hxxps://coupons-businessinsider[.]digidip[.]net/visit?url=hxxps://sunset3[.]glamdrixa[.]com/&ref=wlus5305XX5jamqfj1dqmc2ffef600000055081a9a

Analysis

user interaction
yes
max time kernel
35s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://coupons-businessinsider.digidip.net/visit?url=https://sunset3.glamdrixa.com/&ref=wlus5305XX5jamqfj1dqmc2ffef600000055081a9a
Sample260826-xc71navcmg

Score

6^/10

microsoft discovery persistence phishing

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
70	api.ipify.org
71	api.ipify.org
72	api.ipify.org
73	api.ipify.org

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
43	4444	firefox.exe
43	4444	firefox.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	firefox.exe
Token: SeDebugPrivilege	4444	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4444	firefox.exe
4444	firefox.exe
4444	firefox.exe
4444	firefox.exe
4444	firefox.exe
4444	firefox.exe
4444	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4444	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4444	4340	firefox.exe	86
PID 4340 wrote to memory of 4444	4340	firefox.exe	86
PID 4444 wrote to memory of 4760	4444	firefox.exe	87
PID 4444 wrote to memory of 4760	4444	firefox.exe	87
PID 4444 wrote to memory of 4760	4444	firefox.exe	87
PID 4444 wrote to memory of 748	4444	firefox.exe	88
PID 4444 wrote to memory of 748	4444	firefox.exe	88
PID 4444 wrote to memory of 748	4444	firefox.exe	88
PID 4444 wrote to memory of 748	4444	firefox.exe	88
PID 4444 wrote to memory of 1664	4444	firefox.exe	89
PID 4444 wrote to memory of 1664	4444	firefox.exe	89
PID 4444 wrote to memory of 1664	4444	firefox.exe	89
PID 4444 wrote to memory of 1664	4444	firefox.exe	89
PID 4444 wrote to memory of 2092	4444	firefox.exe	90
PID 4444 wrote to memory of 2092	4444	firefox.exe	90
PID 4444 wrote to memory of 2092	4444	firefox.exe	90
PID 4444 wrote to memory of 1680	4444	firefox.exe	91
PID 4444 wrote to memory of 1680	4444	firefox.exe	91
PID 4444 wrote to memory of 1680	4444	firefox.exe	91
PID 4444 wrote to memory of 1680	4444	firefox.exe	91
PID 4444 wrote to memory of 1508	4444	firefox.exe	92
PID 4444 wrote to memory of 1508	4444	firefox.exe	92
PID 4444 wrote to memory of 1508	4444	firefox.exe	92
PID 4444 wrote to memory of 1508	4444	firefox.exe	92
PID 4444 wrote to memory of 2672	4444	firefox.exe	93
PID 4444 wrote to memory of 2672	4444	firefox.exe	93
PID 4444 wrote to memory of 2672	4444	firefox.exe	93
PID 4444 wrote to memory of 2672	4444	firefox.exe	93
PID 4444 wrote to memory of 4136	4444	firefox.exe	94
PID 4444 wrote to memory of 4136	4444	firefox.exe	94
PID 4444 wrote to memory of 4136	4444	firefox.exe	94
PID 4444 wrote to memory of 4136	4444	firefox.exe	94
PID 4444 wrote to memory of 4000	4444	firefox.exe	95
PID 4444 wrote to memory of 4000	4444	firefox.exe	95
PID 4444 wrote to memory of 4000	4444	firefox.exe	95
PID 4444 wrote to memory of 4000	4444	firefox.exe	95
PID 4444 wrote to memory of 4868	4444	firefox.exe	96
PID 4444 wrote to memory of 4868	4444	firefox.exe	96
PID 4444 wrote to memory of 4868	4444	firefox.exe	96
PID 4444 wrote to memory of 4868	4444	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://coupons-businessinsider.digidip.net/visit?url=https://sunset3.glamdrixa.com/&ref=wlus5305XX5jamqfj1dqmc2ffef600000055081a9a"
1⤵
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://coupons-businessinsider.digidip.net/visit?url=https://sunset3.glamdrixa.com/&ref=wlus5305XX5jamqfj1dqmc2ffef600000055081a9a
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27099 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {12fcad2a-5098-472b-9ba4-deeb86fa37aa} -parentPid 4444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4444" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {1e00efc9-47e4-48b4-89c2-de5064479bc1} -parentPid 4444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25164 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {d80c01c5-13cc-45a0-b6b3-9fe3d3903350} -parentPid 4444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27276 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {db8052ff-2fa1-496d-8949-480ad5a9e497} -parentPid 4444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4444" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2748 -prefsLen 34775 -prefMapHandle 4072 -prefMapSize 270279 -jsInitHandle 2760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2700 -initialChannelId {741a2aea-e8c6-4fd2-af7c-75b1597ae010} -parentPid 4444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4920 -prefsLen 35012 -prefMapHandle 4924 -prefMapSize 270279 -ipcHandle 3244 -initialChannelId {5b38e1e4-962a-4bd9-bdbb-dec53baa041f} -parentPid 4444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5156 -prefsLen 32952 -prefMapHandle 5160 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5076 -initialChannelId {bb01db9c-f8fc-4590-950c-4a361f2610df} -parentPid 4444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5180 -prefsLen 32952 -prefMapHandle 5184 -prefMapSize 270279 -jsInitHandle 5188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5192 -initialChannelId {c881ee1b-e3f8-4b15-b37a-72bfc26e93b8} -parentPid 4444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5520 -prefsLen 32952 -prefMapHandle 5524 -prefMapSize 270279 -jsInitHandle 5528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5536 -initialChannelId {89f4abb9-1a36-4cfd-9da7-709fac051590} -parentPid 4444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3968 -prefsLen 32952 -prefMapHandle 3952 -prefMapSize 270279 -jsInitHandle 3956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3944 -initialChannelId {cebf4d5f-0fdb-49ed-9c77-e2fc7904a4c0} -parentPid 4444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 201677bd38c26c4d513a3b92825c36eb9ba7baa1d5606cb923fa1168e7138251
MD5 2b889f282985d86a57acf1112b1da33e
SHA1 3d2891cccd4dfd63128086ad4decf7cf4de13b76
SHA512 82c9c4627f86b5850301052d946822b3498622e2472a905de76d48500d740f189fe039ed4df2bb51d6a407168ec96c9a6c3613bfa60584ad0c819936a1fbbaf5
SSDEEP 384:HXkRyiO024YbDL84KKDL849B7SOEAd9KVRaAcP+AWRMAj:3mZYbDL8lKDL8CB7S/AmVAf+hRMK
TLSH
T11C727D7D4F003CAC25A7C0F8C5F982A94D18BBA7DEE6C06D21583D0DC698969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 6d86cd59589d4c6cc07af38e728e068bad9b19c439870e757ec9d42467827d2c
MD5 104640e48b97ad36b8089830ad99faa0
SHA1 d317953bb5df1d37b47a6bfc5814a0e9677827ec
SHA512 11037ff6dbdd24c996eefb8e3f283ed8a4ed90fbc84a227e64b08846951bc385635752ac9326a224cef13a0a8199721b377b6aa8d04cffb41973df0fd35e2892
SSDEEP 96:fFT2FuFvsFvDFvC/dd66JozGzgClKtmc0d/U2SdF95/7bkW60rcE+fyUR6Ux2WI:N1d66JozGzgCl6mc0dBOv5zbowb+fyj5
TLSH
T1A6C1EC28E729563FC808423BCCA61F500F36755B9C8E3F1931AC641D2D562DE7A9E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 d1b248825d3181287d17ea3114940484b797f072327a79077d363b7ff4ebd3dc
MD5 20ee992f96445257bf4b4da1fa96b789
SHA1 36213b5f0996d6b4d458c4cea58c9e2c6e5e9cbb
SHA512 b88b33b6aba2d4a67a6c8741ac50c8ff242bd0e633bd7181776f064c76f10b0c33ff270ecf2d70840a3a8fa90480ab1e9c288dcf5f500a55c7de597a23549808
TLSH
T1DD619658F228863FE445813ACD921F412F347456A8AF7F2A35AC604D1E5B2CD76CE17E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6386a75671f5efe78db076dfe1f4b38ec435fa180feee22d35560bd9334af8f0
MD5 61695ee9814cb6a882c557eb548f37a3
SHA1 cc525bac8ef1400c0b976306a41abad058751eb2
SHA512 45e08d28a442e29f9f8ce9aa7bf9d4d938a95f3deeb481c5994cc27d9fe60e31c8f0ccf911d52b914ce638b66d16d7e183618d7ec178e43d545a8552ad3914fe
SSDEEP 192:N1d66JozGzgCl6mc0dbOv5zbovb+fyjqYu:rd66JozGzgC1jKbovb+fyja
TLSH
T163D11E68EA28863FC408427BCCA61F414F35395B9C8E3F19359D641C2D5729E3A9E2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 286ab54ee2db48633b9bb15b69be99c13820ee49ab3101fdd0bfd7c170e8e7cf
MD5 69be54410e8dd60db2a2bfbf759dc08d
SHA1 f8909a9273ac4d22dd5df422604d831325af747f
SHA512 7651bfd6eb1eea46b4fc057bdf6d3fd7f449634bc4688e2f71082170eebb756c31455b6e9600116eb640b9ca28f4f2c42bce2affd9684022f6a7c664f9c7c9e2
SSDEEP 192:3Ov5zboPuZ+fyjqYZ1d66JozGzgCl6mc0d:IboWZ+fyjjd66JozGzgC1j
TLSH
T1D5E11F68E628923FC408427BCCA61F414F35399A9C8F3F18759C641C2D572DE369E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 1KB
SHA256 68dc7e0a4fd63ff70775654017f99e6270e6207a8624b19302ecdafbb4823970
MD5 5d9e840cd04ab6a2dc28a026aad760dd
SHA1 6d28a23d070313bc3d9d46501624e7ac22c15bd4
SHA512 d990c5150a283b4520838be6b9e561881d85cef43b4bdf5a904875b82ef0848fc9229397bdb8c51b1448103c28160f4f3ac46e9afa4f31a7106e15d9a310e96a
TLSH
T1B4214C9C3AB98E6A58C6F2AC7490168E57954F0B04871C438D52FF8DCE81AD9326E87C
MD5 SHA1 SHA512 TLSH

Submit Download

0ec23deb-00ec-4b18-8de1-2d8196c46531

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\0ec23deb-00ec-4b18-8de1-2d8196c46531
Size 883B
SHA256 15ccddfa81aadaf1722c24c6a80fe460e1a9f9b23e8a5cda1aa14667630e290b
MD5 a3dd3facedf5d6bfa3b7cf805f2a2a18
SHA1 1896366ca85be4cf6d515ea35f9de605cd60feec
SHA512 ac3fb822e814c1899362a5dc9e9d26ea16df19081733be37e1d8a1b0eb23f5e143fdb5f2454842c8973ca0c99d8f445a110d9b941a0b9766d0016ee79d8e487d
TLSH
T16511C084DB64B5F3CD68D24F869537438BE4B32384CA54143DB159280D7EA1EA7A670B
MD5 SHA1 SHA512 TLSH

Submit Download

337c0306-b33e-44d2-af74-b125a88a5234

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\337c0306-b33e-44d2-af74-b125a88a5234
Size 886B
SHA256 9d5e780de7bb39d928f91af9efff5e4ba5246821598b94980161de185dd9bcb6
MD5 f17f95ddf1a2ce76d4aa6f2eb8df853d
SHA1 f014972d5f0357af2dd94723b4f1364cbf699bc3
SHA512 98677bcd5af570be875e7a560a80b5f479c061f617567939352b06ffffed9f8a67912faabef0155a6ecc5e9837bc7ba90608f0c35ad38ee94850c0a56914c75e
TLSH
T11C11E35086B4B8B3CC28D28F95D577428BE4732384C658587E615A380DBA61FA7A270B
MD5 SHA1 SHA512 TLSH

Submit Download

4effc3c9-454f-4078-86fe-110525d88b1b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\4effc3c9-454f-4078-86fe-110525d88b1b
Size 15KB
SHA256 19a463cfe49d0027180b94fae73ba4e86b20d9a19eec2e7cb430e6fed28a7ebe
MD5 51135b80124a231e24270b860db2ab55
SHA1 0a31fc2468262891fef757fb98ce3490b51dd5c4
SHA512 3106a3426fe909cc14c12794446e9b76cc876c02acd394c61666c014efc40bb95887a57766557946bac86c4442eb9a8b09e9b8320288a33ce328057a0a0e5d29
SSDEEP 192:0OMj8sihArRzx7Kyh7NDrjRFLLAzY2R0UXwYBOv17ktk3D5UxUMblw9C9p5sjiAq:0qsiarRl7KyHDrlac2R0O4klAq
TLSH
T18772D956683045BA8251E3A8D4ECBFC3E5F528CB4C415FCADBE4BD086DEE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62ed36f4-efff-4063-8c80-9fc00ffacd2b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\62ed36f4-efff-4063-8c80-9fc00ffacd2b
Size 235B
SHA256 037a82abc68cb838205c23c94b422e1e70322f283712e9df9e9636584e1e1f51
MD5 a0a5a243ead5bffe2f25785ef7ff5696
SHA1 37fd0a8862077a955b47376b4fc245049b8f64da
SHA512 fb8b4e3c29e2dc9492174e7844745ec093e820eb77fb63be972d3dab869c57639edd23aa2faaa0c53dbb033fdbb0164a50fe4f7b0d4a6756b3eab55d54acd194
TLSH
T185D097865498BB6D0A140F03B0A4A8C630558C332478A85095F212B88DFEFE8429184E
MD5 SHA1 SHA512 TLSH

Submit Download

95a60841-feb9-45b3-afc2-1c3bacb4849b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\95a60841-feb9-45b3-afc2-1c3bacb4849b
Size 2KB
SHA256 df193089d03746b3fcf995b4d563814f0864c4091d1958c86aba8651949898b6
MD5 d381e4753f3657efa9dcae5760106fe8
SHA1 0fd7162cefee2da715ebd0d7aac1fb4813787d4e
SHA512 e2ee11b3181fd89d8f8afa6485f6f0004f04d55cdca9ca404a9b59cacaa788733470a03b6d579e1ac0eed9edfe63dbddff2bd6b371a57354f245aa3be6a87d4f
TLSH
T12641235C35B89CB78DAAE59DD482278E9365870310C61C433E62EF0C8C96A5D336B53A
MD5 SHA1 SHA512 TLSH

Submit Download

d3bf4a0c-bbed-4421-a6fc-b873268bc095

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\d3bf4a0c-bbed-4421-a6fc-b873268bc095
Size 235B
SHA256 90e677248a104db244debf6057adb8de1e6642d0198cc26d2f3889e6882b7360
MD5 4974fa1515d962f3d263cb9b506e0772
SHA1 1fea53b88621947d83de41fa6083d2a8b2a968ae
SHA512 be4742a3d5fb09c96090e132576bcba65b04c272a8867129972f7011173e268511d159f8822ad3d2ade2fd2ecd617e80631488d1a3f2a0c175ed6839fe19d4b2
TLSH
T193D09780248867AD0D080F07F0A039C6319C8C3728A8A830869140F889FD9C901A298B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\extensions.json
Size 16KB
SHA256 f52cc6f5448e785f19006cf6a69279ae86416348eab0f68da64fd51319a1ca85
MD5 bac360023ff4483d95c91981d66cf20c
SHA1 0059344485e92ec7f675af0c1c8df3070c7d602b
SHA512 1ed081c48f28e7d34162f77567f9944c1608d300ee7d8375881eba3ff9d85fd154c2183a2c26c6ddfad8c5662cfb9df58f7587c07ab39733fa3c742ddb67f2d8
SSDEEP 384:HkI4vYUmldvL8dhW894z/96ozL4HHL4P/L4HdL4HsL4H9iwX4hW:EI4gRfoXV4J684L474d4G4v4o
TLSH
T1D172431545048EB8294FA79AAA36BE01C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 7.9MB
SHA256 b9e8644462dfabe1551cf28d7d5cffe21a3a2be5272bb8ddc7b9abdb8bcc4e43
MD5 996896e0eb6463e687998bc9d25d80c3
SHA1 8203916cc60bdbb561b587615403357f5d603cdc
SHA512 cce2cc713704f653189794e34dd4847639b5b85871e252652e5b9e28fafad9971fc0e4a798ff0a9dc6de2e5b2b1e77d324b711878b1f6861bb1747e8af812473
SSDEEP 98304:jXYpvNa5R+WAjfAm11aGMFRGg9LEGLYmghF5Q/i4Wvq/i2tR:bYpvNaejfHuGMFIg9L4mghF5QD/9X
TLSH
T122867D89E36350E8D85ECDF0466EAA72D438384E0335AAEF17D48B315A727C42679F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 8KB
SHA256 f952ae232fc0680ecef985e77044ed3c3d5e0c3bb1ef0241f69e887fff2e1626
MD5 f7a0ddf193104a4795509a39d16bbb84
SHA1 5efeec824feb952e02b2ca1e1e60f1918364dfec
SHA512 35fb16476c5cf628d1b508dd34367175ee9c9abaa3700b2ee9ca0e013544e33a43f174f0e2044a9b532685806c9f8089e9bf655ca6e5c82109661b5c1ce93b1c
SSDEEP 192:1pNyNxNONyNqNyR6f88FprDKdSSOh8RKWBrOn6jBw888ZQeZGjr:XoXoMcFU2dKieRKWAn69wMZQeUjr
TLSH
T1A702ED789104CB7F64F276ACAC6448715AB2023BB7BF6CD750B99485050CF3446FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 6KB
SHA256 2b652b1cb18d2a4a54e507ad6137c0ef494887dceb3b4a19a0f40979915a4464
MD5 32fc57a3dc4b79bc798a918f8e2f537c
SHA1 a85b71aea65701307a363aaa826cef202ba5f748
SHA512 eb0b6793424cc64ac5147417a989dcf5fad3946bc4880a6b163974ed0e61326f60282bba16fe987a423aba6abe843c48ced5945fc477d8a6e4e060df79bf9603
SSDEEP 96:xHrUTUmqGq6fzFpr1zSpKdSSlfdv9jYnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzFpruKdSSO9NWBrODBw88Jr
TLSH
T15BE12F789508CB6F74B677ACAC6888716AB2013BB7BF28C350B554C4050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 3d73cff5db9b941fbd155747b9313cdafaf744d379e586e8ce831566677d6990
MD5 9a19edccde632354ec159f994c9bb233
SHA1 a4892f3d626e1768f571a5be1f13146922c519df
SHA512 0ccdbc614d3a9aa29eecd26b63114127eab1433ba129a4687d116205b8398f5bd6f2b9e954738f38b8e530733ac513ad69a65a87f64d8fce345ffe505deaf34c
SSDEEP 96:xHrUTUmqGq6fzUL1zS5SSlfdv9jYnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzULsSSO9NWBrODBw88Jr
TLSH
T1B7E130789508CB6F74B677ACAC6888716AB2013BB7BF68D710B594C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 8e544c31b93ac7564110407bd34650c1d8decc5c98e2d48f121fa34bdb8533d5
MD5 1d47d81c1aeec2d539be44d5309d435d
SHA1 8e53f39ffaf220cafabc6ff5c8d0718111d90df8
SHA512 92719059fc3ca964c673fe688125e219a7cf834e6da8c3f452d75f2e3f034960dced62e8515fb504910bdbf6d503c4c78126dbef48c2a205583c535c0f3c9bee
TLSH
T15331289745450DF62AD25545C9415FF383E1382708AE9CE0DA0ECA839AED68F72CA12A
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 08d63485f3a4d5f387a8edf18019af453ed9a4e6a9b7b79d90d62f040b2f7116
MD5 77fdf0ad6ac2551980ec90666501787b
SHA1 3ce7f0b608e8321ed4a76d1287c0451bd11f4b76
SHA512 0f2040b0dc8592f66a7566cd3d29d9375346348607d53863913485561dfeed4baae152dc79fa1d7fb5acd65785013e217d9a2b328e2123225a354a3c1c310ed4
SSDEEP 49152:X7j3QLjgCSizDGYwul+gXZaW3sLx0RUuEwiG:Lj3QLjgCv+gXYW3IxiUciG
TLSH
T1931639F824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CDFAE05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads