f0d91729a24dba84020badaaf7bb6f429b8283840e8f9239d0c8bb69fdc183a4

Analysis

user interaction
yes
max time kernel
898s
max time network
893s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/08/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
avcodec-62.dll
Size 1.6MB
Sample260828-xmkccasdnc
SHA256 f0d91729a24dba84020badaaf7bb6f429b8283840e8f9239d0c8bb69fdc183a4
MD5 c3296cd76144c7c69d7633e04b6122a0
SHA1 9e8cedb2520dd9b84528c56811f262464b4f9873
SHA512 0c757fd9354ffc512478f4d1e29d42027ecaf9d1d3267c92007e9e655da66789f44dc7d41e98b48436b466274d1d7838a65fca2b3116cb96214cb8422e5ba4c0
SSDEEP 24576:Jt4HOgRuXRuqO6yonXQpr+neDGbzK3cu9c16XmVkml3cRRQR6XmH+MKuuJKC55v9:qOgRuXRuId5TcgRYTCsVh79rAbwz
TLSH
T1A3759E81E69713D2E94A14B4426B773FA63C2E2D0310DAF7DB846F61F872BC0953B649
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	980	firefox.exe
Token: SeDebugPrivilege	980	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe
980	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
980	firefox.exe
2692	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1760	2140	rundll32.exe	81
PID 1076 wrote to memory of 980	1076	firefox.exe	83
PID 1076 wrote to memory of 980	1076	firefox.exe	83
PID 980 wrote to memory of 4156	980	firefox.exe	84
PID 980 wrote to memory of 4156	980	firefox.exe	84
PID 980 wrote to memory of 4156	980	firefox.exe	84
PID 980 wrote to memory of 1052	980	firefox.exe	85
PID 980 wrote to memory of 1052	980	firefox.exe	85
PID 980 wrote to memory of 1052	980	firefox.exe	85
PID 980 wrote to memory of 1052	980	firefox.exe	85
PID 980 wrote to memory of 2636	980	firefox.exe	86
PID 980 wrote to memory of 2636	980	firefox.exe	86
PID 980 wrote to memory of 2636	980	firefox.exe	86
PID 980 wrote to memory of 2636	980	firefox.exe	86
PID 980 wrote to memory of 4252	980	firefox.exe	87
PID 980 wrote to memory of 4252	980	firefox.exe	87
PID 980 wrote to memory of 4252	980	firefox.exe	87
PID 980 wrote to memory of 1340	980	firefox.exe	88
PID 980 wrote to memory of 1340	980	firefox.exe	88
PID 980 wrote to memory of 1340	980	firefox.exe	88
PID 980 wrote to memory of 1340	980	firefox.exe	88
PID 980 wrote to memory of 4048	980	firefox.exe	89
PID 980 wrote to memory of 4048	980	firefox.exe	89
PID 980 wrote to memory of 4048	980	firefox.exe	89
PID 980 wrote to memory of 4048	980	firefox.exe	89
PID 980 wrote to memory of 2388	980	firefox.exe	90
PID 980 wrote to memory of 2388	980	firefox.exe	90
PID 980 wrote to memory of 2388	980	firefox.exe	90
PID 980 wrote to memory of 2388	980	firefox.exe	90
PID 980 wrote to memory of 1436	980	firefox.exe	91
PID 980 wrote to memory of 1436	980	firefox.exe	91
PID 980 wrote to memory of 1436	980	firefox.exe	91
PID 980 wrote to memory of 1436	980	firefox.exe	91
PID 980 wrote to memory of 4616	980	firefox.exe	92
PID 980 wrote to memory of 4616	980	firefox.exe	92
PID 980 wrote to memory of 4616	980	firefox.exe	92
PID 980 wrote to memory of 4616	980	firefox.exe	92
PID 980 wrote to memory of 4296	980	firefox.exe	95
PID 980 wrote to memory of 4296	980	firefox.exe	95
PID 980 wrote to memory of 4296	980	firefox.exe	95
PID 980 wrote to memory of 4296	980	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-62.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-62.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {686a7b97-daff-41a4-af20-0f746c221772} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {3948e641-7c7d-43f3-a2f9-bbfe28a15550} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3652 -prefsLen 27274 -prefMapHandle 3656 -prefMapSize 270279 -jsInitHandle 3660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3668 -initialChannelId {cdb13df9-f3df-4a10-86e4-d87d38854991} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3844 -prefsLen 27274 -prefMapHandle 3848 -prefMapSize 270279 -ipcHandle 3796 -initialChannelId {334aaee5-876d-488d-8028-db54b164277e} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3184 -prefsLen 34773 -prefMapHandle 1416 -prefMapSize 270279 -jsInitHandle 2728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2656 -initialChannelId {c319c251-1090-4288-b2a2-8443645fbeb5} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4832 -prefsLen 35010 -prefMapHandle 4704 -prefMapSize 270279 -ipcHandle 4632 -initialChannelId {6578ff45-abad-444a-9c26-044ea3c3bf41} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5032 -prefsLen 32900 -prefMapHandle 5036 -prefMapSize 270279 -jsInitHandle 5040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5048 -initialChannelId {94b1a392-1d79-4247-80d7-af0153493f12} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5288 -prefsLen 32952 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {1e62b31f-51de-46bc-aaf6-4fb3dc2f747d} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 32952 -prefMapHandle 5444 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {615b4d9f-5bba-4135-8975-d2c209a57d63} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6324 -prefsLen 37270 -prefMapHandle 6548 -prefMapSize 270279 -jsInitHandle 6576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6648 -initialChannelId {86e1c9e0-31b2-44f3-aed5-dc6f372543a4} -parentPid 980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4296

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 ab175349676889eb18d0906888f8e4a3fbe03ac3c170e13052e9bb0987d33f08
MD5 0f4645a941fcb45847011370520649be
SHA1 2b0aa141be98af88dbf880b5f770a9a1710e0e6c
SHA512 1eec4bc3d97b4128f2f0b833da69fe44d7ff1c1d94d757236f3a8ba863c0a0f9db1a8aaae9bd2e60443cd0de94ad5481221fe3bd0ac9d50e027fec483d4e3129
SSDEEP 384:HkCjiO024YVDL84KKDL849B7SOEAd9KVRaAcP+AWRMAX:EzZYVDL8lKDL8CB7S/AmVAf+hRMC
TLSH
T1E6729E794F003CBC1597C1E8C4F592A98D18B7A7CFE6806D21583D0DCB98AA9A4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6DED9FE7A50E8290358DC1D8C755B05692CB9E36

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\6DED9FE7A50E8290358DC1D8C755B05692CB9E36
Size 512KB
SHA256 e592c4e2dfffd295f57a4a27bb2d4f5cf5c37459f296c2b06f40139d01350a23
MD5 fca58a73dff0d4c8fa190b8d4b2ab94a
SHA1 8cac388e70138a9c33216bdbdbe17a3ab02f037a
SHA512 6b377edf0b26b4585b65d6e41761247fe0a6bd7e493f3904994d1d123de341b567071e44419af5465be4e6620293177d4dbc2fff22116bc06f9c796e048df1ce
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErhR3:OltBL+PLQFZBgBo2xAzpsrr
TLSH
T16AB423A8B73B766CD37A5C76C297D4F857E8DA2B56422CE80C4E018E6140BB132D63D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 4ab594dd0bb13d462e8fd298f9983210ba30ceda9cbc832228774eae34322243
MD5 67b622cc870c99b31dde4f9b3b07e265
SHA1 268d2bebeea5f96ae92fa0789c56aa742bb890af
SHA512 d22fdd79712820829af2ec68b71bf2a4f0b1d2713d19bb9b065fd47842c75f6eea12d26787f9d45a2b64bd33816e770a21e4d547075e2c741ad12f3c8792f648
SSDEEP 384:HXkRyiO024Y3DL84KKDL849B7SOEAd9KVRaAcP+AWRMAK:3mZY3DL8lKDL8CB7S/AmVAf+hRMn
TLSH
T1F7728E7D5F003CBC25A780F8C5E592AA4D18B7A7CEE6C06D21183D0DC698969B5F948F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 21KB
SHA256 af324cd946cec1bf4fffd89728db43f4409393fbb466a3beb7c6b357e1a7c032
MD5 25fa3e4e3547ed300cd4a6306114b86d
SHA1 b13a10d4150879459a3f139ceb898e1b70802fc6
SHA512 0818065fc345a1bad2f39b4b9ed98be1c6c4db6c0570532e7eb5b5695bae60fdb87a2796a2b9fb7496fd3e0e9f939ae3116016e41e1ad32d5958ab78c95da6fd
SSDEEP 384:FJWJGVca12krtuVm+gglBOVjeQ8RJol5ghvjUkBWa5PGm5x+GDa50XYScm3iYXEr:T+GVcWrpl8RJG5gZjUkBvPx+GDa50XYL
TLSH
T1F7A24C743AF51315F3F29F759AF1A95A643AB866AC00DB4D0162028D0977D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 21KB
SHA256 8aa20b4b85352dac91eb6e840dca70a9e1f4032967da8cbde10a37442e3253a4
MD5 e4e2d7538ac9818b02eea34b7c4e9a87
SHA1 a9916aaea7022b92dff77b95e9d119a310895248
SHA512 c80a870dc864b0bc40ab17a3f5cda576b96fa77c8ead4b9c2a228a85d09a4bde5fc5c9d377825aeeff942f82013d6719a7c39b57640b7e4ea7e300ee7d2f5b32
SSDEEP 384:oJWJGVca12krtuVm+gglBOVjeQ8RJoP5ghvjUkBWa5PGm5x+GDa50XYScm3iYXEr:k+GVcWrpl8RJI5gZjUkBvPx+GDa50XYL
TLSH
T19AA23B743AF51315F3F29F759AF1A95A643AB866AC00DB4D0162028D0977D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 494090b1b1975dea1d0e78edd0b9cdbdbc536475179982bb4bfd07894d1f3cf1
MD5 8f34d1c6ff2a3b08140d61d11105abda
SHA1 1de33650e32804ef63483b8075b0ed30bde496e7
SHA512 b72c29aa544c639f9cc620b7882fc80eec3656b48ea432750e08b01d96525ab4d7df42d7e474bca5dd229c41098dfaf56b82723f02682e2b260c0e939dc6d795
SSDEEP 192:hOv5zboabY4yjbY1d66Joz0dzgCl6mc0dz:+boabY4yj2d66JozQzgC1jd
TLSH
T118D1CB28E628863BC455023BCCA61B500F31399BD85E7F2A32DC645D2C5B69E7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d353fe5c84952de11ab63bbd34d56070471ab9aef1298ec674e35780cb204145
MD5 23bd3f5cb494b7fc4cc4b406f1cf5cf6
SHA1 9b964bc564483bbf4b378c2812fa3943a0dce48c
SHA512 4bffd54c34a648139a8b8707f05eb3dfee21348ea9aeef95291622383947d6eb467db45daad18999c337871b0b6a82bdc5cc6bc6c0f031d6216e28752d7adf00
SSDEEP 192:JOv5zboHrZY4yjlOe1d66Joz0dzgCl6mc0dz:GboLZY4yjVd66JozQzgC1jd
TLSH
T108E10E68E628867FC454027BCCA61B450F35388BD84E3F2A359C605C2C5B6DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1a270ca737ec0067ec0057a0e6f788758976bfb06685172df82fd8c6b869146c
MD5 9a0cb90e1ab2a07cf8a889747495ad44
SHA1 d57b0bab599c56e5264750e9d1256032a3a291f6
SHA512 09e6430ebcd1b5f52a6b47536f29bd2d82a11298a1f3ed891702c9c40727b2f22e2f14e07b1cac3aed870dbdbf91a582c33b42571c90e3edcc11c1579dab6cbd
TLSH
T17E219E6C39B84D6A9C87F65C744101CE93968E07049B1C435D92FE8CCD81AD932AE83D
MD5 SHA1 SHA512 TLSH

Submit Download

1a1c46ef-3f5e-44aa-8081-bfe43dfbb44c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\1a1c46ef-3f5e-44aa-8081-bfe43dfbb44c
Size 235B
SHA256 dce533835ecbc89b8e9ec6defa1f61e7f3627831b4943ec32d02bf89cfb539dd
MD5 ea6689bedd6eac78aee8597d9cab8ab0
SHA1 b911b0a1719df4212ccbda5b1e77a1351022d8e9
SHA512 19f036e0e08dae914272a18f69fccb200395c29ad953e48824ef9e328c0815b86279e02ff5f3b21e3ffdc59810f2eb6a74e6ef0448badafc9faa6d5c9da7b214
TLSH
T16AD097822898272C08040F0AB0B06AC73084CC3B10B46810C97128788BF8DCA4321806
MD5 SHA1 SHA512 TLSH

Submit Download

2ae4e89a-5ca0-4e49-bd51-1a6560b56e53

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\2ae4e89a-5ca0-4e49-bd51-1a6560b56e53
Size 235B
SHA256 debebc4db25f904ef290ac14f0e89ede04f07ffef36c03e68e4929fe9425507d
MD5 28ec55a33bfde815874f2f8fc8de24b4
SHA1 ea17aab0b42a7c3cde4eb8de3f6ae228d5ae3e95
SHA512 5258a731e1c5993957ecb6a418203fa051f129dd6b376ad2c7fc46a20cdf6b7ac3021a9f319f3a06933c06c6469311bfed70676b971c5c1f823a893f6f801397
TLSH
T1F2D0979018886B1D08200F06F2E0A8C230484C339460A810DB6842B89DB8AC4826283B
MD5 SHA1 SHA512 TLSH

Submit Download

600f43a8-fe79-463d-bffa-7efda7f1d2ac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\600f43a8-fe79-463d-bffa-7efda7f1d2ac
Size 2KB
SHA256 f25f9be052b9d9f2cd8e8858a09843f376900160b06e0ee5f8997593e064a381
MD5 e349e35516803a9cc0c328754c0e51e3
SHA1 ae3fcb6e48d23be7c497c29789f516bc75124534
SHA512 da4491eece5cc4584254a0bf7c82de2981b1ec7327b44d25cf5487fe1316a71497adcc9e8b5610e65d22b3aaa83624cc28e15f3fa9a105851b7bbf5c0e1a39f0
TLSH
T14841315C79785CB74CAAE18DC591338E57708A1340CA2CC36D61DF0D8C8AB99237E53B
MD5 SHA1 SHA512 TLSH

Submit Download

77851419-b0b8-4cb8-ad4f-dfe34ce4f268

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\77851419-b0b8-4cb8-ad4f-dfe34ce4f268
Size 883B
SHA256 15feaf985dc7f5b3f567b38e41e247a62aaa07070756de664b9ef3357754df33
MD5 25cad2d08c5dc0da620eff5f084b22d1
SHA1 cd95788001097f0f9c663e47e78d64a592e2a5ce
SHA512 aa187a5bb87e31bb8b22de61e7ca3ba6fac075ea96b398b6f4082be696bb9c312d371a735d3eb83dbfb13e60bf68479a47391504172e642ba1e2a8f02a33c590
TLSH
T107110081A53076B3CC78C10F86A137425BB47523C0CA44643DA88A040C7EA1D636630B
MD5 SHA1 SHA512 TLSH

Submit Download

7cd68b01-a175-4922-99c0-20415faab17b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\7cd68b01-a175-4922-99c0-20415faab17b
Size 886B
SHA256 4c2972f2c8bbfd2b7af4efade176e3b00805f20c5bc4d7b3cf464cb87d5c1097
MD5 3853c2474a4ee3837ac3d7525dc30ece
SHA1 cec2b4653ae96a26d8e36de9248604b3f883d6d0
SHA512 7fb5409029d1f464f52ee7f5f979e413d577f286b9c0725b3b05a9950491ad7d12237ee82aad7947c44818cec33786bf63474530fbaafa7ecdd2d48f709a8577
TLSH
T10F11008196B0B6F3CC78A14F85D17B464BB0742380DA4C543EE48A180CAE61E67A630B
MD5 SHA1 SHA512 TLSH

Submit Download

db67562f-8025-4121-95dc-148577307018

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\db67562f-8025-4121-95dc-148577307018
Size 16KB
SHA256 3dd2dddf35a6c9f1f0b6f993e3650990825bebbe53831755e9f5fd3440c2533a
MD5 3855492e889987c14def8fb5e5f7ef7a
SHA1 7cfda783a5169dc1868b0e02974b43c069ee8f38
SHA512 1e5202b15025b5e457f3c9aae62535dcdd7cc3e06a481dc984c360f106a50d9ae7427a8ef63cce72769bdb94fb59ed065a3b16c07b3198a27fb8b0b181fd3e29
SSDEEP 192:C+DjvKFzxUvR7Gjl/qg1ULstZBtHGFMk1BiYxPKQpULeO9LH3yCe1SOkedkuBhA:bDLKFlUvR7G2LoZrHGFF1AIKJX
TLSH
T12D72CA56682045BA8251D36C95F8BFC3E6F538CF4C019FCADBE4BD0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\extensions.json
Size 16KB
SHA256 1466a6666464524beadd1f0739747afc48d8930cc9b59ece53a1f4bed292535a
MD5 d0deb598e0cdea283e520e676b72a738
SHA1 43b516a61f8c4d99498b84c4fe2fced47bdc2613
SHA512 302e0360fe77ccf7b98da64b01145d5c636fc836015e610cc650b796425f4fa8750a0708b8709b1b7fcd1fe3ecd95c20c2ef26ef97d3d73604a1820b958757db
SSDEEP 384:SkI4v4Umldvu8dhWZO94z396oPL4HFL4PIKAL4HCKAL4HgL4HeWu4hJ:lI4ARfDXd4h6s4F4wKi4iKi4i4+x4T
TLSH
T13272421545048EB8298E979BAA367E02C37D573B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs-1.js
Size 8KB
SHA256 407c51100a178ccc7bb3aa1b8b09280b0ce5a177d4e16b8980338aa8e7104d7d
MD5 8b49bbfa836cdf0f4036770fbc748918
SHA1 2d76f4fce9a1ed596a919ff6cb2fa8d55f7cceca
SHA512 a11a32852abb549f195edab2bc4862a63e21453dcfe6ab5c3d9480f387932ece9851e2a8daab884baddbbc2e8698b6a2c82caa59ca0be945006363e66fcdc415
SSDEEP 96:xHdJTUkqGqDfnKNObzSGSSl5dv9jCfn+WRLySI/Bw88Sp8L4cndeJGS:PqRDfnKNUSSWR2SKBw88m
TLSH
T1A20210785008CF7F64BA366CAC2589715A72023BB7BF68D710B954C5150CF3442FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 6KB
SHA256 4b8a934339cb4c970e10b1c998011d665e149cea1a587ba2502a3f329966fa8b
MD5 25246989c4c0ab66cc9e8940505d69ec
SHA1 ed80d955eb5ebbffb4c676ada9fe13446bc87643
SHA512 9fcd9209d0ac7c44c0b311cc3114b6a32eb2b75d9c86e5fb2c58adce2fe69567f2b14fc04766aa978fde7cb11729b8f5bb5cbafa5cd9a668293646c2e357d8cd
SSDEEP 96:xHPUTUkqGqDf2h81zSoSSl5dv9j7n+H+StBw88H8L4cndyc:FHRDf2h8xSSc+StBw88O
TLSH
T131E12F7890188F7F64B677ACAC6888716AB2013B77BF68D750B95489050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 7KB
SHA256 d68181b8f9e23a0b5638ee85dd30c230487e14860e5f2dd0288982d93debfef1
MD5 588ca72c2b9533981a849fff52a9d6a7
SHA1 2c96ed0c9c922118b237191f53ffc33bcf658867
SHA512 d07838da9c3ea4fab03015ae09257248338f15d6eef52eca19d9dafcf1d2210fd616a2b05d67adf7eaa76b9e221f7b3cc0c8b48663e251b7214844bd2d529711
SSDEEP 96:xHPUTUkqGqDf2KNObzSGSSl5dv9jCfn+H+StBw88H8L4cndyJGS:FHRDf2KNUSSH+StBw88N
TLSH
T171E1317894188F7F64B6776CAC6888716AB2013B77BF68D710B954C5011CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 6KB
SHA256 4f86771a0736b84a96dcc15cff7af56664879d9c00b07bc2dc4fc372f5c31765
MD5 f8cd9ddab3b04a0ee909a3cd3f076de3
SHA1 d6d314ae8eb65593b6a32e7fbb956c8eb8cf2a75
SHA512 7110c8904728af7df6d60ba8afc0800ef53e3dc76d1011f2b75cc7baa42e993052b870884bfb8de6e8837869ca732466dc7987b357f09981bad5344778cc16ee
SSDEEP 96:xHPUTUkqGqDf2KN1zSGSSl5dv9j7n+H+StBw88H8L4cndyc:FHRDf2KNXSSc+StBw88O
TLSH
T115E13F7894188F7F74B677ACAC6888716AB2013B77BF68D710B95485010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 1a91ea04409d1c2561bd430b0c8c29f95c1090a4af85f3c884240831c068afdf
MD5 6c233802169cda75a6bacf437a2c6b47
SHA1 94424a9b3446a854ea05e7a7714c7f06b0d92400
SHA512 0bf634c6c41b5a55d3433b640166b2d48658a59b88965dd30a63918f6c28a937f7bd470ce50644ca906ed743442c2dda2c8a4dffaa2452bbf6017da06554f7d2
TLSH
T1C3218785FE1F1DF65254D15AD2C86FE4DB956062427CFDF0D869160107C455D3265309
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 78654e725d36122c0daea1cecb7db97a87d14643a4305b9bb81ea821a8331126
MD5 ce3add2080bffd26584ce7fa037ad5dd
SHA1 01c91a4b8313eceba2f53b2ad21409973a3c958d
SHA512 e18aaa3f608f74ebda2fa6b7d5d32dc74e45037f9d3496aa211fa4e18bcd26e052d06f17f930ecbbf7204d2d229f0ee91c5757ae0393f48aa277945ec977377f
SSDEEP 49152:/lPbkMngvZR+JhEYhAU58Q9hJCHkda13PUTEi:NPbkMngBQ58Q9hoHkdSXi
TLSH
T1F51639F824D1A257F3808037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads