50e4f7eb7451e69a8211d78a1a519dd5586a238a85e5ec23ddb7cf3cdf2461bb

Analysis

user interaction
yes
max time kernel
112s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 20:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NBJ0zCLD.html
Size 2KB
Sample260901-zrf7laxcpg
SHA256 50e4f7eb7451e69a8211d78a1a519dd5586a238a85e5ec23ddb7cf3cdf2461bb
MD5 fd7b673a143458af1add02d58ee6d115
SHA1 5de3173fb91064a62d261427aaff3d290adc814d
SHA512 daf6f4a2047dd3076f5b7559de7ce63435e4713f29c87e441468183c55d2bdc22027ff6211c35a609f3771900c632fc701f3673bd995519bc068832a5d844bf0
TLSH
T10C415323E904802542B5E244B4F9B76C8023878FDB725C41ABB4B5EB91C7FE1C2762E5
MD5 SHA1 SHA512 TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4532	firefox.exe
Token: SeDebugPrivilege	4532	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4532	firefox.exe
4532	firefox.exe
4532	firefox.exe
4532	firefox.exe
4532	firefox.exe
4532	firefox.exe
4532	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4532	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4532	4432	firefox.exe	85
PID 4432 wrote to memory of 4532	4432	firefox.exe	85
PID 4532 wrote to memory of 3064	4532	firefox.exe	86
PID 4532 wrote to memory of 3064	4532	firefox.exe	86
PID 4532 wrote to memory of 3064	4532	firefox.exe	86
PID 4532 wrote to memory of 1592	4532	firefox.exe	87
PID 4532 wrote to memory of 1592	4532	firefox.exe	87
PID 4532 wrote to memory of 1592	4532	firefox.exe	87
PID 4532 wrote to memory of 1592	4532	firefox.exe	87
PID 4532 wrote to memory of 4820	4532	firefox.exe	88
PID 4532 wrote to memory of 4820	4532	firefox.exe	88
PID 4532 wrote to memory of 4820	4532	firefox.exe	88
PID 4532 wrote to memory of 4820	4532	firefox.exe	88
PID 4532 wrote to memory of 2516	4532	firefox.exe	89
PID 4532 wrote to memory of 2516	4532	firefox.exe	89
PID 4532 wrote to memory of 2516	4532	firefox.exe	89
PID 4532 wrote to memory of 1480	4532	firefox.exe	90
PID 4532 wrote to memory of 1480	4532	firefox.exe	90
PID 4532 wrote to memory of 1480	4532	firefox.exe	90
PID 4532 wrote to memory of 1480	4532	firefox.exe	90
PID 4532 wrote to memory of 560	4532	firefox.exe	91
PID 4532 wrote to memory of 560	4532	firefox.exe	91
PID 4532 wrote to memory of 560	4532	firefox.exe	91
PID 4532 wrote to memory of 560	4532	firefox.exe	91
PID 4532 wrote to memory of 4040	4532	firefox.exe	92
PID 4532 wrote to memory of 4040	4532	firefox.exe	92
PID 4532 wrote to memory of 4040	4532	firefox.exe	92
PID 4532 wrote to memory of 4040	4532	firefox.exe	92
PID 4532 wrote to memory of 3816	4532	firefox.exe	93
PID 4532 wrote to memory of 3816	4532	firefox.exe	93
PID 4532 wrote to memory of 3816	4532	firefox.exe	93
PID 4532 wrote to memory of 3816	4532	firefox.exe	93
PID 4532 wrote to memory of 1648	4532	firefox.exe	94
PID 4532 wrote to memory of 1648	4532	firefox.exe	94
PID 4532 wrote to memory of 1648	4532	firefox.exe	94
PID 4532 wrote to memory of 1648	4532	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\NBJ0zCLD.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\NBJ0zCLD.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2028 -prefsLen 27099 -prefMapHandle 1784 -prefMapSize 270279 -ipcHandle 2116 -initialChannelId {68fcae57-62ac-4ce2-a417-d1519ff43933} -parentPid 4532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4532" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2516 -prefsLen 27135 -prefMapHandle 2520 -prefMapSize 270279 -ipcHandle 2528 -initialChannelId {78e37e3f-3042-4713-be52-2dbd68345cbb} -parentPid 4532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3644 -prefsLen 27276 -prefMapHandle 3648 -prefMapSize 270279 -jsInitHandle 3652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3656 -initialChannelId {5026901c-968d-4a72-87e6-1284d62a0e56} -parentPid 4532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3648 -prefsLen 27276 -prefMapHandle 3644 -prefMapSize 270279 -ipcHandle 3868 -initialChannelId {e037448c-6b38-4440-bf5a-3ccc9a20a998} -parentPid 4532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4532" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3312 -prefsLen 34775 -prefMapHandle 888 -prefMapSize 270279 -jsInitHandle 1336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1344 -initialChannelId {1373d6f5-9311-4794-9b5f-80a5129fc660} -parentPid 4532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2784 -prefsLen 35012 -prefMapHandle 2788 -prefMapSize 270279 -ipcHandle 4904 -initialChannelId {8ce9dbed-0d57-46c7-98ac-d2a1ada0f066} -parentPid 4532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5036 -prefsLen 32900 -prefMapHandle 5092 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4712 -initialChannelId {db1cf046-5362-4ae9-ab6e-3c98e07b3e43} -parentPid 4532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4872 -prefsLen 32952 -prefMapHandle 5244 -prefMapSize 270279 -jsInitHandle 5248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5292 -initialChannelId {0ce2e0c2-e80f-4f2e-b6ab-8f5bc43272bf} -parentPid 4532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32952 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {1f9e0a2e-6b32-4629-b273-ed5ba625f268} -parentPid 4532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 d90adeadf298535b2441f1cfc575779374f2129213b68f76c13c35316945602d
MD5 5a4981e00fe3762da2ee126ac60831bf
SHA1 a9ee2a52c7ae9ca872369311852e7ee6eac699db
SHA512 cabd41dd13c47829315b328a0c162cf7aefad2a1c702aa32d1c657449ed173f6102cccfa058236750c0b0995a9be8e62fdedce11286c95145f0a06cba70f3a49
SSDEEP 384:HkCjiO024YBDL84KKDL849B7SOEAd9KVRaAcP+AWRMAJ:EzZYBDL8lKDL8CB7S/AmVAf+hRM4
TLSH
T16F729E3D9F003CBC1597C0E8C5F992998D19B7A7CFE6806D21583D0DCA98AA9B0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 24e4608eee7c9ab7ffbc9752966de17fcfc45f6efa025f0da1fe8994c243bc8f
MD5 fef624453ef1549c0dff631779645fd7
SHA1 b966a770acd111889beaf27898ab3e0adc07fb17
SHA512 fe501c6f3356c30cd031616ecf9f33b5dfec640ae062066b44238c73692c8ca88b74535da9c024111485dfe1c9495664d29882c3e889fca90a9ae6f284b95e43
SSDEEP 192:grSnh1d66JozGzgCl6mc0duOv5zbokmTbVtyjiO+:dd66JozGzgC1jXbonbVtyjI
TLSH
T156D11E68E768863BC044423BCDA21F400F35399B9C4E7F193AAD64082D576DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 65eaccf08589c2fecb09f10c37596142b00175285eb3484be462aa48f5e5f00a
MD5 2776b00d6886d09c29e4fe585b817dc7
SHA1 738ebc9c7d80d17210c771d5b6914946e7b3b727
SHA512 f662c02cf72b94d70b8b0190daf0ad68e8874b9eec68375152b5ada7773699d9a63e6263e1a11cc85ae106860f2bc8b7618f6351c9c07efc630fd34c86a0e382
SSDEEP 192:hOv5zboPlmTZVtyjiOlrSnh1d66JozGzgCl6mc0d:+boOZVtyjSd66JozGzgC1j
TLSH
T1BAE1FD68E768863BC418427BCDA21F400F39389A9C4E7F193A9C640C2D576DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2af7138fe45fd8ef37ee86fae483527bec1c2252aeb66b6d09ecbb8363172438
MD5 a22be92fbec884840f4ee0ea8d7e838e
SHA1 40a92a86ff63f310609d5d0fb57bb67dd35bbc5d
SHA512 fd3ab8d9cc6da1f255cc8aad61e6743cdbc4628ac949a58423731017944c1bc296e436bb921e59aec28ac5aff803e891f08b3862c18059a475ac2aeb44997ef7
TLSH
T1CE21674C79F94D6A9DCBE798B84142CE67454E0608871C435E22EE8CCEC1AEA326A438
MD5 SHA1 SHA512 TLSH

Submit Download

1e8f81f8-00e4-44ad-a2dd-1f5e09a3eb22

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\1e8f81f8-00e4-44ad-a2dd-1f5e09a3eb22
Size 15KB
SHA256 4c4a9f788ea2f3ebd895f0251bf4ade5c80f5d79baf0c08e2cf89efe6e669f68
MD5 3729fc4a76efe91059d42577b32b6972
SHA1 ab3446130a2be8b38bba442eef37041a03dd7df8
SHA512 bf5170bcaabbf289a8c4c2f87fdf65139b853343d3eebe525af51256c5682683518880d524da1a22bda38f940d7630e6e5ea4cca7fbc99e140557fc6e3452453
SSDEEP 192:CGlS49gxXB0sPL1Kym1SzxDcgRZFSxbmQiCNVbiCqP0M1b5EJ3ZSy68d2t+DWljH:vS9xXlwBSlDcgRDSxbQCXbDMR+O1wYlX
TLSH
T14772D9166860557A8251E369C8F8BFC3E6F528CB4C019FCEDBE4BD085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

247e4dac-8cdb-4098-92e9-c42df626b004

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\247e4dac-8cdb-4098-92e9-c42df626b004
Size 886B
SHA256 16a1a294a1169db974aa05c24e39655ac6ee0389d3e237301bd665d8783fe0f0
MD5 089e252c46e6c9e4f3a22720e4436d3e
SHA1 1c557e6eb23d9673e9fdaa04b6f5f7a3f62d344b
SHA512 61bd3b865c0600a3ff1d6014481b11778a0c52d323ceefed3125aaf0303e479edc52867af6fa3014fbdcef2f3d859216f18081ce913c330b4abaae872b86aa66
TLSH
T13011275147BCFDB2C838D24BD9A077424BE47623C4CE59147F655B180C7A51E93AB70B
MD5 SHA1 SHA512 TLSH

Submit Download

3569d576-f35e-4363-9942-e469f4ffc216

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\3569d576-f35e-4363-9942-e469f4ffc216
Size 235B
SHA256 8451fe39562480e92a7ec8bcd4cea7eb30eaa490726655e8aeb5b96947d445b7
MD5 d154f8461cc1a6131b4b40a6d4151f6d
SHA1 78ad334ac31c98e2a1de61bf973effb04701d58c
SHA512 330a096dd1281b4acc7353c9eb4f06599d38a977cd006ed357309977b77a7f4ae8a6b074cf3e68408e920e5602049a67876b8710786ec6d744edb7294d3e08f7
TLSH
T188D0A798149877BD08181F47F0B079D630994C3754A86C509AA14574EAF9DC9D2A2857
MD5 SHA1 SHA512 TLSH

Submit Download

48e8f40a-5ebf-4c59-9226-da7828cd86f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\48e8f40a-5ebf-4c59-9226-da7828cd86f7
Size 2KB
SHA256 4e240e06dfcc4f2b0a54be59df4a336a65d88dde00f20043f1de156f33c3ff8d
MD5 290b5c956049c00dec2fd52a8120e61c
SHA1 04a721958624c66dd01ead14afd4dfb86b05ed0d
SHA512 722741ca194b24442e19e5f7a7f37e24ccb102ab547389534dcebc4f25b02265f9c8680393a58a2624754241b80bc1df10e973a023a1f00bad567011b650a3c6
TLSH
T1C641665C26785CF78CDAF19DD842338E57648B0300C62C432E62EF0C9C9A65A336F83A
MD5 SHA1 SHA512 TLSH

Submit Download

8636bd72-9283-4665-8c47-f14b2183c96a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\8636bd72-9283-4665-8c47-f14b2183c96a
Size 235B
SHA256 0c0d62b440837b0ba52c55629dab966336b084aeaaaccb9c1efe6ba9b5954def
MD5 2381c4bcd0dbf430441147a4ccb79bd3
SHA1 ba9118b9e780d8557dea27d0fcab6f86cc48f802
SHA512 2aaca07a2d6e27f8a7f8abc0f7c80834f3062302a341d38957522db1393213108a6510d74ed3c4bae9031231cb39659f5bc2e482a88d24b3eccd383877ed9126
TLSH
T1A5D0978424A8672E08100F07F0F0A8C231448C3338E0AC208AA1407499FEEC401A2C17
MD5 SHA1 SHA512 TLSH

Submit Download

c202c35d-5d74-49f5-b9f9-daa384ea8604

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\c202c35d-5d74-49f5-b9f9-daa384ea8604
Size 883B
SHA256 d6e4d890cba8c187a644ac361154cfb38bc972253d283858894ba2334792bf16
MD5 7c12f35048bde60acd78845f99fe5878
SHA1 0f9076ccc48bbc6a9773073bbc3a11e08beaa1b8
SHA512 2e7e0bbc7274a29c72a7e6c700a5d749cd99e7681fbaa82fee013c6dd9b240b6e5f1eccbef99c40f4667c82b1c2020a84ed9ffd04c245539b44a59446ec61fa5
TLSH
T1E211E75197B9B9B2CC78D24FC9913B025FF4BA2384CA94143FA559180C7E91E936B60B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json
Size 16KB
SHA256 0e37c527eb7ccd962981b463cf640fa96988d0ec764efe51abc608103310b59e
MD5 0685fe51265776791c1e62d6401c86f9
SHA1 886fbeb12d13b75ffa8ccbdd43dc994a8f81bc21
SHA512 54183f3a992ae4b10c5c0180edf6dfac60fdeab9452e0f226e90375c0122f6421da452348b3e318651ffa07e71144cb8eccd80ebc3bc48bdc45fc46ac1cfd3e3
SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4Hmv4hy:mI4dRfFXQ4d614d4D4J4+4k4A
TLSH
T1B472421545449EB8298EA79AAA367E01C37D533B70845C38F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 7KB
SHA256 9c40404888cba9b57bdfecdce87caf298fba7f7c48bbc81ce6700d471519d987
MD5 42a482fa8703f1a6c8f166b83a2b5425
SHA1 cc5b39b7bdb5623ebe64fac63692ee537969736a
SHA512 79e81a8624ce17a1fac3df3267ad528cd2308d83d85dcc3050828dbc1d50c94b20497ba44f6c62fd21b031841598a168c522ed89f69afa79afc616b89df23748
SSDEEP 96:xH4f1TUOPqGqsWfTF6ObzSVSSladv9jHnIHe9Bw88ObK8L4cnTDEx:mfkRsWfTF6vSS9e9Bw88ObNY
TLSH
T132F10D7891548F7F75B6776CAC2888316AB2023B77BF68D610B994C4050CF3542FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 cf9a4d0f8fe11cafa604efbc203ab87ea854028423f8aa621e3d570922fefc77
MD5 54f72b9677bb0bb4019d199e083d3fb8
SHA1 228d795a65ec9b28cea7eb4ae204690105ed5794
SHA512 80551f50281f74e3c03051f00e5ac28f73ff8927a5b1a7e82d111bb9cf9b1e864136174bf9a1699727282102fc830efc4229043107cb1ee02091c1dc39595c7f
SSDEEP 96:xH4fUTUOPqGqsWf24P1zSX01SSladv9jHUnIHeABw88n8L4cnTDEx:mf5RsWf24PG01SSK9eABw88qY
TLSH
T10CE1217895188F6F74B677ACAC6888316AB2413B77BF68D710B954C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 f0658dea027ed3b4e40f66f8a548cb802ac1783ecb7cc894c1e76b315512a4a0
MD5 a227ebb225aa3e81da7b937b44176bf4
SHA1 42649c858247f7703b9de3a49184dd236203128b
SHA512 b6d37bdfde777f3b8504be50f965a72c430a357f3cb76c9ea3f2b4154af860e36e221635eb393626d0587f8dd03ddfcbeae37e1c304731f0635f3896bd24f355
SSDEEP 96:xH4fUTUOPqGqsWf2F61zSVSSladv9jHnIHeABw88n8L4cnTDEx:mf5RsWf2F6ASS9eABw88qY
TLSH
T147E13F7895188F6F74B677ACAC6888316AB2413B7BBF68D710B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 2298da796c4841b07c8d63b0463bda82c9c8c28305cc2b47a9875bdde0c3ce3b
MD5 b4d5bec91acc735ca81c4b4b68af7504
SHA1 670e983b9b88238bee35000aea3aaa0c36a31f8b
SHA512 adaa4243b87afeac60bc726df3137dd980be6fbe80b621c101dfb9e6557f54780c1a096adaa1968161a37d0763e264ee947c91901b48246db5ef60b20e9ec453
SSDEEP 49152:aDmgwuOi5lUF2lkfjKdeaKvgmRBbFOYkg/b:WmluOi56F2eOeaKvgmR/
TLSH
T1B42639E820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads