hxxp://cm[.]g[.]doubleclick[.]net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=YXNNNEl4MVNXdTVyUjZfZFF2eUwycDR2

Analysis

user interaction
yes
max time kernel
28s
max time network
33s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/10/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=YXNNNEl4MVNXdTVyUjZfZFF2eUwycDR2
Sample261006-werwsasybx

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3504	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3504	1744	firefox.exe	81
PID 1744 wrote to memory of 3504	1744	firefox.exe	81
PID 3504 wrote to memory of 2472	3504	firefox.exe	82
PID 3504 wrote to memory of 2472	3504	firefox.exe	82
PID 3504 wrote to memory of 2472	3504	firefox.exe	82
PID 3504 wrote to memory of 3808	3504	firefox.exe	83
PID 3504 wrote to memory of 3808	3504	firefox.exe	83
PID 3504 wrote to memory of 3808	3504	firefox.exe	83
PID 3504 wrote to memory of 3808	3504	firefox.exe	83
PID 3504 wrote to memory of 2468	3504	firefox.exe	85
PID 3504 wrote to memory of 2468	3504	firefox.exe	85
PID 3504 wrote to memory of 2468	3504	firefox.exe	85
PID 3504 wrote to memory of 2468	3504	firefox.exe	85
PID 3504 wrote to memory of 1124	3504	firefox.exe	86
PID 3504 wrote to memory of 1124	3504	firefox.exe	86
PID 3504 wrote to memory of 1124	3504	firefox.exe	86
PID 3504 wrote to memory of 4832	3504	firefox.exe	87
PID 3504 wrote to memory of 4832	3504	firefox.exe	87
PID 3504 wrote to memory of 4832	3504	firefox.exe	87
PID 3504 wrote to memory of 4832	3504	firefox.exe	87
PID 3504 wrote to memory of 5148	3504	firefox.exe	88
PID 3504 wrote to memory of 5148	3504	firefox.exe	88
PID 3504 wrote to memory of 5148	3504	firefox.exe	88
PID 3504 wrote to memory of 5148	3504	firefox.exe	88
PID 3504 wrote to memory of 5420	3504	firefox.exe	89
PID 3504 wrote to memory of 5420	3504	firefox.exe	89
PID 3504 wrote to memory of 5420	3504	firefox.exe	89
PID 3504 wrote to memory of 5420	3504	firefox.exe	89
PID 3504 wrote to memory of 5600	3504	firefox.exe	90
PID 3504 wrote to memory of 5600	3504	firefox.exe	90
PID 3504 wrote to memory of 5600	3504	firefox.exe	90
PID 3504 wrote to memory of 5600	3504	firefox.exe	90
PID 3504 wrote to memory of 5608	3504	firefox.exe	91
PID 3504 wrote to memory of 5608	3504	firefox.exe	91
PID 3504 wrote to memory of 5608	3504	firefox.exe	91
PID 3504 wrote to memory of 5608	3504	firefox.exe	91
PID 3504 wrote to memory of 5616	3504	firefox.exe	92
PID 3504 wrote to memory of 5616	3504	firefox.exe	92
PID 3504 wrote to memory of 5616	3504	firefox.exe	92
PID 3504 wrote to memory of 5616	3504	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=YXNNNEl4MVNXdTVyUjZfZFF2eUwycDR2"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=YXNNNEl4MVNXdTVyUjZfZFF2eUwycDR2
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {a15ef9b7-a44f-4e48-926e-a46dc2b8924b} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {f2fe7ff0-6ec4-4997-901a-3b107df1ff7b} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3900 -prefsLen 25164 -prefMapHandle 3904 -prefMapSize 270279 -jsInitHandle 3908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {a4c14bcf-2adb-4d39-8d84-beee08374347} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27274 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4128 -initialChannelId {ffae95ac-16f0-46af-a74e-d1cc00772d92} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4544 -prefsLen 34773 -prefMapHandle 4548 -prefMapSize 270279 -jsInitHandle 4552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4560 -initialChannelId {29377038-d9b1-43ea-b43d-5982416f4e9a} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5044 -prefsLen 35010 -prefMapHandle 5048 -prefMapSize 270279 -ipcHandle 5016 -initialChannelId {3b35591d-e6ab-402f-ad45-e9e6c2c9f04a} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5488 -prefsLen 32952 -prefMapHandle 5492 -prefMapSize 270279 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {cd98ba18-378f-47c0-8e85-786bd083a467} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3268 -prefsLen 32952 -prefMapHandle 2720 -prefMapSize 270279 -jsInitHandle 2736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3364 -initialChannelId {0a5f3841-abb1-4e88-ba69-aa3f866cf262} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5884 -prefsLen 32952 -prefMapHandle 5888 -prefMapSize 270279 -jsInitHandle 5892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5900 -initialChannelId {c555734d-a08f-43e2-94be-19218228c373} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6072 -prefsLen 32952 -prefMapHandle 6076 -prefMapSize 270279 -jsInitHandle 6080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6088 -initialChannelId {a1dd83d5-4e2a-492b-a0d1-4b0d6b62a497} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\activity-stream.contile.json
Size 4KB
SHA256 b7bf7dcb09ea38d90f76604c982d4b1a0d2f914cdf3a2a72e9d71662be071514
MD5 a407afed2d0709eecb78d68c36423943
SHA1 cdc81f6e57e843fa27df9ffff102719bf3263cfe
SHA512 c5795192f9f1208f5236c7f569947412b710be501dd2575162398c134f21c16a026d5287e188de3a69fdf718f1c217e85cfcf484ba74913a31380af5e6a457b0
SSDEEP 96:TI6xPkcMUg0komm6xoNLJD5hT+mRCdOny16xTWHCylz:PMWblNpWmRCdOynHCyF
TLSH
T178A1D69B987444021B72A6F61C1B26ECF0237416D9E1DABCB1AB9D21859C7DEC0C794D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 d6fb3ec4c10fd2586d6e8728c1134aa399c4a25b2377851b3ad73ee88d085a72
MD5 21c2013ffbd2d76dd71a085f213b03c9
SHA1 c94e32279930ca697b072b71e2c34585efe88113
SHA512 b1ecc4cb49bfbd48aeb66158cfa6dde7464a53d2a71805f4c697467f666480cf02f4a94ad62eef7d4663f2660c789596668b2937ac0c2bcb0364f59eedad5742
SSDEEP 768:9yq57RyoNR6QV/i5p+Ls1inR+GMaQO4851j/p6HbEihOOrp:sUNyrQNiz+WiYGoO40p/p6bb/
TLSH
T11373F9A3A6E971BB1BD037CB1C4F796B66A10246E38906C9FDEDC91C81CD654023A5F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 915ee1458ee9012146fd0f46f3a1e06efda50af74cb456fa942536915dfcd2ac
MD5 b408775e821cececfa57326239e15318
SHA1 aec06e9832011ac8827880fbabd494f2cfb5a8e8
SHA512 b2721130d9c1d307ae3c216695294e02217d953b4694380901c8d681397c04b4759d4288e8debb2d9aca8a27d7421b4312f336e129f998fdc9bf8bb3256919c3
SSDEEP 3072:j3lLT/EC67jI9GAsynOojAc9O51edUUEeEID/:pn/YjWGAsMBcHedUJmb
TLSH
T144B3AEF6DFA2CD2DA4FFD42D67C1843EFD262444B3A72019C8236324A2C6FB46675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\SiteSecurityServiceState.bin
Size 1KB
SHA256 c32898e24472eb5e384269862997a62aefe56a71b75921fa652ca033af320526
MD5 dc9d4ff04c0b3bddedd26b9c54aa1617
SHA1 969b3f6bf5e9a63fd38bea684b1bc4814162ab52
SHA512 5508cf12e767c9fdbb2edff18b27b1e2f660a4a06ff6bed12848823cf4b181a64beb4b7644048312cbbdae90b67fb2cf7dc8b1662bf3ba475220d62219c81064
TLSH
T1FA21123D48ABC236E0C69675349D58D40C7533C64272F0F83FA5A2967090EDF21ED360
MD5 SHA1 SHA512 TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\broadcast-listeners.json
Size 209B
SHA256 63221253f5c30efa214c2cd2adcf51a9c9f9a2c05f119b00a51c9579825c2c24
MD5 97c3738563a9448365a735f5f29ed3d5
SHA1 15a81433236ca6e6ecc4e1c8d0fdb8523b265c57
SHA512 ed98f42d5d02ab53a9e50f80b312bed4b5d05d053bec582cf9d619ef91251e86cf4f4d1123c645500fc1dc4673b49a8b7badd3f3a39f565ac643ca4fd0157ae6
TLSH
T159D0220E14177C7F4B486229F00827800B9A10093270A03DC3AEA0540A2AAFC4008190
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1cd12d4f48d1bac7ffc88834df12a8c026504c2c31355696b204ecfaf2c1de6a
MD5 7d32a0dc082557c06f2337b8da9f0917
SHA1 37d108aa7868819337b522f6b0adc323f6d5d20b
SHA512 48478e9096aaf3b393b56351f4568bc01bc267112f19f1561d8013ae367e8ed5bb02651ec1296c1d69d729faa52ad19ff13837bf651f924e835e2763959351da
SSDEEP 192:/1/66Joz0dzgCl6mc0dlv8Ov5zboH5IQSyjxecN:N/66JozQzgC1j7v/boZIQSyjx5
TLSH
T11CE130A4E6384A3BC405537BCCA21B450F3A398A9C4E3F28399D641C2C572DE378E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7aaddab8380ca11e28a4f0b866a18a92711c35a181fe7da586d559ed32d73979
MD5 ef5c148b8e43cd49c0c329480fd4e985
SHA1 4dc0b04165ed29b4a63c5bdcc45efdd1c37b447b
SHA512 d78d86e3206e4339cd2f9609994985f4e04df5190a50cfdf31b55efe8caf01b976f3493bf6653002100283beca76b84ec4cdc81f8f38f06eea15f237d0c59a66
SSDEEP 192:w1d66Joz0dzgCl6mc0dlv8Ov5zboH1ZIQSyjxec:qd66JozQzgC1j7v/boVZIQSyjx
TLSH
T136E11E64E6288A3FC409537BCCA61F410F39399A984E3F28359D655C2C572DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\events\events
Size 1KB
SHA256 fc9b81dc07c0a72c0501d9cbeb7f5365ed717a26d7a26ee3df91e19763e12c00
MD5 cbcfe42d2e02a5b58eeaded7f0a550df
SHA1 83310e096beb116a1ab487434e4898de3c7d00e3
SHA512 724a709709bf4d0766473721be80302956f6c80ab070b35e61e6ba9c09f99d34500f5a2a6cb3c6d900abff0ae2e26ebb3ef64ebd5ab9a5b8ea98b8e6b4aa95e5
TLSH
T13821495C3AF84D6A58CBEA9C7480028E6BD68E8B15871C475D13DF8CCD91AD933AA53C
MD5 SHA1 SHA512 TLSH

Submit Download

1ff75842-6fee-4a86-8d03-da335c27faf9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\pending_pings\1ff75842-6fee-4a86-8d03-da335c27faf9
Size 235B
SHA256 1008cc2061598c9b381e159ed8c5bf54b86b6ada86e39018adbd08fe6b77c15a
MD5 5fba1cd73820a838fc346eaed158f04f
SHA1 7e56f82ac00a3f9669cecdfced215ecb03985284
SHA512 aaa6eb4eee9163ff74e01cea62d6a4ff10cc6955acf3dbc1bb237925873efd95196ad5b0f4c80cce653c8b7f31430730a887e23543a2c2faf8f66d8b19ca32d3
TLSH
T144D0978028C8B32D48001F07F0E02DC232A45C3350B99810D6A006B4D9BCDD8021181B
MD5 SHA1 SHA512 TLSH

Submit Download

2cf3c86b-b963-44b3-a781-36fb4d7289b5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\pending_pings\2cf3c86b-b963-44b3-a781-36fb4d7289b5
Size 235B
SHA256 5b96bcefbf5bcc937e852279e9189c3bb0e3999ef7de1b88a5b2fc638668c5ff
MD5 7b83521106170326739deb2951403e9b
SHA1 ef53dc1063abc77dc57f5d95d19a68461102cb64
SHA512 e344b494a3acd7d359b7b70d078a0c019b2a7f1ebb1da2f5051c6cf0df63e0a87e2966fce24a94b26ef91c73e566225dc1419b9d4f6dbad8be05f850c944e612
TLSH
T1E8D0238024A867AD1C044F13F0F06CC630688C336075A820DEB241F4DBFDDCA1312827
MD5 SHA1 SHA512 TLSH

Submit Download

4cb760d7-0db4-4feb-bb3d-48fa7b02270e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\pending_pings\4cb760d7-0db4-4feb-bb3d-48fa7b02270e
Size 2KB
SHA256 1895edc623a9737bc2320bd9dff3be0cac22cd7777c77335427e3368851af825
MD5 07773e15d8fc3d5ad5fa4a2224b282eb
SHA1 eda8ada45c928d0601903821df82eb2d49ab5df9
SHA512 7b2ad0667dea36e72b497a5f6d1ef867e7f81d845a1beffa3f587bb411e4b16c5ca708e5fad65bc0de5e249446bbedfb6a061d6a4b29295c338afae589041ef2
TLSH
T1AD41206976BC4D369CCAF24C94C2238E53348E0340C72C876D96DE0C8DA669D236A96B
MD5 SHA1 SHA512 TLSH

Submit Download

79f03a02-a6d4-48be-825b-bee75b9e17e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\pending_pings\79f03a02-a6d4-48be-825b-bee75b9e17e0
Size 886B
SHA256 1c93515c0ebcb50034e493c902d4a871ac0134a61fc3f8bf1d6ad453d63d2b6a
MD5 bcdf6955f7703854f615b87f89f2e00a
SHA1 21b2056cf237239117cf0d53742832bc4e3f1f13
SHA512 510aca5d6b045cdef361ed993f8bc3f1bf380d287fd33c4a0a0fda4c1930d82c57dfa6e28b2fe1025a5d2606e312adde60973b42e6e968737f5ad79c1dcfeef1
TLSH
T10E11005286297AB28CACD28F85A2BB4346F47563C0CB190C2D554F280CBA65EE367707
MD5 SHA1 SHA512 TLSH

Submit Download

fda056f1-03b3-4195-b095-c66665f1f2ea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\pending_pings\fda056f1-03b3-4195-b095-c66665f1f2ea
Size 16KB
SHA256 5f6dc1b737241a9d1850c6a512ac50e1ab640585e5cbc3629d9a234c7f28be33
MD5 4f37dce1b82e2d63699853ea48a06fb9
SHA1 4a3b3a39d64cb10cacd1bf0ba56355e71485e2ae
SHA512 81ff7f88a19ae47987d5ba33b64d0f65a72dc043220240ff7a53719645b78905497b17dd55d12d43d1a8f6c1845fe61ab1d27df8432f123d1bff3103797f5752
SSDEEP 192:Qy+evigmE1rkX3oKHBWE5pGEx4kNJHUIXwKRIz6RiaUSVqBK1NLce43JB4+iP1L:L+nE1rkxcKRIGR5USoBKLLa3JNit
TLSH
T1CE72C9166820557A8291E36994F8BFC3E2F538CF4C419FCE9BE47D086DDE06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fea405c2-6af6-4f7b-a43d-fad3443eeb3d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\pending_pings\fea405c2-6af6-4f7b-a43d-fad3443eeb3d
Size 883B
SHA256 2169b93d61cf5674f2b0fcd37262ed8fb34fd80c3f5369c59290e5293eb7de53
MD5 661e2ea6a8d56caeab1b264fce383852
SHA1 f6aed77cd934293b2de9ad94c1fd17edddb4da39
SHA512 8ee28050c339b0b92dbe7e9a848fecc5046b73030bf8a07c23f871ee71e2125990a046c375ee7f92519975a3042759c4901b42b09490e8b4499f7c1adc22d803
TLSH
T10B110481D2257D72DC7CD24FC496774347B8752380CB550C2DB54D280D7E91DA36764B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\extensions.json
Size 14KB
SHA256 efeb8c57a0f7e1464915355d13ae673da9455258e36695647745f017ebf21193
MD5 d0b88ea1ce229e9832a8e160af574565
SHA1 5e0f03604b2833b38a921c6ea8ecdcbae68645dd
SHA512 71cb05ea1ab4942fb6bb3b03a6dfc80c8ad527f850f278d4814e4acb659c58c4f0d0817134b4daf2b7755e35b75cf081bcd3910a9fd573920619422a109f6e17
SSDEEP 384:IkI4viUmldvg8dhWb94zB96oCL4HWL4PhL4HHL4HJL4HC:fI46RfZXC4z6D484h4L4B4i
TLSH
T15362531545149EB8294FA78BAA367E01C37D473B60445C38F4DD8FC842FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\prefs-1.js
Size 6KB
SHA256 2f61b36833a56a354e78dc0ba6dd93fbb8a761a1b8bfa0e521cbe3829a5b57a4
MD5 3461c269237955f82e20397c3c6a6cca
SHA1 e853d389f67f4f950751de97234d7d50c08b0a44
SHA512 e0225ecab135492763a7d4a67a5cd8724f49d88793761bd8551705792e736ab4905480aba5a078d20bd1ad66884c83788ea5bb4659c4904bc2df5b1919c4abc3
SSDEEP 96:xHr8UTU5qGqnfZjIF1zScSSSlldv9jHneHizcmDFCBw88H8L4cnBuV5:G0RnfZjslSSS4izWBw8835
TLSH
T1FBE12F7894088B7F74B677AC6C6888316AB2413B7BBF68C750B954C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\prefs.js
Size 6KB
SHA256 8af08d1aa507f85c3a9e922b269af881310c59b0c22aafd523d5b3c7757b4ca2
MD5 e54a66514af665f68e61c2add104c455
SHA1 293614ef990a69a8314183aaeff3045e183b1e60
SHA512 e67ca973cbd63de30458b3b9cd8c5b67a945c6b5a6bcc3dea12121f057aaeeac6bc850aa21c685ec9a9246c0f21f7114aa6c154e5684a2245858dc1c08faabfc
SSDEEP 96:xHr8UTU5qGqnfZIL1zSLBSSlldv9jGneHizcmDFCBw88H8L4cnBuV5:G0RnfZIL6BSSZizWBw8835
TLSH
T14BE1207895488B7F64B677ACAC688C316AB2413B7BBF68C750B954C4050CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\prefs.js
Size 6KB
SHA256 fe2d2f4cd67c13ee14ca6980ecc828af6159e1b379a4e85ed46d5801a2d9035b
MD5 9ef6c966a0607f61ee494d878d1d33f4
SHA1 d33def4747b3e3564e44fe661be689ab79c173d8
SHA512 2e9eca0b63c336ed95cfc00258078d5c23a2deccf37869edfb723f6fc69b50896ddf7c5357fef9f49e1d680789060f69746f670073bc0f661981a44f7dbba0ea
SSDEEP 96:xHr8UTU5qGqnfZjIFObzScSSSlldv9jHneHizcmDFCBw88H8L4cnBuV5:G0RnfZjsCSSS4izWBw8835
TLSH
T103E12F7895088B7F74B6776CAC6888316AB2413BBBBF68C750B954C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\prefs.js
Size 7KB
SHA256 d809966b6bdde01e0c5c38eda045d12edd111cc039ffcdfe2246f50f9f1cf645
MD5 e18b00e0d77214c260552efb366f0420
SHA1 13386485c7477dd77400eccca78b2863219a1e92
SHA512 c9a18352fc88c4e432c61cebcc650e30bb2da3184e29f6c9cb171c136ab195c2f212b85c9054ca404ee1cf6b585243ee853e6856e0e4a605059733bd91e18d10
SSDEEP 96:xHY8UTU5qGqnfZjIFObzScSSSlldv9jHneHizcmDFRBw88bWP8L4cnBuV5:B0RnfZjsCSSS4iztBw88I5
TLSH
T187F10E7895088F7F64B676AC6C6848316AB2413BBBBF68D750B954C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 8cfddeed41d3f7f4b2b1c4a012b514c0ddc7caec3c059b79a9e470e939f8798b
MD5 4bf13b82813d846a9dc099d8067e2499
SHA1 68fe5032638dca6c861ecaadcb758f5923a22ea6
SHA512 2fd7a6caf88f95625b842b63b423b12ce02a82a40c2aa13a8a245d378ce4525a81a997d59b9a46b7a33cac1079df645c96a0114999f81fb77c13c62029912e86
TLSH
T185312C975D7E2DE56A05924BD04C4FF087552017CDF6C8D058CDCF46228D2CB61C4609
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 8521ce4948c4bffaa059da26fb2e4bb1cfa57ce4a943fa94a47014be3ffa27f4
MD5 c304b8cde85cd8d94a617b2c07bb7865
SHA1 139376ec8433d66d7984cba7957052b8b949bb5d
SHA512 b030dd28f48a244c33e2f8f0ced7850e77c95e5cc0654a0ec8613e3b6a9fe3638e2a33f29dd5beece56d8ff86c537afe05a793299ed02b5f7ac954fb5ff2f717
SSDEEP 24576:dNJhzkWdRY/A3jU1CYxFYSsHnq16AvVWO5IRoZrAN1Jq07/hfuQMmDZg:dNJCf6o1CYFcOaRIkN1Jq07dpdZ
TLSH
T1A2362AF820D1A257F3414033664593EF21EFD00C6027DA085BE99AE9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 8.1MB
SHA256 6efa9ff3583a2d3bf245bc1a24b90d3f42c37e2fd2449503762bd78f38615cb5
MD5 4077db136f29723830334e4120baedaa
SHA1 fcecbb9879c985372488731a3dd36c7ac9b29379
SHA512 4f03379d40868eeb83ccb67a09507b0e70a1896d51d2fffe43e5e419c823be33c53773f87ee00aef6625b16ff68c49ccb46df81a5cf09401dd2e7cddc0ac1519
SSDEEP 24576:n3thzkWdRY/A3jU1CYxFYPsQ/a+YjLH1WO5IRoZrcNnJq07DhuyJQ4ynZp/jgiSt:n3tCf6o1CYY5OaRIgNnJq07Ay+/nZl2
TLSH
T1A8864CA630D1C6D2EB4180B3B21E43DF30AFC19D20D796181A68769C95676DFDF2B329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.4MB
SHA256 60cb9ab90c317a5ecd496a2c99474cc62d6807733d49aa7e66dd70ab1cac7f82
MD5 5af567d515782a4a5c7e1cd778769de5
SHA1 16f9f503850e3b7179baadfba7633e3567a25e09
SHA512 a31b20625dbf4917990f0b3bd9068b642180d8000c0323e84ad8144502f720b855caecefa56a5a1bd5bb8cfb80255dfed3f30fd0c85e42feb3c012f56a7dc815
SSDEEP 24576:XthzkWdRY/A3jU1CYxFYKsQ/a3YjLHgWO5IRoZrcNnJq07efhuIQeqb:XtCf6o1CYtFOaRIgNnJq07pXD
TLSH
T175262AF860D19287F3414033768583EB21DFD04DA427DA080BA55BE995B9CEF8E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 960KB
SHA256 cc600c12e42019d3afcf32619d91400a1c65f114d81aa0e3eeb7fb74ab920eda
MD5 b8ae5fc37ac658eea8fb57962f8b12c2
SHA1 a6b8da16aacef6fcf50e2d6dbb4b84cc210cf974
SHA512 cbea9e20a7f5cd850a7b0c1ddfaf54d3791c304a9f5e5359a4dce47b2d3eb02315c80942e164680010cf0bd75eb4a4ae83e090d9a7d512864993b3d4e9110e1c
SSDEEP 6144:Jg3K393t3m3Q4Sr27b5tR1ImjxbCSr7Lc/1W75riQNUGBi3/xOY/CCbOr/6VwBFm:AbJw/IRiSU3g/CbOGVwBRl3R2f
TLSH
T19C259ED034B4D15BE362D43B664DF3E7113FE10884B3D6948BE6628436ADA9F9DCA306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\targeting.snapshot.json
Size 3KB
SHA256 38499a9475b044ab9e2ae6bd6a8f89f6c1c5c6575a4b359e9e842b2c80ac5f8b
MD5 3d9ec6e60661134fad83fb75e423afac
SHA1 28366f245980920e0bc6926187d07e992be627ef
SHA512 af645d5603bf193a187a64f9c3b1d1bbe42b4fb5ed7f155f3eff97a90dd4b79e6fc52d26a1399bef7a0539f6d55dd5e2880c5c9df83178d0ca0c4d0e130bbdee
TLSH
T15971920C961CA4BEA66BC3C0E6447FA78BBD053370847458DAFE460C95FB9FB122611B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads