8956dcf5dc1b4aefc225afb50e269720c38078df368aab6a8fe4746d2658bc14

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SlommyCraft.zip
Size 648KB
Sample260922-ndrkmada28
SHA256 8956dcf5dc1b4aefc225afb50e269720c38078df368aab6a8fe4746d2658bc14
MD5 31d7574f8ab44a549f6ad70eea8d53f4
SHA1 c236bbf52fc077c71daa2138332a2df8bd784c5c
SHA512 bef37d258d9b7635266b6ebb06f5fcdeab87c3a5f55e4eace287bd18af989418de3273071e982fdae77e257c6c944322365604dccaa9fe2b39d4f31c46862fe1
SSDEEP 12288:5W4wvhEHUvUmnEpvFsM0t6kOrYXPdoRvv/fEwzomn6VSqvp7RdeAmH6YGiou64sG:Wgvpurrd3VMwHJp21wQX9NAmPg6
TLSH
T194E4BE27C06F8D3BC06B9B78C66117679ED20BCDF930764736496468292E04E1F973BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5312	firefox.exe
Token: SeDebugPrivilege	5312	firefox.exe
Token: SeDebugPrivilege	5312	firefox.exe
Token: SeDebugPrivilege	5312	firefox.exe
Token: SeDebugPrivilege	5312	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5312	firefox.exe
5312	firefox.exe
5312	firefox.exe
5312	firefox.exe
5312	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5312	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 5312	2764	firefox.exe	101
PID 2764 wrote to memory of 5312	2764	firefox.exe	101
PID 5312 wrote to memory of 4332	5312	firefox.exe	102
PID 5312 wrote to memory of 4332	5312	firefox.exe	102
PID 5312 wrote to memory of 4332	5312	firefox.exe	102
PID 5312 wrote to memory of 2736	5312	firefox.exe	103
PID 5312 wrote to memory of 2736	5312	firefox.exe	103
PID 5312 wrote to memory of 2736	5312	firefox.exe	103
PID 5312 wrote to memory of 2736	5312	firefox.exe	103
PID 5312 wrote to memory of 672	5312	firefox.exe	104
PID 5312 wrote to memory of 672	5312	firefox.exe	104
PID 5312 wrote to memory of 672	5312	firefox.exe	104
PID 5312 wrote to memory of 672	5312	firefox.exe	104
PID 5312 wrote to memory of 3736	5312	firefox.exe	105
PID 5312 wrote to memory of 3736	5312	firefox.exe	105
PID 5312 wrote to memory of 3736	5312	firefox.exe	105
PID 5312 wrote to memory of 1968	5312	firefox.exe	106
PID 5312 wrote to memory of 1968	5312	firefox.exe	106
PID 5312 wrote to memory of 1968	5312	firefox.exe	106
PID 5312 wrote to memory of 1968	5312	firefox.exe	106
PID 5312 wrote to memory of 6060	5312	firefox.exe	107
PID 5312 wrote to memory of 6060	5312	firefox.exe	107
PID 5312 wrote to memory of 6060	5312	firefox.exe	107
PID 5312 wrote to memory of 6060	5312	firefox.exe	107
PID 5312 wrote to memory of 204	5312	firefox.exe	108
PID 5312 wrote to memory of 204	5312	firefox.exe	108
PID 5312 wrote to memory of 204	5312	firefox.exe	108
PID 5312 wrote to memory of 204	5312	firefox.exe	108
PID 5312 wrote to memory of 444	5312	firefox.exe	109
PID 5312 wrote to memory of 444	5312	firefox.exe	109
PID 5312 wrote to memory of 444	5312	firefox.exe	109
PID 5312 wrote to memory of 444	5312	firefox.exe	109
PID 5312 wrote to memory of 4960	5312	firefox.exe	110
PID 5312 wrote to memory of 4960	5312	firefox.exe	110
PID 5312 wrote to memory of 4960	5312	firefox.exe	110
PID 5312 wrote to memory of 4960	5312	firefox.exe	110
PID 5312 wrote to memory of 1736	5312	firefox.exe	117
PID 5312 wrote to memory of 1736	5312	firefox.exe	117
PID 5312 wrote to memory of 1736	5312	firefox.exe	117
PID 5312 wrote to memory of 1736	5312	firefox.exe	117
PID 5312 wrote to memory of 1020	5312	firefox.exe	121
PID 5312 wrote to memory of 1020	5312	firefox.exe	121
PID 5312 wrote to memory of 1020	5312	firefox.exe	121
PID 5312 wrote to memory of 1020	5312	firefox.exe	121
PID 5312 wrote to memory of 4028	5312	firefox.exe	123
PID 5312 wrote to memory of 4028	5312	firefox.exe	123
PID 5312 wrote to memory of 4028	5312	firefox.exe	123
PID 5312 wrote to memory of 4028	5312	firefox.exe	123
PID 5312 wrote to memory of 2276	5312	firefox.exe	124
PID 5312 wrote to memory of 2276	5312	firefox.exe	124
PID 5312 wrote to memory of 2276	5312	firefox.exe	124
PID 5312 wrote to memory of 2276	5312	firefox.exe	124
PID 5312 wrote to memory of 5676	5312	firefox.exe	125
PID 5312 wrote to memory of 5676	5312	firefox.exe	125
PID 5312 wrote to memory of 5676	5312	firefox.exe	125
PID 5312 wrote to memory of 5676	5312	firefox.exe	125
PID 5312 wrote to memory of 5856	5312	firefox.exe	126
PID 5312 wrote to memory of 5856	5312	firefox.exe	126
PID 5312 wrote to memory of 5856	5312	firefox.exe	126
PID 5312 wrote to memory of 5856	5312	firefox.exe	126
PID 5312 wrote to memory of 3776	5312	firefox.exe	127
PID 5312 wrote to memory of 3776	5312	firefox.exe	127
PID 5312 wrote to memory of 3776	5312	firefox.exe	127
PID 5312 wrote to memory of 3776	5312	firefox.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SlommyCraft.zip
1⤵
PID:1808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4460

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {c8e190d6-0095-4894-b7d7-b22667a6bd3a} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {03ac054f-6ba8-43a9-9c3a-a3a1e04c9e8a} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3864 -prefsLen 27276 -prefMapHandle 3868 -prefMapSize 270279 -jsInitHandle 3872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3880 -initialChannelId {dc277289-6eb1-4c77-8236-7ceef7008f16} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4048 -prefsLen 27276 -prefMapHandle 4052 -prefMapSize 270279 -ipcHandle 4124 -initialChannelId {0790f48c-e28d-43d4-813f-5937407aa40e} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4348 -prefsLen 34775 -prefMapHandle 4352 -prefMapSize 270279 -jsInitHandle 4356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4364 -initialChannelId {39c6eb1b-c4e5-4494-bf05-91f716efcb8a} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5048 -prefsLen 35091 -prefMapHandle 5108 -prefMapSize 270279 -ipcHandle 5116 -initialChannelId {e3469820-1a9b-42d4-81a9-7f4739739ffd} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5304 -prefsLen 33031 -prefMapHandle 5308 -prefMapSize 270279 -jsInitHandle 5312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5264 -initialChannelId {518a9951-2dfe-4963-a627-211b2b9111d2} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5616 -prefsLen 33031 -prefMapHandle 5608 -prefMapSize 270279 -jsInitHandle 5604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5632 -initialChannelId {d5696a39-4070-4ca0-9e9b-69f42c6fbbec} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5792 -prefsLen 33031 -prefMapHandle 5784 -prefMapSize 270279 -jsInitHandle 5776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {801f940c-d6a0-445a-9985-66b302e26af9} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4800 -prefsLen 36845 -prefMapHandle 3004 -prefMapSize 270279 -jsInitHandle 6368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6272 -initialChannelId {e1e48031-46ac-4d91-8c0d-c6c7a5ea01dd} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6440 -prefsLen 36845 -prefMapHandle 6316 -prefMapSize 270279 -jsInitHandle 6436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6224 -initialChannelId {0151fc6f-2d92-4d98-a083-ac68d653cb5b} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:1020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6572 -prefsLen 36845 -prefMapHandle 6664 -prefMapSize 270279 -jsInitHandle 6656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {f82f555c-1e40-46ba-a61d-acdf388a1799} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6784 -prefsLen 36845 -prefMapHandle 6820 -prefMapSize 270279 -jsInitHandle 2724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6828 -initialChannelId {e7caf1a6-fc75-4115-877b-7ed3607e33b9} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:2276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5584 -prefsLen 36845 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 6928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5312 -initialChannelId {bab627ec-c6b8-4398-8174-63a07481aa1f} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7164 -prefsLen 36845 -prefMapHandle 7160 -prefMapSize 270279 -jsInitHandle 5848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5932 -initialChannelId {613d684e-1152-4ef0-b0de-56f103c06086} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6716 -prefsLen 36845 -prefMapHandle 6720 -prefMapSize 270279 -jsInitHandle 6704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6464 -initialChannelId {5349c279-aebd-4f5d-948b-89cdb4006b3f} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:3776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6972 -prefsLen 36845 -prefMapHandle 6960 -prefMapSize 270279 -jsInitHandle 6816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6588 -initialChannelId {545b0611-b3bb-43d5-9e62-7e56d5574a49} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:3300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7492 -prefsLen 36845 -prefMapHandle 7496 -prefMapSize 270279 -jsInitHandle 7500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7508 -initialChannelId {e5c1be19-9d9f-4f48-ad5e-107963f16490} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:3028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7492 -prefsLen 39984 -prefMapHandle 7276 -prefMapSize 270279 -ipcHandle 7640 -initialChannelId {5228ee12-014a-4fd0-af6c-6473962757fd} -parentPid 5312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 utility
    3⤵
    - Checks processor information in registry
    PID:740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

175E0D133A7AACB787C50C3FC18D945549BAC6E8

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cache2\entries\175E0D133A7AACB787C50C3FC18D945549BAC6E8
Size 63KB
SHA256 c2f35ae0421cfddd31c6add4f72170dd5a6e6b896ba7f83f24c223a60ab6a443
MD5 d4918c67c0a3c95b2696d707cb032613
SHA1 65841298edb05732aa04669077586b252ec884a0
SHA512 c8266659d33d517906bc81e17909c17b57bdf8db64bbce352d0d8c5469414cf382caa529a02ac0c841b7fa291725bd9903a5511cf3faf12a089df2f1bccfc533
SSDEEP 768:RRwePPLY8AVvfW7N++cSDO9PvHt918E+IuAisvDMauQlnB9WdjhfuNAgb:RRweXLYRmcqgtwIPisT/OXcb
TLSH
T1F4533C25FF614E32D925027140BBA33A37B1E08657F2E3677B8AF066AC2679D0D41DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1B99A0FDC7EBAA3285584ABB7BF3BB786740ABF4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cache2\entries\1B99A0FDC7EBAA3285584ABB7BF3BB786740ABF4
Size 828KB
SHA256 e137b47445a4ed111701bff4ed84977e0e8b92816f1fb5216272211037818a15
MD5 89cf88e8cdac810bea7e7d63214d8a90
SHA1 dd060a386dcc030b24efaa8f246966095993258c
SHA512 a119685b4ef96463c39b9b62886960fa3f22bc940947eff6b8ac9f6b71f3e35bc58aeb0f248f62b570c2774f7d6906e18c4b82d80bc9e0c7217af5f2e8f3c1a5
SSDEEP 12288:jnneBTr5shFaTppuSt1BYd7g1TVgUWXpWNDwSzLNfWZ4ryMRtRCAYHkk/C1H2:jnAJeoTpBWAb4X
TLSH
T13705F827FE505E63C82103B140EB27363B39D4975756F32B2ACEB62ABC1A7790C6159C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4F28DF566FBF925AC1E369CF6D52094749BADD1F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cache2\entries\4F28DF566FBF925AC1E369CF6D52094749BADD1F
Size 325KB
SHA256 cc25210ac67b0008aecc433bce72d964351bef4fa481a289354f9fcb8b44415f
MD5 0c128832145ab754006f8edcf4a6d611
SHA1 b77baf866a45a5e8a329f7c02c7abe5a76f7688e
SHA512 11edeb15f2f6d51b3835eb9f7a4bd6c32cb017cba99ef3662c052f0b4428b65c8e11f398d274ffb14b7f7d37f85622a73a32fcef90215d23ceaddfb4c6ce4654
SSDEEP 6144:FsWYATlyAp+ITvC3gkAieEQCuumluDBEZq7nk94qX6XuZ:uWzyxevC3Np6xMEU7c6C
TLSH
T16C641866FE962A63C92406F540AB23333631D4855BC5F3376ACFB061BC697781C62DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

578B288E58D1CF9B405B1DD845732FFF001E0C47

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cache2\entries\578B288E58D1CF9B405B1DD845732FFF001E0C47
Size 158KB
SHA256 f640b46604ffe5701ca34a62e8b605141751a00efb6fb2e1fc71eeb935be618a
MD5 0c5b576625e1cac7e7286da016432838
SHA1 9f2611091099a7cb61506b6659c3cb798141f2f5
SHA512 a149303b243c761bc7251d1c8e90629f1a6fb17b0201dd6b866a34116ed93b5c819e50e7b1df0a720359bb26813a23c559940a1fe5e9ffe5b8a6112ce53cd6e5
SSDEEP 3072:F0cZgbeTyt1RxqdmqxontXT+XpW777oYOQ4HoKfiZF2d/:CAgSWt1RUdmqxontXT+XpW/kYOBHdiM/
TLSH
T170F3D726EE564B22C95403F245A347313F31E0452BE6F32B6FCF7212AC272E90E5699D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E70A7776644ECBF8F01CF99FBFD759C6AFDE891

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cache2\entries\5E70A7776644ECBF8F01CF99FBFD759C6AFDE891
Size 57KB
SHA256 ef8d0811f2a08e9ce6335c0598aa93447f082452fb5cf483f88f3818fa058382
MD5 cb32e8465aacc08b4dfc38711033a2f6
SHA1 78b8ab1368d23c56c88ae4ee37b1172d23000985
SHA512 722800a4bcab57f3609afd93133c86b403f7f1e0d3d085e36aa03195a1f487438efc9a9e4a66811515e10726c69a3bc682fda8b4d941717d92a6eeeb0016747f
SSDEEP 1536:Coc2Dp/b0UNnOJCD8GlcKLApcaVFL53r2Jm6i+AcVXhoG:pVp8GlcUApcaVFLVavA6XhoG
TLSH
T170436C25EF1C5532D5512279442F12EE357CE0734690E8ABBECDB1B434A5A3C063EEB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7AED7A6F1C088603E3F779EFA05C79F4AB604809

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cache2\entries\7AED7A6F1C088603E3F779EFA05C79F4AB604809
Size 114KB
SHA256 2a354e8ba4adb64a9024acf606801dcbb181155f98a007a9dc05aa3858917c61
MD5 fa5309dc5539c749798f12b9eca89b4b
SHA1 22178aa01fbbf16ada0336a8768cccc7d347163d
SHA512 81a35c5e21ebafa1b1de1ea5bccbfc62c674a12fde1e8333f4c53de8929437e7b63a117ddb09e3ff0a1d9abf9a830ec7c686e9ee916f7ea03c645b82a8403425
SSDEEP 1536:6a4WFLMzZYUd7J+Pj/AI1WmOdvl47IYIucdC4iycV:PLMFYUd7J+PjYIAYIucLcV
TLSH
T14EB33925AE621F23D563133512EB51203931D88367C7E60FBF8E25646F9D73C0EAA96C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 8aef2438fec41889aaadf371522b5a1abc3a69a2ede85b0c113b9fc9085041c4
MD5 34d030b54e3bff04ebe014c4b20e7a0c
SHA1 cb81974c8ad95e702db2642aa0dffc7f2e4ebb99
SHA512 75fb2706175ad430a549b41b78fc7b17512ff629539de5c37af67278fb712f5632c01053263d253e4378218c540c41ae0cd2f13ca4dc778fa29274d69f26d9cc
SSDEEP 384:HalwSiO024Y2DL84KKDL849B7SOEAd9KVRaAcP+AWRMAFL+LS+i:6l8ZY2DL8lKDL8CB7S/AmVAf+hRM8LEC
TLSH
T198728E3D4F013CEC1597C0E8C4B982A98D18B7A7DFE6806D25583D0DCB98A69B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B7FFA7D15E8E9C4C38CC2F4D2B9FE2E864352970

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cache2\entries\B7FFA7D15E8E9C4C38CC2F4D2B9FE2E864352970
Size 247KB
SHA256 31a8906724135e59a1d73baebe9334cf1d8c986922885e77ed6b12336bfbb877
MD5 aab206a502cf2770c923689058d44d3d
SHA1 188857c8aafca15072d9f8de9b75b0e4062a0d24
SHA512 2cdb3a7315d09c05607257aebdaccaf7bb156bb113cd9a6c72bb95a225179e1b3185ce6ad55f36fe36c4de2f20067c48b7327acd5435ed8785f4e5d3f4f80a39
SSDEEP 3072:z+MQ+zywCmxaWcE8BI9YRSivbEpeePb+Mdmf6HgqAphoiHjJo2Xs8L8WDgC0RVC:zpQaDcEfzivbEEei/JljXs8L8WDgV3C
TLSH
T10644F826EE061613D92007F0406B27363A75E442AFA2F33B5ECFB512BC6D7790D659AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f73e6aadcd428ef319d10bb3c2df39bf.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\thumbnails\f73e6aadcd428ef319d10bb3c2df39bf.png
Size 17KB
SHA256 1f9dd4b2eea0d934e3c777f6170bc371f955412901f2cd939aeaa1d581e923c9
MD5 2b27e7c7107807c65cc26ace0cc94415
SHA1 da5264f926f7d32185826c3b1ac2617434fbeff4
SHA512 6f1fbc383f79f494c5648f8c33973ee521f7a9eebbe3e4cce0b123179433134b7d887c9a299b9b8ae17d7aa1b70f5d8a8aa3244cff758822add202afa8801b40
SSDEEP 384:BZ+LCpfK46CffjHclGxXUt1a/KxFrfVa6nDit0doNtaQhq:BZ+LCpfK4Vokxk3a/49DDA0doNtap
TLSH
T13382C0C964CF75C2A13AA9354AF9F4C1C17C1FCEF00AC0A592F129B96CD7A7A56510F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\AlternateServices.bin
Size 10KB
SHA256 42422080b96b4aca054d8a153d32e66db8b3ffe232333f0342f52d647febbbff
MD5 69d6982c1aff1fd061840ca86dc1397c
SHA1 d8ddec1ee883b380e8c3b500408a516e9d1df5f5
SHA512 755a5b40144331dc4680ab59cf75105cbf453796863cc2e9e721ab805ccec6124e9f347266ea7c5c5a6c50a75d25f419dfb3f975ada4c200f7da7dd089c6a8af
SSDEEP 48:h94bYdlkpdgdOdfde0d/aW6bi7vzbyhRyt5:h94bYdlkpdgdOdfdfd/L6bi7vShct5
TLSH
T19D2213F7AB7A5022F2624F74D0987A8DEC67065708E898D54B00A0D703813E2E0BEF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\AlternateServices.bin
Size 21KB
SHA256 4e8512855dc3b6e74ca77acf80b3ec977cdf4506972774c56184328f22aff383
MD5 8140b083fa07b336f226e5003a67ad1d
SHA1 9d8a082824e793e0228e8157395355b742b12970
SHA512 fab782222cb7737076cb1683d259b0a1b0fb5db2239534279e8ae7e90162ec23b0ab639403fbcd3828bdb282bd69386ee9ba9353d72b6b62c900c7e8b4945823
SSDEEP 96:hl4ucYdlkjdodSdSdqdBxQbi7pkhctvRGbQGjGpH7mYoOFVqGb8GbGiaq3ShR2bX:hzcY/kjGQIwKGtbiD2KMZ
TLSH
T1BFA223FBEB79A452F2624F78909C3A8C9CA30256499881C84B0194CB13857E0D0BFF2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.bin
Size 96KB
SHA256 e9f878f7d839a4bf5050575469a7c28e6d037a15bdc1304b96e206ec26cb3935
MD5 c3f0ac1451a5750a85923ffdef4fb596
SHA1 01a4829e5f51c07da0dec315bf2dc402931e3b8b
SHA512 21c1e9ccd0d1d41e5e9e645a85ee6556017c8ef79cfb18d7a47058fd679962c7547c47727887653cd57a6db718e5f3e055bf5d08b8a7f8b19e2abcc7fdbedcc3
SSDEEP 1536:nLwhdjT0/rN3CH5mnYf3XHKh050/YHsaamtF4vgRGbeIuxxg:nLwPU53CH4YPHQ5xomIEpuxxg
TLSH
T19CA30280DB1B543BEC2441BBB89517283B35F8544A595B1B3AAC04762DCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 96KB
SHA256 34ad5def8ed4e61ac2c2b9ee8ad7d1c7218fb888ce4b2deab912bde91c95cc94
MD5 ef6918c2cb0caec96536e07e9055c08f
SHA1 fb0150bb3dfa9b438e769f2494bc8d4f455fcd59
SHA512 72488b4eb6aa0422e5779a6d0ceea39c71695e7ba078f62c001c2919f04a0b5d1539dac4a6974fe4d16141cd4fff8044a04b9744b67cbeb8967ab00db8e4a548
SSDEEP 1536:WLwhdjT0/rN3CH5mnYf3XHKh050/YHsaamtF4vgRGbeIuxxP:WLwPU53CH4YPHQ5xomIEpuxxP
TLSH
T154A30280DB1B543BEC2441BBB89517283B35F8544A595B1B3AAC04762DCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 68ce05d604fdbd3a77a58508792649124ab886e53800beb21ffcb374768ff5c9
MD5 1a7af633f85c8d953ee1094b116712bf
SHA1 ea877d22616edfac469aafd24676ba8f0de52a33
SHA512 0dc10ecabdadc61120a8996591732f1cdca1c63517a30ef53ed99396d772b9c805d40f80f077edd139870294d7dd772660d96660fc69c26c821df1b576ed00ef
SSDEEP 192:j1d66JozGzgCl6mc0dvoPOv5zbowZGv8yjvnI:Bd66JozGzgC1j5ogbowZGv8yjvI
TLSH
T10ED1CD68F629553FC818023BCCB61B900E3A3886989F7F29719C641D2D972CD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 96KB
SHA256 0c41ea31de7fade9b597107eb57ab4f64e3976aa086cb93e404afd1a6db6b432
MD5 d3a560836fec70c479283a3456d0798a
SHA1 c3b339dde15553b6e9555d41e94019a63294ab30
SHA512 abe7e4351f8ea206b0003dce016d79d369027a256628bf9c43025c113e6d99396d333bf439c94bc89d99f6bd2a38539f63ab5e6445031483e98bea121ccb6596
SSDEEP 1536:kLwhdjT0/rN3CH5mnYf3XHKh050/YHsaamtF4vgRGbeIuxxj:kLwPU53CH4YPHQ5xomIEpuxxj
TLSH
T137A30280DB1B543BEC2441BBB89517283B35F8544A595B1B3AAC04762DCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 96KB
SHA256 36db983ddc94f71bc2d13d54ae54727b9019d7fe4fd8aeccc9704201a519f391
MD5 30fe206ff53640ab0fac5b608dd409a5
SHA1 1376d9eca339193ef07c4d14c46577985aee7a06
SHA512 94f0d124e9bfa1a3db2ce624ef6c70058764a3cba76c5fad09f5862eecb4f682b06d7bc1f5f454b696ba08eacc6b5c9915c9124cbb12181c5bb5b65cf2176bc4
SSDEEP 1536:xLwhdjT0/rN3CH5mnYf3XHKh050/YHsaamtF4vgRGbeIuxx8:xLwPU53CH4YPHQ5xomIEpuxx8
TLSH
T15DA30280DB1B543BEC2441BBB89517283B35F8544A595B1B3AAC04762DCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 a9763e1b1631f943152883368ec8e528292920beae02922df8e9c0d0e9c5ba32
MD5 97cd687b4daab3632a97b688db88c9ff
SHA1 23123e7ada5d8d6cf183cfde45211284f2cbc097
SHA512 475fe3091b4132d5594b8d5d4e508dd3d6111fee19e1beb7d0da143be1a575a218feba6863d43f0d06e5454ddb66393df30c2252514619472949907a097de7e8
SSDEEP 96:tFYsQFwFE1FTFa/dd66JozGzgClKtmc0d/UfxSdF95/7bkW60rcPyUR6rWI:z1d66JozGzgCl6mc0dqxOv5zbowCyjCI
TLSH
T1BFB1CB68F229463FC858423BCCA21B500E36388A989E7F1935EC745D2D672CD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d6dfc34f5a6c6fc180f172c818fa8a6443560583727da83b5762d6ad2f450a6e
MD5 b2e1cb6dc5a7d9a640c62dab60360774
SHA1 3d049ee340cd1f365dea367c29d4faebd88805eb
SHA512 1b834a3d8e88a3624afcb42dd5a83ac7220541d678d24c159e46946f97cc5c6448f63bd70f29713654797f214afbdf756023462e6d8ffffe24736609c592a256
TLSH
T1B821CE5D7AB84D2BADC7E65CB844078E53994E0B058B1D031D02DF8ECED5ED932AE43A
MD5 SHA1 SHA512 TLSH

Submit Download

40b5d228-d64a-4330-a274-169366c30578

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\40b5d228-d64a-4330-a274-169366c30578
Size 883B
SHA256 1f63398316331f4281be390e2e0acd3d1d09a28bd775cf2c4988673854d89dc6
MD5 2f5073ef68d78d08b7650de4a22d4a04
SHA1 ddb13d1a1497246fa334d8b6c745352c3ba09207
SHA512 ad712979cacc02504500fdb62b3234be930895aef735d2f2c05f4a578eeb0d440f6855702ad073bb6a9f751220d9b637c913e7848cb506c9b1040b962f9f9b4b
TLSH
T1D7110090A9317873DC6C824BC5E537028BB47513C0CA99183DA65A180CFF51E93A638B
MD5 SHA1 SHA512 TLSH

Submit Download

46e6c02b-f6c5-4078-87bd-f38c8330ab1f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\46e6c02b-f6c5-4078-87bd-f38c8330ab1f
Size 235B
SHA256 3756cd09978e7c5107c3dd8c66ac536f5ce31dce49e3800d73586db2d35e565d
MD5 2d5bc4b2248143b7826683bc123fbe10
SHA1 6bc044c6e2ca0a2cf22018f1dfa0ec62723a061c
SHA512 b6f8797cd6d06d4939711226a5f2d8093a713b924dc727f8f2e0f15fe16ae042a5d67908bdadde2b333408723da9cf5c1bed2a75d1c1d823dbf7806764fb7e44
TLSH
T1F9D097C1188C732C0C100F1BB0F02DC630444C3324619820D5A288F4AABDEC801A1917
MD5 SHA1 SHA512 TLSH

Submit Download

484ec9e8-52ac-4430-8968-207911ad8cb6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\484ec9e8-52ac-4430-8968-207911ad8cb6
Size 235B
SHA256 6e5301244a7e67ba30678e83d253bd613f0397cee96be73d00cf1390a06d2029
MD5 f3b9ca6237100187ceb6f0e6cbf5569a
SHA1 636a960d4a62537ef4ff6c95e6f5ba04c660b290
SHA512 4b66833b22853479eb2ac01f54ce2a4a951cce02f8c3fd4dbf8536df85fb36d1aad9f83fd6133b02a10603656bb9eb02f9f70745a3554884007ac6297f3381b1
TLSH
T1DBD0A7841CBC7BAD182C1F47B4B1A9E730848C372AA59820D96185789FFD9C542A2967
MD5 SHA1 SHA512 TLSH

Submit Download

6c2c2d50-c432-4d25-bdc5-252d2f4eef57

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\6c2c2d50-c432-4d25-bdc5-252d2f4eef57
Size 886B
SHA256 ef151dca6efbd48546205aaa15ac3118152a13c651530450129dcb4332053a2c
MD5 b7ec1816bc1bbdc8701f74e7806fa842
SHA1 f4f65d57f7e72e6efaa668463143d83ab93aea7a
SHA512 78731573c2d58c70e03036d36b146c1afd0d787dc8ee51c43190a91b6e1885060ea2ca4a678b52a5daf73a374506aff08a2417c1d5ee4580ae50da5c2bc58cce
TLSH
T19B110090993579B2CD3C924BC0E077424AE47523C0D74E083E911B180CFF50E93A7307
MD5 SHA1 SHA512 TLSH

Submit Download

897a2d21-04d9-4def-85e9-797b107c352e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\897a2d21-04d9-4def-85e9-797b107c352e
Size 15KB
SHA256 e21794f2acbc1293df48b7f5acb48d6956e349d35911e2de2afbfbc77be3e112
MD5 c13e8eacd1e0a82c8fda0b6fa8e3de7d
SHA1 38ffc5a452574ae834e703acccc2db7bd3b27573
SHA512 ea039e044e80cdc8d1ce09a99b3c097d3ce51cd80ff0c7f32fbd92bb41388776a0213103370b03f601f64e55875623217ae4a6a937cc4fb53cf853e588ce23fa
SSDEEP 192:Tm15O8AetydZZG3Y80rdEjCmViMdHLMe9S1zxcalKvzuc4L11ulBfX9xLde:Nf8djFViMMYS1lcalK7uc4LANLde
TLSH
T17972D6162820597A8251E39994FCBFC3E6F628CF4C419FCA9BE47D085DDE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd6d6d5f-ca82-4a93-b6d6-e2347a536d36

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\cd6d6d5f-ca82-4a93-b6d6-e2347a536d36
Size 2KB
SHA256 5102419bb1ce6dd0d69133b65e2d3c01fa746823279d9cd320eb13aa8c080bc0
MD5 f876b87c7cad0c671fe2d763cb8db967
SHA1 d81a8758a0a95974b64263e052507362799f5468
SHA512 7fe5d604489c27126d0efaee3059b4fc589e68a1939fb1ced08401276127eeab98fd8b4823dd65e12abbefeedf6108481a4da3b028301dac177b9e7942aeac33
TLSH
T13D41545C35B85C769CDAE54DD191238943744A4240C21C836E51EE4CCDE665F337E56B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\extensions.json
Size 16KB
SHA256 aa3811dd3870716d2156cb4c9689bfe6fcc8bd3ac20c90a631ad7e25e62e289b
MD5 99804a1f69915f778b6822aec9f07350
SHA1 361ffbd9da430c118bfb0e905803e3777ebd91c3
SHA512 9e7d76deb6a752472848fe6e0b2ac37146b98904a29d515723ba8bd9fee126e6a3d48f1def2bac6a444542a6e32d0799b76f6d3e309c3502ef755f35576f63d1
SSDEEP 384:xkI4vDUmldvmC8dhW294zK96oSL4HgL4PYL4HtL4H7L4H1n4h6:CI4bRfuXP4C6v4i4i4N4H4h4A
TLSH
T1F072641545049EB8294EA79BAA36BE01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs-1.js
Size 8KB
SHA256 eff73674af19406c38e84a0abdee66501aba3ee8fbcc85cf83d06ad959dad644
MD5 a05e8737504ab156183f5ed998fed1fd
SHA1 387bef83f3b0e0d8d4f8966b8860a65fc8c2b346
SHA512 df4ce418c1432b7a356d7de78554e7f1bd101efef74b2e968471f6cddd7888404fe66e6607791fbffc942a8e83849227cc60c0178692f6bd4a89aa4d5876b969
SSDEEP 96:xHrJ5TUdGLqGq8fbMzObzSfSSlSdv9jHnWWRvyHQWPoBw88e6IO8L4cnuVCL5GS:RJiGGR8fbMzJSSCRsQXBw88kQU/
TLSH
T13C02FD389104CF6F64F636AC6C688D715AA2013BB7BF68D350B994C5051CF3442EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs-1.js
Size 6KB
SHA256 173dc379cd0c98e52c5c9d30f0f24a6ce947f393c1092e740767ed7ca0e937a6
MD5 51bb5ce43e01145aad90193df7df9240
SHA1 7a495d37da3910c4990e5b23838864873cb13990
SHA512 da79deb493f7086c000f66f6eea716ad4643fc041dd1223c030ee7e67896dec7f08673c461146a9f06a5739b606711933d6501fbbb16fde1f3555385382269b7
SSDEEP 96:xHrJUTUdGLqGq8f3Mz1zSfSSlSdv9jHnWHbQW/Bw88n8L4cnuVCL5GS:RJNGGR8f3MzWSSLbQuBw88jU/
TLSH
T10BE13F7894088F6FB4B677AC6C6888715AB2013B77BF68C750BA94C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 6KB
SHA256 ab92ccecb220fecd028792d0dab94a4711099d363df60f60ee899b1fac0aef5d
MD5 553362f45365979f267d72fe0a25d9d2
SHA1 7b7a7129107a6900cdfc5ad398dbd1d477abd024
SHA512 30be70021959642f23bb5bf3acb0a57e2ce4db6d31bd49e467117c7d5b48bc740b89d0a23c917b229cf56419e22f8482f8c05c1662eb6c4086d4cf9c96b6bafe
SSDEEP 96:xHrJUTUdGLqGq8f3kqq1zS7SSlSdv9jinWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3kqqySSubQuBw88jUo
TLSH
T109E13F7894088B7F74B6776CAC6888716AB2013BB7BF68C750BA54C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 7KB
SHA256 1ee2b2df9fd10e960a59499bf20dad1c7b55f9de4087a4d03abb09182679fe0e
MD5 e8e001c00e9cfb6949cec671c438add2
SHA1 fef88616adb6e36eb9da2b219337f43234b97231
SHA512 449807c3d7e54c3d52104c320079067eae51ae46ca80436e7084dd82f3951d3e868585861ba198b47979c9f5f2e3be0793101490cf3de69440067b527139cfc8
SSDEEP 96:xHrJ5TUdGLqGq8f3MzObzSfSSlSdv9jHnWHbQW/Bw88I8L4cnuVCL5GS:RJiGGR8f3MzJSSLbQuBw88+U/
TLSH
T147F12E7891088B6F74B637AC6C6889715AB2013BBBBF68D750B944C4011CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 d60bd35cdce159065c3458d9661c6155e580affcf348256804aac9f6e9d4ed0e
MD5 46597880c493347e54d5b5ceae8b3459
SHA1 d2397a6f7961570810259079e1338066020ce5be
SHA512 bfa08b7c082bf68b8611974102a67e09131b876fd80c6db2cb7ddf5c602d6850432730dadbc3228e8852c3cbde2708b20737230fb9d3a35806892bcce1d0c739
TLSH
T1D021D743AD7B1AFA7E45C190C4888FE9C78D7422807404E0428D8A4A20EC40A775720F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 c41fc3921c8e0b2fab85d169eb429125c3b5137005607eab4d84be8d67f2ae81
MD5 e5c2ff1f8d1ae13d63033a91aaa0ae13
SHA1 1d1251826743697a5350f21454265a6d722b931e
SHA512 789b9d77700fe09e8443c454a356d8549dce45dc94823ac6c46348627e09f10d16c1dfad0c3a9cabea3f77a631d4c678a079bbf62ecfc5956faf61f5018e4ec9
TLSH
T11021BA87FD1F59F9750980C690CD8FDC9A9594528234F8E08E8D598215C8B0B766F30A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 e530670094dfa4070a27516d4c673ad6aacea064b4618c092856e58ef8b8456b
MD5 b15ae01a4bba266d7bbc3e94357efa48
SHA1 4d90665cdf7e6e0b09db6b8c3fbfd10cf6942531
SHA512 beb15cf574a4d8b781eec0d460d0adb34882251f8ff910f3da7161d7526ef8b3937178ef260d10b9c8179ae267e2db667f3d129f43f0ed389b029393ca4d9efa
SSDEEP 192:5uBMsus9txj3+GTSS9SR/pyg39190KstqmJqG7XOyxPYc2tkgZ:Bs9rV5TSdP3/j7SV7HPH0kgZ
TLSH
T10FE1902166727DDC76A0C5CEF0C9572DEC743C87F8AC29646F2D2506853864F13F169A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.2MB
SHA256 896dc9b66589db9ad4b1a62acd0ff8f23265ff25632394a89ea8a3b37b4ca76f
MD5 0b14b538ddfc7985753673d2fa748273
SHA1 55e47689d9842f04935c424b2f93f20c4f6b5cb8
SHA512 7eefb91b7bb7cf4546a63323733a3ca8f34f01d9612cd99b28f71e1f044a9f63eb9047a7e2f31973d7afadcd7990a2c2636f2689a47689e632d089fc7a2bb37f
SSDEEP 24576:VIGFD7xRaZCXjtWY8Kevh3bHbrnyNhLgk+7HGplmDiuaI+vk0fd:VIqKCXhWY0Ugk+7imDilFk0f
TLSH
T1E14629F820D1A257F3414033764593EF21EFD00C6027DA085BA95AE9A5B4CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads