hxxps://link[.]inproxalberta1[.]net/signature/images/tLgkhaq8CI9wvOyfURG3J[.]png

Analysis

user interaction
yes
max time kernel
52s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://link.inproxalberta1.net/signature/images/tLgkhaq8CI9wvOyfURG3J.png
Sample260930-phpghaeh49

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3724	firefox.exe
Token: SeDebugPrivilege	3724	firefox.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3724	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3724	5072	firefox.exe	85
PID 5072 wrote to memory of 3724	5072	firefox.exe	85
PID 3724 wrote to memory of 2216	3724	firefox.exe	86
PID 3724 wrote to memory of 2216	3724	firefox.exe	86
PID 3724 wrote to memory of 2216	3724	firefox.exe	86
PID 3724 wrote to memory of 5116	3724	firefox.exe	88
PID 3724 wrote to memory of 5116	3724	firefox.exe	88
PID 3724 wrote to memory of 5116	3724	firefox.exe	88
PID 3724 wrote to memory of 5116	3724	firefox.exe	88
PID 3724 wrote to memory of 3748	3724	firefox.exe	92
PID 3724 wrote to memory of 3748	3724	firefox.exe	92
PID 3724 wrote to memory of 3748	3724	firefox.exe	92
PID 3724 wrote to memory of 3748	3724	firefox.exe	92
PID 3724 wrote to memory of 1248	3724	firefox.exe	93
PID 3724 wrote to memory of 1248	3724	firefox.exe	93
PID 3724 wrote to memory of 1248	3724	firefox.exe	93
PID 3724 wrote to memory of 4912	3724	firefox.exe	95
PID 3724 wrote to memory of 4912	3724	firefox.exe	95
PID 3724 wrote to memory of 4912	3724	firefox.exe	95
PID 3724 wrote to memory of 4912	3724	firefox.exe	95
PID 3724 wrote to memory of 5472	3724	firefox.exe	97
PID 3724 wrote to memory of 5472	3724	firefox.exe	97
PID 3724 wrote to memory of 5472	3724	firefox.exe	97
PID 3724 wrote to memory of 5472	3724	firefox.exe	97
PID 3724 wrote to memory of 5516	3724	firefox.exe	98
PID 3724 wrote to memory of 5516	3724	firefox.exe	98
PID 3724 wrote to memory of 5516	3724	firefox.exe	98
PID 3724 wrote to memory of 5516	3724	firefox.exe	98
PID 3724 wrote to memory of 5524	3724	firefox.exe	99
PID 3724 wrote to memory of 5524	3724	firefox.exe	99
PID 3724 wrote to memory of 5524	3724	firefox.exe	99
PID 3724 wrote to memory of 5524	3724	firefox.exe	99
PID 3724 wrote to memory of 5580	3724	firefox.exe	100
PID 3724 wrote to memory of 5580	3724	firefox.exe	100
PID 3724 wrote to memory of 5580	3724	firefox.exe	100
PID 3724 wrote to memory of 5580	3724	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://link.inproxalberta1.net/signature/images/tLgkhaq8CI9wvOyfURG3J.png"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://link.inproxalberta1.net/signature/images/tLgkhaq8CI9wvOyfURG3J.png
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {05cabd8e-61dd-4e3e-b5b1-0ddb7fdfb521} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {0a561080-2b77-4f8c-8f2c-bb13a1451c72} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3888 -prefsLen 25164 -prefMapHandle 3892 -prefMapSize 270279 -jsInitHandle 3896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3904 -initialChannelId {0a661eac-c54a-4e02-9e71-89e31dfb4b11} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4056 -prefsLen 27276 -prefMapHandle 4060 -prefMapSize 270279 -ipcHandle 4128 -initialChannelId {2be3468c-f048-4b3a-89a8-cfdabd5b9c2d} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1652 -prefsLen 34775 -prefMapHandle 2668 -prefMapSize 270279 -jsInitHandle 2680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1548 -initialChannelId {08ba30fe-096b-43d4-a409-1f0ab3e7cb31} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4788 -prefsLen 35012 -prefMapHandle 4784 -prefMapSize 270279 -ipcHandle 4804 -initialChannelId {4fc6058e-b4c7-43f5-acd3-c19ecf3844b3} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4972 -prefsLen 32900 -prefMapHandle 4976 -prefMapSize 270279 -jsInitHandle 4980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4988 -initialChannelId {acc5adc7-285c-422c-83b6-a01592082b6b} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5108 -prefsLen 32952 -prefMapHandle 5112 -prefMapSize 270279 -jsInitHandle 5116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5124 -initialChannelId {31dfecf1-7b8f-42e1-b242-715b83913502} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32952 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4972 -initialChannelId {5f244943-53f5-4119-b8b6-0f47f334d17c} -parentPid 3724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 189f6701bd0f7205b02a376ddb0ac9339c4e2d69d56e3287128a3282c55d053a
MD5 7e2eb2394089e83580f9712d1aa73aeb
SHA1 b1634b4f93e04080ff1dca4524c5add204024d2e
SHA512 801163a384a739bbe12b5ca07b62b0e2a7989d052d4cec0e1f002a742d05285060f5af2165f133337ff6fc73126652e3ad7094832a53c8a78c1d4b69d62c4f00
SSDEEP 384:HalwSiO024YzWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA3L+FS+8:6l8ZYzWTToXJWTTogB7S/AmVAf+hRM2l
TLSH
T1F6728D7D8F413CAC275790E8C8B943598D1CB3A7DFB5C06D26983E09C984A2A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ec96a7e5e83d09c2f121aabd2b79f97835d3099774884a790b5ea978233bfbcd
MD5 60dc5d2ddb915868f072ead9d05440a3
SHA1 277559e9ec04694673bb706b399db821375b02da
SHA512 2e402dd58322801dc936b825fd1e5c6a0fffd2acaf6d4f2ee0cda7fabc127906b4eb5072bad84145dca951dac15b49bd0b336e14d86b0ee2514b724bdb372b29
SSDEEP 192:s1d66JozGzgCl6mc0dV3d+Ov5zboP3ZSNnyjxdQM:Wd66JozGzgC1j7bofZ0nyj
TLSH
T187E111A4E629863FC408027BCCA21B450F3A395ADC4E3F1535AD645C2D5B2DE3B9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 76b261b185b4fa50ed53213d17a1e99813c355f7df0b5b49734e03ddd2195e7f
MD5 96235a5f25525b82b9c35470f45e7184
SHA1 fd4eecc80a1430c77056291fb4ea00a9cc507ecd
SHA512 533c1898457288db1df3510415d64a1e4b309787a14c10b6f6aa3af0b2123ffa71260e49f42410e56b3f9b88d3471b19f407864e49894b504d93a9de5d74e298
SSDEEP 192:T3d+Ov5zboCbSNnyjxdkME1d66JozGzgCl6mc0dz:nboCb0nyjUd66JozGzgC1jd
TLSH
T141D1EE64E629863FC448123FCCA21B410F3A394A984E3F1531AC685C2D5B2DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0b898fcf1eb73d7f3489727003528b1bb49d04721e7f55a24e0e69110fe30a4e
MD5 0ff5056fce144b61741c5f97dfd3b5ad
SHA1 93863725961e888dd9662af8327560f29d7a40e3
SHA512 4c2ab31d22080ebfbe36afa942c23a8d24f75fbb052a3c6ef548bd46505bf8b4dcf80476c5c7372cfa35bdac751c43e66546aec999d489405abd08ad89953932
TLSH
T10C21AF4D3AB84D6E9DC7FA5C748501CE53904E0B55871C431E02DF8ECD81AD932AA57E
MD5 SHA1 SHA512 TLSH

Submit Download

193c7aff-2b81-4931-aeb0-977ee805780a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\193c7aff-2b81-4931-aeb0-977ee805780a
Size 235B
SHA256 7730e21ea5fe5636685b54f802aebe10e2b95da324f78680ff3d2d3f9cf5abd1
MD5 64544d3d963a54aeda20b0f99c609540
SHA1 dccc7171fa68fa1317fbe192a0f3ae1d7b77afb1
SHA512 174c261716dad77633bd68e66ee316f6ab420dc4f988b42d5be8d8e3eccc38e54b46009b546405c77782865c1ac5ddd909c907768737c67cf345464561b146b0
TLSH
T122D0A7C028986B6D49144F07B0A56AC631998C3714A46961D5A14B78A9F9AC8439292A
MD5 SHA1 SHA512 TLSH

Submit Download

3424b88a-876f-4cef-9d26-a1e84934de56

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\3424b88a-876f-4cef-9d26-a1e84934de56
Size 280B
SHA256 d3bcb775a734a021d0bd352101c538a7508c97fcd2c2425eadb85295ceb86c7c
MD5 9da2f5cf71b2f3eb2a389e3cc7df6912
SHA1 8d674643c63778eab6d0ddee2d579b4be04e15a6
SHA512 249dd04be7ff306bda060c2dafe7452bd648c0a7123e3637b1137eb226c48740f9eb23570e0ed87bc823083a7db9ee52304ff3c3ea2ea36fd99867adfd0ba9e0
TLSH
T1A8D02BA46898265D4CB86F06F0B0B5D330A98C3264F26900D5F1063499FEEDD819285E
MD5 SHA1 SHA512 TLSH

Submit Download

75dad107-dcf2-494f-96db-c632daf40b33

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\75dad107-dcf2-494f-96db-c632daf40b33
Size 2KB
SHA256 45900cdbbf0654981b875b0cc6d9f20ba5318cadbb75b2c1b7041e03da1c6d72
MD5 ebc2de146ebec882a7cd9307fe0583e1
SHA1 3b19bb04b83c1c22a06d1bb970693758a6fe22ce
SHA512 a371ff0edf9f3106ab8b0c648f5898904134620b3650412cdda9770bffea2cdc257ebb9f358794d54568a061ac197f243aa83de5e469bfce952e2f4d062bb642
TLSH
T10F41439C36BC8D7A8CDBE14DD442238E57B44E1350C62C436E51DE4C8EA669D337E12B
MD5 SHA1 SHA512 TLSH

Submit Download

97b423f7-ab2c-465b-86fb-b6e2adcb3174

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\97b423f7-ab2c-465b-86fb-b6e2adcb3174
Size 931B
SHA256 c054bcba5f0e89741d2bf879d00cac13e5321acd45bad69e9216b39447f53a05
MD5 bd531133bfa17b934dc36d7c07c29aea
SHA1 4e247c9fdd587fafa8116d2afe08d39a0e579e89
SHA512 7c98b8693a98da610d93cd0af2d462f7acfc524afb7223151e6401048e893bc2a7f49e99357147425224fb08fb817e250f691f41ebc41b1d444bde9f0cacadc8
TLSH
T1D61110816A39B9B2CCACD18BC4A1774657F43113C0C64A183FA09E180CBF60E537670B
MD5 SHA1 SHA512 TLSH

Submit Download

d7334dd9-cdb6-4f6f-9c10-de4cf5f91af7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\d7334dd9-cdb6-4f6f-9c10-de4cf5f91af7
Size 883B
SHA256 1e16651a7df3c357b0b5d6b7216f3db4d5a6c9bb380e09c7cf94eee5535b0089
MD5 adddfb1ff8778d00e722d4bb751211db
SHA1 8b346389f82e1a9e9043692805aa37f70f92bd79
SHA512 78760be909a00ef7033c7abd7408baa404770b0b610e483ab4956a70c4405d66f94918a74096f52b68b199b2588de758aab4c740fb2c641f18d2153c3d73138a
TLSH
T1621104805639BA72CC68924FC952374647F83613C4C645147EB04D1C0C7E51E537A707
MD5 SHA1 SHA512 TLSH

Submit Download

ddded1d7-f8e3-4281-b8b0-839ec89ee87f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\ddded1d7-f8e3-4281-b8b0-839ec89ee87f
Size 16KB
SHA256 c8a7502c1c4933f2a1a491dc5175eef842e967b62a855b717814f2f0cf332d26
MD5 98e86ddd9274192eb5dbf235109a6b32
SHA1 4a072f05aee7b2c1418eb2e365aa8ae187334f57
SHA512 4cdc28d168ce7c524db7fab37709b2c9538f48c580d00bd3d6f7d853c00f909cab78a0c60ff594a0148619ced4f45028d09a9b393eb777a8256f3dda300130ae
SSDEEP 192:IXmrWd+oQa6nFREyINzWUMcwuaGj70ipb5zgEXb717/evvXGRueN6JhuBejUzYpH:tWudxw0ipb5EUbV/qvXGRjNKEWUzy
TLSH
T12372DA16286055BA8691E368D4FC7FC3E6F528CF4C418FCA9BE4BD086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\extensions.json
Size 16KB
SHA256 9274513184f272c9e899b2ff4c69152809cb77fd3ebc4b133bdd64cbcc32ef5b
MD5 0f6f14f32db9e779511fc926e69930b5
SHA1 d66c67aed07ceff5d151716cd6fed9f72705c674
SHA512 39e84f7765fb359be4a03aacbd80652a7636e4a52a9f09d01dc64466f41d5701475946db04418c61b6f4750db11785a2503c98e18297b8140c6755c792a35cd4
SSDEEP 384:ZkI4vvUmldv/8dhWX94zR96oWL4HwL4PZL4HiL4HTL4H+gkO4hF7:6I4HRfMXm4T6j4S454w4/4xf4X
TLSH
T14072411545048EB8294FA79AAA367E02C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\prefs-1.js
Size 8KB
SHA256 5f1e7e48763e7ff0b905c43bc2de51bb783eaff15dcd739fb88c6fb238567bf2
MD5 71f79a191d1630a5e982d2bf12066ada
SHA1 a702c9684c25b63ec1c0b176887f890f5c287482
SHA512 0ffca12f17f62e8b764224b5d4cb224751a95e9019470bae54d8e5055785682d96adf4c42929daf88346f8a6c3694427acc2a1edf80ff3ee10ce6198c11e9d9b
SSDEEP 96:xHL0ZTUrqGqNXfBZIObzSfSSlSdv9jRWnnGRWRNSDtcXMOwBw88O88L4cnkVtOJA:ePRNXfBZI5SSlG8RNGtc8RBw88NaW
TLSH
T11A02FF3C5104CF7F68B676ACAC2889715AB2013BBABF68D750B954C5050CF3445FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\prefs-1.js
Size 7KB
SHA256 a42814c73da4993ff10fd52208abc40641c89e62d7ec9eb08755771fbe77d1d1
MD5 026d712029e65ba1931cf93bd1dc2320
SHA1 9795048373cc5342436bc4342859bfef07a77521
SHA512 24537e089724ca52a338275c9680945aaa6ef941d06d882bcc55e942ac749d148d45a717fe035d21e9d8216c14880465342a41f6a411d37b27c6ad987703ad54
SSDEEP 96:xHL0UTUrqGqNXfRZIObzSfSSlSdv9jRWnnGRHvtcXMgBw88n8L4cnkVtOJmGS:eWRNXfRZI5SSlG9vtc8gBw885aW
TLSH
T137E1207891088F7F64B677AC6C2888316AB2013BBABF68D750B544C4051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\prefs-1.js
Size 6KB
SHA256 daf532846a2f4a7c915db4c46640fd4100f834ddee18acc98e6097eabad4f071
MD5 7eb05385e124ee54a578097e9943bf69
SHA1 7eccba0c43aed620811e057e2f8cc405450498f3
SHA512 6ded21d2a868fc5d2efc61d884750e4a183097637dc6aebc8ac166e418355e28f146b13be48de7a11453e7acaf02721aaacd47a082f6060f0d3099a8110c3877
SSDEEP 96:xHL0UTUrqGqNXfRZI1zSfSSlSdv9jRWnnGRHvtcXMgBw88n8L4cnkVtOJP:eWRNXfRZIOSSlG9vtc8gBw885aN
TLSH
T16FE1107851088B6F64B677AC6C6488716AB2013BBABF68D750B644C5050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\prefs.js
Size 6KB
SHA256 57eb9a9a3d4a0897981a5a28e519789742ce41a646e9b244a34f1300a8e62491
MD5 a6edf29e6ee7bfe65e90da4bbe417a13
SHA1 17574e264ba33d108543a05a9792673843b79378
SHA512 3ca54c97d9e12bdefdf56660bebb03ca14f37c9dfc92c4a49fa17f70cf223ae3e9543d7ff9eac67438f856957bfcfacd0454c777098e19305e90c3415958bcec
SSDEEP 96:xHL0UTUrqGqNXfRbS1zSJSSlSdv9jpnGRHvtcXMgBw88n8L4cnkVtOJP:eWRNXfRbSQSSx9vtc8gBw885aN
TLSH
T1B4E11E7891488F6F64B677AC6C6488316AB2013B7ABF68D750B65484051CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\prefs.js
Size 6KB
SHA256 dabf675199261117c31d5ca908232573a71a6daa45a0af73fd8bcfbbd7fa7838
MD5 6e769bc5fc92ff2814102528b19230f2
SHA1 df5528d558d5a56ffe31b0056e9fb5ddacaf62f6
SHA512 8edcdb696c452df5c340ccc21c63bfd4558838ae957af99153f40f3b08eeb0a6527cca17c0539a986555fff07487fb43d0125afe89b2b581f5dd5c723c8a30ee
SSDEEP 96:xHL0UTUrqGqNXfRbS1zSfSSlSdv9jpnGRHvtcXMgBw88n8L4cnkVtOJP:eWRNXfRbSOSSx9vtc8gBw885aN
TLSH
T1D4E11F7891488F7F64B677AC6C648C316AB2013B7ABF68C750B654C4055CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 76f3502f9d096b8ff96b45d14438595792ad3e92fb05ed2dd00b1289f314e1dc
MD5 acaf766bcf2c7d825090989ad37ab08d
SHA1 a78bf7696ea5c1d43ec91c73186c349dcc0e9307
SHA512 bd306e455574b22fdf21933f588dcd78274edaf17e599032fa252a396401f03663ae020a626b278494fc15941cb81eba4096f4dca919f97087feee67a380a4d8
TLSH
T115210B4B68C72DE4BA10D676449B8BD0C719346244E54470C109CE42E19F75EBB8B33F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 d16440243ad2402aaa17099003ea88132da9f3bf5db6f722007c1f19dfb17ab4
MD5 7cb8b98bec51eaaa409d71057e5ea7e6
SHA1 d7af6c34b162fa81e94270fff718b53d99868c86
SHA512 18d726036c3ab5a20f24f4ed2ac2e17582ef8d9e62f261006f71a35c4bdbf55f3358aa81adf81be33bb9e97330c50984f8508e6c240d5cf0569d9a3939a686bc
TLSH
T1B5210B4B68872DE4BA11D677449B8BE4C719346244E544B0C20ACF42E19F69EBB8B72F
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads