1eb0c8859451ca7311b44aefe8585f297a4183cbb1d355dc1b4551e6310af80c

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CardLogin.html
Size 49KB
Sample260910-bbv4tatame
SHA256 1eb0c8859451ca7311b44aefe8585f297a4183cbb1d355dc1b4551e6310af80c
MD5 44aba951eb6ed8452d5c9f8440dca560
SHA1 52faf29617203b229404b255c8a665df44436b79
SHA512 515c1972d4bf3510969a0852fb3fa5f3f755c3f8a95edce56dc3fa78ed5aea9550c4e1b98f12e9d3961f01963948e977e1bc73deb2248ef7e769a8eab540fe7f
SSDEEP 768:c9BnSlOZv3OHLOO+iDMj/BQhvWGrVb2u6LfX39+MsCCTxJY:cWiU0QhvWGZCz7
TLSH
T1383394123CC0487205B741DAB4B2D7ADFCB1A157D70288067AFC266B1FF6F869837669
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3388	firefox.exe
Token: SeDebugPrivilege	3388	firefox.exe
Token: SeDebugPrivilege	3388	firefox.exe
Token: SeDebugPrivilege	3388	firefox.exe
Token: SeDebugPrivilege	3388	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3388	firefox.exe
3388	firefox.exe
3388	firefox.exe
3388	firefox.exe
3388	firefox.exe
3388	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3388	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3388	1164	firefox.exe	89
PID 1164 wrote to memory of 3388	1164	firefox.exe	89
PID 3388 wrote to memory of 2032	3388	firefox.exe	90
PID 3388 wrote to memory of 2032	3388	firefox.exe	90
PID 3388 wrote to memory of 2032	3388	firefox.exe	90
PID 3388 wrote to memory of 2440	3388	firefox.exe	91
PID 3388 wrote to memory of 2440	3388	firefox.exe	91
PID 3388 wrote to memory of 2440	3388	firefox.exe	91
PID 3388 wrote to memory of 2440	3388	firefox.exe	91
PID 3388 wrote to memory of 5404	3388	firefox.exe	92
PID 3388 wrote to memory of 5404	3388	firefox.exe	92
PID 3388 wrote to memory of 5404	3388	firefox.exe	92
PID 3388 wrote to memory of 5404	3388	firefox.exe	92
PID 3388 wrote to memory of 108	3388	firefox.exe	93
PID 3388 wrote to memory of 108	3388	firefox.exe	93
PID 3388 wrote to memory of 108	3388	firefox.exe	93
PID 3388 wrote to memory of 992	3388	firefox.exe	94
PID 3388 wrote to memory of 992	3388	firefox.exe	94
PID 3388 wrote to memory of 992	3388	firefox.exe	94
PID 3388 wrote to memory of 992	3388	firefox.exe	94
PID 3388 wrote to memory of 828	3388	firefox.exe	95
PID 3388 wrote to memory of 828	3388	firefox.exe	95
PID 3388 wrote to memory of 828	3388	firefox.exe	95
PID 3388 wrote to memory of 828	3388	firefox.exe	95
PID 3388 wrote to memory of 1108	3388	firefox.exe	96
PID 3388 wrote to memory of 1108	3388	firefox.exe	96
PID 3388 wrote to memory of 1108	3388	firefox.exe	96
PID 3388 wrote to memory of 1108	3388	firefox.exe	96
PID 3388 wrote to memory of 2872	3388	firefox.exe	97
PID 3388 wrote to memory of 2872	3388	firefox.exe	97
PID 3388 wrote to memory of 2872	3388	firefox.exe	97
PID 3388 wrote to memory of 2872	3388	firefox.exe	97
PID 3388 wrote to memory of 2860	3388	firefox.exe	98
PID 3388 wrote to memory of 2860	3388	firefox.exe	98
PID 3388 wrote to memory of 2860	3388	firefox.exe	98
PID 3388 wrote to memory of 2860	3388	firefox.exe	98
PID 3388 wrote to memory of 3660	3388	firefox.exe	99
PID 3388 wrote to memory of 3660	3388	firefox.exe	99
PID 3388 wrote to memory of 3660	3388	firefox.exe	99
PID 3388 wrote to memory of 3660	3388	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\CardLogin.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\CardLogin.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {b692e192-ddb6-4151-a2dd-e775593036e6} -parentPid 3388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3388" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {df389805-1800-422d-8a7d-bf4e4b31d4e0} -parentPid 3388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3900 -prefsLen 27274 -prefMapHandle 3904 -prefMapSize 270279 -jsInitHandle 3908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3916 -initialChannelId {aa201a71-7901-4271-8ed5-5c7aebc8b265} -parentPid 3388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27274 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4144 -initialChannelId {0ad05f9a-1d7b-4084-9809-14f052fb7f01} -parentPid 3388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3388" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4464 -prefsLen 34773 -prefMapHandle 4468 -prefMapSize 270279 -jsInitHandle 4472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3120 -initialChannelId {0f50b4ba-770f-4586-a086-2318c6c2e0e8} -parentPid 3388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5148 -prefsLen 35010 -prefMapHandle 5152 -prefMapSize 270279 -ipcHandle 5160 -initialChannelId {d506887f-aa74-4585-b1e4-10d9d9cbdca8} -parentPid 3388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 32952 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {07f926be-b903-4f85-b25a-35c187f6737f} -parentPid 3388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32952 -prefMapHandle 5732 -prefMapSize 270279 -jsInitHandle 5736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5744 -initialChannelId {e88fc324-4205-4007-a1d3-43a8195c0cdc} -parentPid 3388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 32952 -prefMapHandle 5760 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {b43c7708-a3ed-48d5-aeb7-04c8a707412a} -parentPid 3388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5732 -prefsLen 32952 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6128 -initialChannelId {9f1764dd-ea47-4845-bf3a-53cf02a6a078} -parentPid 3388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 084fec439613cca2c6e57c84ac260ee71aec72f8e282d222a058611b1f7dbac5
MD5 9fe16b43ae704b62c8c7e76aa73930eb
SHA1 cc75b5738e213c33c901db1eac8821ea28294d0c
SHA512 3d5d36673ef587d3b05a2865386d795de3d6fea465ef2652ab3219570c056abbcf78caa5e87e5e54924b4becacee764feba9115643d9242bbb8a57780fbde1eb
SSDEEP 384:HkCjiO024Y69DL84KKDL849B7SOEAd9KVRaAcP+AWRMAh9R:EzZY69DL8lKDL8CB7S/AmVAf+hRMo
TLSH
T1A7728E395F003CBC15A7C0E8C5F5929A8D18B7A7DFE680AD21583D0DCAD8A69B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 df618a56af908c9dc379b6d6a9243a0fbcb8c023a11b0987012d49a89917e005
MD5 02473ddbdfb45580df371e815310d0e8
SHA1 25424855647f573321231b6bb8ed16207e1e6566
SHA512 30ac45c9b23886e3abcf77b97d4238d1caaf02876041f9f538cd18a0e938c09e78752fc7b0d1d8ab016f816f5c88dc44140707c3fdc8dc645b6e274089ffbef0
SSDEEP 3072:j3lHoGZ7IsoViBREmq71Dut95k1L4CGQAKYkM:pHzms+sRu71DiHk1LPGQRM
TLSH
T14AA39FF6DBA2CD3DA5FFD41DAA81C43EFD222404B3A33019C9536351A6C6BB86675708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\AlternateServices.bin
Size 10KB
SHA256 58d94966f5d8693adf7d1f3f6775b054691fa6a7bef1b05c269b898485bc27cd
MD5 f62617b243a28ecac036f4ae8dc2f29e
SHA1 a1e05aca623d33a75cb45ee13c7c42d162e06346
SHA512 199dbc8605ffab445253c5555c3ebefee014cf5e39df11905461cafd72ada1d3ae1f9ff603d4f244569c76eac9bffc69f66d57594e161743a7510001e864bfd8
SSDEEP 24:xuhMZL8OEBY2AEDxc0YjEthvGq0GGjGuE7+lz:HjDjKGgGjGuk4
TLSH
T156227FF33372A1A2F4D25FB5802972A8CC330E351ABAD5D44295D5E203C2AD6E1AE74D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\AlternateServices.bin
Size 10KB
SHA256 3fcfcbd661c7cbb117945d2a9c1ec059f385ba7cb5c436b1a42f3c71264367b9
MD5 5a8a2aa7708b1f6e2d8765479b6a996e
SHA1 e623a141ea6c2373c8fcb287cda27a280965dcf5
SHA512 f12da3cf8f22a9a452775c95551261d03b1b798e857b7eab9fa471d9ca2c7c4df0c50e64568677215a08e06f2e10c0a87d1a651eb967a856c40a78a8af189501
SSDEEP 24:DuhMZ18OEF62IXE9Lxih0uELh/Gq0GGjGIEt+lz:jEKX8cYGgGjGIK4
TLSH
T16F2241F33372A162F4D25FF1801972A8CC330E390BB995D45254D5E602C26D6E16EB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 4e0e9c986fa11d21a48f2d037a9ad9e8ab9988c7c1a212168311a8079b751f4d
MD5 6427361192546c6dcfb9ffd899837802
SHA1 8b750202143d96c6f21ccf4751c5a6a4de7b12f4
SHA512 6b71131e2e92e714715ada84e8aeb1538abf00ed9ea6f8a0734e051e08066997e8315d7a12e64f2f0f75a0a3918748d33a7ab4201c3ae018b374d8b68a5ff7fd
SSDEEP 768:QU1GbqGM/W4CqGcm+uSV3R/zv1bZbcb2bwbJ7Ei:+bqGM/HCiV34x
TLSH
T122C21184FB2E953FD41552BBDCA61B001F79B88A98092F573A4C64682C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 8dc6ca599e81b7d6833540255cb3dadc9579e2689cbfa15888d351fc08e4588f
MD5 ab2d7ad16d50bb4f7cc69382520ab3ea
SHA1 ccebfa52c1747d16ec9ea884f6c0412b398f408e
SHA512 1331982f1bbf26a9d7397d841f26b860632a8df472994499b99e903a167c2f0eba2a231d409d39879c58d8beab4164bff5ee6d2ebb1253dee14a9036d79eab1e
SSDEEP 768:1bqGM/W4CqGcm+uSV3R/zv1bZbcb2bwbJZU1+1i:1bqGM/HCiV34a
TLSH
T109D21184FB2E953FD41552BBDCA617001F79B88A98092F573A4C64682C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6a5811010d3acb4c3834d5769a27e9cd8ca17d09d03bed1f2eaa50426a9f5e3e
MD5 cd91f01b8f4544b1859943fc45a921d8
SHA1 b9ff20fbb30116c0cdc3bce04bffdf1bf5239769
SHA512 8ba058876d11bd8d027ea942ab54ddc2be9cbf0dee81c077989d91b64a0b331b3414f6a342b9f431747434a60c9bfd2021c9748e1e5d5c215ca7c883c6727dcf
TLSH
T150216E5C39B84EAB99CBF25C744112CE57A14E4709871D430D12EF8CCED1AD9327A93C
MD5 SHA1 SHA512 TLSH

Submit Download

21e45b39-4c63-437b-b392-e6bb93e0cea7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\21e45b39-4c63-437b-b392-e6bb93e0cea7
Size 2KB
SHA256 ac1898b42fd8fabb07ec5e8c511bb5ca1c13fda7a529271f11d071b94701dc08
MD5 76e030221d6b1eeed81b2f0dcc0c35d2
SHA1 4e37a266e98d64da1c917a74481c5f5b6b32c728
SHA512 13ef7366fca2270d1bf847bae1a29ee6d5adaf03451b7305adb003ad41fb1b4aec13a77dfb14979ce6de834a018520f72c6fdf4c50acaf1ddbadec363a367602
TLSH
T1AD41535C36789CBB9CDAF14DD59233CD87648A0704C61C432E45EF0CCDA679E63AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

22db2e02-33a7-4d93-879a-4b3f691e03b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\22db2e02-33a7-4d93-879a-4b3f691e03b8
Size 235B
SHA256 bc1691f0c2192e7349c2f3a9f037457b8bd16c11eb9e3df08d3465b89273d075
MD5 7bc286636521a9350bbd7ed21ec04258
SHA1 b6bbdc401f3f10b796a0fa590efdcb5601508847
SHA512 1fa4f819648607b9208d0ca256512a39a8e5b3b8ef31691dfbc224ec9d4f8c0fe03d602366a584f2ebf98fb83b37daf52d64ef186a26c90d4ac963309f191c08
TLSH
T1F4D023C0388C672D0821CF0BF1E268CA30884C332070D820CF910378CBFCDC9416291B
MD5 SHA1 SHA512 TLSH

Submit Download

37251c46-11dd-491e-a90a-df98300d2d49

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\37251c46-11dd-491e-a90a-df98300d2d49
Size 235B
SHA256 e1022e0020128641bf3cd0aa4b3f625c19c176753cd0c0221cb81d45c7d02294
MD5 44041045e7a7f69063fe59f36ef67c29
SHA1 50321e1025975516fce77fc5f4a844dedd8f1e3e
SHA512 a2f73d25e178fa8de91068b87331376f725058ad3c34a8a1f977b9d84e4ae1de336d51aaf41f5d7f53217f448b096e4f1efec46fcc9e637f4228c302cef4621a
TLSH
T1FFD097A014A8676C48080F03F0F07DC630544C332074B810DAA68A79DABAEC84162816
MD5 SHA1 SHA512 TLSH

Submit Download

930e4cbf-ba59-4e02-a742-288cc9681539

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\930e4cbf-ba59-4e02-a742-288cc9681539
Size 886B
SHA256 356c79fe73bf9b44b8b209b1342925445aa7ecdfbea8835c9483a7356373bc4e
MD5 cc9325e6221bcafd9083d2a3b9e012af
SHA1 490d4b10fc882191ba9816db60e7ae1db6f96324
SHA512 217b40ad21762130ac4ee0543194ffec68f0191b9c346ca7dc9ff5fc10ee14bb9a3db83b4466e595f74ce34903af20fa4d24cc17c1037a994c2daaf42a1b5d63
TLSH
T1931104418B2479F2CD68D24B959277424BE4702394C945043EA46F180DEA61ED7A772B
MD5 SHA1 SHA512 TLSH

Submit Download

dba3639a-8ed1-43a0-befa-546884fda990

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\dba3639a-8ed1-43a0-befa-546884fda990
Size 871B
SHA256 0f7878fedd0d0ac006b2dc33c5914dde492d510977ccc08695a507d024a423a6
MD5 d596c4dfe0f9aef57ca19e4d969304c0
SHA1 38591b8a20dedc9fc98e11e15d47132c943ce4b1
SHA512 bf4ff812c60c9368401fda8a5fe609df079149f587ee658322f390d61d1314fa5009d921d2d0660decd0bba16bac655efa189992009d5c192453aff37e5f5dcc
TLSH
T1F5110041972875B6CE68E24B8AA63B414FE4782380CD44043EA16F1C0DBE61E979671B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\extensions.json
Size 16KB
SHA256 2e481dca3a8c5117cdc31d5551aba06dcffc3157adb2da4d1f7cc92a2b5cbd33
MD5 850d82082cfd1545ea2e22d051480a17
SHA1 495db3edc2c4aac7d2c4011107a92cce4a5c6ac7
SHA512 22ff587b89d724aeea692bd673c70ba878842eed7523c6d25dc7379fde0b674b2e2c6ee0d8df2604306e0e309bd6fac3596a03c7b63efd17f02e6514a1addc3b
SSDEEP 384:ISkI4v5UmldvG8dhW094zM96o+L4HXqL4PCL4HPL4HeL4HgI4hH:8I4BRfLXd486P4I444z4E4B4t
TLSH
T17672521545049EB8298EA78BAA367E01C37D533B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs-1.js
Size 7KB
SHA256 38efe6939ac26755bcc7de3ad4dc5e5395f4b7410358e1bebc7dfacdc8526319
MD5 c1d0ba22c05a25eeba3901f77a5f3d5f
SHA1 640dd456f8e1df3a345cd683c3e4d9de8cc89201
SHA512 16bbbac3b115680f8832d381840eb96392e06dc7191131681367b75f66f1c6b5bea8115e42369e215c5fe09cb5b14fe046e32baccbdcd572ba47b166e347f85e
SSDEEP 96:xHvtTUNqGqCf6ZcObzSwSSlvdv9jZlnsRHrDnBw88ibf8L4cn+VLe5t:9ZRCf6ZcKSSK9rrBw88y0t
TLSH
T1D8F10E789104CBBF64F2776CAC2489715AA2063BB7BF68C710B954C5414CF3446FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs-1.js
Size 6KB
SHA256 517c88dc9db02894fe5237d37fd925c55db5e10b3c7c01108a1627326df7fe9c
MD5 4c593f896a84ec37c6a91f5642d2c395
SHA1 1251b6942737a17a1f68df9031de9d60b988ec1f
SHA512 8e47888c7b0a2a2b8eb39ef252d5f5dbc63227440766f3678bfe11f8302db13df8d66ea386aea3cd9ca6f7a22128d0a5f937316fc5c1c9a10c7f44da63b474e9
SSDEEP 96:xHvUTUNqGqCf9Zc1zSwSSlvdv9jMnsRHrDqBw88u8L4cn+VLe5t:9ARCf9ZchSST9rGBw8800t
TLSH
T123E1007895088FBF64B6776CAC6888315AB2013BBBBF28D750B954C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs.js
Size 6KB
SHA256 804e0a75e2e9cab9f6979d3c6f882a3615ad9ee8f3744e70e6eb345f0743670a
MD5 2d9c577a448dc41ca222b3fbce165fea
SHA1 35eefc03cef1e0069d63eee2dbe3d5641cad4bf1
SHA512 42b73e0f55fdcf08ab6fcddd0d9e2dccde5b5c02051597bcf4c8ba44f906cbc615d8341876e1f98fe757ae42bdc283fab88791051d17746eceeb35def636e2de
SSDEEP 96:xHvUTUNqGqCf9Vc1zS9SSlvdv9jMnsRHrDqBw88u8L4cn+VLe5t:9ARCf9VcASST9rGBw8800t
TLSH
T141E10E7895088F7F64B6776CAC6888715AB2013BBBBF28C750B954C5051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 2673e7d03d0da1a104e2bc2f8a2a554b9fb696840fe7bafb135334a5c3eb5a21
MD5 cc4abb98c4d5a4e936ce057413df456f
SHA1 f6e122bcbff71bc3ee0ac6d5d1c3269206353a5d
SHA512 0325dbe46f471962af2e0dde75a3352822ddd6e6d145727e299bc6fd2b12e78220a071d0f9b6dfa2a2f4f84346bcc1d356b0bde866f3ef249bc345538877b8db
TLSH
T1D031F703D4673EE53AA2D59A85894FE186A8316040B619F0848D8F81AFBC42AB643159
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 2904863b816c90527dc30ed57a66ca896b74fd1d20e1c1673320b519acb1dc41
MD5 0280af919cf197d6b5bd3675d8feddf0
SHA1 198169e632ae04511d63480a12a12108109060ed
SHA512 2440cb76aba7a265a324cf3121be65816e492b3c684c06a147f15a3f39ac6e4578096dce1810a74105e45223e364a79b268141f4fb2af553c606f75ef599d90e
SSDEEP 49152:i3qHfgdhffWjYVXQPdAvHT37SDiWSIDL0p:cjTECvHr7SGWSIXY
TLSH
T14A4629E860D1A257F3814073724993EB21EFD00D5037DE085BA95AE9A474CEF8E17B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 7e71411c6b9de5f61bdcfa36fb3271bc00b60850b1b2896dd3bf0b280f97f3a1
MD5 6e46278fce60eab02f2e43d3acc51682
SHA1 4e76c77b696a5d36f6c049a0326aa121ee48b21b
SHA512 421d3fc5043b89a310eb7b7e8104ee2a1e8040d8042bee39981900c40ef691e3f554df32d07c98db10f510ab4a828a3044053cd2b56b36e08951e9f355254043
SSDEEP 49152:M3qHfgdhf1WjYWXQPdAvHT37SDiWSIDL0p:KjYECvHr7SGWSIXY
TLSH
T16A4629E860D1A257F3814073724993EB21EFD00D5037DE085BA95AE9A474CEF8E17B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads