73a39b0461bf4a41d2815868dc559848205373f2fcd68628140a451fb24883da

Analysis

max time kernel
900s
max time network
834s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 37KB
Sample260827-lqa3asha65
SHA256 73a39b0461bf4a41d2815868dc559848205373f2fcd68628140a451fb24883da
MD5 0062f68e0935702ec18394464b20146f
SHA1 6b14ba375cc467bbf12574872584bc27db589ef9
SHA512 ba3ea097774107e4bf66b1d10487e291e69c27ce8113308150bcd89408b26c28b3da26b5d4209f031c748d6b0fee9377986fe5286dfb9e126f452f83cf046f36
SSDEEP 384:WGKjROF1atLsh4hk9aixP77XrDhmokNcx8jIpzxtsw8hlotCLRHDqpBO6rDYDgh5:qO1a5mbP77XrDhFkNlooHMrDFhpkty
TLSH
T1FB038333E1C1593A003341C6DB6553A9FB6B5207EA094018FABD136B2FB6F65FC23999
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	firefox.exe
Token: SeDebugPrivilege	4564	firefox.exe
Token: SeDebugPrivilege	4564	firefox.exe
Token: SeDebugPrivilege	4564	firefox.exe
Token: SeDebugPrivilege	4564	firefox.exe
Token: SeDebugPrivilege	4564	firefox.exe
Token: SeDebugPrivilege	4564	firefox.exe
Token: SeDebugPrivilege	4564	firefox.exe
Token: SeDebugPrivilege	4564	firefox.exe
Token: SeDebugPrivilege	4564	firefox.exe
Token: SeDebugPrivilege	4564	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4564	firefox.exe
4564	firefox.exe
4564	firefox.exe
4564	firefox.exe
4564	firefox.exe
4564	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4564	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4564	4772	firefox.exe	88
PID 4772 wrote to memory of 4564	4772	firefox.exe	88
PID 4564 wrote to memory of 4580	4564	firefox.exe	90
PID 4564 wrote to memory of 4580	4564	firefox.exe	90
PID 4564 wrote to memory of 4580	4564	firefox.exe	90
PID 4564 wrote to memory of 6040	4564	firefox.exe	91
PID 4564 wrote to memory of 6040	4564	firefox.exe	91
PID 4564 wrote to memory of 6040	4564	firefox.exe	91
PID 4564 wrote to memory of 6040	4564	firefox.exe	91
PID 4564 wrote to memory of 1280	4564	firefox.exe	92
PID 4564 wrote to memory of 1280	4564	firefox.exe	92
PID 4564 wrote to memory of 1280	4564	firefox.exe	92
PID 4564 wrote to memory of 1280	4564	firefox.exe	92
PID 4564 wrote to memory of 1656	4564	firefox.exe	93
PID 4564 wrote to memory of 1656	4564	firefox.exe	93
PID 4564 wrote to memory of 1656	4564	firefox.exe	93
PID 4564 wrote to memory of 3724	4564	firefox.exe	94
PID 4564 wrote to memory of 3724	4564	firefox.exe	94
PID 4564 wrote to memory of 3724	4564	firefox.exe	94
PID 4564 wrote to memory of 3724	4564	firefox.exe	94
PID 4564 wrote to memory of 5756	4564	firefox.exe	95
PID 4564 wrote to memory of 5756	4564	firefox.exe	95
PID 4564 wrote to memory of 5756	4564	firefox.exe	95
PID 4564 wrote to memory of 5756	4564	firefox.exe	95
PID 4564 wrote to memory of 5432	4564	firefox.exe	96
PID 4564 wrote to memory of 5432	4564	firefox.exe	96
PID 4564 wrote to memory of 5432	4564	firefox.exe	96
PID 4564 wrote to memory of 5432	4564	firefox.exe	96
PID 4564 wrote to memory of 4920	4564	firefox.exe	97
PID 4564 wrote to memory of 4920	4564	firefox.exe	97
PID 4564 wrote to memory of 4920	4564	firefox.exe	97
PID 4564 wrote to memory of 4920	4564	firefox.exe	97
PID 4564 wrote to memory of 2928	4564	firefox.exe	98
PID 4564 wrote to memory of 2928	4564	firefox.exe	98
PID 4564 wrote to memory of 2928	4564	firefox.exe	98
PID 4564 wrote to memory of 2928	4564	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\sample.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\sample.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {e38281b8-efd4-4930-b440-3a8e742660ff} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {20b8cdfa-0f11-4945-b904-7a7c9d74824e} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:6040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27323 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {d3fef1c4-12e4-4611-83c7-14a41d538234} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3988 -prefsLen 27323 -prefMapHandle 3992 -prefMapSize 270279 -ipcHandle 4060 -initialChannelId {419a8154-b5fa-4a94-be62-e86cb9613e24} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2784 -prefsLen 34822 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3028 -initialChannelId {92f4f77d-b5c2-4ea1-9a8b-6765c16c371a} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4988 -prefsLen 35010 -prefMapHandle 4992 -prefMapSize 270279 -ipcHandle 3084 -initialChannelId {45dbeb81-0e85-4db3-9b61-4fa0e4fe659d} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5744 -prefsLen 32952 -prefMapHandle 5748 -prefMapSize 270279 -jsInitHandle 5752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4500 -initialChannelId {bc565b51-beda-4d47-a8b4-4bc127db9ba7} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5892 -prefsLen 32952 -prefMapHandle 5896 -prefMapSize 270279 -jsInitHandle 5900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5908 -initialChannelId {f8bee2e9-f7cd-482f-92ed-412167840382} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6080 -prefsLen 32952 -prefMapHandle 6084 -prefMapSize 270279 -jsInitHandle 6088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6096 -initialChannelId {2a9a78ec-4f22-431e-9862-1ef3cc1c8629} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2772

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\activity-stream.contile.json
Size 5KB
SHA256 6e33c50fc98f066f5fb63b5029390a6d784e12ee4e6797e00787d024cc1d13ae
MD5 2c06a03d7ff28184153c8b6635581b27
SHA1 09d1f885e4b0c2da0cde8e22bff0d01a09c2c5f1
SHA512 0b7c1303c4a9494fe542c4691dd5709ea12275201d0984fd951ae733e35972ddef1506a8a82af9bd8d2ea7fbc41cdd94311f07f66bece8064661273c8cf75011
SSDEEP 96:TBOp7uEvlb68top1pPtKfApQ9lYzmT+mRHAob:o7lvlb68OfKMQ9lkmRHAob
TLSH
T162B10CAF95A449132733A7F46C0F2B69E243B08795E5CA9C73764C21618C35E81BD9C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 80064f338b72ce2a7144c5f680b755e399d3e076855935e5935ec4a28a91c88d
MD5 8093da377252d3a392792f5fef276204
SHA1 4cc75a9c07ee40ee5ef95c360519f8efeac488eb
SHA512 4e195a2869ae13b07fae915319707d2a845473ccb7b235df749ad9e121cdb20fc8dbec95ca4ddd881789a4f29a47ab241a1e6e36427ebd7c27c515d8cc3b4d0c
SSDEEP 384:HkCjiO024YqaXDL84KKDL849B7SOEAd9KVRaAcP+AWRMA5lI:EzZYqWDL8lKDL8CB7S/AmVAf+hRMt
TLSH
T1A0729E7A5F003CBC1597C1E8C5F492998D18B7A7DFE6806D21583D0DCA98A69B0F648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 4d058aac2830144a5accf1fed88d82db87bec45a40cda52b3d61edc471b2f9b6
MD5 dd3374d18eb358e1f337dab6b830e5ca
SHA1 44aeb24748d06c901c93b5f6fd078495936f82b8
SHA512 177c6649630fe7872d8ba01c3e63620fbd4a11f933387a5f57dcbee40865c95a1b4b633f4bcc977d8604575118ad29172c8a4604582b4d2aceefd3f1f99da2bf
SSDEEP 384:HXkRyiO024YVDL84KKDL849B7SOEAd9KVRaAcP+AWRMAB:3mZYVDL8lKDL8CB7S/AmVAf+hRMw
TLSH
T1BF727D3D4F403CAC25A780E8C5F992A98D18BBA7CFE6C06D21583D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38Q0NK3TSH2L13B41RD1.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\38Q0NK3TSH2L13B41RD1.temp
Size 7KB
SHA256 55dd82f5eef7739d0690e71bb7a7f5a07aaf486a860f66124cb76face1639b2b
MD5 db09da51a2cba3dff92d22bf6d15b416
SHA1 e65d479bc30616043ca253742897c889475c1f82
SHA512 8f4483fd4bdf2973ff92f4446140b340f4d1dbe48ab33dcde5d8da5dc834f825ef467020f9372a4e4f05b36a641915d12dc542cba50ac86188936a88638a8ff6
SSDEEP 48:aX/doSJ5Ugdwu7dlpzYa/doSJ/6Bdwu7dlv3Yw/doSJ/adwu7dldQxh/doSJd1E4:XMJSM/iqM/y9MxSM5
TLSH
T151F1CD010BFB0D69F4F396733A31B747ABB3FD01160A279DC18BA2454A327505A6DBA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 007eb42e492053e83d163a6e631106253c7b7c48a55aece1b20bee96cd7cf065
MD5 a7baa2843d5d054e4a871275375bf43f
SHA1 021de35bad1fdd83c7cc8c89f06eb65e8a7674b7
SHA512 666891a0d298e5cef93b99684019ee41c328d1b8731e289bb518287b2cf1715383ff1183cb80631612e9e73586df55eadb6232b4520ca9e59c64b3c1b2ebd637
SSDEEP 192:ebY1d66JoztdzgCl6mc0dROv5zbo7M5myjsy:xd66Joz/zgC1jcbog5myj
TLSH
T1AEE11068E628863BC405137BCCA52F400F39389A9C4E3F2975DC651C2D5B2DE369E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 67d60bcbdd1a1187f494b3f0843bc3d0f13590a4e1b2cf1b0b5ef3a3b728f79c
MD5 3cf24803900e4040ac880f2b8e51671c
SHA1 9913d822777c9ae5dc1984cb8acc88b292bd5a40
SHA512 d9e678ffdf419d073b287d6f7ee5bb920d4152093fd72a51b4cc80f63967d5bcb9499ccf5af03508b4fed32f2cf499ff94e44947aa9cab267ed594a349376bb1
SSDEEP 192:rOv5zboXZ5myjsy9bY1d66JoztdzgCl6mc0dz:0boXZ5myjId66Joz/zgC1jd
TLSH
T145E11068E628863BC405137BCCA52F400F35389A9C4E7F2975DD651C2D5B2DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c20f2f0218c94c6cbd41e4199e36f57671242beb88bf31d13795cfc7d221ad23
MD5 2298aaa188c8ec75a30d73104051c303
SHA1 55f6e6305a6b0ac0cd476043d0c1fe69c7bb91ec
SHA512 a7346ec0f7d0999c00cec49ac6e1d1a0dc86b1e1c1117e0b6381e1dd2dde04303bc453711919b5408aea059548443b638909e776d182af30a43ae7eef3da7844
TLSH
T1FF213A9C3FB84D2B9C86E29C74A0128E53554E0706C72C434D12FFCDCE996D9326A439
MD5 SHA1 SHA512 TLSH

Submit Download

02b2d881-41e6-42c0-baad-f4f764fcc2a8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\02b2d881-41e6-42c0-baad-f4f764fcc2a8
Size 235B
SHA256 3486bdc711fbb115bbe4626498fe2c1237097bc8234c780a8cce4f41d49e87e1
MD5 626dee5501a8fd5a54f3d2badd5f68d1
SHA1 86a9d1ea6a7ee915ea738defe9e477c7c18c24f3
SHA512 700e4456c5e5ccf8deb9dc6d52e3539b2dd9ca8ee0410d08a2f50c756bf27e8702a7114a92cc10a322fb75997718d4fcbb6213fedbcd0c0d73e4824f77b13e91
TLSH
T1D5D0978028C86B2C0C200F0BF0E16DC238884C3321745810E6A20938CAFDBCA8152C27
MD5 SHA1 SHA512 TLSH

Submit Download

0aeea871-b8a1-4500-8b59-41cdbfd8e636

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\0aeea871-b8a1-4500-8b59-41cdbfd8e636
Size 883B
SHA256 04219a121fbdf5e3171777ad0719ba02796414d474b3d24ae6e3de7c14b9fc6c
MD5 835270e322549e817b0a0a0efc84d303
SHA1 b17871206c588d67545482088899c59f74f86a16
SHA512 7b4417191b80d1b79d50856d4ac42aaf664377c1c96b5c9506499aa4a2724b23ffaf13d0db1e6c601757451ba0be45b7b5f349a33f3c737f2847f9e958932221
TLSH
T11C1100859530BA72CD78E28FC9A637014BE8A93384CA94103DA15E184D7E60FE7AA607
MD5 SHA1 SHA512 TLSH

Submit Download

6cbf9842-ed8d-4fa5-8e49-583998bb299a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\6cbf9842-ed8d-4fa5-8e49-583998bb299a
Size 886B
SHA256 8429d5f5a1a31f6c0958d232c40d1e4e85cde90531110e975388aa16d4dcef0f
MD5 e072db24612e02cf226e41fa079ec12b
SHA1 f223d2d6e21b6c021f18b24c0d6d021b7af33df1
SHA512 e5932710bd245900488cc8abc74826bccbaa5e0ae9fd98542d2b70ef8a6bd1a9d735a9a4c8e09e54872565e58d4b9271957be692d1851779832d30952d3090f9
TLSH
T17911004586747571CC68A28BD4A176824BE4B46380CA69207D905F284DAB50E976730B
MD5 SHA1 SHA512 TLSH

Submit Download

8798afba-441e-4c31-b8c3-38038f6a2cb0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\8798afba-441e-4c31-b8c3-38038f6a2cb0
Size 16KB
SHA256 e549c79d9746b5282b0c21a3ae4c096a9d655d7664f1366d8cb1a4f199a8d5a6
MD5 b3500cfc627fd8af4323fbf209ddd47f
SHA1 e424b529f5dc8af26dae0f38a603c5091951e9ad
SHA512 f4f3a2c7f5bdfcef53412cf1e41273fe63ad47bdd8369a1b5086b486fec527dc9aae6c03e2251751324ddbd5e76c7e97fd4a8d78b7e2d4da5e2a8ae4c9987a68
SSDEEP 192:ymLcJ9+3wBBFue1LRt40n6EpH3SzxRDRKDIQ7ZbBfUXikceQleYFwpvtenpf1Y15:/3woAzn6AH3SlRDRIIQtbW8+HxcDs
TLSH
T12A72B916586055BAC191E3A894F87FC3E6F528CF4C419FCE9BE4BE085DDE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92c5736f-03e5-4b40-92f0-025bdbafe592

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\92c5736f-03e5-4b40-92f0-025bdbafe592
Size 235B
SHA256 a3b8f128983af07b04d1e8a8661485e363e0b4008a4c578b16e8b16fa7205336
MD5 1a9821f4b18dadbc34a50ece1e90e8f2
SHA1 be799002a6a583975113af2b072cc4db986fda5a
SHA512 992472b3f228dc8d2d36806e02e769ed4baadc06c531174ea4de6585bcefe0d9e6974adbce811d75126ea66f44aaf7c3c2ad442d603744b79e99e28da7a1ebcc
TLSH
T1C8D097922CD8AB3C08044F03F4E0F9C330898C3330A4A810A691007889FAEC552A682A
MD5 SHA1 SHA512 TLSH

Submit Download

d49d5fe5-0697-4d92-b377-35a17b187677

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\d49d5fe5-0697-4d92-b377-35a17b187677
Size 2KB
SHA256 0b108a96edaaf63af8fd0a2e1b51f6b4f263757731ba4d2b0147f3e455fe50f6
MD5 18685cac9742e741c046f8ffeadb245e
SHA1 496ea9d717be429c5459d14f305e0d3340da5c3a
SHA512 5fb9785378bf963455f5c1e47d8742a7ff89296a9a0d8415371257ccdff54eb50238e996035bcd0e70acb6a2cbedb4bdbb665f311487df20cc28846836120991
TLSH
T17241666C36748C77DCCBF18CD452328D53609A5344C22C933E41EF4CCD9269E336A966
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\extensions.json
Size 16KB
SHA256 a9c8e3ef70edcab8cae68144dc3eed6e7ac67d002a57d8c14bf6d9146ed437ec
MD5 f086c75c40e2e88b452cb2070f5a27f6
SHA1 4aac57f4737d158cd2a18e99f5e845bbe29a276f
SHA512 44e492de15182f3ff4cb61b6e6ec615ff0578ccaca4d1878b67c15a06a6edab47d3e6b16db301631fda11362da9c49bbb0c66c93a6ce86c633a21e0576b3cb12
SSDEEP 384:XkI4vjUmldvi8dhW794z+96oCL4HN9WL4P36L4HLL4HoL4HtuGe4hF:0I4rRfHXS4u634jc4fI434K4NC4f
TLSH
T11D72541545448EB8298FA78BA636BE01C37D533B60845C78F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
Size 7KB
SHA256 5a3b2815f95cf922a13bb909cfd74b12fc2ea5436dd61091e7bca1648ff9514a
MD5 5a6e9d5fa6c26122087ddbe62d62b401
SHA1 6667cf23e2cc6fcb6efe1142fe62e1bff719dae4
SHA512 f20af3eebe3c274a1fd0a609921f9cd163041aad8726c33282d1813da90f7463bf9d602c65e0e99273297b7ee25650d8d8cce008d16945417aa759b0a6694561
SSDEEP 96:xHV9GlCG+vTUOvqGqZCfAVT+ObzS/SSlvdv9jvxnlFHvqv5uBw88Y78L4cnQVywS:D9GlCG+gRAfAVT+JSSLyv5uBw88Ce
TLSH
T1ADF1EC789604CB7F74B677BCAC2489715A62023BB7BF68D610B994C5050CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
Size 6KB
SHA256 f90e2617946f53d4aaee69daa37b4abb00b8b3d9ae5335c4373bc74b706ad281
MD5 32959b9b0d580ea231e32fdf00e1a6fa
SHA1 e59ae222af5e9e824fb2b48466f974661ab676f4
SHA512 1c72d85883953d9d69aaeefdaba71d15b14056ecf803f7b3345af8bb7128d241ff147aca0511bb16f425ec2bc9746f7da12bb421a4c8eed1f25d7ed33ba50e73
SSDEEP 96:xHVUTUOvqGqZCfST+1zS/SSlvdv9jvxnlFHvqRBw88u8L4cnQVywS:DPRAfST+eSSLyRBw88Ce
TLSH
T115E12F7894088B7F74B677BCAC6888716AB2013B7BBF68D610B594C4050CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs.js
Size 6KB
SHA256 14fb7b39db041f5f94cba965d4cf40caf1891065555c1b5f1a70dead74800f53
MD5 2018ceb841259f6d27f8b668004c2c51
SHA1 e780ab0081e0705957d269b1f416ff7aa0f86166
SHA512 c2c2e6e12fc7e9a5fba91dd0b0ab87da956dff2673928949e6d2c645d34f4b63618971e6f7aaa8a4ae67b5976e58bc3ebe90d809feab07b373850fe8be47c1c6
SSDEEP 96:xHVUTUOvqGqZCfSMn1zScSSlvdv9j8nlFHvqRBw88u8L4cnQVywS:DPRAfSMnxSS2yRBw88Ce
TLSH
T151E11F7894088B7F74B6776CAC6888716AB2013B7BBF68D650B554C4050CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 e95d7f83a8f7a6816009f93597c8f8703c7cf3447df203c1b253ff3a8717a1c0
MD5 add710b5d8f95ee94b7b633910bbcdba
SHA1 3246ee14c2ccd9bfa3523946a10f9c53721375b6
SHA512 5b2c9aa33bc791b8a670c54e4db4abbe15560dcfd0da3b65e3070765e1bdd04d4c88eaa585ebd7530992e1b25b73310d5b73c19986a6952ea77cac2848b667c3
TLSH
T10B210B12DC663FF07A11455FD8C6CEFACAAF3431443108A0409CAB42745D15CF746604
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 4ba76cabdde487dcaa654baa1db794011a05ee13b6e7ed721fbc20ffb598dfff
MD5 38ad691b974f9709938f80bb7796f02d
SHA1 feb17603255ab7f52cc6ba93fdd02a862f5fc47d
SHA512 0de25c552195a6a4111f89fee2a78f4304336ee5490e7ec7ac057bd151035b8541addf02cfd902ac82bd4cecc875ef6c9d85fde323aae8438f77292f895dd2c1
SSDEEP 49152:MgaHfgdhf1WjYWwQOAAvHTh7SDJWSnlYF:dzzJJvHt7SlWSnm
TLSH
T1C14629E860D1A257F3814073724993EB21EFD00D5037DE085BA95AE9A474CEF8E17B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads