c5e95f643581ffd5eda5b6bac0dea664208357037e074d65cde6d5f10bc2c083

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
explorer.exe
Size 3.2MB
Sample260910-3e72bsxdld
SHA256 c5e95f643581ffd5eda5b6bac0dea664208357037e074d65cde6d5f10bc2c083
MD5 7b2798bd507ec7fec0d8ddf2ebe05627
SHA1 502a28ff4c5f37be4e3e8b822a86b9265093c24b
SHA512 9262800b0e0bc1adb5ef2820abf37c8440df1e54e170e13c299f79e18b3eb629be29f6977f9db4cd57fbe7c04dfecd55a8e1fdc088c4ee2a90be8c4c15715f7a
SSDEEP 49152:Fn1hvOITVAjCQ7cLkSVGJ/XgpfP1dpRT/T4zbw8A7/eFwD:1xYfafPAzbw8a0k
TLSH
T1EEF58C5927F840C4E17AC17CC9468B16EA713C255331A6DF0660BA7E6F33BE4993EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	firefox.exe
Token: SeDebugPrivilege	2772	firefox.exe
Token: SeDebugPrivilege	2772	firefox.exe
Token: SeDebugPrivilege	2772	firefox.exe
Token: SeDebugPrivilege	2772	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2772	firefox.exe
2772	firefox.exe
2772	firefox.exe
2772	firefox.exe
2772	firefox.exe
2772	firefox.exe
2772	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2772	firefox.exe
2772	firefox.exe
2772	firefox.exe
2772	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 2772	1536	firefox.exe	91
PID 1536 wrote to memory of 2772	1536	firefox.exe	91
PID 2772 wrote to memory of 2216	2772	firefox.exe	92
PID 2772 wrote to memory of 2216	2772	firefox.exe	92
PID 2772 wrote to memory of 2216	2772	firefox.exe	92
PID 2772 wrote to memory of 5696	2772	firefox.exe	93
PID 2772 wrote to memory of 5696	2772	firefox.exe	93
PID 2772 wrote to memory of 5696	2772	firefox.exe	93
PID 2772 wrote to memory of 5696	2772	firefox.exe	93
PID 2772 wrote to memory of 1900	2772	firefox.exe	94
PID 2772 wrote to memory of 1900	2772	firefox.exe	94
PID 2772 wrote to memory of 1900	2772	firefox.exe	94
PID 2772 wrote to memory of 1900	2772	firefox.exe	94
PID 2772 wrote to memory of 4488	2772	firefox.exe	95
PID 2772 wrote to memory of 4488	2772	firefox.exe	95
PID 2772 wrote to memory of 4488	2772	firefox.exe	95
PID 2772 wrote to memory of 4296	2772	firefox.exe	96
PID 2772 wrote to memory of 4296	2772	firefox.exe	96
PID 2772 wrote to memory of 4296	2772	firefox.exe	96
PID 2772 wrote to memory of 4296	2772	firefox.exe	96
PID 2772 wrote to memory of 2408	2772	firefox.exe	97
PID 2772 wrote to memory of 2408	2772	firefox.exe	97
PID 2772 wrote to memory of 2408	2772	firefox.exe	97
PID 2772 wrote to memory of 2408	2772	firefox.exe	97
PID 2772 wrote to memory of 5484	2772	firefox.exe	98
PID 2772 wrote to memory of 5484	2772	firefox.exe	98
PID 2772 wrote to memory of 5484	2772	firefox.exe	98
PID 2772 wrote to memory of 5484	2772	firefox.exe	98
PID 2772 wrote to memory of 3212	2772	firefox.exe	99
PID 2772 wrote to memory of 3212	2772	firefox.exe	99
PID 2772 wrote to memory of 3212	2772	firefox.exe	99
PID 2772 wrote to memory of 3212	2772	firefox.exe	99
PID 2772 wrote to memory of 2572	2772	firefox.exe	100
PID 2772 wrote to memory of 2572	2772	firefox.exe	100
PID 2772 wrote to memory of 2572	2772	firefox.exe	100
PID 2772 wrote to memory of 2572	2772	firefox.exe	100
PID 2772 wrote to memory of 4156	2772	firefox.exe	102
PID 2772 wrote to memory of 4156	2772	firefox.exe	102
PID 2772 wrote to memory of 4156	2772	firefox.exe	102
PID 2772 wrote to memory of 4156	2772	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\explorer.exe
"C:\Users\Admin\AppData\Local\Temp\explorer.exe"
1⤵
- Modifies registry class
PID:1312

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1924 -prefsLen 26983 -prefMapHandle 1968 -prefMapSize 270110 -ipcHandle 2040 -initialChannelId {f37cb7fa-5b40-4948-9353-98ad9e8a674b} -parentPid 2772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2772" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27019 -prefMapHandle 2424 -prefMapSize 270110 -ipcHandle 2432 -initialChannelId {5cf3a6d0-6f32-47f8-99dd-2662f33c662c} -parentPid 2772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3812 -prefsLen 27209 -prefMapHandle 3816 -prefMapSize 270110 -jsInitHandle 3820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3828 -initialChannelId {fe66c265-8155-40eb-a20e-14f48e1a4c07} -parentPid 2772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27209 -prefMapHandle 3980 -prefMapSize 270110 -ipcHandle 4072 -initialChannelId {28da74ca-f421-49a7-bb03-83dc689cd30f} -parentPid 2772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2772" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2988 -prefsLen 34696 -prefMapHandle 2904 -prefMapSize 270110 -jsInitHandle 3056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2756 -initialChannelId {e2c32750-5d21-4d61-8c63-29cd1a669a90} -parentPid 2772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3752 -prefsLen 34971 -prefMapHandle 5140 -prefMapSize 270110 -ipcHandle 5148 -initialChannelId {f5f88b8f-f75e-473a-9e9e-9dbd0d46f414} -parentPid 2772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2976 -prefsLen 32928 -prefMapHandle 3056 -prefMapSize 270110 -jsInitHandle 2940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3372 -initialChannelId {3e23d8e4-f0cd-4cbf-b0e0-2979af221f91} -parentPid 2772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32928 -prefMapHandle 5488 -prefMapSize 270110 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {ae6780ab-2ab6-4096-bc96-d0b4c257d0e3} -parentPid 2772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5808 -prefsLen 32928 -prefMapHandle 5812 -prefMapSize 270110 -jsInitHandle 5816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4924 -initialChannelId {81b47d20-86ab-4e96-9366-07562604dab6} -parentPid 2772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2608 -prefsLen 33007 -prefMapHandle 3252 -prefMapSize 270110 -jsInitHandle 3256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2748 -initialChannelId {70081d6e-2631-4a82-9e20-44dd7afe180c} -parentPid 2772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 874bb85162fd01525d06a12983f7b21f45f7e5b0f292de9f43bf39229c785816
MD5 a59b2c7526165bbb08e5bc53a6048aa2
SHA1 9a39915be19fb8e6aac86f11db8f282d638e4e35
SHA512 8dc1b5c5966642148ca901eb19bd9a0aa2bb8cca4e2119019e7da2fec13e814fb2d35020d56b7bc9558c67b78f37cebefd5ac5fb1c0878f2f1397e2943e74735
SSDEEP 384:HkCjiO024Y0DL84KKDL849B7SOEAd9KVRaAcP+AWRMAhzt:EzZY0DL8lKDL8CB7S/AmVAf+hRMu
TLSH
T1AE728D395F003CBC1597C0E8C5F9929A8D18B7A7DFE680AD21583D0DCAD8A69B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

298bc09d-3064-4ea0-bfd8-2cf111267612.zip

Path C:\Users\Admin\AppData\Local\Temp\298bc09d-3064-4ea0-bfd8-2cf111267612.zip
Size 3.8MB
SHA256 0f26d820b4bbdca26b02e76d6c0647153ad7e1839222f15361fd2ee9016c8e25
MD5 332c58722feca58fafa164c84a73e390
SHA1 35a1dcd7a2c185c3d3cdd600fbe744a544d43b51
SHA512 50624e3b7b2e378e97551e2c725457ee9e4e45464ebf4f6161a23789cfd91dbf5435b28bf00e88ec468de5e47357ca5639d54a2bc935beee12aeed8e316dbbec
SSDEEP 49152:DnLfvscTV1Dwlboyf+y95De31Jmaj4qj9aSy+lEbmZ+s6FWsxcOeqsRTY+AgHIk3:7LfGo3MU1J7gQlEbW+sMxvUBHIkVJ
TLSH
T11106E07DDE5C1F0DC9CF83BBC50D2FC2984C4FAE8054A9EB6A6A9971DCA31E61B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\AlternateServices.bin
Size 15KB
SHA256 7eb1f20faa1e1a623fa15683c4ecd9c47d5ff6ce06d42ca6cecc832a5b46bc9b
MD5 efcd4ac7479e71b4f78c9b97cf849ee3
SHA1 b9dd523fab09772eaaa81b7e3a072c723b5941a9
SHA512 617768e6a981b4c0a6eeca6a184d2f2b544d6aa330544130708d0227960c10c41e84387e2a40ebbeb3d9d6354234ad43dfb458e04157f137bb60f04426466431
SSDEEP 96:ivM4fvZF/Mb6Hm0YiePG3biEmHEbEW2QaIg8:ieOJY+Vg
TLSH
T1D56208FF1B7A7162E8622FB404AA384DCC370A26CBF28585872F91970291395D07EF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\AlternateServices.bin
Size 10KB
SHA256 b1a366c5a5527356a6c5119655970e337e3b9bcf443fc02025331f8c0129100a
MD5 d6b00749280243e4bc768708743d4c85
SHA1 cafaa1a9f9c223ab5e91133e79fd341770bbb193
SHA512 0a39cefe5582f65d3b2a514222f9fd56cfc78b24bfea3a224ce459360e7ef15377ff470c214a0f158fd28d2f9000c29892d0e4798312abda575444c4b6376719
SSDEEP 24:duhMZnUlfo+lzUUh7dc5UR5ztoPUBxZBlUVKYIvgyLUBwyoy+:kFo4t5dXBoMbZBm0YI4PG3N
TLSH
T1092257FF577A7421E8631FB404BE38888C33062687F2D185872B819702953A991BFF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 60fd32aac0bb71a38a65e8348846a6f7b840260a1fd9b8f235c1397f31c7cd6a
MD5 94855b37bbc421bd63ff0fbc80be54c2
SHA1 1b8277ebb448ae733561695fffc1b293443bee90
SHA512 c0e5a9cefbc2982617ecd7180a119f4a026261979a764e2f25400b79aa79c86582e2a2f76d17fa99c4d975aed37ce8f7dc57140cbc9dfe97ab4b0284fdef3ff4
SSDEEP 768:Eq51R+DFMMpGcm+u4djRsIZDEObwbkb/bA:H+DFprdjY
TLSH
T162C20184FB2E953FD42512BBDCA50B042F79B88998092F573A4D64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 a570022c90efc8adf56d048a2414be17ff30f484e5864034141d3ef83c230592
MD5 d12460175f4b54f0174b1a72ea56acbe
SHA1 0b8e789645c95655da16484d7a3f78acff603777
SHA512 a4fec0cc543aef6632747bd78c437118d09c84075fea2c0fd776aba0589d8033651a683cab3035abcb72f18fbd68f899e2117b81ec2906bca42a352f28dbf377
SSDEEP 768:/9c+DFMMpGcm+u4djRsIZDEObwbkb/bAk1/:m+DFprdjYS
TLSH
T1A3D20184FB2E953FD42512BBDCA507042F79B88998092F573A4D64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 68KB
SHA256 70b5c6c508536999cb4b7f02005271ff210b55e693ccc5cf720eba720cc5deb5
MD5 088fe41462798bc6e4ee4a012ee60f3d
SHA1 026f07de62ca675dfc724cf0cd9a48a11464e32b
SHA512 5e76b092d3c78c17996dc342a368c9d644b77dfb9cf338871fcd770e09031295c010da3d7e4baf1bd1cb5bad63b8aed334b506a1489ba1821a6a5e35001c3d63
SSDEEP 1536:C84qwqvtQ1yItvgy1WCbIEsuIloUMxx9WO+BAxweSmeJ:CjqVtYRtToCbJUlIToA8bJ
TLSH
T1FC631244EB1E953FD92802BA9CD21B003F79F8895A5A2B67375C64786C873DC3D4E06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 1KB
SHA256 13f3013db32bd7dd95397b1f418e8460593cf7447caa9ead64dc4cd1849a86bc
MD5 2f74ebb706172bb3f61ebe9aeaebf1c1
SHA1 028f4bbadeea4eba60ae56c6c7602de891a48392
SHA512 15971e05f329c4767d55be11888824acb30a10a1b228f5396295172950a83b665d61f8ee8777fea5d30f7fa69c0c5105b1aa8a05de9c447359dd50f1fa9257cd
TLSH
T13F11CC4C39B84EAA9DCBE39C7941028E53554E06464B5D434E02EF8DCE85AEA327A83C
MD5 SHA1 SHA512 TLSH

Submit Download

060a8e8c-70b5-4b25-ba5f-930c2ca919a8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\060a8e8c-70b5-4b25-ba5f-930c2ca919a8
Size 235B
SHA256 06c0932bd9a591bc3b115961878ec5eb0119b4b1938a5303734c3b7777586718
MD5 34f5ff512f0ad6f6041705176fdf8b0c
SHA1 3d5ed10085f13b9bbb4e5c38d332bc23e39c109d
SHA512 8ec9670d5a00df3b959e158255227dea36961422dec189280f3009ba282d5baea8368f0b90dad00ddec9aae54931326d48b341c351879a7f5d3cedde239112b4
TLSH
T178D0978028D8232E48288F03F0E028C230844C3710786810CB9041B48AFCAC84161806
MD5 SHA1 SHA512 TLSH

Submit Download

4dd29e29-2283-4b9e-916d-770f97ae1ed8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\4dd29e29-2283-4b9e-916d-770f97ae1ed8
Size 871B
SHA256 6a371df2fb03a16b29b665d2c3d940d4b421ea680745a84bbdcc05a31526d7b4
MD5 534f5b985f053b545595ffaf84683fa3
SHA1 2d174c2d0d1607fa82acacd5cd826143feeed2fc
SHA512 34a7d04f91ab49e4089531af5bdf643c0fbe36df6a8b7064acdaefdf2a8865f9f565829483c28698c51d997bd5f944085997e80012ab3fb7666d506a11ff8b60
TLSH
T19C110094E631B6B2CC78925BC5D1370287E4B423C0C659043DA50E140E7F61FAB6A24B
MD5 SHA1 SHA512 TLSH

Submit Download

851ea0b6-6716-438a-b2b9-4815ea644c5b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\851ea0b6-6716-438a-b2b9-4815ea644c5b
Size 235B
SHA256 644045dd1c1f76baaf72864c9c1e1cec36cd1f3d647bbe0b1347720596ca1369
MD5 d1f7f402621a316a87b4f8e39eb915ff
SHA1 3f52c83d3cf04ac346747632d15d79ccb94923d4
SHA512 f0fc4e1242e78ccc9997abe063004c858d59cce284c942af8fdd65ea0ead6333d7e2a43f5c1db1ab917c856790a44cf2cd9fce7c22df8d59ac54098256ca809d
TLSH
T161D0978914886B3C0C001F03F0B06CCA30688C3320B89860E5510578DAFAAC8022288A
MD5 SHA1 SHA512 TLSH

Submit Download

894e59ed-9374-46a7-9e9d-44319c5ca6ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\894e59ed-9374-46a7-9e9d-44319c5ca6ba
Size 886B
SHA256 a5102cd03ee4bff58e4eaa312879e3ccd5623467446e3fa338e5990f686b0ab0
MD5 c2ebaacc2bf9908e2580d83555828d52
SHA1 89a6c73ae7f13b3c7042f0a1d9173c8c65aa547a
SHA512 a32a645142c56f455c1fb3626f4bb41532ea9bb698d6c893bd0837e61186f8d8c4c45cc00037ab2c8a49cf88392f3a13b0ed197e2d5870d1c48aa5e30b15b0b9
TLSH
T1BC110490A975B6F3CC78829BC5E137028AD47423C0C649047D545A180EBF50FB76E207
MD5 SHA1 SHA512 TLSH

Submit Download

f7f46a73-ad2a-48d7-b345-5286b23bdff6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\f7f46a73-ad2a-48d7-b345-5286b23bdff6
Size 2KB
SHA256 45c21ebd0ff6d7186d013347624ecdf0c28a71aed3434ca3dd2cabf9906fb4a6
MD5 2c0848692c71fc4110c28dcb0da36f53
SHA1 1d758a684c3ff8750582ffdd14ba2e2cf2226201
SHA512 44f62f6a74df3d23947d66fb4c694f1a727ff3b66b3dbfa4ba2f3297ebb2640581974646034e47dacd33edad0a548bd9a73aeb7c0f695d13fcceb160e6e19006
TLSH
T19541426C35789E775CDAE36DD481328A57A09A1340C21C837E41EF0C8E9629E676B42A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\extensions.json
Size 16KB
SHA256 ec75ea5a11144d603c7de7c76a53fa4f5fd7cf945b2c1366b6853e5fd9888bae
MD5 1896405b36adb31e49e93bb70a026d17
SHA1 769d37d38550f1cc4e89e142a13a208657315a7d
SHA512 1b4576d1e6be8614044506f733080d46c74c52cc9aea2f624754fc643fb020e8fb5edf1ccc1c41f92f8bb1ff026477e983ea8f51eb0661a1c9040f0c6a93bbed
SSDEEP 384:9kI4vcUmldvD8dhWr94zS96oJL4HZL4PGL4H7L4HML4H3L4hO:+I4kRfQXC4q6+4x404H4m4b4U
TLSH
T1F172421545049EB8298FA78AAA367E01C37D473B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 12KB
SHA256 ebd4bc30a3e4e6acc720d337772510e10364d274367d6e7362a94bda195b131a
MD5 f9854c9f290be95378d5c85430eade42
SHA1 cf2f7f5fe7073b9e3d0534f82dae6cd419931f18
SHA512 c303ea3b7a995ba840af1521a76579cd91839b3dbe423479eb110669fb65ed3a8de60bff96fa1b1a446daddffa30f7621ee0ecb3d3311046f46e3c22aea13fd9
SSDEEP 192:GmRsfD4QSSSLRZA0ScSdijOBw88N6ZxsVTzH:IIRZ6NwUan
TLSH
T13342993861448B3F24F332BDAC264AA05D954627B7BFBCD715BC9582444CF2841FAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 6KB
SHA256 6c165dda326e584be72ccac8e57308c6fe16ccd61dd679b175f1e9556144cc60
MD5 bd65e44faf70c308cc754db35a15da5c
SHA1 d2798212e661764734b6ced836d3b4163e19387c
SHA512 06034d8295c51cf5298622cc94cade52c8a43d21d2e7f759e2518870ec57b6b84ecdd0dee822fe4d03411deb5d987642537d6f7eeee0100b5177b341b1cfad0b
SSDEEP 96:xH+UTUQqGqsfD1zSyQSSlvdv9j5nAHdA0ScSqBw8828L4cnEVgsGS:ArRsfDjQSSWdA0ScDBw88W9
TLSH
T125E11F786408CF7FA4B6776CAC6888315AB2413B7BBF68D750A954C4015CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 8KB
SHA256 7b1a19a86467a4b3715205ac3fdc91dc0afaf381da9390f14b6629be5c20bbac
MD5 ddcae907b0939b79e642e19ceeec77a3
SHA1 2341841a08f05432af7cb244de4e53f63d9bfc74
SHA512 749464bb46eab1ec44aca9cf70d5aaf256caab5a163e8f39fcf5a1c3bd4196c64dfd5fee2a559cc759a3dfebd74500bff266800d10b9ae947255b820a0dc93a4
SSDEEP 96:xH+NTUQqGqsfDObzSyQSSlvdv9j5nAWR/hA0ScSrZ0uBw88OI6J8L4cnEVgsGS:AmRsfD4QSSzRZA0ScSZ0uBw88g79
TLSH
T1BA020D386104CB7F64F676BCAC2549705AA6023BB7BF68D710B955C5014CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 7e9081500b5cb83d0df6bce11deaffaf0eab033ef6405f18bc4f168f10dab219
MD5 8fd17a1370f99d0139543c0d01928469
SHA1 c1e7a3cf285d557540c15339162d719bf7aede9e
SHA512 65bca5bfd0849058f17791d8e8cd6c77963e9995226f4387bca64637cb1a7217a86ca4c9c6294266f35411ad051e1fa0a32de3e319922281babe97e319f85779
SSDEEP 96:xH+UTUQqGqso1zSJSSlvdv9ynAHdA0ScSqBw8828L4cnEVgR:ArRsoMSSldA0ScDBw88W+
TLSH
T1EFD12F785408CB7FB4B6776CAC648C716AB2413BBBBF68D750A954C4005CF3842E9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 8ed6884c3bd9838a9cc07399876fb25a18f86c11157c148673879db87e1ccedd
MD5 d62f9ea7a4340c11c530e404bff6a7c9
SHA1 6685ab15254755b98411d7949aca32e493758aeb
SHA512 6ae5423d73188a7b157e749b5af967f3356c8759ae7ec9b0337df4867f883b4c4ec4f754efe6fbab1fba82f015484a832ce540f9e93e61b1f2a0608e468cc735
SSDEEP 96:xH+UTUQqGqsfDObzSyQSSlvdv9j5nAHdA0ScSqBw8828L4cnEVgsGS:ArRsfD4QSSWdA0ScDBw88W9
TLSH
T1E5E12F786408CF7FA5B6776CAC6888315AB2413B7BBF68D750A954C4014CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.baklz4
Size 968B
SHA256 7e996e1b54ebf62dc73c077b2a0e4a2b60d916762f864e5fe55231a5a9d4e745
MD5 c2adffe0508f30585db9c1f593d51ec7
SHA1 8f65b71758f582215eedfcb9e6b0093b043ffa5c
SHA512 a5b02e93ddf209cfae5ed1ec4187aa3dceefbfe7dc32f184b0b23095c2dc87ad1750fa9194d7760a618ed69071ca34aa1ea3a093f05f98d9eab3bc32eadf5059
TLSH
T1D91194C2FF5F7B732B24D107A88D1BEC4BDB305653A45890F91A4202868819BB06A386
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 a80bab9957b995e23999c9dc414912ab52a588ecb6d1e0d66faece17e1353464
MD5 92909871b646d7ec51d30da2031e59ca
SHA1 16daec70ec589a2b950e6b770a74a1f279592fe8
SHA512 7ad2187b634c912ec29b9fe5dc5845b25b3c51039954461a9a8396a1665a30814271880a346c5308a7089bc97b335ac5bd22c7e957f0cf79cdac893aa0ed1f84
SSDEEP 96:pN2QnMP8Kw+j/ELwAHZZO/NHv72S3biMewQfPYIBAkvszSKwc08Vj9WZk5RXzJuz:btnMP8KDYL9OneHTAmsz6ojYZk594JZ
TLSH
T161C19FE6D3292C35D418900683D4CDA0CAF55C75433299C0ABA8BA931F30F96BF7F016
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 467dbf20378679a74e46dddc69aca683cb04d9fed65681308fb1794e9924f5d7
MD5 2ec28086061f53d23fe9be1ff6daf742
SHA1 abbd2920f79e0baac311a87b6e0b67b62a9bf83b
SHA512 9194474169f986dc478546027a6d13cd89484d400a8244a9c2c6f295361b63afce1ef8fe3ccc8fd73052aa81e968b97e9a56dee0e140f78158ca348d7a84cd5f
SSDEEP 96:w2QnM+rIw/ELwAHZZO/NHv72S3biMewQfPYIBAkvszSKwc08Vj9WZk5RXzJu39y:wtnM+rML9OneHTAmsz6ojYZk594s
TLSH
T1A6C18DE6D32D6C3A8119900682A4CDA0D7B15C76033299C09AA877935B30B96BF7E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.3MB
SHA256 dff8b93876734bb7533d226b0d3067060dc9acdac4af43ff981e9c3c0bdec3cb
MD5 bea1b4eb3b223460367f3130bed48911
SHA1 911e9c7dfbcc4ad2218ba9c5910c697891fcb05f
SHA512 8ccc52fc1c7421e1c29e34cf1a667d9b0d053b53ae824c8c5662e2656d8f4f831c64e96bb82f8d454e70e3cb56d553e0b614d253a65e77c66979f8b72caacf77
SSDEEP 49152:sCcYE1QLYc8N5M65xL8bSkDPqLok7sJ7hRz8xf5ISlzqXbg0Ilcr+jlaSZPUZWWX:vUN5M6HL8bSkDqLoAsxp
TLSH
T114764BE420E19253F38644B3718993FB21EFC01C6036CF48579496EAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.3MB
SHA256 da589dfcbcb3d5b321851883737461377542f941980c2dd68accdadfc07538c1
MD5 72d8b644bf602ff5a0c49eb04a929ad4
SHA1 0fd105841deb8a70392d53d8e42d8821dfbc0e51
SHA512 fb38080ae13bc222d3d66922cf27902a259bc827b8fd5135ca3c371d4d32a8399dc82f5af85cca3b2c6c5f4a3e2d2529bb21d368e14ecec6a54753775b71e4c7
SSDEEP 49152:Q9yWk9n/X1fe4y2D3/YKYKyXTlQoqbyr2lvNJwRVmj/88d14AN8Ye1oVYU8M5DYw:HAM5DYH782WjwqLFEIOK
TLSH
T199765CE420E19253F38644B3719993FB20EFC01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads