29ddc4b15ec70f69d733b17cb47b90f9961c279de0772ea69916760b41f750ca

Analysis

user interaction
yes
max time kernel
63s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FSD.exe
Size 506KB
Sample260928-e6hczsvcpg
SHA256 29ddc4b15ec70f69d733b17cb47b90f9961c279de0772ea69916760b41f750ca
MD5 8c3aa5e2affe7e77be81f5acb94d0d53
SHA1 5859e3b41b1534123e3dd3aaab81a154de83f370
SHA512 49a6477f717fd9c28f1c2b4310770cb6dd838d24c0aa510e879f8f0db38cf86bc7187211f41e8195a39dcf9937d2ff02f9c2f4822677201ba229089c05a79542
SSDEEP 12288:HDhjfkusOzDBzpGutdT0RdwZ5WFKnU+s:HRn9zJ4gdAROZgBr
TLSH
T11CB46CF0DE52959CE063193486D1D8B15BBF2D202E50498696E5BEA33F33D8D6C3B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	firefox.exe
Token: SeDebugPrivilege	3480	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3480	firefox.exe
3480	firefox.exe
3480	firefox.exe
3480	firefox.exe
3480	firefox.exe
3480	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3480	firefox.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 3480	3976	firefox.exe	101
PID 3976 wrote to memory of 3480	3976	firefox.exe	101
PID 3480 wrote to memory of 4836	3480	firefox.exe	102
PID 3480 wrote to memory of 4836	3480	firefox.exe	102
PID 3480 wrote to memory of 4836	3480	firefox.exe	102
PID 3480 wrote to memory of 3536	3480	firefox.exe	103
PID 3480 wrote to memory of 3536	3480	firefox.exe	103
PID 3480 wrote to memory of 3536	3480	firefox.exe	103
PID 3480 wrote to memory of 3536	3480	firefox.exe	103
PID 3480 wrote to memory of 3692	3480	firefox.exe	104
PID 3480 wrote to memory of 3692	3480	firefox.exe	104
PID 3480 wrote to memory of 3692	3480	firefox.exe	104
PID 3480 wrote to memory of 3692	3480	firefox.exe	104
PID 3480 wrote to memory of 4580	3480	firefox.exe	105
PID 3480 wrote to memory of 4580	3480	firefox.exe	105
PID 3480 wrote to memory of 4580	3480	firefox.exe	105
PID 3480 wrote to memory of 5100	3480	firefox.exe	108
PID 3480 wrote to memory of 5100	3480	firefox.exe	108
PID 3480 wrote to memory of 5100	3480	firefox.exe	108
PID 3480 wrote to memory of 5100	3480	firefox.exe	108
PID 3480 wrote to memory of 5808	3480	firefox.exe	109
PID 3480 wrote to memory of 5808	3480	firefox.exe	109
PID 3480 wrote to memory of 5808	3480	firefox.exe	109
PID 3480 wrote to memory of 5808	3480	firefox.exe	109
PID 3480 wrote to memory of 5860	3480	firefox.exe	110
PID 3480 wrote to memory of 5860	3480	firefox.exe	110
PID 3480 wrote to memory of 5860	3480	firefox.exe	110
PID 3480 wrote to memory of 5860	3480	firefox.exe	110
PID 3480 wrote to memory of 5876	3480	firefox.exe	111
PID 3480 wrote to memory of 5876	3480	firefox.exe	111
PID 3480 wrote to memory of 5876	3480	firefox.exe	111
PID 3480 wrote to memory of 5876	3480	firefox.exe	111
PID 3480 wrote to memory of 5884	3480	firefox.exe	112
PID 3480 wrote to memory of 5884	3480	firefox.exe	112
PID 3480 wrote to memory of 5884	3480	firefox.exe	112
PID 3480 wrote to memory of 5884	3480	firefox.exe	112
PID 3480 wrote to memory of 5840	3480	firefox.exe	118
PID 3480 wrote to memory of 5840	3480	firefox.exe	118
PID 3480 wrote to memory of 5840	3480	firefox.exe	118
PID 3480 wrote to memory of 5840	3480	firefox.exe	118
PID 3480 wrote to memory of 4336	3480	firefox.exe	119
PID 3480 wrote to memory of 4336	3480	firefox.exe	119
PID 3480 wrote to memory of 4336	3480	firefox.exe	119
PID 3480 wrote to memory of 4336	3480	firefox.exe	119
PID 3480 wrote to memory of 5012	3480	firefox.exe	120
PID 3480 wrote to memory of 5012	3480	firefox.exe	120
PID 3480 wrote to memory of 5012	3480	firefox.exe	120
PID 3480 wrote to memory of 5012	3480	firefox.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FSD.exe
"C:\Users\Admin\AppData\Local\Temp\FSD.exe"
1⤵
PID:5020

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {f74ef56e-d7a6-4864-afd6-ccd5d896075f} -parentPid 3480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3480" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {97c4d9f6-ad4b-4d81-a5a5-84c760d3b782} -parentPid 3480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3444 -prefsLen 27276 -prefMapHandle 3448 -prefMapSize 270279 -jsInitHandle 3452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3460 -initialChannelId {9b54d8d6-d5c3-4a4f-a34d-7f84730e250e} -parentPid 3480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3612 -prefsLen 27276 -prefMapHandle 3616 -prefMapSize 270279 -ipcHandle 3632 -initialChannelId {b608c249-4742-4eff-8ef4-e3f3acb99ccc} -parentPid 3480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3480" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34775 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1260 -initialChannelId {f3be85e3-449d-4900-988b-da5218a0391a} -parentPid 3480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4864 -prefsLen 35012 -prefMapHandle 4812 -prefMapSize 270279 -ipcHandle 2848 -initialChannelId {3da27428-791a-4208-929c-96acf67d376f} -parentPid 3480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5020 -prefsLen 32900 -prefMapHandle 5024 -prefMapSize 270279 -jsInitHandle 5028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5036 -initialChannelId {3522fa7b-f7ac-4215-92a3-52c26ed7ef6c} -parentPid 3480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32900 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {81feb458-3282-4454-a620-186779126815} -parentPid 3480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5508 -prefsLen 32952 -prefMapHandle 5512 -prefMapSize 270279 -jsInitHandle 5516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5524 -initialChannelId {bd2fb3cf-cdf1-4e2f-98ee-ea387fb1c826} -parentPid 3480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5024 -prefsLen 33071 -prefMapHandle 6148 -prefMapSize 270279 -jsInitHandle 6152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6160 -initialChannelId {26480e6c-9466-4ea8-8e92-873301dbbdd8} -parentPid 3480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6592 -prefsLen 35183 -prefMapHandle 6596 -prefMapSize 270279 -ipcHandle 6604 -initialChannelId {39e532f4-2c7e-4abe-86d0-62f8008f42fb} -parentPid 3480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:4336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6588 -prefsLen 33071 -prefMapHandle 6732 -prefMapSize 270279 -jsInitHandle 6508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6536 -initialChannelId {8f6ee4a5-4b4a-4ce8-b4d8-ca2b63c70824} -parentPid 3480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 cffafafde1fffb5794d66dde64840b549461122501c7cd7f5853bd7ea6900666
MD5 c1b1d12b03079cfad2a9de1a630e9b3d
SHA1 b468c98ae1a3f545a2e95c85b6c74160220ac862
SHA512 817b59e1547f041f6fe90ccce1d1183265b3156946edeb53d55b232de08347561be9ffb4e2ea1dc8da6973ffd21232c380086111cc375f8cb92fd3aa460d63bf
SSDEEP 384:HalwSiO024Y2WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMArL+GS+J:6l8ZY2WTToXJWTTogB7S/AmVAf+hRMoN
TLSH
T105728D7D8F013CAC2657D0E8C8BA43558D1CB6E7DFB5C06D22983E09CA84A5A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\AlternateServices.bin
Size 10KB
SHA256 a6d02605f753bfab1a987c981421e5926ca821a68b7cd5e95e3f43e8856c1d54
MD5 6ca60b2dde70be14cfd9f8230a1958cc
SHA1 3e7d3544b2a5448b4a886ba7585d7de297081c1b
SHA512 74cfed4aa80361c800de7c2bd47821431111bcf63789643bf80a657caabd68843f035912d3943d7313cd9daac7cde590d80ef345e4fb8ff5c07e5a8eccf2210b
SSDEEP 24:uuhMZ8A91DRC9xwY9B8o9B1aUN9VvSe5q9F55A5Qz9lb:ZK5RwqSOiXaUHBS0I56Qh9
TLSH
T1332278E75F79A463F0528FF0409D716CEC730329196D9184CA4590E712D2BB9A1BFB78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 190a59d4383cd361c099aaed1b47b004a92d5019fa36791c63e384bcde46f97f
MD5 fb2ad1b9bc96736a5c504ae909ffe589
SHA1 8c628892ac290b9aba44bffa14658682a5ee2cca
SHA512 18d83e93cf12ef6a358856a4e23d9570a6b4d84dc1f90539b2aa3fe7d74a0ad06c54faacd36b23ea348b5c0cfb0af3f51198b6cf2402601c2f4ac953d3fca4cd
SSDEEP 192:8zSL7SlOv5zbowbjidShyjGvS3zSCc1d66JozGzgCl6mc0dz:owbbowb+d2yjWjd66JozGzgC1jd
TLSH
T12FD10E64EA38863FC409023BCDA11F404E353956A84E7F19359CA55C2D5B2AE7BCE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0aff575516bf33bb8d5b5f17f2a6ce263ef43e680f7bfef9e3bed8f1491e4964
MD5 57c29a34fefafb57bf93fb3090d5907c
SHA1 87680ff1158fed0c6b5e6c717f579542a35d61e2
SHA512 b9e6d234cad3917eec735602dd7c0271ea0dfa46d801692be71ae82fa4ae80a83062b52651a18ea81a4eae622dd8bef0799681c4e35a33d5e53a8ec5e46a2ee3
SSDEEP 192:UCc1d66JozGzgCl6mc0dCzSL7SlOv5zboPdZjidShyjGvS3z:ad66JozGzgC1jkwbboFZ+d2yjW
TLSH
T14DE10F54E628867FC419027BCDA21B404F35398AA84E3F19359C651C2C572DE7BCE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 85ac910ab160f6b7510ed537b02f7de32c48165d7aff8099b2d9a754f8852d36
MD5 a3542f5c54979f8cd42dab8eb39e2261
SHA1 b4a51584aa6c23d85e7e07a7089ab6f615220f25
SHA512 2b6421f88cb8c99c9a557a86b0d19a0958e3febb5c9bb3ed2c7d92ded73655552a283517fb162ccc99ac27e15d7fdebd7218a430b5c8a1dc153e4ff3603b2417
TLSH
T1EB61D858F2298A3FE445413ACC965B402F347452A8AF7F2A35ACA14C1E5B2CD7BCD07E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 937aa0637ec687fcb8f8c299d2f799d5917e1f61a1be348c7608e020a925b1fe
MD5 7ec5559426a6ecf0dc12397d44ce527d
SHA1 3dae5686e276b462b94b0ca838e6ef1052cfd414
SHA512 64da337a28348e2e9545ae13b3604597cf9ff11acf169d8bb9c11443b326d0d60c1d527116e686c1345274796d19f845e7fa15d2cb56bedc5aeb3b1bbbb8fa99
TLSH
T10B11AD8C3AF84DAE9DCBE69D7449528E57914A0B144B1F431D02DF8ECD81AD9316B43C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\events\events
Size 4KB
SHA256 5b53f8b0b190723f0017e64543c3870c35789c955ba2bedaa336bbe4e7521f64
MD5 7ee23391f75ec5196919a55ba9ee5c18
SHA1 bd11f6e5f0c08d8bc3f8a8ce25646c28fccb43d0
SHA512 ac2efa52993272b39782bfc90a668e43ce2c1118520aeb9dc76a08333fc7505ef6a9b7ec23ffaceb529d5185b88499e3ab82971331b35c508c38b4a6d34e88c5
SSDEEP 48:Yp7mom83A88cceXhwxFoK/A2aXsOIi/ks6zuHcLYY6vNwsPyu47Eqd+iQKQndinf:CkkPcwwfaf6fi5Dxyu4DdkdcBsaE2P20
TLSH
T1FFA1311E26A90CBF6CC7D79DB848868D47DD4703A48B1E870CC7DE4ACC4669A329F429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19358015-46e7-4502-9103-b23b10118181

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\19358015-46e7-4502-9103-b23b10118181
Size 16KB
SHA256 c4e5cc8a3a7d1579a7fa787baeda978abc472447de2aefdcf2c1fe09aeb30046
MD5 0e4c83a0e1a9e05b863d0a9124e73d03
SHA1 037a515215161168a26ce883eec68637809a4b8e
SHA512 fc33314255f541b17902bdb75e4151bf1ac7a9adc3affc7315df4a1f61e7a3d8014f9ece0d7b0db73e186424781f0a309e22c8564747fe2829024cede12f198d
SSDEEP 384:eKiskHbvA4x63y9QGpmRaBSKRccJl3luM2:N4xQyPN3X2
TLSH
T1F772D9566820457B8691E3A9D4F8BFC3E6F528CF4C418FCAD7E4BD082DDA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42898102-7d69-4469-8459-87fe1a124a6a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\42898102-7d69-4469-8459-87fe1a124a6a
Size 235B
SHA256 7c509ac8863065b20a22d38a23de25d2fa4f89f315bf143102bf33342c191f33
MD5 595752a11b2c63c3d508dd026e36f3cd
SHA1 3edef22c967eca04a562ef3da42159df9e732542
SHA512 06b9426355cefb11e1496e92cd281f956d3f2e74ae6aee1503d41a2cf8e2e22fd483c0c0f017c3e727d3ab830cd6fde3d73c777e8e33e8c7033499547e96d8b1
TLSH
T1F4D023806C8CAB6C08040F0BF0F079D630854C3B10B19830DAA11174DFFCFC50152C07
MD5 SHA1 SHA512 TLSH

Submit Download

519d7d29-6e14-44aa-bd22-ff56e6015ad1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\519d7d29-6e14-44aa-bd22-ff56e6015ad1
Size 886B
SHA256 61045f46efafdb9299fe253a501639541e2499227ab37314dadda7b80356ce60
MD5 0d545658cd062004d1efcc2357c0e880
SHA1 7f1bdff3955811b250be394af606b8cdef88088f
SHA512 1c362461289ab1f457b53a90dc815b43c3648ad7e459dcd29495ff70a60822b894612c0cf8add64794b5f4433e8d0c7f6662896587a8456ab8a33c9b2691cb0a
TLSH
T1FE1100829A74B9B2CC7AD29BC5E177428AE07513D0CA9A147D548F2C0CAB41E67AA307
MD5 SHA1 SHA512 TLSH

Submit Download

5f2f0fd5-a7a9-45ea-a2b3-def04bf8638f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\5f2f0fd5-a7a9-45ea-a2b3-def04bf8638f
Size 883B
SHA256 0273485178fdc170cca32850ba1dc232426c8231972c84c9561e679e6a0bae7d
MD5 3ec44eae5e02d5b5d2c3cd775380b95d
SHA1 ef7ed2aa85a0215ee9c72ff3a6f9219239490ae2
SHA512 2dc5319983cbf242f1279498e64ba65505a61d51ec02e7d6466b1c5180f893e6a99b920f334a8d0d9f2432c6dc7b6124915b59d7bd0ddf71c594323d132f3015
TLSH
T141112341E774B9B2CC69D25BC69237015BE47523C0CA96043DA58E180CBE51EA7AA347
MD5 SHA1 SHA512 TLSH

Submit Download

8447f1e4-c37d-4c65-9f68-c213560196dc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\8447f1e4-c37d-4c65-9f68-c213560196dc
Size 235B
SHA256 adecbeb858ea750b55a570dac7cf37a0b48d776bddee5f8d4b7d9a2a9f075754
MD5 09590ded8779e3616f6410ed18128977
SHA1 ab761bfbe7be56f233f2b4fa536a13e534ad8718
SHA512 db4375f704634c5997aea3a08c5c62b5da7147d73574993fb6dbf190981c947fe9a60ae6d434603fce39e79ff3c51253c6d6f5e404e9cbd952cd2637fa72612e
TLSH
T1D7D097A11498EBAD08180F0AF0E02BCAB2584C3764F8982899A040388ABDEC54262867
MD5 SHA1 SHA512 TLSH

Submit Download

fd18e4ca-c01e-43bd-90b4-42b23ff63051

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\fd18e4ca-c01e-43bd-90b4-42b23ff63051
Size 2KB
SHA256 8875967c157ab4e5ca6222c38a9be759d44bb2a940fc85fb75a526fa6e94d676
MD5 51578956468f1f9ccc3853c7bb33f6de
SHA1 8f4022edb9d20d76e8b4fa1bf674f3e357991ffb
SHA512 19321a1f057dd1c0d9bf6f4e99bba229068220899750ea7e6129b2982d9856704ada2a255398b3bc1e8985d56174c891a50e843c79e03f892faa4ea0a47433db
TLSH
T12B41435C76B45C769CDBF64CD581238957708E4350C628836D91EF0C8CA669D37AF42B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\extensions.json
Size 16KB
SHA256 047a39fc6598bf0c03b4a8dccae89a82ca540c1bdcf6c659c2b2a276930cc3fc
MD5 dddad5ad2ae1a66a914c827832bcf328
SHA1 ff8953f6ecbdcf8d7e7bb11720e196d12529ccc4
SHA512 f1597e2b806af854175a4dbab45be497889294a80fb5a3f6ef534db286fc4ea7cd009868e424ead7ad02747e0ab9001e18fca6da9c7370987a78d162a913f175
SSDEEP 384:6kI4vuUmldvr8dhWC94zn96o5L4HLL4PNL4HZL4HAL4HZ34he:9I4WRfYXL4x62434l4x4C4J44
TLSH
T1B972531545048EB8294FA79BAA36BE01C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 214KB
SHA256 062875945aab322b6a872cc5e306570ccd4fa2bac6f539d6b81bf08659902387
MD5 d2514470b7125d2b48fcbec2795c439d
SHA1 788c2f45d581bfaec14ea29746c1696c5ad93c94
SHA512 532c97e8872cd50b3ac02bb1789fc96f00b50f40c1e38337612992176f2d222d010945ff038df25b8ccfeac0c1ecc04e5896ca7cb5823c66c0f48f05d41e5cdb
SSDEEP 3072:om1c4xtCwNz2Sym8CGZUCYEjB6RcpQnujrRzHk8kukm4eTzsx:op4xt3RNyg6BmcpYuHRj7/7u
TLSH
T19F24E7ED537250B8541BCCE0DB3EA8B6014C20BF51A1C3B908DCD17989B7AC5AB59FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs-1.js
Size 7KB
SHA256 a94cf83b72cbe3589e363dda0c478e07144d0c8d16d1402a6c14a6a006fe2075
MD5 d1a7529238bd07e72b79401f6efbf36f
SHA1 45978a012d7dac179c89b8d13f347c3226fc372e
SHA512 287986ba86ef69a3cdea8f6408807173ca227ebcad44c56648fc651e01d9b54607eb3c903410740768e76dc3477f700467ea088613902cea6718c6b457c55e3d
SSDEEP 96:xH6UTUBqGqgXf6gZUNbzSPSSlSdv9jLnzRHytUyCYBw88n8L4cnpV1pbGS:ksRgXf6gZUiSSe9ytPBw88EpR
TLSH
T15AE1307895088F7F64B6776CAC6888315AB2013BBBBF68D750B554C4051CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs-1.js
Size 6KB
SHA256 92ffcfeaa12c83b15f291d1d505c6b43371d0bb380cb5f557bd43e83de2aedbf
MD5 29e8ec28c2f5fc679bd850ce647baa22
SHA1 54f405c73d3896a6174e6d216c36484d48a9693d
SHA512 07f9f22d1f0da3ff328f32f3f2f335d4791c10dfbb263ac19d750bdc15c3619c1aacf1b891fad4ff1cd1d209585e5989bdde39ea44a4dc027d03c83c08662285
SSDEEP 96:xH6UTUBqGqgXf6gZUkzSPSSlSdv9jLnzRHytUyCYBw88n8L4cnpV1pbGS:ksRgXf6gZUxSSe9ytPBw88EpR
TLSH
T138E13F7895088F7F64B6776CAC6888315AB2013BBBBF68D750B554C4051CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs-1.js
Size 7KB
SHA256 0648994528656986e6005e633005a5f81edb1676c05373a8e0c918b219342869
MD5 32309474dafa01865946db093732dc41
SHA1 77528f5318aaedec3b413377dac3fe52500ebeec
SHA512 359e736fd377f1d710f77d89f24417388701171d6072e3edc853f1f6bfb6caa42c74ded189196b9b5ccc3892494f469f23e25e5b9814e9c377e19dbaa45780af
SSDEEP 96:xH6RTUBqGqgXfngZUNbzSPSSlSdv9jLnzRHNH2tUyCWtBw88fnQ8L4cnpV1pbGS:ktRgXfngZUiSSe9NWtpBw88JpR
TLSH
T19BF10E785104CB7F68B6776CAC288D315AB2013BBABF68D750B554C5051CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs-1.js
Size 6KB
SHA256 5b67acd9d51666eae880ce73c8ab283b2fb2fe6f23aa03f6ff971f8f5641a2f2
MD5 2442b38af0f8f98d35648fd2dc5fd91d
SHA1 6a9b1671d68997bba45cee24dfa671b7aa2715af
SHA512 23569f62e8a44c4975c3a7ee26dd508e0f8859484036ec7f0cb265dbdb6c4ba9750904baedea5bd4b403e72fe8342b3bb63d8df85eeb7c5fc706f2bcaa90f518
SSDEEP 96:xH6UTUBqGqgXf6gZU1zSPSSlSdv9jLnzRHytUyCYBw88n8L4cnpV1pS:ksRgXf6gZUeSSe9ytPBw88EpS
TLSH
T1BAE12F7895088B7F64B6776CAC6888315AB2013BBBBF68D750B55484051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs.js
Size 6KB
SHA256 6c1c19f8f26ec2e510eb55a7851a817030a8a09139ef227a2d7fa5d82e107639
MD5 36aea5596c182927bf28dcdeebadf6df
SHA1 7453cae90e9fa1c72ace48875ea5356512a6291a
SHA512 c33a11557bfab845ba2b98b05063df4a9760e432dc766d32ff71189dbc6fdc5c9490afec10b91a2b17c71411f45900d9f13f53defbda048e40addc5881c86f6d
SSDEEP 96:xH6UTUBqGqgXf6WJ1zStxSSlSdv9jcNnzRHytUyCYBw88n8L4cnpV1pS:ksRgXf6WJYxSS59ytPBw88EpS
TLSH
T1A2E13E7894488B7F74B6776CAC6888316AB2013BBBBF28D750B554C4055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 721efad9a1f27dc5df7c1c695e0dd8ad038b2d5a570bf2a71dda45414fc3b4fa
MD5 a8c955e53a185dc94b40e44b2306c3aa
SHA1 14ef8084fd28f9f9faf6c51cbee4c2213d251477
SHA512 e2c64803ed70163cab66f6163a651f28164b383e75e4bdbb1cbd76f07cfc60d5cfe399f2bf911d2852468e64bbd00175518e8a6acc9b0b505942a909bd308843
TLSH
T1F1514AEB1D1AA8FB34A5C6D2E4CF4FD1C9921010093B4076FD5EAA2151EC04EA696F5F
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 603ca649a92b7757680594d084c904bcf2772e4544e1aa69440257a1e109ee4f
MD5 88ed684bd5c786c5cf042d68d05bc2a6
SHA1 72ea5cef421ffe50117af384f66c3dd08b79b657
SHA512 0e064bf6065e2fbe7b59680891b787b4091632117b5bb67f1588bcbd7ca48f21f2d2e10d1c211716d4900733a7ea9f1bbe56fa33c8245c3c718dd074e8622439
SSDEEP 24576:qwpGlu4DBXpSOjyADYBveY4sGtcrOILW1QOgYaQLuw8BBBjZNTrIOayi:BpPkdGCYIhhQOgzQLuRdjjTrrA
TLSH
T1B04619F820D1A297F3814033724593EB21EFD00D5027DA085BA99AE9A575CEF8E17B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.2MB
SHA256 bc5ae89e5024913f6920c4f7a520d123a8eab8cc3f9ca8c9dcf67b4b48110ef9
MD5 35dc05858bc95a33af763933ce494bc2
SHA1 205cbb10444e1cda15c4517063eee129e9076288
SHA512 e3a7fc0aff70869b4a6cc1f586cb20da0639f61ef77cc0fb2df889d8c448ffd9e3fff015d287486ab45b9864ef14646c3c96a2ff1a19515837ef57d5fde05bb1
SSDEEP 24576:YbO7oWjjdCjyNEaYyvm0POAVgZcre7LWAQObYaa0uw8BBBjZNTnwzam/1:Ybf6YGNbYrphQObza0uRdjjTn81
TLSH
T17C6629E860D1D247F3864073B24993EB21EFD00D5037DA0857A45AE9A5748EF8E27BBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.3MB
SHA256 44dc0fef02dd9505bb65e0a4c4010dec126c67e3da738e9cd1d0d1b1a21651ab
MD5 62160f58343a8c9e7baccc16201b66a6
SHA1 38c961266308edded3d85225a6e3ad1ea4d83c55
SHA512 2e5c588b809725288a6a82f5e03fabb32102b88f6209065cd55f504ccb2491dca3313d9fc10320e9d84c467dbaf41827d7d5ea57859374c5691109367c8f26af
SSDEEP 12288:R2fKL73Qo+AybOiU/BHDujCddXjYPtjzwe9Y:ci4JoijgdXjyNEaY
TLSH
T1EE559FE034B8D14BE3A1E43B6A4DE3E7223FE108D4B3D6D45FE12384369969B4D86716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads