-1238008c85ae} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2800 -prefsLen 34773 -prefMapHandle 2804 -prefMapSize 270279 -jsInitHandle 2812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3128 -initialChannelId {79b9bc00-17a5-409b-b17c-3e89f8b6c009} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5096 -prefsLen 35010 -prefMapHandle 5092 -prefMapSize 270279 -ipcHandle 5104 -initialChannelId {2eab13a6-f724-403d-ad53-37403195efc8} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32900 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4908 -initialChannelId {94745865-8be2-401b-9e83-4987e42e3b90} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 32900 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5292 -initialChannelId {3790202d-3d14-4b13-a12a-8ff8025b6027} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5692 -prefsLen 32952 -prefMapHandle 5696 -prefMapSize 270279 -jsInitHandle 5700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5712 -initialChannelId {d059886a-396d-4207-a845-77916c86554e} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6700 -prefsLen 37005 -prefMapHandle 5476 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6724 -initialChannelId {b7e391bb-0eab-48a4-92d2-c388216e06f0} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 96e365478ce6bd8c614d5207c672db9447fe6b56814df7070e340522169b6ea8
MD5 5f6817ea34d79a960e04bbe684a7bc9f
SHA1 ab411e1b888ed675d79b6e6846fd199fb336520f
SHA512 f95ad3a98395809576d574ff5970364ac4c13cabab266e143c1890218061fe5ba362545bb4820da42328950e99147d4f8eedcbb49561dd8c85838a0b08ccc837
SSDEEP 384:HXkRyiO024YADL84KKDL849B7SOEAd9KVRaAcP+AWRMAxOsOa:3mZYADL8lKDL8CB7S/AmVAf+hRMqOsOa
TLSH
T157727D3D4F003CAC25A7C0ECC5F982A98D18B7A7CEE6C0AD21583D0DC698969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 44KB
SHA256 4276dd368884a50eecdddae27336675997f448df7ade5eb78fb72c904dd48dbc
MD5 2c35ada4b321f0ae8ad2b635fc6f0a81
SHA1 70fc5b8f55a61404d578b94b90421471f4577762
SHA512 1f30232ef40f5ac32105f9fda15b2e51a755bc41d4e2f52c4d4329ebe99faeac82e7473b408a03451cd343165572c169d9e692c7141a5b47e7aab45ae81814df
SSDEEP 768:uSs7zv92CoDEryGcm+uVRmys7Kz7UrGFj75nF5ubab8bjb2bVbGbqbnbbsTg40nv:uSs7zv92CoDGdy70sTg40nQhJLM8Pe
TLSH
T14B230144EB1A953FD82812BBDCA21B002F78F88959192F67365C64782D872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 844c732f273202a72befcaa6df88f85397aebefd1a56658ec34ca60057fe7709
MD5 4ec7bbded4c513fde5b6f44a9ab4ed17
SHA1 8b1abbb75ad38bb8da0de672dff181cfaae0e8f8
SHA512 701a1bf28032def51f6a0d4ac609b342eb790655302ef598f6a6287f6a82cfb68edecdc8987e1348b6d920b69b63eaaf555f917ea42cd9de5f043753e54c8dc6
SSDEEP 192:eOv5zbo7zZ4hyjyMYl1d66JoztdzgCl6mc0dz:1boHZ4hyj+d66Joz/zgC1jd
TLSH
T1B0E10E68EA29863FC814037BDCA61B400F75384AD84E3F2975DD64482D5B2DE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 1KB
SHA256 95941701c8bab5b531c3ab138721adb550886a13f8ae785578653199ef682354
MD5 e23fc45aa5419cb1aa45a5ded8504935
SHA1 aabb4c35152453fda943ceed5a3e1dc198d43ae0
SHA512 5765447befefb2aab734115777ad92174748942f74547b4b7a46f056c7f2e0c322fb62f628e6e54b3c3944f491cf1a13c9e3d2f3d0294f249f97a499a6818db7
TLSH
T19721675C39B94DAB98C7E6DC7444028E53558B83048B2C474D92FF8CCE82ADE326A83D
MD5 SHA1 SHA512 TLSH

Submit Download

133e790e-39fd-4adf-b41f-498ca5c49ed5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\133e790e-39fd-4adf-b41f-498ca5c49ed5
Size 2KB
SHA256 1ed27703ebda231e4d6aaeed1c6408cb68856fceae662055f6adf7eb89d081c5
MD5 ffb22e104fdc791d1ad50578b96c77f7
SHA1 36915e01ff0b2a0e994e7534703f40ff3b752bce
SHA512 f4f7dd387f81f7a349ef9580391730806961bd4281f3857cd400a92573091678b11ab4ef2bcaccead5943afeca4e18e5383598a27adc21544ef8146424bb7005
TLSH
T19F41507C35789D379CDAF15D9092368E93E19A0344C228432E51EF4C8E976AF73AA41F
MD5 SHA1 SHA512 TLSH

Submit Download

386ba7a6-14a3-4ed7-aa4d-0030f412e913

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\386ba7a6-14a3-4ed7-aa4d-0030f412e913
Size 15KB
SHA256 8acb5cf62df5eddb816c9bbfd8e611e6cb37c1c48dfdea9e581d1a88b5e616ff
MD5 a79fbb01eee16eae7be659e97fbf5a79
SHA1 ef3ae31bbbf013de5993de960bf2c9f9a800483b
SHA512 99c0749b98df40d83fd3934c28186575b96467e14d82f7068d26a54a0051b633c66fbf7f7007a6deb1096cbfcc59ab687396a7915672becdd2cf7cb97ee2bde7
SSDEEP 192:PG/Bltrw8u1NF4HfQLW4jQdFxnlz2RFE1DBQ5u2AB+jTJyX4Qw87QSAzxAwY5HxB:0tk8cfWQR3s2AQuD7QSAlAwY5HYM
TLSH
T1AE62E8596430497E8691E368D8E97FC3E2F518CF8C019FC9DBE47E0869EA0AE5127C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93825688-e9bb-4536-9c6c-8bb44323ed07

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\93825688-e9bb-4536-9c6c-8bb44323ed07
Size 886B
SHA256 e5971bb6190ba844b76402b9b6b956838ef6d16eb9168ee58c6f2c25e240205e
MD5 f5d414b5662add3bb0ef6a6d6cde281a
SHA1 b99178fc0b956d20f1cedcbf1ad59ffb03a4928e
SHA512 c0057bc85763b1ae91611a93bee8203aaf174d499a0c71feb169c7ce0ca9d75be4f4f91408f623e33f03d1dd969876e77dc568587b1e4abe68ad35f2816e6eff
TLSH
T1641100909975B6B3CC78926BD5E537424AE0B023C0C659147D995E180DEE50EA7AE107
MD5 SHA1 SHA512 TLSH

Submit Download

af70101d-4399-4ad4-bc83-e4e5cc3bb2ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\af70101d-4399-4ad4-bc83-e4e5cc3bb2ae
Size 883B
SHA256 66bdf3a47248672e45a95b51e83a3314f47bdb40f23b830a9d666addb4489671
MD5 2ef1288a3cc4021dcfe73a30116b529b
SHA1 801611c072160015621b15588f9d8525f35afa14
SHA512 4137c794ce9ecd9d5bc57c86e9e6a860edcf0bd611c848b7919ef4f643a8bd117bd799d82b70699ad3cb1ef290459d8fdaeb823d6f239574730e444a859fe049
TLSH
T130110090D535B6F3CC78825BC5A537468BE8B42380C655147DA41E140EBE51FA7AA10B
MD5 SHA1 SHA512 TLSH

Submit Download

e1a52d43-f29f-4c00-bb94-5d579acaa059

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\e1a52d43-f29f-4c00-bb94-5d579acaa059
Size 235B
SHA256 0b38160ceac23054bb596186c4122980bfed0db54911c2388a94f4d0d32d19da
MD5 ea5a14077e91e7e068fc2e47400d738e
SHA1 622dc1eca7e17a73ff35f0e9b28478f35121cff8
SHA512 a4fb7a21bd3ddaa31d81488e3bca6badcee527f24f510aecde65e9eaf9c8ddab5f471b45c1853e4065787497567ff60dbd67f2f3e92491b6910440800e7acf74
TLSH
T150D023927C88735D0C380F0BF0E029C23084CC3714F85C50C56195748AFCEC80215C27
MD5 SHA1 SHA512 TLSH

Submit Download

eaaf27e1-260e-4574-851a-d3ff6df0f05b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\eaaf27e1-260e-4574-851a-d3ff6df0f05b
Size 235B
SHA256 9b54c6a397c1de6d54d97cdf072d7edcebae6773aa46af61ec33681d83221861
MD5 fc6574244396ea4610f98479f3339599
SHA1 163d77d3e223947f10113811fd45d6a825a80da3
SHA512 d79f9c8331ea3d4eb63586bb4bd7758e78640a45316bdcaf149f6b9d091937b9bb60ac6af106ad356fbe3a58eb70c39798316ba8a3128dd186c18d76e43dd200
TLSH
T1EDD097C024A83B2D08244F0BF0A069D2B1854C331464A810DA90093499BADC84292C46
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\extensions.json
Size 16KB
SHA256 ecec5af60fa24428c3c01c3db3aa2ee0cd65827faffd1b6059489414fbe884bd
MD5 8140bd2a27f30c27f6eeb34b6f977ecf
SHA1 599a46ebb843abcf389d4ba4ae6b61e360e7bc18
SHA512 950e4c92ef6db68502580ae100f2806292c2190e296dac9490d4d7d51a4b4077dd531248bf93f317099c26c5dddcd6447c3944adddc072588f3f95cbf4a6964f
SSDEEP 384:9kI4vcUmldvD8dhWr94zS96oJL4HZL4PGL4H7L4HML4H3S4hR:+I4kRfQXC4q6+4x404H4m4C47
TLSH
T11172521545048EB8298EA79AEA367E01C37D433B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 6KB
SHA256 801e399eb59b2c84c3f84a28cf847cfebad51e508535ca5aea22e9d14a585ba6
MD5 b06b88a38e607a77d772f4966780080d
SHA1 e9b6c5e4fa024ba4f92eaf84234ca79f00f90f56
SHA512 707ec5d0dc90bce56ad859c1fd04cd422850fc6664db28c689df99a25e63aaa5f27837c4466a48c308ccdffee54ad6ddaa22540c0a6b09fc8df062809a3be4a8
SSDEEP 96:xH+UTUQqGqsfq6V1zSHrSSlvdv9jInAHdA0ScSqBw88u8L4cnEVgsGS:ArRsfq6VqrSSHdA0ScDBw88e9
TLSH
T1BFE120785008CBBF64B677ACAC6888715AB2423B7BBF68D750B554C4014CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 12KB
SHA256 285803c76d11f1cf6f1c4207bd8efc2addb930f2a5fd1af3b8ca39b980f01f2e
MD5 b933206c7ad8d0ea57b357626be7d5cd
SHA1 d9bec2d3d95090865c232a57fcce591a9af22952
SHA512 57c5e60ee79c7daa4d70bbd95536c4e550d6808e134ec435ce0952316bb311c90fbc1b26ae55e6b2bcb551f7374e4c7f56e9981abded8cb5efc49903d53ad9ad
SSDEEP 192:G6Rsf46VFrSSpLRwA0ScLOBw88IqscNanRD:MHRwYwtod
TLSH
T13D42CD3856408B7F29B6327DAC2549F019A243777AFFBCD305F9A891044DF2481E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 8KB
SHA256 624ca82827a871a28f866bff6ef9b6ce47c4d491f44694b1dbddb92fb663147e
MD5 7160b813791442fed2adef91382a37b6
SHA1 0c21a2b0a1dc4b7011bb63c8ce8253a746fae356
SHA512 4055064ba848fb03ea7a8c3220d7a4b5c292ecd5e9432cafff9aaa0d069f6779bfd482037cf5afca87b3c52be2fc9d4f7d28dd7652f9cf96fab899f7ebb51557
SSDEEP 96:xH+5TUQqGqsf46VObzSHrSSlvdv9jInAWRsthA0ScSLBw8853Pzt8L4cnEV6sGS:A6Rsf46VFrSSWRwA0ScqBw88Rz/D
TLSH
T1B30211385504CF7F69B676BCAC2449705AA2023B7BBF68D750F99885014CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 943eba31fca1361044b2f6352c366c9e61874d653a9f6765369f23df842de130
MD5 55923b6d35d60dd4b8b518176190c643
SHA1 2c186cb097f3962675c85bed41ba844671e3f0a2
SHA512 487ba709d29ead672d0f818c427b2d4464ad3132f156a1443178a7c575224f73f1d313b9b8ab995afe8e21fdd0fe25e0ccba120ac4d37547ba812e573a03ab1c
SSDEEP 96:xH+UTUQqGqsfqbr1zS7mSSlvdv9jFnAHdA0ScSqBw8828L4cnEVgR:ArRsfqbrqmSSmdA0ScDBw88W+
TLSH
T18AE13F789408CB7FB4B6776CAC6888716AB2413B7BBF68C650B554C4054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 7KB
SHA256 f30e6793c98efe6843ea1051d14d4893b83148e6d86dfe4b517947e6fd1b3b1f
MD5 773d43296bfc7b6b8e297142002c30fa
SHA1 9b502e53ca995beacad17a474bf71e0b07d756a7
SHA512 92e098a98fbc2ca93b2bda0103703b21e585d8bb3cc2b13de1bef2729831d984319f1ffb1d158560d3706752b20a6f16e8500cf9d7b86b7f5fe505a65cc8c5b2
SSDEEP 96:xH+UTUQqGqsfq6VObzSHrSSlvdv9jInAHdA0ScSqBw88u8L4cnEVgsGS:ArRsfq6VFrSSHdA0ScDBw88e9
TLSH
T1ABE13F789008CBBFA4B677ACAC6888715AB2413B7BBF68C750B554C4014CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 65bff613ccf0b1041c6a15513b0d9c31ba652c54b5845030f5ae69fcf692e74b
MD5 49fd1c82d6e0c8c8cbf4e4bd95832f8b
SHA1 241fde649281a886ae45d95e7b44444ebc8a4908
SHA512 09488680b3e355d9ab903efa2c473b2f53e61d82cc086a2040757047cb0d85e54889bc8938ffd7d02942358dc344f0e445c17b7943e7ce026aa30e66b384261d
TLSH
T1B821BA8ABF2F1CF23695C04BE4C98FD8E6A66251467858F098B556065584A4F728D305
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 1deb41fad6fec4a44ce40fd53c2e83d0cd0813b0df8dc9418479de2249a737bf
MD5 f80cdae9bb3986ea30d3e11026f08559
SHA1 0a0dc1f4903acac449aed4d3c4e446af517810b6
SHA512 2bb934cc04263d848a5fa013a836d97a08f1f14372fb359b4049ead244338a16e6e1360438d5697bf95815bb0ce9360edcc1756978a5df25aca34764a7f7b43b
SSDEEP 49152:xYpKU0HeTESYSO3lERUGblgN5IQ+8ejhu5:+7uVERUCM5IQ+8eA5
TLSH
T185362AF820D1A257F3814033664593EF21EFD00C6037DA085BA956E9A578CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads