hxxp://mailto[:]BD[.]JYYGEOBZINWGKS2THBBGUVTJ[.]MNDES4LRPBEEC2KFNVGGQZTP@unsubscribe[.]qemailserver[.]com/?subject=qunsub_CGC_N0b89CleKS8BjVi[.]UR_cFIqqxHAiEmLhfo[.]centene[.]EMD_gxnTvyad973WTnk[.]SV_50fD4zNJVnm9Hjo[.]UR_cFIqqxHAiEmLhfo[.]CG_3LjMwcqtmIV2d9R[.]https%3A%2F%2Fcentene[.]az1[.]qualtrics[.]com%2FCP%2FRegister[.]php

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mailto:BD.JYYGEOBZINWGKS2THBBGUVTJ.MNDES4LRPBEEC2KFNVGGQZTP@unsubscribe.qemailserver.com/?subject=qunsub_CGC_N0b89CleKS8BjVi.UR_cFIqqxHAiEmLhfo.centene.EMD_gxnTvyad973WTnk.SV_50fD4zNJVnm9Hjo.UR_cFIqqxHAiEmLhfo.CG_3LjMwcqtmIV2d9R.https%3A%2F%2Fcentene.az1.qualtrics.com%2FCP%2FRegister.php
Sample260825-s9blhavepg

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	firefox.exe
Token: SeDebugPrivilege	3556	firefox.exe
Token: SeDebugPrivilege	3556	firefox.exe
Token: SeDebugPrivilege	3556	firefox.exe
Token: SeDebugPrivilege	3556	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3556	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3556	3700	firefox.exe	85
PID 3700 wrote to memory of 3556	3700	firefox.exe	85
PID 3556 wrote to memory of 4212	3556	firefox.exe	86
PID 3556 wrote to memory of 4212	3556	firefox.exe	86
PID 3556 wrote to memory of 4212	3556	firefox.exe	86
PID 3556 wrote to memory of 4268	3556	firefox.exe	87
PID 3556 wrote to memory of 4268	3556	firefox.exe	87
PID 3556 wrote to memory of 4268	3556	firefox.exe	87
PID 3556 wrote to memory of 4268	3556	firefox.exe	87
PID 3556 wrote to memory of 2056	3556	firefox.exe	88
PID 3556 wrote to memory of 2056	3556	firefox.exe	88
PID 3556 wrote to memory of 2056	3556	firefox.exe	88
PID 3556 wrote to memory of 2056	3556	firefox.exe	88
PID 3556 wrote to memory of 5100	3556	firefox.exe	89
PID 3556 wrote to memory of 5100	3556	firefox.exe	89
PID 3556 wrote to memory of 5100	3556	firefox.exe	89
PID 3556 wrote to memory of 4716	3556	firefox.exe	90
PID 3556 wrote to memory of 4716	3556	firefox.exe	90
PID 3556 wrote to memory of 4716	3556	firefox.exe	90
PID 3556 wrote to memory of 4716	3556	firefox.exe	90
PID 3556 wrote to memory of 4432	3556	firefox.exe	91
PID 3556 wrote to memory of 4432	3556	firefox.exe	91
PID 3556 wrote to memory of 4432	3556	firefox.exe	91
PID 3556 wrote to memory of 4432	3556	firefox.exe	91
PID 3556 wrote to memory of 916	3556	firefox.exe	92
PID 3556 wrote to memory of 916	3556	firefox.exe	92
PID 3556 wrote to memory of 916	3556	firefox.exe	92
PID 3556 wrote to memory of 916	3556	firefox.exe	92
PID 3556 wrote to memory of 1316	3556	firefox.exe	93
PID 3556 wrote to memory of 1316	3556	firefox.exe	93
PID 3556 wrote to memory of 1316	3556	firefox.exe	93
PID 3556 wrote to memory of 1316	3556	firefox.exe	93
PID 3556 wrote to memory of 2360	3556	firefox.exe	94
PID 3556 wrote to memory of 2360	3556	firefox.exe	94
PID 3556 wrote to memory of 2360	3556	firefox.exe	94
PID 3556 wrote to memory of 2360	3556	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://mailto:BD.JYYGEOBZINWGKS2THBBGUVTJ.MNDES4LRPBEEC2KFNVGGQZTP@unsubscribe.qemailserver.com/?subject=qunsub_CGC_N0b89CleKS8BjVi.UR_cFIqqxHAiEmLhfo.centene.EMD_gxnTvyad973WTnk.SV_50fD4zNJVnm9Hjo.UR_cFIqqxHAiEmLhfo.CG_3LjMwcqtmIV2d9R.https%3A%2F%2Fcentene.az1.qualtrics.com%2FCP%2FRegister.php"
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://mailto:BD.JYYGEOBZINWGKS2THBBGUVTJ.MNDES4LRPBEEC2KFNVGGQZTP@unsubscribe.qemailserver.com/?subject=qunsub_CGC_N0b89CleKS8BjVi.UR_cFIqqxHAiEmLhfo.centene.EMD_gxnTvyad973WTnk.SV_50fD4zNJVnm9Hjo.UR_cFIqqxHAiEmLhfo.CG_3LjMwcqtmIV2d9R.https%3A%2F%2Fcentene.az1.qualtrics.com%2FCP%2FRegister.php
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {5f62b65c-823b-459c-aec6-3dffe3b22baa} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2508 -prefsLen 27135 -prefMapHandle 2512 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {588c456a-ddea-47dc-ab1f-7ae4307df501} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3724 -prefsLen 25164 -prefMapHandle 3728 -prefMapSize 270279 -jsInitHandle 3732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3740 -initialChannelId {c9e87a6e-0679-4f84-9df6-aee6312abd6d} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3888 -prefsLen 27276 -prefMapHandle 3892 -prefMapSize 270279 -ipcHandle 3960 -initialChannelId {0a456160-1293-47d0-a6de-733e0c2f3d71} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3152 -prefsLen 34775 -prefMapHandle 3120 -prefMapSize 270279 -jsInitHandle 2752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1672 -initialChannelId {e492f441-c4d4-4057-8691-931522b07ba5} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2644 -prefsLen 35012 -prefMapHandle 4956 -prefMapSize 270279 -ipcHandle 3320 -initialChannelId {59f80014-164e-4d4c-b9e6-a022b2209f6b} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5308 -prefsLen 32952 -prefMapHandle 5312 -prefMapSize 270279 -jsInitHandle 5316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5324 -initialChannelId {d61c1b21-6849-42d5-a5d5-63adb0ace604} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4888 -prefsLen 32952 -prefMapHandle 4860 -prefMapSize 270279 -jsInitHandle 4864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5332 -initialChannelId {d4ac4e46-32d9-4dae-9cef-70b9e313ef04} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5652 -prefsLen 32952 -prefMapHandle 5656 -prefMapSize 270279 -jsInitHandle 5660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5668 -initialChannelId {e36ca699-7ec6-45ee-a2ef-d8de19ad59d2} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 15d31c128deef246f91a1def9367bb35ebd95094ea58b79d2c3f66db57e3f283
MD5 0f753503d49d2fc230e7f4c8a91dffd1
SHA1 dcf1dd49806e93b90b2cc64972e4531f7fd0a9cd
SHA512 5464c5bc9caaab1ef11a768ada34490a8c4d12734ab4e47aff7340161ac65e9841d42e14fa20344eee02270d47a4743b03ad55f6e4f4846ed43f7f8bd26967c3
SSDEEP 384:HXkRyiO024Y1DL84KKDL849B7SOEAd9KVRaAcP+AWRMAr:3mZY1DL8lKDL8CB7S/AmVAf+hRMe
TLSH
T1B5728D3D5F003CAC25A7C0F8C5F982AA4D18B7A7DFE6806D21583D0DC698A69B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fdb276a-f113-4960-9fdb-e4c730db8d53.zip

Path C:\Users\Admin\AppData\Local\Temp\4fdb276a-f113-4960-9fdb-e4c730db8d53.zip
Size 3.8MB
SHA256 d08c73dd1f32fbd201ba90d0c877f9b972739c0e1fee4f6d816445be1c58fb08
MD5 9b5c5784cd6ee400fa2b1bc4efcd9e9d
SHA1 35fc800590c554590580a9a2e430fa11e9e7c4a9
SHA512 21b695f76d67f6e96dd8f1208ce43116b6058155a92130a59d3cd212f49384544cb7ee11ee7656751309fd7800b408c23524cf1f92927a515f5b3f6109c5f322
SSDEEP 49152:1Ga84n/7L8vRDQFj8kww+DHBshv34yvSDOHPIUlI8R6k+hX9e8oxi6BYCaPO30uc:ca8oF7W1shXRQUlIQ6kwe+DW30uPE
TLSH
T1A306F175E69C1A09CDCFB3BA850D2FC2D84C4FA680E4A96F7A6BD9715CA31E61F44C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 007d34363d92bd71b83e7d0975fc88b80a95f575dd5454ee4bc1728dd9275083
MD5 b9b4baf78a542baf705f6be2e9598511
SHA1 cfe7fab01364e1fbd0aeea05385b4530b114d8d2
SHA512 6772d8a46181e6dc580980f03e047ecedeacf9f8e44628329a48067bd68b03b3221ee6568ab4eff52f2fd55c97f7bd6a7061d7932376901ffa09aa0fa29161ed
SSDEEP 96:cZSdF95/7bkW60rcE+fyUR65WZYFT2FRFBF9F7/dd66JozGzgClKtmc0d/UK:SOv5zbowb+fyjIX1d66JozGzgCl6mc0d
TLSH
T118C1FD28F728523BC808423BCCA61F500F36755B988E7F1531AC641D2D572DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 5b390f640689a11b78453cae4f6ff2f8a7c1c9183241b2d00edebcd6110cd5d7
MD5 16aa210cc488b2a511b9e7f34d6322ae
SHA1 cec12e5baa97e46f315e6a387609992957ea1f0e
SHA512 6db081225e3200dd2c3992a1fbd1f62041d2c193fe5410b922dc4ce336cb058a68c2051f1f9a6591d5500d639e62de9610585d9022421c7c5c5e76b3dd92823b
SSDEEP 192:MOv5zboZZ+fyjmxe1d66JozGzgCl6mc0dz:vboZZ+fyj9d66JozGzgC1jd
TLSH
T127D1FE68E728513BC808023BCCA61F500F35799A988F7F2971AC641C2D573DD7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 07e4b87c556f36c6018c6a3cc174d8050affa93380837cf2844f0d601cb394cb
MD5 ba837afb0cd66f86f2f99f2909f46990
SHA1 b75b5f5f33c48d41555c14a2085705bf624d2a14
SHA512 f2338adb87ba47a716d6d0e799a8785c639ffb2a8d8d2ee5cfc50afced59aa8b017cc21604b41ee94570b1605bdf5df2db4c942e65f2c7f5c27ca65b34b6924f
SSDEEP 384:kwC9fEvDOJZcGcmhu9Rs5H2Z6KqrvWabBbL3Vd66JozGzgC1jUboa+fyj0z:kwyEeuGcmhu9OWZ6KqrvWabBbziEm8X
TLSH
T1F1D20044FB2A953FD41452BBDCA507002F79B88A585A2F973A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 0db815f21c0b3d9795dc47ea8f4e74c7b32d00132db3d4bdf1f22cdc306e5683
MD5 4f76d3c002136a5fadc216de8940d315
SHA1 2dd4ef9f454fe8cb75f140b6821427ddda39b5e4
SHA512 c89c16e76002ec458ba289afcbf5a6846cddd16ecc42da4d66ac53da539519f8f3de744f26f71e0d1aa59e26569a76d95ee1c34c6458680895b97ee0d985a06f
SSDEEP 384:Lboa+fyj0Pd66JozGzgC1jxwC9fEvDOJZcGcmhu9Rs5H2Z6KqrvWabBbL3:P8MEbwyEeuGcmhu9OWZ6KqrvWabBbz
TLSH
T125D20044FB2A953FD41452BBDCA507002F79B88A585A2F973A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 4a580a2c4048649782a52bf4f680171a35aa35d900adef4ed33c521b10b66792
MD5 6d72b19c3bc59cf21df5f58b6b9ee7bf
SHA1 fb1415f79f6d5eb33ab670d305feae440ff37a7f
SHA512 18a83649e8e8cee6113a42132e643383ca8d93f6cb0a277bf3730a1237cc1b0e2c179841b3913d0c9d65ea7fd91049a9c748ebb9e0b9bafe9a2ff6c9d152b46f
SSDEEP 384:yd66JozGzgC1jxwC9fEvDOJZcGcmhu9Rs5H2Z6KqrvWabBbL34boa+fyj0z:jEbwyEeuGcmhu9OWZ6KqrvWabBbzQ8X
TLSH
T132D20044FB2A953FD41452BBDCA507002F79B88A585A2F973A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 1KB
SHA256 17729368a494f18a360100604a79f6ae6eba314085c2b0c3aa1ea3e78880664a
MD5 d8fdcdc6dcd7dc7c9454c929176c72f1
SHA1 5010a8ae7484b4f40f80785a1064cd3526b81cbc
SHA512 efcb2f205c7745f913aa8d060fe36e31a48218449273aaaea4dcec42397c8e77c01fdfed7bb45b7029f208cf10b1a55a6995f9256d49a7fc33e6e4ae38e133ca
TLSH
T14611AD5C3AA44D2DA8C7E29E7090028F57954D0389875C534E12FFCCCE91AD9792E52C
MD5 SHA1 SHA512 TLSH

Submit Download

5665f5d4-9ca1-4bfb-b0ad-de6a744c0840

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\5665f5d4-9ca1-4bfb-b0ad-de6a744c0840
Size 15KB
SHA256 2dfaaeb6bb9a28568ee7f85a61bae162de4d200ff3cd46876d51f96f46a2019c
MD5 1e528def6e892cc71aa1dd1cc0457ca4
SHA1 1ef6dfbeeeefed3544c2b3bc8b38ebdba728ef7b
SHA512 7b9d0aa41e1e9f36af615a7e9813c903a079f751a65ec8655f73dc32016c7994d5d3a2a080506b4ffa0234184fcf8c018426b323110cef5639169eb5f4cf0350
SSDEEP 192:Fu8wk3ShYfzxKRP9Y/P8oozrejddF/d/64iw+GRd8NI7Ej7hHmz4WX1dBTq2L+jL:Fu8waShYflKRP6c60WS5HHWDajL
TLSH
T16572C956683045BA8251E398D4ECBFC3E5F528CB4C419FCADBE4BD086DEE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f33005a-ce3b-4020-99e6-9a694b725ce4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\5f33005a-ce3b-4020-99e6-9a694b725ce4
Size 886B
SHA256 45b4202ec93bb1e60b1d22cb115bf68dc308cc2e84ad49f319aca2d98beae936
MD5 2b238d3484c6a9efa57482ea3c0b6fc4
SHA1 04456f25d00374346fc67d4b118cb885dd2a2740
SHA512 a1ef78720fcd9c9375fb05dd7004688f99f137d2cf507b1d9cb8f1128375283e613a478b2389d6645ad34200c9887385dd5297186edb59f59114fd84c6e40a1f
TLSH
T16C112785C7B478F38C58D28F96917742C7E4B123C0C61C147D604A2C0DFA51F676660B
MD5 SHA1 SHA512 TLSH

Submit Download

9530f220-8161-4b6a-8acd-feaed8b31936

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\9530f220-8161-4b6a-8acd-feaed8b31936
Size 235B
SHA256 f8ef9a7c8033ffc30ea791f5fbd72b80de111d2dc8276f9ec23741bf61420540
MD5 4f3c38c9e01165ae44421acc07616011
SHA1 6bd1fd853ad9b65f40da0673bf3203c5fde21aca
SHA512 2947e5645e5f59606f9e0a8757d4f4eaa27c189b0819d9d47112b458279ca02fb7474ce56bda94d494347d49bf99eb33f332a6fb095c7b737c946ffd56d56be3
TLSH
T1C9D0978428B82BBD08100F2AB0E0B8C331C48C3360B8EC54AA5149B489FEAC4919192A
MD5 SHA1 SHA512 TLSH

Submit Download

a8ce7ee6-f634-47b2-a482-a137ea3e2b11

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\a8ce7ee6-f634-47b2-a482-a137ea3e2b11
Size 2KB
SHA256 fccf80fcdedfb1d3e86e134dbcc02abdadad9acb37bc0e353f5866bd0d067cc4
MD5 d13503287be2eafbb2eadcf47c50f0bc
SHA1 c8aeacd49ef408b3c4f46302a3b9d6af1646a326
SHA512 257a20e7e3f676af08676ab83080c175e7f41036c2b60f420f9cb3ef07c63911b216ab8736324521fdd29cd2937198a14410a0edb5a0cf764bc1ce2ab75a6a13
TLSH
T13841F16C35B85CB79DDAE18D9482238D5728C65340CA28832D61DE0DCC9969E336653B
MD5 SHA1 SHA512 TLSH

Submit Download

a9f721c0-8cfc-4f95-a4da-63b73a247281

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\a9f721c0-8cfc-4f95-a4da-63b73a247281
Size 235B
SHA256 f918cc8d45b5e2fcce1a6ef5a30316c6823e06e580627a21630f8862ce7443da
MD5 2c36f5b7e7d57773441878d17524af4f
SHA1 5db117bee2caae667f6ca7a870ae1c319e12e67f
SHA512 62c796c1622c957fe19b9340feff6f6293c30af049e31cb1c859b731a293e0f5613e027174370d34e601d6013dd7c986afc6a944a0f749da746007675b887304
TLSH
T1BED0978114BC376F08004F17B1E03AD631894C3310686820EA51463889FAAC411118C6
MD5 SHA1 SHA512 TLSH

Submit Download

fc1456e1-1a93-475f-9a83-66cca87fe219

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\fc1456e1-1a93-475f-9a83-66cca87fe219
Size 883B
SHA256 913c5b7c71be059a6f4e2d2682ac3be326d2ecbf2f0006d6b20adaf17a55c558
MD5 7ab73069db689e2bd084dd2b0d307c33
SHA1 9ace73d5d90bb6b48c2390760f0ae5e4d2c99db7
SHA512 c2647b92ae78b45374f1d7482826a4d453c4509a12065239bc1c53b66a08de0eab01e215f6e5ea0436304f1fd39adcc2e78242f84be4ea47b3fb4999fa31482b
TLSH
T143112345D670F8B3CC6CC34F8A9677028BF4B22384C954143DB499280D7E62EA7A670F
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\extensions.json
Size 16KB
SHA256 3ed0c7281ba0b064de73ea565e583b0eb920ebedbc4b54027ba06fc4428b672e
MD5 15593281abc5d7084b0ee318d5a9cab0
SHA1 38e9611d0dbe180f89e81db88e971d77c1822e8e
SHA512 b81d492d08297f838acae140a79600a18e141b2eda256e641a136b34b8f69fb3951fa9f4992c5f5b5eecf129b80d9cb560b5b777e8bcd4bd77af2686f77a2dfe
SSDEEP 384:HkI4vYUmldvL8dhW894z/96ozL4HHL4P/L4HdL4HsL4HfB4hg:EI4gRfoXV4J684L474d4G4Z4u
TLSH
T16172431545049EB8298EA78BAA367E01C37D473B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 11KB
SHA256 3dc3a4eb42968090b26a7fed6e41801e4a4ce14fc4aeb0c0b04af018e525317f
MD5 424e2027b8706333418aed35f6aad5d1
SHA1 bd8e8fb70dac881d33d3dd7ed4b313c6009e2504
SHA512 062cd592abea699ade18edd7cee430cca72f7735defce6040466737c52c201d29c3f0f11edac6a973f22ed94ba45d3b4717b5123ce2b2290c6a8f949aefccac8
SSDEEP 192:iYR6fM6tixkSSL8RYWBrOGOBw884jC2q+gEMN9/DT6M6XT5Ikjuiu8h+KXEHFo3:8yRYWAZwIjC2q+gEMN9/DT6M6XT5Ikjn
TLSH
T1A832BE3C6144CF6F24B6327E6C2549A15A610237FB7FACE701B9A4C1450CF2551EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 7KB
SHA256 9389846e5d16bebbbaae1abcca7aacafa4afa59577ac2cdd4b09f9aae2aa365f
MD5 e003d6a5f707d4608305e239f796c4da
SHA1 4af223a296697f4571239eca76092d7905cea911
SHA512 cc364a3f8b638bde8721e12c7525164e432d8b5299871d777e0eba9e33ff5bc8b6f6e1f9fa3b138d1f766a68a09421aa1a776ef53c8132a1e8beebb9a255a0e9
SSDEEP 96:xHrFTUmqGq6fM6tiO2ObzS+SSlfdv9jHnpRHNWyS9JOSBw88fRMjq8L4cnuF5j:1YR6fM6tixkSSL9NWBrOSBw88ZMjE3
TLSH
T16CF10E789104CB6F74B276ADAC6488725AB2023BBBBF68D710B954C4050CF3455FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 41d555c21eb8dfb8679b811616e23efcb729fedeaeb293e48819133d6fd90b5d
MD5 cf0aeb11249901cde6f32023c65290b3
SHA1 54694711614c69cb57608b4c063353c63ba8702f
SHA512 c3d47ca64aa673bcdb3fe84887721b86a6fb9ad30d459d6696817e8de47573dec7c54b3087d4fe4d7b440a4540578bfa85bb2bdf6b89db553348091b3a9e9493
SSDEEP 96:xHrUTUmqGq6fzUL1zSRSSlfdv9jenpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzULgSSo9NWBrODBw88Jr
TLSH
T1F8E12F789508CB6F74B677ACAC6888716AB2013BB7BF68D310B594C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 bfbcad5ad1dbf91814aeaa2edb5b40e85cf2080c00882b279f6177d36f3e95be
MD5 e76f8cc74a14b981751e3c7ba6920664
SHA1 2413cff80333fc866eb454095fd09a9de1abdc02
SHA512 b82b9051565ff35b4b2c02296990a63109b6abee2e0647b2214b858d37b47e3182de03234cee4b7003f41e47a616e8279cbb6d1673504520e765cefbe53169c2
SSDEEP 96:xHrUTUmqGq6fziO21zS+SSlfdv9jenpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzixjSSo9NWBrODBw88Jr
TLSH
T123E110789508CF6F74B676ACAC6488716AB2013BBBBF68D710B554C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 53352a33986894cea562536cbb42f27768819802639d7f0f624455f64e458112
MD5 e03f2ec743b6a7b9ae09ec02a2c56cb1
SHA1 462b4b3145ea901eae3d4e139e58c22d4cf1c53c
SHA512 2dc3495169416b2dc5cf3b7768cfa41ca4bad50b92e853858518d3a7a53ed04b6e309b8cbe2cb2a0be3b17af6c0983a296d045a62b9ed2303869c1581bd8881e
TLSH
T1C131078289562FE974F1701ED4464BF2C76718214874C8B073CA8D8295CE4CAB6C6FA8
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.1MB
SHA256 a94a71ba0e0d78869f6dfcf09ed4d32d2f12d04dcd64782882e1aaf967aec273
MD5 99e535ee464d11b186856ca0b3623f27
SHA1 3f6ca08823e5f19cfa92f21e671317e0a427a2a2
SHA512 259355c40d2380c234510b1178b4577fbd376ec689d61249885be4a02438dc5f65a9d77baaba78b05e7596f17281257acc4b81852146771cd506ae5eacba9c80
SSDEEP 24576:pD38HgilTOyw8tQYBD8k8HFusktXOaW3sTvfXBKwjWujj5CoUVGblyhWa5C:pD3ONtQYCYs0XOaW3s7v0mW/oUVGcBo
TLSH
T1A4463AE860D1A257F3824073B24953EB21FFD00D5037DE0847995AA9A578CDF8E17BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads