hxxps://csgcons-my[.]sharepoint[.]com/personal/simone_damato_axetfacility_it/Documents/Rivisto%20e%20firmato?e=5%3a2akpij&at=9&SafelinksUrl=https%3a%2f%2fcsgcons-my[.]sharepoint[.]com%2fpersonal%2fsimone_damato_axetfacility_it%2fDocuments%2fRivisto%2520e%2520firmato

Resubmissions

30/09/2026, 11:29

260930-nljvra1wbt3

30/09/2026, 11:19

260930-ne62psshna6

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://csgcons-my.sharepoint.com/personal/simone_damato_axetfacility_it/Documents/Rivisto%20e%20firmato?e=5%3a2akpij&at=9&SafelinksUrl=https%3a%2f%2fcsgcons-my.sharepoint.com%2fpersonal%2fsimone_damato_axetfacility_it%2fDocuments%2fRivisto%2520e%2520firmato
Sample260930-ne62psshna

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	firefox.exe
Token: SeDebugPrivilege	3192	firefox.exe
Token: SeDebugPrivilege	3192	firefox.exe
Token: SeDebugPrivilege	3192	firefox.exe
Token: SeDebugPrivilege	3192	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3192	firefox.exe
3192	firefox.exe
3192	firefox.exe
3192	firefox.exe
3192	firefox.exe
3192	firefox.exe
3192	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3192	firefox.exe
3192	firefox.exe
3192	firefox.exe
3192	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 3192	3860	firefox.exe	87
PID 3860 wrote to memory of 3192	3860	firefox.exe	87
PID 3192 wrote to memory of 1828	3192	firefox.exe	88
PID 3192 wrote to memory of 1828	3192	firefox.exe	88
PID 3192 wrote to memory of 1828	3192	firefox.exe	88
PID 3192 wrote to memory of 4540	3192	firefox.exe	90
PID 3192 wrote to memory of 4540	3192	firefox.exe	90
PID 3192 wrote to memory of 4540	3192	firefox.exe	90
PID 3192 wrote to memory of 4540	3192	firefox.exe	90
PID 3192 wrote to memory of 1960	3192	firefox.exe	91
PID 3192 wrote to memory of 1960	3192	firefox.exe	91
PID 3192 wrote to memory of 1960	3192	firefox.exe	91
PID 3192 wrote to memory of 1960	3192	firefox.exe	91
PID 3192 wrote to memory of 4684	3192	firefox.exe	92
PID 3192 wrote to memory of 4684	3192	firefox.exe	92
PID 3192 wrote to memory of 4684	3192	firefox.exe	92
PID 3192 wrote to memory of 1988	3192	firefox.exe	94
PID 3192 wrote to memory of 1988	3192	firefox.exe	94
PID 3192 wrote to memory of 1988	3192	firefox.exe	94
PID 3192 wrote to memory of 1988	3192	firefox.exe	94
PID 3192 wrote to memory of 3380	3192	firefox.exe	96
PID 3192 wrote to memory of 3380	3192	firefox.exe	96
PID 3192 wrote to memory of 3380	3192	firefox.exe	96
PID 3192 wrote to memory of 3380	3192	firefox.exe	96
PID 3192 wrote to memory of 5484	3192	firefox.exe	97
PID 3192 wrote to memory of 5484	3192	firefox.exe	97
PID 3192 wrote to memory of 5484	3192	firefox.exe	97
PID 3192 wrote to memory of 5484	3192	firefox.exe	97
PID 3192 wrote to memory of 5496	3192	firefox.exe	98
PID 3192 wrote to memory of 5496	3192	firefox.exe	98
PID 3192 wrote to memory of 5496	3192	firefox.exe	98
PID 3192 wrote to memory of 5496	3192	firefox.exe	98
PID 3192 wrote to memory of 5508	3192	firefox.exe	99
PID 3192 wrote to memory of 5508	3192	firefox.exe	99
PID 3192 wrote to memory of 5508	3192	firefox.exe	99
PID 3192 wrote to memory of 5508	3192	firefox.exe	99
PID 3192 wrote to memory of 5800	3192	firefox.exe	100
PID 3192 wrote to memory of 5800	3192	firefox.exe	100
PID 3192 wrote to memory of 5800	3192	firefox.exe	100
PID 3192 wrote to memory of 5800	3192	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://csgcons-my.sharepoint.com/personal/simone_damato_axetfacility_it/Documents/Rivisto%20e%20firmato?e=5%3a2akpij&at=9&SafelinksUrl=https%3a%2f%2fcsgcons-my.sharepoint.com%2fpersonal%2fsimone_damato_axetfacility_it%2fDocuments%2fRivisto%2520e%2520firmato"
1⤵
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://csgcons-my.sharepoint.com/personal/simone_damato_axetfacility_it/Documents/Rivisto%20e%20firmato?e=5%3a2akpij&at=9&SafelinksUrl=https%3a%2f%2fcsgcons-my.sharepoint.com%2fpersonal%2fsimone_damato_axetfacility_it%2fDocuments%2fRivisto%2520e%2520firmato
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {7de489a1-58f4-4efe-8217-9600aaf0af8d} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {ded76b9d-2667-477b-af26-adf7924bd2ef} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 25164 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {8411e156-6a5b-4c4d-8793-0547abf32ba8} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27276 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {7f53bdc4-52a3-4a4c-9728-dc435f3f3199} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3096 -prefsLen 34775 -prefMapHandle 3100 -prefMapSize 270279 -jsInitHandle 2952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2944 -initialChannelId {230580af-ea51-44f0-9209-86f3b14fdfd2} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4940 -prefsLen 35012 -prefMapHandle 4936 -prefMapSize 270279 -ipcHandle 4960 -initialChannelId {6c095af4-31a6-42a0-a69b-221c5ec590e8} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5116 -prefsLen 32952 -prefMapHandle 5092 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {e4a28d4c-26e6-412b-a3d5-a53ae670158c} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 32952 -prefMapHandle 5084 -prefMapSize 270279 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5328 -initialChannelId {95f70bc9-ae4b-44d2-a428-a1b64f592af8} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5516 -prefsLen 32952 -prefMapHandle 5520 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {f58cb1d9-598d-4e68-9c92-059d39c2d995} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5800 -prefsLen 32952 -prefMapHandle 5804 -prefMapSize 270279 -jsInitHandle 5808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {27c644b9-ab73-4da0-85be-e22807b6d75c} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 0a5847cd1842d1fefb457c7c91f7da3912e4886d25bced7dfa902e9e93c843a9
MD5 6c649730aa180d3437fb2dd70225c64b
SHA1 17a641bbe41d53a22ebb46d6c1df31f49d09ccd5
SHA512 c36dd807b0a7b47f2149cceb4f397a0c0c10659d210ac9791839a86cec5a3d0fb45a940c11c05ed4f043a32550543bcffd0edc21ac2b193a67ba54175d9981e1
SSDEEP 384:HalwSiO024YjWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA3L+3S+y:6l8ZYjWTToXJWTTogB7S/AmVAf+hRM2R
TLSH
T129728D7D8F413CAC275790E8C8B943558C18B3ABDFF5C02D22983E09C984A2A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 b81b02f07fd2d3fa5ff1c6cd5e2c751e61e65c53bab0b6ec03fb2b79d312a565
MD5 d1207e2fe6e199579f5915247e095326
SHA1 9db8b441cf4c8a6e924b556f775b32f41e60f33b
SHA512 70ecb07edcb02d9c8bcc646dc1091b79fd1a238d57400e23a784bb8aac793e91e1d6c5f491011fc4bb481baefa71308bb7c59303346e2f50a27c645fadcf072a
SSDEEP 768:0EGdpj4zsa1mGcmhucdzsKchTvmPb+bYbR4b:Uj4XsaI
TLSH
T1ACE21144FB2E953FD41412BBDCA50B042F79B889591A2F5B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 571d7758de21e750f992f6cc32d91bbd970876ed6d5c2da143b35d163415ab04
MD5 571a0c430b37bb2d5c36a4198ffa9b3e
SHA1 449a9b17781d985dd157840568196a612d9fa7e4
SHA512 4467702cd293f02df80a98877680bffa79ba62ca35c02936d12712369a2e84840613d3219e64dffd9ecb153918d6c1a47c39ec750cb73b8642f57607f6e33b28
SSDEEP 192:tX9Ov5zboYZOVZyjif+Qw1d66JozGzgCl6mc0dz:UboYZO7yjjd66JozGzgC1jd
TLSH
T1A6E10068E629863FC048127BCDA21F444F35389A9C4E7F19359D64082D573CD779E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 dc9e7ec2b28a29746f536c3ca36d24d8b7435e23244be72d54003cb6ee394bad
MD5 aeaee2d2f365feb870a81081d1123117
SHA1 be9e28ce76ffe6f93ea18fc330778ca4ae8f9e8d
SHA512 1498797324bbafa7ac8d7b046f9efc7d4dc7a5cab0353d68b4ebd6cb890b43fa2a4bc53df8754a1b8b3fbddad9b36da990b06bbb05e2521f499b9f7166e6be81
SSDEEP 768:2j4zsa1mGcmhucdzsKchTvmPb+bYbR4Cd7E/:2j4Xsaq
TLSH
T12FE21144FB2E953FD41412BBDCA50B042F79B889591A2F5B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 af547f682a80249fdf7dad273b6f9f8aaaf26c8a9ed11690d45b648feabf15cd
MD5 0faa16d355b49a47d018162aa99bd2d1
SHA1 b38555ab950c020d77e51ca9e426c83befd31d3c
SHA512 f254c77ee62d54bfc80758b517c5ddebe6b440b4ed2de52fae873d5e862370373f3697ac8b7953ef5038775c3d36d3e70023dc6ed5ea32a1830a51b8ab6594a9
TLSH
T13F61B75CF2298A3EE048513ACC830B401F307496A8AF7F2A39ACA04D1E572CD778D13D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0981f8ed1547ec53cd872f22b298b55af47d730dfba210b86b9ce0b257bd271d
MD5 51e11679a86dbffa32cd662b5ee66d64
SHA1 8dff7b112896954d6bf23c729c7b148a6c24ee83
SHA512 4fc770c58f8b4d8a88094f670c3f60f0e6ee45ff58842381957edf99d1d542ba8e54f33bb10e2651ab9f8520ae4ac30ae823d562b45be458ed5d96cd276c284f
TLSH
T11D21484D3AFC4D3AAD8BE698745002CE53914E1B54871D536E03EF8CCC81AD931AE83B
MD5 SHA1 SHA512 TLSH

Submit Download

2eb5927b-4cf1-4953-85a6-497aafdce039

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\2eb5927b-4cf1-4953-85a6-497aafdce039
Size 886B
SHA256 9536d00d2ad9b183de30c5907ef4f16b1d2af9e0c9663c08ca1d0cf499278037
MD5 e08161fb846756cca27091d65af1605f
SHA1 9ee7c49365e5427a7799fc8a5bf6091329d33475
SHA512 b6c7d9bdfbf53fd4f9a81df1b9cc4c25e9856e05fedf0a3fa488462e4c31e9856e628f7fa56867f956ba190d037c1cb285c093564f880032262e397084f852e8
TLSH
T1DD110041E625B9B2DC7C924FC9A177028BE0746380C699187EA98E080DBA24E6376747
MD5 SHA1 SHA512 TLSH

Submit Download

4b6535e5-309d-4470-8a14-4ed1255e1aa8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\4b6535e5-309d-4470-8a14-4ed1255e1aa8
Size 15KB
SHA256 511e72c61f08ad61769173fa281554d239e45b16b3f37f8bddfc123daa5e6d61
MD5 a8a6df3a980d15e4ab25ef5557d35dff
SHA1 f6a3ec16d84fc2119301cac9033a99d85e2ffd04
SHA512 cffaafcd04e9740df387b474eac228c27fc09246275473e5f2a49f9963443bd1e26bd0ceb4e6a4d6b21dbc9379aa98129c5a800406489977a12eb6a542e2f28d
SSDEEP 192:5LJwNg/UKiz0N6JPSQjIGIssMq+NsTTdKdscT2t8wpUczmQBcRZ1j19BjtuFkfgR:JJwdKiz+TTawpUcrBcRZVpcifgI2
TLSH
T18472EB562820497A8251E369D4ECBFC3E5F538CF4C419FCA9BE4BD085DDE0AD112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be349167-7ff9-4aa7-a94f-61722cc904cc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\be349167-7ff9-4aa7-a94f-61722cc904cc
Size 235B
SHA256 535f7ee9469343a5caf13e012c191f9045b2f030f99611b320952ea93dacbf46
MD5 c9158001d41fc1251e847071162cacd9
SHA1 639095de4aedf15775008259c7515e29400df0cd
SHA512 8a5506c17f171d7324484aecb2b3297b6b88765db6ffe375cfd110710a19894770eb3d5313c1ea1b3dd939a9c73e29761f568d2c1c10ff382f579151f431173e
TLSH
T1C7D0A791A4A8676D08141F27F4E47EC731884C371864A820A6A54775EABAAC952A1917
MD5 SHA1 SHA512 TLSH

Submit Download

c3012198-87f4-4dcb-94b7-81a566375596

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\c3012198-87f4-4dcb-94b7-81a566375596
Size 2KB
SHA256 d3d78184ea4d5901100d99facbd7563acee21a63b0f4fa1c41056f05538247ac
MD5 0540e8b4e4dcf4080a302a1200457ac6
SHA1 b07238469f2213100d28d800f64271145f6faaa2
SHA512 525e4e5d267296965eda5375ab049e97254814302587c98d5b1931b02f93d5ca6ce537ba2ff91f37341383f0d27be48672c7fd531ea3dab2c53b4469ea9781d7
TLSH
T1D241435C75F84C376CDAF14D9082334E9BA48E5604812C436E52FF0CCEA679E23BA52B
MD5 SHA1 SHA512 TLSH

Submit Download

c5a21f69-4a3d-458a-bf3e-6241dcd23c82

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\c5a21f69-4a3d-458a-bf3e-6241dcd23c82
Size 883B
SHA256 291bc42c373fc9a09776e5029dd16dda91911921b1bb2c9dc764bfbb06ad4c0e
MD5 28442ad7004d04e204689f469df80f98
SHA1 629b21ff3a955f607d403cd09880b73d6bf7c0eb
SHA512 e094c52ed276c44169b98f670ddcb2a5707c2f59a8aae7e4e86666b9f4a65ecda4261ba16d4cf76758cfebcf7734aa871070a292de9f0705d241cdeecf9d65c6
TLSH
T1C2110045E3357972CC7CD24FC95237018BE4692380C994143F698E080D7E70D9766687
MD5 SHA1 SHA512 TLSH

Submit Download

cb07f2d7-ca16-417d-8427-f554991c68df

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\cb07f2d7-ca16-417d-8427-f554991c68df
Size 235B
SHA256 55b6d9bcddb53d7cc709cbcb48211117071368efb551a4a621a7c62b605dc35a
MD5 93cecd98e3092d2a1e3c4418ceb8ab2d
SHA1 1f5cc9822c99e5ea4e1adeec02c71509e81700ed
SHA512 47114857379b68983fd43f016bbfe26791ae70772d37957a4ca21476b15bc6403bd8def5c7368e55c94826d246ef731d6577252c61fcaff772f6597cdf9be141
TLSH
T1F5D097882CD87B1D0C182F03F0E22AC630854C3328785820D6A14138CAF9DC44275816
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\extensions.json
Size 16KB
SHA256 45da9d21f8287def0a795e686672900ce08174e800823e23dc6680e770dd6eda
MD5 fa4396231572dd2c9fd3c138f06b55ca
SHA1 5a62ed48d1a8cf3670d6881d224a81b1d9875ec7
SHA512 93c5b3c01a777df5e5a892c612b14f6989389b45f4b33331f7c5ca6de861ef36005307ad5a9b3674824c4b1059903727a1d4de6c9cfb9fcfb7b32dbf1bdee45b
SSDEEP 384:mkI4vfUmldvBM8dhW+94zO96otXL4HpL4P1L4HDL4HTL4HOK4hN:pI4XRfbXT4e6Yb4h4d4P4/454X
TLSH
T12E72411545448EB8294EA79BAA367E02C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs-1.js
Size 8KB
SHA256 2251b61f7271b1acf7e03c52d27962001ad44ff1c98aa6d1945cd6e360473b4a
MD5 b5c2dde572f87262889f19c28d0a13e1
SHA1 07ca7aa4513e6376df6d446ae0cf6d31f63f4dbb
SHA512 628d725cc0c5c09799f1ba160fc14cd3d5ac083f94ad3d13c27208e0fba36ad8153687a3b0e911fa45c23007da8ecfcc312fcfa21dcad7c78ad7b1853768a2a4
SSDEEP 96:xHY1TUzqGqZEfH875zObzS2JSSlSdv9jgnvWRH9W/EV9jBw88usTC8L4cntGUI6:KzRZEfctzMJSSOR0/EfBw88Fw6
TLSH
T17202FE3C9108CB7F64B2366CAC2449715AA2013BBBBF68D750B994C5451CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs-1.js
Size 6KB
SHA256 d08085af29a22336c7490709c78855a7f9adc7ec831d3686795ea8709b848c04
MD5 502794eb57fe34ff064d691ec939dcfc
SHA1 291c98537ad5fc996dab0be2ad048f38454c94a9
SHA512 3e5436920d3e566a6c96d6118207de3a842d5b91b052b6d7d435aeff3d55b2b3e30b87bf374e567af3c8d0d429f48aa969777c7b59b1b9d4bbae0fb20a259468
SSDEEP 96:xHYUTUzqGqZEfU75z1zS2JSSlSdv9jgnvHhW/YBw88n8L4cntGUI6:KORZEfUtz7JSSvo/YBw88n6
TLSH
T122E1207891088B6F74B6776CAC688C716AB2413B77BF68C750B544C4015CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 6KB
SHA256 af4d41bb6a3df637a3996253edc290f69961a356000206ffcdf37f831c2246d3
MD5 3bf0effc8dfd9337f9a4cfb3f728f2c4
SHA1 e9212a01cff8548c5f47afba02d09d0563ee405e
SHA512 277db836b2b8ec0ef48cc5b03c6c313b7ea8be860b56b48aa89e6f01469d4b85b7ed3d01eb4bc8afaafa206bc053030bca19f141c151d8688534516a1e8fdd5d
SSDEEP 96:xHYUTUzqGqZEfU75zObzS2JSSlSdv9jgnvHhW/YBw88n8L4cntGUI6:KORZEfUtzMJSSvo/YBw88n6
TLSH
T175E1207891088B7F64B6776CAC688C716AB2413B7BBF68C750B584C4015CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 6KB
SHA256 1e8076cb7d3873dd1c3c4fd77a68417b39aacbb7ab38e7df9005939fc73b9b3e
MD5 ccb2275cf70fddbaa439c8199adc5d07
SHA1 af5f238643f69b33fa3a763886211a5613a10d13
SHA512 9a29eb43facbf9d3d37504a081ef6a41bd8c5d73a09ee54b3a9718762d8c2d51c7c5ec2316cb48abc8c5bbf2b69d1fbc1f20f03570b7bd5367ff5bfdde6f80a9
SSDEEP 96:xHYUTUzqGqZEfUUq1zSkSSlSdv9jHOnvHhW/YBw88n8L4cntGUI6:KORZEfUUqxSSKio/YBw88n6
TLSH
T107E1307890488B6F74B6776C6C688C316AB2417B77BF28C750B554C4015CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 89ebf5ae9ed50dcd43e8f2a3257ebe1f3e1f2ad22966301b07609a4b60c54b9a
MD5 d8dd245b345dee0e107fbd4866f941df
SHA1 8ac0a12b95a1201e4b90a3ba445457258dd97dd3
SHA512 5a71b860e8f7bb06b6667b3a0abcf9032595dbcc072718045c363b6451be5fc458c608fc9bb96fa2a1eb5f6cf6838c90414a6ad208e8471a295cc0bb045f7196
SSDEEP 96:Hzf6wrsm9iAmd+z00KUvqq+hHFhV850CajtTjE/s7inD/MDv54smvoEftb:T5g1E8ZhVs0CcinDULasmvoEfF
TLSH
T1BDC19E53E9FF3681EC49C1C484893DA1422F3E0E0C2550F6568DBA5EAFB9B241B4767C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 3e6981316b8ca5afd5f3accbfa0bd6f708ac7feaf4f822c585bef9f865580bff
MD5 6f85b7bf960a3ad941ed4f347e6a2e39
SHA1 b2b9a70c372e7becafc7326c168328b179bebee9
SHA512 2c6f06c9e1ab71080feed7554381988f5e0edcb0f0ad71818a18bb2da038391126a203fe6e70bf194e7c121aa06bba6d825a211bde324d141f8c525cba6674bf
SSDEEP 96:Hzf6wrsm9iAmd+z00KUvqq+hHFhV8s0CajtT6E/s7inD/MDv54smvoEftb:T5g1E8ZhVJ0CninDULasmvoEfF
TLSH
T1F9C18E53E9FF3681EC49C1C484853DB5822F3E0E0C2550FA568DBA5E6BB57241B4767C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.4MB
SHA256 8ce6c26b0fdc12f1ec935f816b60e8cf8684cd3ddd460c54d59921d2285d3c71
MD5 ba3a011d5b5b5984bedd28eb0db2aa22
SHA1 21636a17a5d499cb836701fa32eb95ded2eb1e44
SHA512 896e041be8cbec877dd8b98b19221f54f216cd3aeb9416b8a476ec93c6779528f822e8787efd03761cf018914e8b8c5438b6ebdc79f15365ad9aeaaa21cbee5d
SSDEEP 49152:T9yWkPn/X1Vexy2D3/Y3+Prm4lDg+DdITJrnH9oImvGtBW9wXKwfV4cK+EEOt3Ly:pci3L7tQ7DhgKuo
TLSH
T18E764CE420E19253F38644B3719993FB20EFC01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads