50e4f7eb7451e69a8211d78a1a519dd5586a238a85e5ec23ddb7cf3cdf2461bb

Analysis

max time kernel
299s
max time network
209s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 20:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NBJ0zCLD.html
Size 2KB
Sample260901-zrf7laxcpg
SHA256 50e4f7eb7451e69a8211d78a1a519dd5586a238a85e5ec23ddb7cf3cdf2461bb
MD5 fd7b673a143458af1add02d58ee6d115
SHA1 5de3173fb91064a62d261427aaff3d290adc814d
SHA512 daf6f4a2047dd3076f5b7559de7ce63435e4713f29c87e441468183c55d2bdc22027ff6211c35a609f3771900c632fc701f3673bd995519bc068832a5d844bf0
TLSH
T10C415323E904802542B5E244B4F9B76C8023878FDB725C41ABB4B5EB91C7FE1C2762E5
MD5 SHA1 SHA512 TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	firefox.exe
Token: SeDebugPrivilege	2796	firefox.exe
Token: SeDebugPrivilege	2796	firefox.exe
Token: SeDebugPrivilege	2796	firefox.exe
Token: SeDebugPrivilege	2796	firefox.exe
Token: SeDebugPrivilege	2796	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe
2796	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2796	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2796	1700	firefox.exe	89
PID 1700 wrote to memory of 2796	1700	firefox.exe	89
PID 2796 wrote to memory of 3076	2796	firefox.exe	90
PID 2796 wrote to memory of 3076	2796	firefox.exe	90
PID 2796 wrote to memory of 3076	2796	firefox.exe	90
PID 2796 wrote to memory of 5904	2796	firefox.exe	91
PID 2796 wrote to memory of 5904	2796	firefox.exe	91
PID 2796 wrote to memory of 5904	2796	firefox.exe	91
PID 2796 wrote to memory of 5904	2796	firefox.exe	91
PID 2796 wrote to memory of 5784	2796	firefox.exe	92
PID 2796 wrote to memory of 5784	2796	firefox.exe	92
PID 2796 wrote to memory of 5784	2796	firefox.exe	92
PID 2796 wrote to memory of 5784	2796	firefox.exe	92
PID 2796 wrote to memory of 5264	2796	firefox.exe	93
PID 2796 wrote to memory of 5264	2796	firefox.exe	93
PID 2796 wrote to memory of 5264	2796	firefox.exe	93
PID 2796 wrote to memory of 2992	2796	firefox.exe	94
PID 2796 wrote to memory of 2992	2796	firefox.exe	94
PID 2796 wrote to memory of 2992	2796	firefox.exe	94
PID 2796 wrote to memory of 2992	2796	firefox.exe	94
PID 2796 wrote to memory of 4320	2796	firefox.exe	95
PID 2796 wrote to memory of 4320	2796	firefox.exe	95
PID 2796 wrote to memory of 4320	2796	firefox.exe	95
PID 2796 wrote to memory of 4320	2796	firefox.exe	95
PID 2796 wrote to memory of 2200	2796	firefox.exe	96
PID 2796 wrote to memory of 2200	2796	firefox.exe	96
PID 2796 wrote to memory of 2200	2796	firefox.exe	96
PID 2796 wrote to memory of 2200	2796	firefox.exe	96
PID 2796 wrote to memory of 5744	2796	firefox.exe	97
PID 2796 wrote to memory of 5744	2796	firefox.exe	97
PID 2796 wrote to memory of 5744	2796	firefox.exe	97
PID 2796 wrote to memory of 5744	2796	firefox.exe	97
PID 2796 wrote to memory of 3968	2796	firefox.exe	98
PID 2796 wrote to memory of 3968	2796	firefox.exe	98
PID 2796 wrote to memory of 3968	2796	firefox.exe	98
PID 2796 wrote to memory of 3968	2796	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\NBJ0zCLD.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\NBJ0zCLD.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27019 -prefMapHandle 1944 -prefMapSize 270249 -ipcHandle 2028 -initialChannelId {85572a6f-a981-47e0-9d9d-528123cd19f4} -parentPid 2796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2396 -prefsLen 27055 -prefMapHandle 2400 -prefMapSize 270249 -ipcHandle 2408 -initialChannelId {eeec2e6a-b07f-4780-8dad-0129c5d1d280} -parentPid 2796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3876 -prefsLen 27245 -prefMapHandle 3880 -prefMapSize 270249 -jsInitHandle 3884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3892 -initialChannelId {96c69777-ca0f-4a2f-9212-4776a234581f} -parentPid 2796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4088 -prefsLen 27245 -prefMapHandle 4092 -prefMapSize 270249 -ipcHandle 4164 -initialChannelId {0b789d71-573a-4be2-a324-2e51bb85d18f} -parentPid 2796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2816 -prefsLen 34744 -prefMapHandle 4396 -prefMapSize 270249 -jsInitHandle 4400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4408 -initialChannelId {49fee47d-18ce-49da-8879-a77882717dc8} -parentPid 2796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2792 -prefsLen 34851 -prefMapHandle 2796 -prefMapSize 270249 -ipcHandle 5068 -initialChannelId {13436051-5d86-4b2e-bd1a-69ba87f56c05} -parentPid 2796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5424 -prefsLen 32809 -prefMapHandle 5428 -prefMapSize 270249 -jsInitHandle 5432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4912 -initialChannelId {bac98519-a8d4-45b1-8312-fcf1e3d86660} -parentPid 2796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5604 -prefsLen 32809 -prefMapHandle 5608 -prefMapSize 270249 -jsInitHandle 5612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5620 -initialChannelId {4219aa40-1164-4519-b7e2-2144b1c5b18e} -parentPid 2796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1604 -prefsLen 32809 -prefMapHandle 5764 -prefMapSize 270249 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {4a5e64d2-83f1-48b3-8ed2-b19212801717} -parentPid 2796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 109c88f99a0d1a04179f172eefe616dedac65dfce9e9cf0f79666977c5fc8200
MD5 1d1f343e603fd52106f2edf560e2c967
SHA1 3a8aeb8f6cbdf69bebccf36261f261f1c10a312f
SHA512 e262cbccca449cc917d7178c56f9ea184a0701eaae40ee4ee12e416f90b8477269b10dbcc0000f50083c1698ab8487c566f67b5e98558c6cde561d9815d6d348
SSDEEP 384:HkCjiO024YjDL84KKDL849B7SOEAd9KVRaAcP+AWRMAt:EzZYjDL8lKDL8CB7S/AmVAf+hRMI
TLSH
T1D6729E3D5F003CBC1597C0E8C5F992998E19B7A7DFE6806D21583D0DCA98AA9B0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YUAEHM0IPF8MSDE9JUZS.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YUAEHM0IPF8MSDE9JUZS.temp
Size 7KB
SHA256 42a332ac5c37c4d386c426b5717c1501c84c29171439f313513eb59e41bb0868
MD5 b638896edfdbd37418c99ca35d59c982
SHA1 673a2d35d5038b7ef9a61fe07700d9b723ae179b
SHA512 48eb9651a7522680456bef7c1890ce00984daba6fa68777e69cf48ab96ce6b5f9a72ce3f3644426eb8fe9500e4db2be5ca5b5f5308a0f2fb4304dbf88b23ba1a
SSDEEP 48:Eemd9dJ5UgdwPzFgTmd9dJ/6BdwZ3FgNmd9dJ/adwLFer0md9dJvhi+rdw1LFZ:+w/5/uv0FX
TLSH
T1A0E1CB014BF709A9F0F39632BB326B12A733FD01562E521EC14A66441E7636085EEFE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1b95a09e9a978ba88ac5e73c7d02025a55c8454bba10dbac5b5ca7b8eeecae22
MD5 501d96b97a130328dbcb8619f0e3b7ea
SHA1 bbd377fae30bbd8926d602809abb32f2d8556e7f
SHA512 7bb6f16f85ba7de128755f91ce8a31a85f36e895925b1b74c4df07896636ed528e061edf8b10aa9e4b2d3f91a05c05aa7b33b56273a87088c3cbcbc3a7b57129
SSDEEP 192:D3GvWJ1d66JoztdzgCl6mc0d0xYOv5zbo8bQ2kyjH2c:3d66Joz/zgC1jqxjbo8bQ2kyjH
TLSH
T1CCD13068F628863FC408123BCCA11F410F36385B984E7F2935ED65082D5B2DE3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a60d0ca36cfc65fe560e52012de1550db5e69bfab68db8e1996f39894d26cd60
MD5 2dc760a6af004e3c2ef3f6b73cf3b3a0
SHA1 6ba749c9c827adea3f5230060027231b207adf6b
SHA512 57049545b4ee5e4082368f49bb8b4452a9a7476d08ff8b05417f4231abbc7721e89f29de32d93f3f46b9e0af8d95d7e3a9f2dbebdc043be1596aa89517d7bd16
SSDEEP 192:fxYOv5zbo7lzZQ2kyjH2ck3GvWJ1d66JoztdzgCl6mc0dz:fxjboVZQ2kyjHSd66Joz/zgC1jd
TLSH
T132E11F68F628863FC408127BCCA11F514F39389B984E7F2935ED65482D572DE3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\events\events
Size 1KB
SHA256 01173c2058f40d4f1ec0993f3c8ead15da3408d40a1ee9a623dda946cbcbe572
MD5 5c288ef73490b9fcdaa48ca9a346b0d8
SHA1 9aa5f4c0dc69c2da48dd390100fc1eb2a26e1f82
SHA512 34d69ec7cd2b6a5baa9dcf868d1afd08068ce5763051a1519ae3622b0842a24ee7500f3af75aa76be04f0c490def3038557881b8def9e2941aff9e74da2549e8
TLSH
T1AB116A5CBDF94D6AA98BE39CB851028E67154E0204871C436D22EF8CCE81EDA326A479
MD5 SHA1 SHA512 TLSH

Submit Download

23566ad4-e55b-46de-8b4c-1726955c62f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\pending_pings\23566ad4-e55b-46de-8b4c-1726955c62f7
Size 235B
SHA256 b4cec9c0c8ccaab7f04f953868f54008f91b35d9c87ff6b8b4af4a94cc897087
MD5 ddc18cca46c163c174ef227fe728a00d
SHA1 a19da665d5fa0ddb21d58ebfa0cb22f463fbcb2b
SHA512 172047fe9c82510ff33252929f36fcb952ab245220b31ede798a0f2d2e1f11e91b6eb9c4f2127c88d996b2e1b8cb31e34910476494a558dbd3ba89d89973583d
TLSH
T1B4D097C02898272E18048F0AF0E1B8C230584D332870A8A0E79184F4CABDAC89162847
MD5 SHA1 SHA512 TLSH

Submit Download

56a5869a-7de8-4e5f-8b68-f402329441b5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\pending_pings\56a5869a-7de8-4e5f-8b68-f402329441b5
Size 2KB
SHA256 ff89312e0be141781af6fb55bbc7f09528c493eaa8edcce62ef9a9156996f769
MD5 64f8e03796f08b6d0939263e5cb56e9f
SHA1 27aebb5c911577df52aa9a31d7845962da73223d
SHA512 b0d4aee3e420c5550da607741b28cc48e16d9503d48108fc2ad6f757b5374c4a6739ca59d3d5ff6b2cdcffb0f40f7ee32996074c8429d881cfd3f49df34b0a3f
TLSH
T13141216C35785D769CDAE16D948227CFD3B08A0344C328832D91EE0CCE9665E336E92B
MD5 SHA1 SHA512 TLSH

Submit Download

5834eb7f-2f43-4ba7-b3c4-724be1cd8012

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\pending_pings\5834eb7f-2f43-4ba7-b3c4-724be1cd8012
Size 886B
SHA256 6a3234e569c1190ecbb86755505acb0e670299800ee3f7e7c5b8733c2584d4d3
MD5 dbfa49d293e97fd33d78864abe6155c9
SHA1 503958c4342ee770723c1aaa32d21e8a2b778787
SHA512 0f5e753c4687491466d8a9d175b882a500ce5844165a201a91c23270cd189eff270e4c1d435f6729596e5eec536fe1c115bbe32c30f7e9a9c5341fcdd10d069e
TLSH
T1FE11004095B8B9F2CC39914B94D07B5287F4751380CA5A107EA09E144EBE51E576AB0B
MD5 SHA1 SHA512 TLSH

Submit Download

bfff6265-cead-4309-867a-77423e9bcd47

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\pending_pings\bfff6265-cead-4309-867a-77423e9bcd47
Size 16KB
SHA256 3675ac467a8d133b16d3853b873aa2d291f503f09f928891d15e981fd08a07a3
MD5 7d25d9e4df73baf2200cac169d7c99dd
SHA1 991938ae4b5f46f27242ebe30d5088f48c82f678
SHA512 7ec1a4576b2791297a92fb7bc0f579bc8d5ebd34f17630b0b158b3f87ba8a7d80e7b346f134d90f02f5a4b11d5b464db2afc98afc3f417fea1d929acd988c7a2
SSDEEP 192:Sl1T3dQx/hMESQfzOdbnKOdjoyf3rcm1QsWIbR7izFTV5nLWrJoWMIIClDLBN6GE:OLdAiEAnbR7iNV5npWMMlDLj/9J4zxD
TLSH
T1E872D9562860497A8251E36994F8BFC7E1F528CB4C419FCADBE4BE086DDF06F112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0100560-6d93-4674-a7b0-45973e012e75

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\pending_pings\d0100560-6d93-4674-a7b0-45973e012e75
Size 883B
SHA256 141f7cd372e3020333b273b3762b2135b3a8c83792592515642b65c0bb9cd282
MD5 c470d70b6d2f22356f435a101cf48dc5
SHA1 a938f2f212f988304f7717a8cfe2beacd04a35bb
SHA512 7bc45411d684c3d5416749a557e5123200cc8436e2f4896d26566ed244528e44737a83a71c05600d7f24a02f64fb6302f8ee9448051bef1461ba206ca3bab6ee
TLSH
T1E3112F809535B9F2CC7CE24BC4A57B1397F4B91380C699143DF05E044EBA52E976FA0B
MD5 SHA1 SHA512 TLSH

Submit Download

ecd6af0a-b6c8-4a1d-8f83-74cfc2d3168b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\pending_pings\ecd6af0a-b6c8-4a1d-8f83-74cfc2d3168b
Size 235B
SHA256 906846470576b032accb95c977c4423dba5d58aa6ec34b20532a50e716e8be4f
MD5 c41f0fba77947ca689193b1d105c5aa7
SHA1 58807027fc7f6c306182994f7de6954d0f493da2
SHA512 303b3cc3f751fd323011700c14a829dfc51e22b21e5a5e2a9759a8bfb3443489dbb85548fee1a98c8a7f5ce4e696ffb326c6cf5773751ce699e36cd382a0ac74
TLSH
T1F1D0978024DC732C0C200F82F0A2A9CA30494C3764749820C691417489BAAC84213826
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\extensions.json
Size 16KB
SHA256 1d803eef422b369674148c9e70028e4b4ddb30ffc9f6266e1fab8a7fa1569b1d
MD5 eb4e18fa92d72c301ca6d1ec59cadf9e
SHA1 0bf23802ab2ec7e0806064c29353864333eaf3b4
SHA512 218f5228f6cda1b34ad6a3f719d37fb6a9f68e5cfd002001ba58f9996707244bc3501b0578f5056188638dc5686140a4f972daf3a9fcbb0206124fcdf143686f
SSDEEP 384:WkI4vBUmldvnX8dhWD94zC96oPL4HXL4P2L4H/L4HZ7L4HI+W4hh:5I4pRfPMXW4y6U47404D4p4W43
TLSH
T11A72531545148EB8294FA78BAA36BD01C37D473B70845C78F4DD8FC802FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\prefs-1.js
Size 7KB
SHA256 1834c603510fa4c6135f7c456176f0803fb5c6c2ba19fe57c947e8ea9fe2378e
MD5 7123a7d49842eb2d0d2745bbd90f189b
SHA1 f83a0945c5b78fbf03c4ed90946b86b4627d70e7
SHA512 6ade86e8b0f1a24eff8eac13d38b680054f6155a4db0c32a17a3d1f6458c2e27b67a0bd2e618e3e624cb4f3c495f7df3f1221daaa27397d2e3bada66dc98cb30
SSDEEP 96:xHZz4r84gvTUyEqGq87fhObzSSGSSlvdv9jrnsHrGi0nBw88Q3F18L4cnW9zEuU:nz4r84gz3R87fhjSS4rGicBw88Q3Fwz
TLSH
T1F4F1FD389044CB7F61B6776CAC6489316AB2023BB7BF68D710B994C5011CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\prefs.js
Size 6KB
SHA256 13c472ec42c020f16aba02f778f62be1fda3247139f9c4b46511bb1ba29534cd
MD5 a79e1ff350e942cc4ed8653d11ef28e2
SHA1 d2252d813b87939b22170835e0550b8f6842ad28
SHA512 0702a3491dfea574e17953d8de1895a36afbde4cbeb0791a7fc1fe2fc96066b406bd1086c253f2db085d125e7b8b3f140e170fd74265907aa635ebad09402070
SSDEEP 96:xHZUTUyEqGq87ff1zS7SSlvdv9j1nsHrGi0SBw88u8L4cnW9zEuU:nC3R87ff6SS+rGiZBw88pz
TLSH
T1D6E11F7890088B7F64B6776CAC648C316AB2053BB7BF68D750B994C5015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\prefs.js
Size 6KB
SHA256 b30bfe2cdabdad07f0f02f1a61cb1d961245d74d54c5ed4bd3ad5dc48cf68710
MD5 6941262a4dc7d06c275cadb59fd20803
SHA1 e02d97f6aedc41666d66aa35c76c66fd195e3c39
SHA512 da2b918207cad9ab3baf49a7fcf075dca86bcefed96158f5c45a07d97678879a323952cd1f429ba5eb630b443a7addc9698bcfaa3cd12175f95b8ad5c448b4af
SSDEEP 96:xHZUTUyEqGq87ff1zSSGSSlvdv9jrnsHrGi0SBw88u8L4cnW9zEuU:nC3R87ffUSS4rGiZBw88pz
TLSH
T1C0E11E789008CB7F64B6776CAC6488316AB2053BB7BF68D750B994C4015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 39a81395eb580e324fea0364e61dd05b075c178ea6e619193651b3ac39c29894
MD5 1705b3ca8acac1225ee1cf8e410a0ff9
SHA1 6288cbfb505712b1d94b87ae326017940b1aebf2
SHA512 ff515c8263fca0c2c8a609c4180da4ba6b7f68f3665536c88f1d80fcaf17aed1faeafebde4f51d1be939505ac5b80e2c4fc69f339ac095a52622935c356b28f3
TLSH
T12521F943A8B62FF17B109165D2828BF2CB7D303244B198F091CED90126DF54CB78751C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads