95a4a308783ad305beebf00bd655b2c533f86b2b8bea7c956b682c124d4e587a

Analysis

user interaction
yes
max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 1KB
Sample260930-jsvtdaxtgy
SHA256 95a4a308783ad305beebf00bd655b2c533f86b2b8bea7c956b682c124d4e587a
MD5 94effd873b99613196311a2b4bce535b
SHA1 55d9b97946691ab920ffb8e8da05bca168a1b184
SHA512 1730a7863e67ba9aca2264bcfeac5b60f31a182cd2a1c691c258054a0b71f3d1c85b82edc934226ac464708173bdad90c87d2e8a4d125652e104d9c011c24233
TLSH
T1D6111F83DC24826C1B707DC4B871F34DC5CA390CADA198E071FD02AC29E07988D1DC42
MD5 SHA1 SHA512 TLSH

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	firefox.exe
Token: SeDebugPrivilege	4396	firefox.exe
Token: SeDebugPrivilege	4396	firefox.exe
Token: SeDebugPrivilege	4396	firefox.exe
Token: SeDebugPrivilege	4396	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4396	firefox.exe
4396	firefox.exe
4396	firefox.exe
4396	firefox.exe
4396	firefox.exe
4396	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4396	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4396	4688	firefox.exe	88
PID 4688 wrote to memory of 4396	4688	firefox.exe	88
PID 4396 wrote to memory of 4868	4396	firefox.exe	90
PID 4396 wrote to memory of 4868	4396	firefox.exe	90
PID 4396 wrote to memory of 4868	4396	firefox.exe	90
PID 4396 wrote to memory of 4860	4396	firefox.exe	91
PID 4396 wrote to memory of 4860	4396	firefox.exe	91
PID 4396 wrote to memory of 4860	4396	firefox.exe	91
PID 4396 wrote to memory of 4860	4396	firefox.exe	91
PID 4396 wrote to memory of 356	4396	firefox.exe	92
PID 4396 wrote to memory of 356	4396	firefox.exe	92
PID 4396 wrote to memory of 356	4396	firefox.exe	92
PID 4396 wrote to memory of 356	4396	firefox.exe	92
PID 4396 wrote to memory of 4520	4396	firefox.exe	93
PID 4396 wrote to memory of 4520	4396	firefox.exe	93
PID 4396 wrote to memory of 4520	4396	firefox.exe	93
PID 4396 wrote to memory of 3476	4396	firefox.exe	94
PID 4396 wrote to memory of 3476	4396	firefox.exe	94
PID 4396 wrote to memory of 3476	4396	firefox.exe	94
PID 4396 wrote to memory of 3476	4396	firefox.exe	94
PID 4396 wrote to memory of 5144	4396	firefox.exe	95
PID 4396 wrote to memory of 5144	4396	firefox.exe	95
PID 4396 wrote to memory of 5144	4396	firefox.exe	95
PID 4396 wrote to memory of 5144	4396	firefox.exe	95
PID 4396 wrote to memory of 4272	4396	firefox.exe	96
PID 4396 wrote to memory of 4272	4396	firefox.exe	96
PID 4396 wrote to memory of 4272	4396	firefox.exe	96
PID 4396 wrote to memory of 4272	4396	firefox.exe	96
PID 4396 wrote to memory of 5548	4396	firefox.exe	97
PID 4396 wrote to memory of 5548	4396	firefox.exe	97
PID 4396 wrote to memory of 5548	4396	firefox.exe	97
PID 4396 wrote to memory of 5548	4396	firefox.exe	97
PID 4396 wrote to memory of 4008	4396	firefox.exe	98
PID 4396 wrote to memory of 4008	4396	firefox.exe	98
PID 4396 wrote to memory of 4008	4396	firefox.exe	98
PID 4396 wrote to memory of 4008	4396	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\sample.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\sample.html
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {6fdce8a1-566b-4b9e-b26f-02c8f8555560} -parentPid 4396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4396" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {fddca0f5-8e11-4fd7-be8f-7851ba71f5d8} -parentPid 4396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3724 -prefsLen 27274 -prefMapHandle 3728 -prefMapSize 270279 -jsInitHandle 3732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3740 -initialChannelId {8bfb8c0d-519a-41ba-af23-335efa91a7b7} -parentPid 4396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3904 -prefsLen 27274 -prefMapHandle 3908 -prefMapSize 270279 -ipcHandle 3728 -initialChannelId {6590e0c6-7106-47bd-92cf-e50de349aa26} -parentPid 4396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4396" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4436 -prefsLen 34773 -prefMapHandle 4440 -prefMapSize 270279 -jsInitHandle 4444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4456 -initialChannelId {9365dda5-b552-4047-b408-cb64011c36c0} -parentPid 4396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5056 -prefsLen 35010 -prefMapHandle 5140 -prefMapSize 270279 -ipcHandle 5204 -initialChannelId {aeefd409-2700-42b6-a014-c9d2268b4336} -parentPid 4396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4600 -prefsLen 32952 -prefMapHandle 2716 -prefMapSize 270279 -jsInitHandle 2936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5472 -initialChannelId {eaaa949f-e967-431a-8c8c-cb24e7dff9af} -parentPid 4396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4684 -prefsLen 32952 -prefMapHandle 5456 -prefMapSize 270279 -jsInitHandle 5452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5480 -initialChannelId {4c279fd4-2a58-4fb5-89fe-1f77e0ab491a} -parentPid 4396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5808 -prefsLen 32952 -prefMapHandle 5812 -prefMapSize 270279 -jsInitHandle 5816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5824 -initialChannelId {38eb1085-2aa4-4650-810c-4061d2fb7018} -parentPid 4396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 be9a18da84f91b5dd9684245993a959a91a6437a0684968b7438e8ddcf6a40f5
MD5 4924118af32bc66eea309019bfd56652
SHA1 28c16a5bb83e9cf8989b434ce3c40f70a493972f
SHA512 38fef5125b701f5c03e7ae86ad86fb7c819e3840434fc97f7fb19dc09f6df0bb2d24901f354096709a5f1c9054d0d7d6671e170bb7d1eb842a3efb24fa7b7bb0
SSDEEP 384:HalwSiO024YuWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA3L+VS++:6l8ZYuWTToXJWTTogB7S/AmVAf+hRM2v
TLSH
T1ED728D7D8F413CAC275790E8C8B943598C18B3A7DFB5C02D22983E09C984A2A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f1c470172e60b5f7b895f5d63b142917bf12eb89771088425a39d2f697ab2076
MD5 0e2e136eb1b6ed7525feead1abb915a3
SHA1 9812b8c1861314dbdd532445655a812cea317e2a
SHA512 8161c68b592eecfbb7079a6e29e88b2c6d12bf1df66fe227d4e547b94bf8ead18c29146772290ff1c09a38df0b72998735e349ddc90d1593595d57b74970efce
SSDEEP 192:BOv5zbo7yZjlyjH831d66JoztdzgCl6mc0dz:ebo2Zjlyjgd66Joz/zgC1jd
TLSH
T194E12064EA38423FC428027BCCA21B444F35399B984E7F1975ED640C2D572DE769E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 3e15b8b480efdbab462d93801b993519ac2192028ecb692757121d31eb4da773
MD5 7fb05a609d13d3653cf0d9953ac07ffa
SHA1 a2371a53cb60fbc45a8859d1210aadb71bc9fe98
SHA512 276dcc3bbbaba03895d05efcf399a7d8eef52b40a9717f9546eb421f689e2b789859e1fbfcb09576d64279200277d28b7cc66df402a12163c37fe2c5af9c3e1c
SSDEEP 768:l1w75afZDrVS4JAmCGcm+ucSHiKqqH8DQH58FdfbsbAbRbbbzbHbSb4bwt9KlND/:oafZDrVHJAMiIt9KlND/eu18mx
TLSH
T1D703F144EB1A553FD46812BADCA50B002F78F88A590A2FA7375C64786C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 e4d71b7a46c32b8171b83f76a67f1482559517986a91ef1ad0d525a71816363d
MD5 3cce5a503a2f1edaa0d2072792633be4
SHA1 d7c6c851ceb400f17fa2528b8570ed9543f79c35
SHA512 d1eb5ef929e577e827e7cf514cf1cccba0777ca8a8cc4f7d3bf5b66c7ab74bec6a18e6915b157b455a6a3cb50bef6aadae2e4f48ac10848aa2094c616f8e422f
SSDEEP 768:QcXbPJXCGcm+ucAAiNKWCxO5bDbT87d1/:QcXzJxAiNhi
TLSH
T1B2D2FE44FB2A953FC42512BBCCA507042F79B88A58192FA73A5C646C6C872DC7D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 ac8a8c4a93cdcbbdb7ac6e6a62c850f797769fb9307caf88a026dd90adbcdc7b
MD5 1e957913c548d53f7e9b77f5cc836b91
SHA1 f4dbdff255e05a788316768cf8e3159eb828a64f
SHA512 57c43801ce4d97504387cf75a6a14fe082962a7cafd4eb206c28e4839d1ab189ff99f25b7a0fe5c88ad54013811c9f10fcd061d116866fccfbf23e1ef480d801
SSDEEP 768:57d1mafZDrVS4JAmCGcm+ucSHiKqqH8DQH58FdfbsbAbRbbbzbHbSb4bwt9KlND/:YafZDrVHJAMiIt9KlND/eu18mx
TLSH
T14403F144EB1A553FD46812BADCA50B002F78F88A590A2FA7375C64786C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 6e5d9613018a93a696612ff8a906a493ff346f38e3cac8531e2357a158b9d7b0
MD5 16bd95da2233d3ae4badf803ad8d2456
SHA1 616b7841f0426bffb6594004775e9f6b0fcf3e6a
SHA512 8da2583b910e2cce005ddaa60a340a08cd8d13454d385e0363d310ac8e011f943042cc534a316130d6f96af4644bba4e5f35dd6a4fcf161c941f85fa9dbbc064
SSDEEP 768:l1mafZDrVS4JAmCGcm+ucSHiKqqH8DQH58FdfbsbAbRbbbzbHbSb4bwt9KlND/ey:mafZDrVHJAMiIt9KlND/eu18mr
TLSH
T17603F144EB1A553FD46812BADCA50B002F78F88A590A2FA7375C64786C872DC3D5E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f3019945bd83043c92fc5e52f59b17b654780850df804080d0aa7042d9c55980
MD5 c7ec04820d8591dc17706299ebc84b57
SHA1 3c6e8c49441a27bd038c3c6202c6ff5a153507ef
SHA512 bfcb54ef7839e2f60957c9b901ba23663912bde35c5b0ae1ad6f9b3ffc4a107a7845af063eed10441359b62b4ea847d912c7c8830eb781259e64224c71b04ac1
TLSH
T15B217C5D3BF84D6A5CCBE6AC786106CF53954E4714871C432D02DE8CCDE1ADA32AE47A
MD5 SHA1 SHA512 TLSH

Submit Download

07ab08fc-6483-4d21-849b-f1eda15c086a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\07ab08fc-6483-4d21-849b-f1eda15c086a
Size 235B
SHA256 d2466d2b8433485284f475253b54493770280ad8ff36ade424ccef79abea37e2
MD5 9064b56f836902b856888ae9a03e0661
SHA1 ba52a82603def7c57f75669ccf1f0aade4d8733b
SHA512 48f8959c90a1105ea7f762be7085cc97de54584a820be9dfb745af811062b69918f463f9a8361e832bbb2b1aba39fcfeb5717bd48007df3862ad3551722b22df
TLSH
T16BD097C038D8636C08240F0BB0B0B8DA30484C332470A810C591043899FEAE80261C57
MD5 SHA1 SHA512 TLSH

Submit Download

131b776d-5d09-4916-bdda-367e15889daa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\131b776d-5d09-4916-bdda-367e15889daa
Size 883B
SHA256 7920fd8dcd0a9cca35cdfa897d3d9180e070a4b69bb8a2c83676a9494e293859
MD5 c98c0086075e499dc7d007b6b4e6e4c4
SHA1 c44b4a91f5d2d20313084d162a7d36ff39469109
SHA512 0f02d75cc6aa9fb79756d04df43fe0c0cd8b729cddb5f7ae40699ee8e5196ee8be5a5e8a72f09baa159d493b1a5bddfe4652048a481e7fad724a7f1800c66520
TLSH
T1F4119940D631B5B2CC78924A89653706D7A47623C0CE99483EB56A184DBA66FA37A207
MD5 SHA1 SHA512 TLSH

Submit Download

2820d89a-768d-4a51-8a9d-f8b7842caa46

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\2820d89a-768d-4a51-8a9d-f8b7842caa46
Size 235B
SHA256 a694ed8d9c1bde8dad894d816d6e90340894323d804ab06e1a28971c0282563a
MD5 ff072fa8a31d0baf127022d5e55f45e9
SHA1 c90c249a2db77d03894921ccb1b79b8a9cdbe9ab
SHA512 cd47ef30ae2aeff7105e4233fdbf21b71ca6baa09cebd40a5e48e87649806a631f2f8a71c1aa2422bab2cf910af367b9749c4f0f1c2445f85fa2902e2d2fc3ad
TLSH
T1F7D09780A488232C08200F1AB8E4ACC630844C331070B810E66014B89AFADC441A280E
MD5 SHA1 SHA512 TLSH

Submit Download

4d08d43d-1c57-4123-97aa-e3c0bc2792a4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\4d08d43d-1c57-4123-97aa-e3c0bc2792a4
Size 2KB
SHA256 7611fb7796b65318273120c39128904a7d36c6e874f4c29e11b4d118280b2e15
MD5 3ae0811497dbeb8fcc1cb977474f545c
SHA1 9d69eafeac04d88fddcb0d35c225a388e530fdc3
SHA512 f765049660ebd610c4257942b1eb84ec693ed31bfad372d105cfdc38a73f554f5ae90f7fc3da9d56d883a7bfa5032ce5a37c3f8735cd009b83ffb515104ad539
TLSH
T16E41211C75B84CB69CAEE54D9492278E93604A4750CB3943AE62EF0CCDD379A337E427
MD5 SHA1 SHA512 TLSH

Submit Download

55829db6-8b91-491b-bb57-9b7f23a68274

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\55829db6-8b91-491b-bb57-9b7f23a68274
Size 886B
SHA256 77f3d42a9bd050a502a11bf85019d6a09f0d6fd035c7aad1a3c57ad71bcc7353
MD5 933bbf7b4c307db87b88b3b208e838b6
SHA1 b49d02aa3de513d21afc9348491a549f8b17a69b
SHA512 7bf36e429678096b4fde101685cfc278a6a9e8dfe4e618a950fbe21c01eb1e7f6cc0c13efc6e803dc4dbcd6019db28723aae6bb0491f3a69ac1a8534fa456121
TLSH
T17B1100408A3075B2CC78A24BC4A1770697907223C0CE99087EB66F084DEA25FB37A707
MD5 SHA1 SHA512 TLSH

Submit Download

6316872c-3951-416c-81d3-147dddc2d218

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\6316872c-3951-416c-81d3-147dddc2d218
Size 16KB
SHA256 7dce3660c60015c3e88d5dc12e39cb9a4cec111d926c09491b6f1781e66ee073
MD5 00a6617be0bd6069992e0f0b78263569
SHA1 b1332ccb9e1d0e615c93d954f9f1193d20573e3a
SHA512 59c717d08d94ace0871ea32a3cf5a7c1169caab371ace845618b40c0b6722a9626feaee7599eeedad3efc166011cff9ccbcb792d74dad2b21b7eebedd520e33d
SSDEEP 192:IOc4XP5VeuqTzfVILKgWVB/4z114Yc0I0Xcd3b8TGIEEnIYYV+V/dZ4zWZZ7Tfas:9XP5VpqTzVILK7e34uCzInnOUZ7T9
TLSH
T19D72CA16586045BB8591E369D4FC7FC3E2F638CB4C419FCA9BE4BD082DDA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\extensions.json
Size 16KB
SHA256 98b542fbd755c913ba284dfebc7688891dcaf50f32a8c09079c215fce8ed9026
MD5 3a3f7138e96e214aeca02be74726329c
SHA1 0b26b804df7752f46c9f7fa16996b58edfaadcb3
SHA512 463fc4959e982af7ecb1f23edae0113a8d982aebbc99884d89268bcab73e9cd7872297b2d814aa492db77e88961994af3c4bec4f7bf81c64dee27bb50714ad84
SSDEEP 384:4kI4voUmldv98dhWg94zj96oSL4HLL4PiL4HeL4HtL4H784hv:vI4gRfuXJ4V6X434Y4E4N4w49
TLSH
T1D572531545048EB8294FA79BAA36BE01C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs-1.js
Size 8KB
SHA256 59edd11e2e0b3aca39648290cb1033990b7a1cd68b32a2d8f7fda74a8f3284d9
MD5 4d1620a911d375bd678302749f5d8b64
SHA1 13916e497778d4085fa933b5c845c18eb7122be8
SHA512 edec2329e43015e5f32afe92fc63e57ebf7d227f9a02ce5377f996b81e81267006b17683d8021f8cf334f7343bf927cb38780aadb0d81deff747676b5bbfc712
SSDEEP 96:xHSdTUNqGq3JfEvtObzSUSJFSSl4dv9j1nbWRrJXsd8Bw88v5u8L4cnKM5I3J:ENR3JfEvtWeFSSFR1X68Bw88hy
TLSH
T17A020E389104CB7F78B6367CAC348D716AA2013BBABF68D650B998C5415CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs-1.js
Size 6KB
SHA256 67091c141e8e183dfdcc7094e834e2ce87be9b64fa21123ca57a32ac76629122
MD5 6fade70f704cdd8a7ca996a9fe38427e
SHA1 a6c37afe55bb8c0b9b559f2d5aedc2eaefd453e2
SHA512 2075ed485f26a6c7e69ee13e8a9d98cc647f94c579cb2f17988c12934e49ef43231a100bf3a57137628583e4a6ff2c5e4bb70c2b852e80f6d1578b0d3a5e7983
SSDEEP 96:xHSUTUNqGq3Jfb4vt1zSUSJFSSl4dv9j1nbHtXsdSBw88u8L4cnKM5I3J:EAR3JfsvtteFSSwtX6SBw88y
TLSH
T114E11D7894088B7F74B677ACAC688C316AB2013BBBBF28D750B55485415CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs.js
Size 6KB
SHA256 1d2f8d223916a828f7efa5ed642af1fe1f7bab27e16cfbb88eade7d832e87182
MD5 c7e00b1d18f6e9e5486fde7f12f311af
SHA1 2d4dda3b3ce6b7eeaf2d6f6a3a8ce18462324e93
SHA512 c673604e4ec34b0a0fe56f3bab0f7e384a02928b5f7de9afbad2988ed20c2a5643013302675db14f05f8b6cf8497fe4058046b7c0f074591769fce7303c608ec
SSDEEP 96:xHSUTUNqGq3Jfb4eV1zSdSSl4dv9jpnbHtXsdSBw88u8L4cnKM5I3J:EAR3JfseVQSSktX6SBw88y
TLSH
T1C3E12D7890088F7F74B676ACAC688C319AB2013BBBBF68D740B95485054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 c9b28f1359752cb286a6342c17751da474dcefd3cf38658e27759cc977f81b88
MD5 ab295ee711a71bed0417c1cb3604f7a6
SHA1 593d5763d48292aebbf60454ede76ff4adbac6a9
SHA512 d87c76c3ae280796ff5f0a71af12fd4873130f38668ee880d176de5e19d962a43e7c540ea06792ab2cbd5c2d2ca13e9ac759fee0833e8fbdbdbbb78a1e0779e1
TLSH
T16621FB9284DA3FF17D504A1AE0F05BFA4AB57066447044B1A50ECF4149F911B7B4E62D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 0274a7d0c667f1aa05661490315313c71098114ace4d0bce9b224c4fbee6d11e
MD5 cebc125f598858725a1a4b849929adf0
SHA1 a079eba15d76bdd162ee4c2866fedce7695c1b97
SHA512 f761923fcf34f8627d6efd99796b6a54e30220b8426b9d3d5e6ba242f460e0c7e179381e750431131171f0e421f2ad51edc468940ee87affea293065be30a70d
TLSH
T1F821FB9284DA2FF17D504A1AE1A05FFA4AB5716684704071A50FCF4149FA11F7B4E61D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 014619d0bf69c84312374e9c5bac7c6c4cb046d30c731ae22dc4e52b01f0e2c1
MD5 da6b76f56c90f6b246b421a1e2975987
SHA1 030ed505696b7718d994c9bae0e49a4983c7a40a
SHA512 67e91e5a9e3813b8c3ab235417ad8cd4933da3722b5fd1febc84ef69afc5b0bfe0f635f1e6000ad12655a49167eeb4f51bd21fb2b9cc96ab74556b49f53f32af
SSDEEP 24576:yNJwu7DmsTOPjPh5YoMkhbthMDqDWPhCQPhTJxK9Z15P7UNqsPAhe3QNikcJW:yNx/kDbYQhP0JxmT5P7xRhsqih
TLSH
T1B94629E820D1A297F3814073724593EB21EFD00D5037DA085BA99AE9A574CEF8E17B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads