0571b0ae077d985616acf9f4101e8338fc225b1b22aa7b339100c7ea3f3022be

Analysis

user interaction
yes
max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/09/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_linux.sh
Size 12KB
Sample260916-2nhmcsfb96
SHA256 0571b0ae077d985616acf9f4101e8338fc225b1b22aa7b339100c7ea3f3022be
MD5 f9a9bda46ccded2442727f6192bfe00b
SHA1 f790978c9d0f6bedc3c0ac596ab5ca31cb9259e4
SHA512 3acb92c0d5b1036692d9d01f79d34b0cc47e132bc000f4d668af93c34943510c1cebcd1365297119c81e3b6066631c63aaddc828d96ffadde3addb3829687815
SSDEEP 192:20Rne9rag8tTiRo154XFs0aRdr8uN+1iTn64A5t2xvHTKm7s:zRYBYrTyH2Nmx
TLSH
T1C6420C44B4594EBA031DD2F9E992E8E86A0D813F4C635D3C744FC0EA2F616D770F8299
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4444	cmd.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	firefox.exe
Token: SeDebugPrivilege	3884	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
8	OpenWith.exe
3884	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 3884	5256	firefox.exe	82
PID 5256 wrote to memory of 3884	5256	firefox.exe	82
PID 3884 wrote to memory of 1192	3884	firefox.exe	83
PID 3884 wrote to memory of 1192	3884	firefox.exe	83
PID 3884 wrote to memory of 1192	3884	firefox.exe	83
PID 3884 wrote to memory of 3716	3884	firefox.exe	84
PID 3884 wrote to memory of 3716	3884	firefox.exe	84
PID 3884 wrote to memory of 3716	3884	firefox.exe	84
PID 3884 wrote to memory of 3716	3884	firefox.exe	84
PID 3884 wrote to memory of 3760	3884	firefox.exe	85
PID 3884 wrote to memory of 3760	3884	firefox.exe	85
PID 3884 wrote to memory of 3760	3884	firefox.exe	85
PID 3884 wrote to memory of 3760	3884	firefox.exe	85
PID 3884 wrote to memory of 4496	3884	firefox.exe	86
PID 3884 wrote to memory of 4496	3884	firefox.exe	86
PID 3884 wrote to memory of 4496	3884	firefox.exe	86
PID 3884 wrote to memory of 5392	3884	firefox.exe	87
PID 3884 wrote to memory of 5392	3884	firefox.exe	87
PID 3884 wrote to memory of 5392	3884	firefox.exe	87
PID 3884 wrote to memory of 5392	3884	firefox.exe	87
PID 3884 wrote to memory of 392	3884	firefox.exe	88
PID 3884 wrote to memory of 392	3884	firefox.exe	88
PID 3884 wrote to memory of 392	3884	firefox.exe	88
PID 3884 wrote to memory of 392	3884	firefox.exe	88
PID 3884 wrote to memory of 784	3884	firefox.exe	89
PID 3884 wrote to memory of 784	3884	firefox.exe	89
PID 3884 wrote to memory of 784	3884	firefox.exe	89
PID 3884 wrote to memory of 784	3884	firefox.exe	89
PID 3884 wrote to memory of 6116	3884	firefox.exe	90
PID 3884 wrote to memory of 6116	3884	firefox.exe	90
PID 3884 wrote to memory of 6116	3884	firefox.exe	90
PID 3884 wrote to memory of 6116	3884	firefox.exe	90
PID 3884 wrote to memory of 5980	3884	firefox.exe	91
PID 3884 wrote to memory of 5980	3884	firefox.exe	91
PID 3884 wrote to memory of 5980	3884	firefox.exe	91
PID 3884 wrote to memory of 5980	3884	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\setup_linux.sh
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4444

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {84e878be-b343-4c67-abcd-8978e437033f} -parentPid 3884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {7a125949-6025-426e-88b1-4e1ab05d9b2c} -parentPid 3884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3800 -prefsLen 27274 -prefMapHandle 3804 -prefMapSize 270279 -jsInitHandle 3808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3816 -initialChannelId {e0c14f2e-5309-4ded-9445-3e1fcd1061ad} -parentPid 3884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27274 -prefMapHandle 3968 -prefMapSize 270279 -ipcHandle 3984 -initialChannelId {a6d1a650-057a-4869-9ec4-9bf1f3abe348} -parentPid 3884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2972 -prefsLen 34773 -prefMapHandle 3176 -prefMapSize 270279 -jsInitHandle 2648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3212 -initialChannelId {0dab712a-42f3-427a-9e3f-8f66e61efdbb} -parentPid 3884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4972 -prefsLen 34822 -prefMapHandle 4976 -prefMapSize 270279 -ipcHandle 4864 -initialChannelId {2b47c7c0-ca65-47d3-b659-153af6ccc688} -parentPid 3884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3136 -prefsLen 32952 -prefMapHandle 5512 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {d0bdc86e-9158-4036-93c6-87339e377fbd} -parentPid 3884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5680 -prefsLen 32952 -prefMapHandle 5684 -prefMapSize 270279 -jsInitHandle 5688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {bffb0d22-c912-4598-afe3-c839b9b7dc20} -parentPid 3884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5856 -prefsLen 32952 -prefMapHandle 5860 -prefMapSize 270279 -jsInitHandle 5864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2864 -initialChannelId {484d73dd-a486-4443-9f22-52d3da1d1ed6} -parentPid 3884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wi9zt29h.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 2e91358c8c72192b99aaf871f57a6f7b37d405f05174e9916cf7b032eb34e9fc
MD5 2145264fd3d7ed1d2b4799e200db5574
SHA1 07d224b3b43760f0908d7da8fabf047a21323b02
SHA512 5aa6c6ab62c6962638af047eda1d1d4a9c7c2102272da7e04d53c8e4fba327992237f2300e37d4cc1b46bfe42740a8c0200e51ed37d319f512bea5e89c89ba94
SSDEEP 384:HkCjiO024YazDL84KKDL849B7SOEAd9KVRaAcP+AWRMA1:EzZY2DL8lKDL8CB7S/AmVAf+hRMU
TLSH
T1F7729D395F013CBD14A7C0E8C5F9929A8D18B7A7CFE6806D21583D0DCA98A69B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wi9zt29h.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 00736b4f46af684076dd05480b7276a809cc32898454fb7ae6bf53da01752b7a
MD5 a2aad0645453042ab9a9558f44ab6873
SHA1 67dbfcc868251076dc0606ed921d5ffa146c0297
SHA512 5fdef07c5a98bc6b553ae78048dd2bba3c70105f49c8ed24e5d30cf08a180b9686641f1b0e2634df8163d14506bae670486e3e1a8a6730aced247c2790262399
SSDEEP 384:HalwSiO024YFDL84KKDL849B7SOEAd9KVRaAcP+AWRMAFL+kQS+kZ:6l8ZYFDL8lKDL8CB7S/AmVAf+hRMCLdV
TLSH
T107728E398F003CEC15A7C0E8C5B943A98D18B797DFE6806D21683D0DCB98A6DA5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d48c050-4202-4406-b2fa-37badab91527.zip

Path C:\Users\Admin\AppData\Local\Temp\4d48c050-4202-4406-b2fa-37badab91527.zip
Size 3.8MB
SHA256 3a5e0e3ef423465432da3d135fd7f95d6ba85c3a757e033b768e1114fd4cbc34
MD5 5f2ed53987e2d297b524878097e2e2cb
SHA1 be3dde5b23a4e265ec21cade974ded4d6fed0bbf
SHA512 d1dbb6841420d642a2f681b0be8b165406cb21230b5bce48923325d8c9a021b64e864c1250d45c6d82bf60ad6f5d7ff498e4d76fdd919c5b9146dcdba4765f74
SSDEEP 49152:GofTTXwMPZ1Lk5vPYaX+ONJdmLB56yP8OrleqmepQH2BeIOBq4hEa2685/M6E03a:G6TTyPY70mB5zs8pQHGeI4hrUt344t5g
TLSH
T12A06E035D65C1608C98F83BA850F2FCE8B0C4FA6B054BD6F6A6A95715FB31A11B7C84C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 23f6b263738a663198f87d30bf27a85ca925e677e8813c45ef4eaf8bb88c5503
MD5 c41176d40adc65b6d923caf46676bffa
SHA1 0908cde49639df61fbe5e8a2d96b703086545b9a
SHA512 af121fa63fb4023a0892c5ce32fcc7f66b8b90b3cd1ee87132adfc0eb081bec9569df39fe730343630d12b20da93167160d1a186a68ba3bbe5b64208d2c7e1c5
SSDEEP 192:zOv5zboH5ZoRyjmOR751d66Joz0dzgCl6mc0dz:cboZZoRyjz3d66JozQzgC1jd
TLSH
T15AE10D68EA28867BC014037BDCB61B454F35389A9C4E3F2935EC64182D466DE37DE1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 765919628691a46a27e21c8f53e712333957f7789e2fc7332b49770c6f039218
MD5 0f0ab2f2d87012421862e5f7a2750b86
SHA1 70c96a898015d05b5db1bba95bf945de8953ec9a
SHA512 329cf722b63a526aedc63c357727e6f5c43ffc5d8babe1d2b513b438e7bff7d2b6fee66100e653f66e47c4e6afe0947eb4b01b84bbdb8725cfaccbb81714c724
SSDEEP 384:zboBoRyjY3d66JozQzgC1jWwCiSYLO8pvtGcmhusbRgtKDphH+bHbE3:HjWmUwwiZtGcmhuWEKDphH+bHbs
TLSH
T1B7C20F84FB2A953FD41552BBDCA507042F79B88A581D2F573A8C64682C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 53561a4394f6d1854c3c65958d9d63a1b53732846ad87fd622782aa8635fbb02
MD5 22aed58067405c321eecf5a6277cfd0b
SHA1 1e0fade09784d9ce6cdac693c430fbc88d8b089c
SHA512 de76756fe9c30442341a05243ca067568a930e23facaad53df4001da95ee94609460019a45fdb92c2278e74801d6298352198e72f9af2312cbec41f106aacc10
SSDEEP 384:ZwCiSYLO8pvtGcmhusbRgtKDphH+bHbE3MboBoRyjY3d66JozQzgC1jd:ZwwiZtGcmhuWEKDphH+bHbskjWm/
TLSH
T16FC20F84FB2A953FD41552BBDCA507042F79B88A581D2F573A8C64682C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8818d97a25cf9c8025c14535549614e8566b990de2d40d44af0be58ecefc654e
MD5 f40f7f1702fb5c67f7882bedd8e65249
SHA1 64bee77727e26513b79b664e4ba0ff39cbc89ca3
SHA512 6f019b58c5d6ef881a4e59e0691a941a285aed246e285140b65a5c9965db863cfd13f66c40cc919cef6880a3a4b5f452fbdeee5833ed1815631a25c1b2f83641
SSDEEP 192:EOv5zbooZoRyjqxq751d66Joz0dzgCl6mc0d7:HbooZoRyjd3d66JozQzgC1jt
TLSH
T172D10D68F629863BC414023BDCB61B810F35389B9C4E3F2531EC241D2D966DE369D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 d3eac53eedfb9a554c7099f713dc42b868e1019ed3087b1fa9f8290accc4e202
MD5 90f0354d92d1a754e84593811eb28ef7
SHA1 5616075b02ffc5c13b706ca66187bdf8b65ee326
SHA512 55ab7de14a60f4b42e35685329e0af3bc0cb9cc2f581cf4525d108c40dc523c07aaa2b34398a107c880815e333e5295bb264f6a49e7e62de1bbefc40a6aac670
SSDEEP 384:zboUoRyjFwCiSYLO8pvtGcmhusbRgtKDphH+bHbE3B3d66JozQzgC1jd:HqCwwiZtGcmhuWEKDphH+bHbsmm/
TLSH
T145C21F84FB2A953FD41552BBDCA507042F79B88A581D2F573A8C64682C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d8deb3d3a188da2bdefc774b7f418a77e35771bd812cdd2276ec977039b161c7
MD5 839274bf2421359ab8d77dd18a26a3a6
SHA1 b577e101148a63f9dacf3f90df35fddb69018d88
SHA512 2f54145fa67ae4a61bfbba2c5272dc300ede469c814f43b3544bcb2c02919ae83db92bee3638dff4d273579921083184428907b8eeb4ddc3ce06c5282f73b3db
TLSH
T131216A4C39F84D2A68CBE29C7480128E57554E0204871D834D53EF8DCE826E9326A53D
MD5 SHA1 SHA512 TLSH

Submit Download

03252dde-94a4-46ba-91a7-402f025a24da

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\pending_pings\03252dde-94a4-46ba-91a7-402f025a24da
Size 883B
SHA256 04797c364d25db3d051fe8b0e5b2057ea2a0907d9388ada70dc62751320a56c9
MD5 8cd34538f549d28f5abb45e9bd92480f
SHA1 6bce3d2215a35d4cc252c7b1d4f0aeac48540cde
SHA512 6e75b6691af7ae2c3ea81c1d3baeb6fac755b8b56f4ee0e039040cbca9e648f6926ba3c044c3d3cc7549a93e97c026ea9a37e5ee19d673068bf5c09d0d5ff34c
TLSH
T17B110054AA2175B28C28924FC9B5370257B47623C0CA95103DF45A044EB9A1EA3B720B
MD5 SHA1 SHA512 TLSH

Submit Download

26c2defe-f1c8-4dbb-ac61-23817ec4b549

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\pending_pings\26c2defe-f1c8-4dbb-ac61-23817ec4b549
Size 235B
SHA256 56dbfe3d6369dc6bfa61c07e6d18b428e23a8a9ced297a92983a73172683cf05
MD5 393b8912fcc11da5c97c7bdc7a82bcdf
SHA1 c2148a27263254f844ce5e21299ff10ec6565e1d
SHA512 5c0b4c97894bce63838ac4d233378a24ecf12e432f9eae23cb704db1eb54510646104604594fddef7e0fb22624db06953c56f19c7857da421cc9ee47accb9903
TLSH
T192D097D068A823AE48008F16B0A0BAC23044CC3324B49860D7A492B8CAFCEC40222C1B
MD5 SHA1 SHA512 TLSH

Submit Download

2a633db0-76d8-482c-ba8f-23c80b669b6a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\pending_pings\2a633db0-76d8-482c-ba8f-23c80b669b6a
Size 886B
SHA256 db7bd1a5990661db9a30e3923c69422b02d6debb1cbe772daf17d608c4ebea60
MD5 e6f64e8e566fbdb59a932bbcf78f33cb
SHA1 268697a031bbe1e45491d94638633efa5216170e
SHA512 50ce2382b24cf1e4865edb2a98bc23eef81eb7cf681bab5a197f5170ba1ee872ebe3923cb6e287a925260df59901726edc7412a0328a123006dbb4414f813d14
TLSH
T1C1114051AA20B8B28C38C28B89F17B0397F43423C0C65A107CE45A180EAA11F93F630A
MD5 SHA1 SHA512 TLSH

Submit Download

9ef1cf47-9b0b-4134-b39f-0b02f63e7cc5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\pending_pings\9ef1cf47-9b0b-4134-b39f-0b02f63e7cc5
Size 2KB
SHA256 02e207685f57a55058802b263e9172de36a4b468afd7175a9e7f3cca89f3ce24
MD5 e8bfb78968661c6e8247ac904bdf83a6
SHA1 10b5e818f3c185fb4a905ff4e48bedb8519b67c9
SHA512 61cfb7a070bed5f0cbdb8225ccd90c96508941e13453d3e54198c34060b72000cdf493f7557f748a4fc1679ac10eb625c9018d2cf162ff28266de96a29df5c05
TLSH
T18841216C35F84C769C8BF54D9491338A53608E1354C228832E91EE0CCEA679A73AF52A
MD5 SHA1 SHA512 TLSH

Submit Download

bbb720f9-fbd1-4132-8476-0e8ab2f07cef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\pending_pings\bbb720f9-fbd1-4132-8476-0e8ab2f07cef
Size 16KB
SHA256 58081bde065da5d717a65176127e50774b0f605553d6e257bf18b2b332e7eb50
MD5 4b8bcf599fda6432549a7234929d4656
SHA1 24c43dc919adfe150ac6c95f84f003aeede122e4
SHA512 e66e56dadbccb733ce45b9efbe2d2e79a0e8a7e725c78d754948bfe64470f9410dc5371e660be9fb165dd19e946c000595da9e236dcddde4a86a0ad6cc006733
SSDEEP 192:sOjSCzxP7c0MuFj0B3w1nA40RrBhqFjYopSFYLz7mU5RTWwEeP61GAHEH7GReL:9jSClP7c0vF4r4oojYo/FKRc
TLSH
T1F572D956186055BA8251E368D8F8BFC3E2F538CF4C419FCA9BE4BD046DDA06E513788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7075da5-0bc7-4360-8caa-50645e10eee4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\pending_pings\e7075da5-0bc7-4360-8caa-50645e10eee4
Size 235B
SHA256 a5d1e42e2915f2d7b9ec38f9df59e33c1ccfeb2359dbc212de8252de63b4d1ee
MD5 cc4dc2a9500b534309dde68235461ecd
SHA1 3fcdd15ce44517848a3592bfd62f7714fa3ba7c5
SHA512 22f9658e48ba174e77f2b55d8f519d05ffcd665af59c2fbfa4b001c72e81b6e10ebf4e590116f80f01c2bec2dd173f4c6c1fa9ea2511d087188643e460bb66fa
TLSH
T1A3D09788948DA7AF0C000F03B0E22CC2B0444C3324646820D56105B88EB8EC44292C07
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\extensions.json
Size 16KB
SHA256 86ffa8c8165af2e42fa6be50a393f23a3b6c177de130e195c890eae8ba130154
MD5 81c9ba7cc32370ec74f166f7962745e0
SHA1 7f7caedc24fd59bb7138f3e143af1911f2b83ddc
SHA512 cd0bb44ca6ff6c0757d75e47341cfdeb2302b5dd6cf9896fadfb01390dc5d4dc7025d2c19c9541062d15324049613858c182d506584478eb79abea821928284f
SSDEEP 384:vkI4vaUmldvP8dhWR94zr96onL4H0L4PDXL4H9L4HlL4HXo4hb:cI4SRfcXs4t6E4O4H494l4Y4F
TLSH
T1A872521544448EB8294FA79BAA367E02C37D473B60855C38F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\prefs-1.js
Size 7KB
SHA256 a80bdbe904c5d2effce1894a8f913a160fed7d63ca5048d4b203d33ac2485139
MD5 7403357cfed001b60ed5a29f690c9c6b
SHA1 6a672e514756dbb02b8c2ba0a04f4831cea23391
SHA512 9f95043584b8a049e23bd65209187c6e4a530483c0bb217bc219fa1be325796209472ee29eaf003230de7d8e0eeeed556257ecf14130608a874d9d499fad2b57
SSDEEP 96:xHoUTUw3qGqYfWfEObzSASSlldv9jGnHHwLBw889p8L4cnpVPIu:u5RYfWfEeSSWwLBw88M3
TLSH
T167F11F7895048B7F64B676BCAC6448315AB2023BBBBF6CC710B99485055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\prefs-1.js
Size 12KB
SHA256 264d3470b579ae402aab181f0f416573feae928d9af0b3424ed6422e03c8356b
MD5 d7eb806cd2adcacb789656fbe37c469d
SHA1 c2352d8dfa0b51964bb097b0a15462746a613d54
SHA512 8f0c08b11e8e18b53d2cc31f07d84d785cadc32072e3eee0079cf03eeefe2f84129bed75f3314081edd23715a5bf1666ad8c10c5600fe48d1ed030533bd32a02
SSDEEP 96:xHoFTUw3qGqYf+fEObzSASSlldv9jGnHpwoDRmgs7Sc1OBw88O1YnckRiH2P8L4K:ugRYf+fEeSSSLRmzOBw88OackRiH/X
TLSH
T10942CC3C61408B7F20F2327DBC6549A019A24637BABFBCD305FD9592445DF2442EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\prefs.js
Size 6KB
SHA256 4b1ec000198be4b0bdde96e9d00ce9608b50ceccc57d3d3d89f107b2e97a4dd6
MD5 4169002472630da30bb771b2520cc109
SHA1 2f4399cfa13cda296c87280b36dabb26971ccb94
SHA512 7770cb8205baebf1c3a98ea18970fea01262fe1b641bf07410240bf8c2da6e40d543876415d7675306d5e34996bf810fedb04f278dc3d7d8c30a10f5f122e1a3
SSDEEP 96:xHBUTUw3qGqYfWEr1zSxSSlldv9jtnHHwgBw88H8L4cnpVPIu:T5RYfWEr0SSBwgBw88o3
TLSH
T1E2E121789008CF7F64B6776C6C6888316AB2013B77BF68C750B95484051CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\prefs.js
Size 6KB
SHA256 6e3c504435df05c7c102cb228e6001335272863db7f79d7c0ab65effb7cabb30
MD5 e0e512bdcfc42385f867852108707fe8
SHA1 c8bd2578543ae51981928dcf90cd555b93a3018c
SHA512 ee309337e86f41c4ee2ab93b6675f3b05febf9faefc99c906ead9c9c369310cb8f9ee4817b00c6490988f78d4c3aea1c75e23150c4017869ba470ca013bb149b
SSDEEP 96:xHBUTUw3qGqYfWfE1zSASSlldv9jGnHHwgBw88H8L4cnpVPIu:T5RYfWfEtSSWwgBw88o3
TLSH
T132E1007894088B7F74B677AC6C6888315AB2013BBBBF6CC750BA5485051CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 dd3585d28329a65d032021b19043dea9dc20ca662727e01111e165d260a3a781
MD5 06438da9eab3c274cab094cd2a4069e3
SHA1 57e94f4381c5ceec85d736009176a3dd99b7d3e5
SHA512 728419fb052b1b1651dd9dfbcf9b361243912a333904cf2666dbd1bf2f6ebc29abcced232a92981c90530f831c3e14ac07cb5648b9aaffd6c9e4f25be63c4058
TLSH
T1A0210A82FE2F28B23355D1CA50C81BE4DFE1B053417AB8E08C29530311C8E2533CF104
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads