hxxp://montepio24[.]sbs

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://montepio24.sbs
Sample260910-lnrx2at1ds

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	firefox.exe
Token: SeDebugPrivilege	1524	firefox.exe
Token: SeDebugPrivilege	1524	firefox.exe
Token: SeDebugPrivilege	1524	firefox.exe
Token: SeDebugPrivilege	1524	firefox.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1524	564	firefox.exe	86
PID 564 wrote to memory of 1524	564	firefox.exe	86
PID 1524 wrote to memory of 548	1524	firefox.exe	87
PID 1524 wrote to memory of 548	1524	firefox.exe	87
PID 1524 wrote to memory of 548	1524	firefox.exe	87
PID 1524 wrote to memory of 2844	1524	firefox.exe	88
PID 1524 wrote to memory of 2844	1524	firefox.exe	88
PID 1524 wrote to memory of 2844	1524	firefox.exe	88
PID 1524 wrote to memory of 2844	1524	firefox.exe	88
PID 1524 wrote to memory of 2268	1524	firefox.exe	90
PID 1524 wrote to memory of 2268	1524	firefox.exe	90
PID 1524 wrote to memory of 2268	1524	firefox.exe	90
PID 1524 wrote to memory of 2268	1524	firefox.exe	90
PID 1524 wrote to memory of 2204	1524	firefox.exe	91
PID 1524 wrote to memory of 2204	1524	firefox.exe	91
PID 1524 wrote to memory of 2204	1524	firefox.exe	91
PID 1524 wrote to memory of 4352	1524	firefox.exe	92
PID 1524 wrote to memory of 4352	1524	firefox.exe	92
PID 1524 wrote to memory of 4352	1524	firefox.exe	92
PID 1524 wrote to memory of 4352	1524	firefox.exe	92
PID 1524 wrote to memory of 1492	1524	firefox.exe	93
PID 1524 wrote to memory of 1492	1524	firefox.exe	93
PID 1524 wrote to memory of 1492	1524	firefox.exe	93
PID 1524 wrote to memory of 1492	1524	firefox.exe	93
PID 1524 wrote to memory of 1756	1524	firefox.exe	94
PID 1524 wrote to memory of 1756	1524	firefox.exe	94
PID 1524 wrote to memory of 1756	1524	firefox.exe	94
PID 1524 wrote to memory of 1756	1524	firefox.exe	94
PID 1524 wrote to memory of 956	1524	firefox.exe	95
PID 1524 wrote to memory of 956	1524	firefox.exe	95
PID 1524 wrote to memory of 956	1524	firefox.exe	95
PID 1524 wrote to memory of 956	1524	firefox.exe	95
PID 1524 wrote to memory of 2292	1524	firefox.exe	96
PID 1524 wrote to memory of 2292	1524	firefox.exe	96
PID 1524 wrote to memory of 2292	1524	firefox.exe	96
PID 1524 wrote to memory of 2292	1524	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://montepio24.sbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://montepio24.sbs
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {c2cf3d8d-36a3-4fce-af2d-b142b5ea4445} -parentPid 1524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1524" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {8a75181a-b7f2-4c5c-8f4a-3508f2ea8835} -parentPid 1524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3872 -prefsLen 25164 -prefMapHandle 3876 -prefMapSize 270279 -jsInitHandle 3880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {50088d05-74e4-4082-b2af-77dbb866637a} -parentPid 1524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27276 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4128 -initialChannelId {459740e5-6961-47a0-b429-61ace24ffaeb} -parentPid 1524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1524" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4336 -prefsLen 34775 -prefMapHandle 4340 -prefMapSize 270279 -jsInitHandle 4344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3224 -initialChannelId {04b10561-c265-4f3d-94c1-8139aecfc77e} -parentPid 1524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5044 -prefsLen 35012 -prefMapHandle 5020 -prefMapSize 270279 -ipcHandle 5036 -initialChannelId {aabb03d0-5d14-4cd2-9c05-c2b3bf1c4905} -parentPid 1524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5156 -prefsLen 32900 -prefMapHandle 5160 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {eda4fb09-f82b-4e86-99f6-f489a909afe4} -parentPid 1524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5216 -prefsLen 32900 -prefMapHandle 5220 -prefMapSize 270279 -jsInitHandle 5224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5012 -initialChannelId {39ac7338-c306-433f-9834-4d47842ba1d4} -parentPid 1524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5568 -prefsLen 32952 -prefMapHandle 5572 -prefMapSize 270279 -jsInitHandle 5576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5584 -initialChannelId {96e3d6e3-0a28-4d13-abea-7756490bd4a3} -parentPid 1524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 902ea084f6b84b6fe247ed345fab80f7b019471217a920fe2181e5bdb0c79852
MD5 dd016ffa3481c212426d82c89c195f99
SHA1 a3ba8ce85c0b1b1ebf3c64471b92b2c789e7a76a
SHA512 a62ea8899c79689a084fa9d12e966da03981c080845203d012d3c3637e008ad8e4fe6ca3c965a7f3afa2d50add72850b9ee0b2d511f0b9151e7369fc43a1a076
SSDEEP 384:HkCjiO024YJDL84KKDL849B7SOEAd9KVRaAcP+AWRMAhi5:EzZYJDL8lKDL8CB7S/AmVAf+hRM1
TLSH
T1C0728E395F003CBC1597C0E8C5F9929A8D18B7A7DFE680AD21583D0DCAD8A69B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 64290f6d2a12381dc0dc77b17c68c98a522ac6af0ec67b08cce491b77d2b8aad
MD5 ff8bd03ebf4033eff249905e11a288da
SHA1 a9107b6694b43ed1d05166bf2948cb1672f1d2df
SHA512 67c11fa7202c7df2d5b9bb3f2bf1ee6a2687c58d0953631e605c8bfae0aa0cf0c7e503924897efdec25e415fde7910ad6c94346273c84b37f3ce510c25d345a3
SSDEEP 192:Mp1d66JozGzgCl6mc0d3POv5zbowbqmyjFx:Mnd66JozGzgC1j9gbowbqmyj
TLSH
T18DD1DEA8F628463BC448023BCDA60F410E36395BEC4E7F26319D745D2D562DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9ef3b864e7d1e0f243eda665429e6bdc4de4ee14f42f672601064c62605b232e
MD5 9ce80152da98f17b4fbff318531d6ab6
SHA1 127662b6f897da28e1d02f181c018e0283a67e6c
SHA512 c9097ed2fd91d5e6508f7bb6c6a95d46cbbd3b99d5d494464172d14ac5a0544eb067c51170f867d82b940b10945c5551f96fab398513a5298b57fae3b785722e
SSDEEP 192:RPOv5zboPIZqmyjF8kp1d66JozGzgCl6mc0d:RgboQZqmyjFnd66JozGzgC1j
TLSH
T19EE10FA8FA28863BC408027BCCA61F414F35395A9C4E7F25359D741C2C5629E3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 44KB
SHA256 763448cf4a7d7b82599462fb5ff66e7ec198a8881ed4b53cce522de4ecbab3b8
MD5 2025face18bb7f776cce28fba15e807e
SHA1 c369c65c46f06c798413ba3a7cde83283d1ad2a5
SHA512 32c5f73dbfb1bf406d6eac1439d9ccb39a72052b98536966de963e8afd3f9468deb54aea96ce26b2438ae8de68599edba088dcf0a5635d9106a55d2fac1f6d5b
SSDEEP 768:D+ubFvXShqKxGcmhu9QKq7UptUsUCJM/Ijfcb/babeb3bVbpb8bjb6bt8cTBebDf:D+ubFvXShZ0cW8cTBebDsCIsMjY
TLSH
T18C230144EB1A553FD42802BADDA50B003F39F889591A2FA73A5C64786C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4611df0c1c50eccc6e6c448eb2aeaeefb4f563c1945dd8079fff6e4c65c1e3c3
MD5 427d48ef115594bacc50626bbc8a551c
SHA1 a4c596b82c3a76f2214020cf980daf7ac00cdcc7
SHA512 376c518eedb43d5c1c4053e4da0ab5f20695ea37a04bea955dd811750bdc9743c1aad398bb7335cf1f66f996718b172aad964931c44145479fd75bbb3a61c2dd
SSDEEP 192:Mp1d66JozGzgCl6mc0dOPOv5zboxbqmyjF8:Mnd66JozGzgC1jwgboxbqmyj
TLSH
T1FCD10EA4FA28863BC408027BCCA60F414E36395BEC4E7F19359D741C2C5A29E7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2327d034f3c6f526b6ab739d21b7f98ed1a1382b2c021d64252b541720dcd7d4
MD5 c9d7d2a797c3fa650d87ea94f7455625
SHA1 006f551d8dce4a846fc8c1442532eee8a74d8c01
SHA512 ee10da1e429552b26698445c8a40061c1ae57f70a5bd4dfb375e255342ec1ad18caf549a0fb5db8379939f802732f1553b692c86a4c31f62eb4edde4a1c5cd67
TLSH
T17B217C6C39B84E2EADC7E25D7591028E93564E07448B1C438D12EE8CCFD16DA327B83D
MD5 SHA1 SHA512 TLSH

Submit Download

3ff5ab3c-a3f1-4bc4-bafc-2b4fe063c9b7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\3ff5ab3c-a3f1-4bc4-bafc-2b4fe063c9b7
Size 2KB
SHA256 adff3b05738245d76aa4f85c7f2b72fea48f6291a25eb4a191666fb3737bbe9b
MD5 48f8977ab5d602b99e43c164600bd1ab
SHA1 ee242a8497a140d1a4f616c4ef259fbe4cbeaec7
SHA512 2c4116dab6d9f78d2a94cd05ed1fc2af7d6e798fd00a97062d378bff37c2d75609b493b5bf1e5ecb7e0df3134d9af183b749c8df84448b06d7a4331a78720a66
TLSH
T1E441439875785D778CEAE19CD082378E17A08E1340C72C932E61EF4C8C95699232B13B
MD5 SHA1 SHA512 TLSH

Submit Download

665ec2e8-907d-40b0-adb8-93310e07a346

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\665ec2e8-907d-40b0-adb8-93310e07a346
Size 235B
SHA256 83ba7ef6b824136caeff63b82b5a109394693429826afba27deb4d1d76f32dd6
MD5 f0dbd658e42f4f92240fce22d72217f4
SHA1 3b236cea1b68c67a0cb53bcc747393e02cea59e8
SHA512 b00cfe8480d6c26c6248590c66743bf4256e3239a0f236fbd75bc9996bde1e19daf626bc8aa42cdcf0f69b002f660899b26f87cdcb4003fdfd1b747c265328bd
TLSH
T1E7D095C05494672C48100F13B09155C6B0444C3350755810D55055749DF99C44361516
MD5 SHA1 SHA512 TLSH

Submit Download

734607a6-507d-4333-9d7b-1972c987d41e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\734607a6-507d-4333-9d7b-1972c987d41e
Size 931B
SHA256 417133af42cf2a4f61f9ecb237b3bf574302ae682e864f501c27e0d496e4e06f
MD5 239110b0c40f3dcba7d71bfe4b5e9278
SHA1 1953668e4cf57e06779221abc7a1c59ab112694d
SHA512 8d86bc91a1e2499d2673a686a93f508990c5e55db15410d7ebefe7c2197383c8fcea675d0c9322f58a0d27ab3807d437a5c504777e5f08c2b651e216f272a095
TLSH
T12A11D4D1AD20B5728CACD247A5E577976AE06533C0C645143E913E280DAE62E632A607
MD5 SHA1 SHA512 TLSH

Submit Download

8341f763-a987-442d-83d6-ed580d97bcaf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\8341f763-a987-442d-83d6-ed580d97bcaf
Size 280B
SHA256 d78046f89873ccfdc8aa61fea8b3f771ccfa065164b8eeefc6818b479b4d7fd3
MD5 6aca7449798e245a27f6efc5552eb36b
SHA1 7a90b18076cda9be3b644a778d671726e42ead25
SHA512 0c5fb268d1aab4963e6d6d4e7780ced657f96d98f1d98a26e8db11f89729505fe08f253fe454810b8bf295fbc034b161617c290b9f40a4773e86e31ef4fe2779
TLSH
T1DAD0EB8A28C8335C0C380F0BB0B035F7B0A40C3325E52820989101A48AFECC88020816
MD5 SHA1 SHA512 TLSH

Submit Download

a83ee49b-fe51-4f75-8aa4-225b34ed3c1a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\a83ee49b-fe51-4f75-8aa4-225b34ed3c1a
Size 16KB
SHA256 32b8e78a6713b324488b9a5d03ffaea6ed45645078c638d09834414919661e1d
MD5 7801b89dcd4465df87f3143d10ad426b
SHA1 eeca8ec44cd0ab12f88a33fa42a31058641dd5b8
SHA512 bd146f430b1abaabb771722b2edf49a32ec2aea3cd96687a6459252969917a9955ed05944989e2b8101d7e0a6dac2a25c5767d2e9018a3b716751907a138a0de
SSDEEP 192:aEljOcwoy1ezxNdB+11bY8+chJQ8uTV8wUm/x548Jz+VcL2RBJ6M0yysnKMTb8A/:RlCcwoy1elvmbj+MJQ4f+RA9Xue5
TLSH
T14E72C856686045BA8251E36898F8BFC3E5F638CF4C419FCADBE4BD0819DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab26d02f-f4cf-4be3-a2bc-e0b2cbe04f5d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\ab26d02f-f4cf-4be3-a2bc-e0b2cbe04f5d
Size 883B
SHA256 41d8297aae762fa17c645eca17da27991204a89ff8755f2a5f346e136a79f4ed
MD5 5d83be695169e2973f0a7122a936da96
SHA1 d7caa668c0c31b2f84b62184761c239c4fac82a0
SHA512 621c2b5539e8d666383e33109622a5a718988cebf8deff2ff870dd1400da1fa54da42d7474f72970315b6d9cd42816934082ff01879614404893e5a22f7f9809
TLSH
T1DE1123C1AA30B5B2CC6C8247C6D57B424FE47A33C0C984203EA07D280DBD92D976B607
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
Size 16KB
SHA256 93fde6b284ed660dc69a21c5ec13d2975a3058941245f90ccdd2c3da1891758b
MD5 0b38fd1fccfe19633c0113f35bc96503
SHA1 b13ded1fd845a4801f4bc41ef2d3a750562e064d
SHA512 8c37f948372fca4116a430c4208a80e26d518c9fcaf8a4ae6006aca59fe0dbadcafdb9d5a7d13f2fd04e698ad0552a0a61bac7583aa17e45798f805217f58ee3
SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4HLw4hn:ujI4VRfOXN4e60434L474f484x
TLSH
T1BA72431545049EB8294EA78AEA367E01C37D473B60845C78F4DD8FC802FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 8KB
SHA256 ba939329883eaab798923d5f8374d1c825b16157f7970108081c258901e5224a
MD5 b280f0b51d4b6c99307e17fa0b256a22
SHA1 80d6edb548fc86e9df7188e5d610148e837b1561
SHA512 1c896930fa7944eb45cad091ee005a02335caa7227b09d4772db27f6e93213f6ec9baae1897214205e7b48f2925d4b954ec95f4f7cc6f99d1bf1067784fa5bd9
SSDEEP 96:xHcNTUuqGqdfpMAObzSrSSlDdv9janERWRhBO+yyEBw887YEH8L4cnrz4jGS:6YRdfpMA9SSR8RiXBw887ug
TLSH
T1D2021D7890048B7F74B6366CAC6889705AB2463BB7BF6CC750B954C5050CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 f504527d2577091bcb12ac055562fe4188fa32078f9a27e44f935a1417f727be
MD5 ef14a54fa0a17b37e339ca01484285c0
SHA1 146aa84521eb491ba6789720e943242eae59d010
SHA512 3b5066d30aa0b2a3f3b583d2f44b130959e93da7453b56ed87205f646d45419342f9d7e4adb22d4e51c0d6c74f44e932646e29337b61db0791c02c91a862025b
SSDEEP 96:xHcUTUuqGqdf2oE1zScCSSlDdv9jtnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEFCSSA9A1Bw88+w
TLSH
T1F0E13F7894088B7F64B6767CAC6888716AB2413BB7BF68C750B954C4050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 7KB
SHA256 d50f919e11b9012841a2b250381c2dd6486d0a34c2c911bf26c5e737a7dbce17
MD5 073c14774523442838114c8f594453bb
SHA1 b9f2c9c90a9f05fa895727670b3c403394d67056
SHA512 e332122194cd88834b184336a3aee0ba47c5b2c03322ad772d7e4c8aa190ac1f2b9923aa3bf26fea1e2d1700000d1d25e3d809357ef452e4515a7adb0872d230
SSDEEP 96:xHcUTUuqGqdf2MAObzSrSSlDdv9janERH9O+y1Bw88n8L4cnrzBHjGS:65Rdf2MA9SSR9A1Bw88+X
TLSH
T1E2E1307894088F7F74B6766CAC6888716AB2413BBBBF68C750B554C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 03df49aa333fef5c52fbca7f1ffd9397907f0c07179778d597cd969dbc917722
MD5 6c433683cb918d9c366bcab1fccf3a0b
SHA1 af6c2c2119d7ef29cc31729c2910b92a00da2064
SHA512 a74514110c436fde62874fb0266c0b39f973bd9c966e3ca38d270845bd0dcfa495d9305e26e2a82f1920679eafa97b50ece31408342304e3cab6fbe5c7f25c4a
SSDEEP 96:xHcUTUuqGqdf2MA1zSrSSlDdv9janERH9O+y1Bw88n8L4cnrzBHK:65Rdf2MAeSSR9A1Bw88+w
TLSH
T1F4E12F7894088B7F74B6766CAC6888716AB2413BB7BF68C750B954C5050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 cf57608b600e92a204e979c58ac0fc4a205f933a933450c9f3b6e7fea07dd031
MD5 779eafd64f163ca5e3aeada03707ed60
SHA1 c208925e803dd04f510157a73d6915ff5864f5ba
SHA512 ca2ba8b16671b0c085e7dee6ab35100b8352c39566e1d59c4b97921c18e6306d9b30ed656d570905bc7984283543a8d1650cee79c8c72f047ecbcad8e908060f
TLSH
T16521E7317C7A6FF53E212117D19D0FFA878624228D3848A095BD975640DC21C330E528
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 cb4e28e83446321ef43d85d7e3f18194f417973dbbef7691995e14e2a8b8cc30
MD5 d512934f42d0ce40d08ade720c21c064
SHA1 3526709380fb49e7772a100eef109f1481c1ca45
SHA512 fc16bb0fb6686c7aa10ffd3678c335589175115e5830f509a65af79cf971e6fdc8834133942fe807dc1c47ab7a53dc7f9e683fc5c392e5b0c35e3a35f1a81208
TLSH
T17D21D84AB9AE1EFA1B21C246D5DE17AEBA4B7042467448C2D1BAA7044118A9E310F215
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 5b679ba79efe84b5c491033e9221b934034ec64d503dca4a109d49034dd3f920
MD5 0012481970ec7cf058e55420e92cfd79
SHA1 fc495f1327d30486bc0af613aaea2cdcd6a18e3f
SHA512 13155c333112badca983047d54c53c9e8d8507a94a4b6713033d5adb3d7391d4888d1944df0f443daa1f1c3018b87dce14e7fe094ab635d835fbbeae0e2ec1b8
SSDEEP 49152:mDmghuVI5lU525aJdaTeaKvgmRBbFOYpg/Kr:imQuVI5652+2eaKvgmi/y
TLSH
T1B02639E820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads