ee11ab5b0613e22d75c38e84190a161c1edaca1b73dccc48bd5f36daad1987cc

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fatal.py
Size 5KB
Sample261024-tfftsscw2p
SHA256 ee11ab5b0613e22d75c38e84190a161c1edaca1b73dccc48bd5f36daad1987cc
MD5 36739eed6bdf2ad85a1cd4c1258ec3f2
SHA1 6a86d3ba97cb7cffa23c22878588cc30dada20e5
SHA512 72c31930ceb4dea3b0a1029f55816c6dab63bf61a697441be7b20dace8b6783802eb3caca48ba31dcf076e1a177ea4b4d328fc4ef819fd679e4cf86ebd74be23
SSDEEP 96:DoHgT/ovafa+aU/+Qcd+GTHxvRGrKnOHHHHsiEDQ1y4U/8rLDH:Do2/Hfa+aUqd+QREE0M4UErLT
TLSH
T1F2C1D9629E065460D0B3CC6E6D02B04BF71E4727863DAA1779BD53A52F7C4218AE0FBC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2436	cmd.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
552	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	372	svchost.exe
Token: SeDebugPrivilege	1808	firefox.exe
Token: SeDebugPrivilege	1808	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1808	firefox.exe
1808	firefox.exe
1808	firefox.exe
1808	firefox.exe
1808	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
552	OpenWith.exe
1808	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 1808	716	firefox.exe	99
PID 716 wrote to memory of 1808	716	firefox.exe	99
PID 1808 wrote to memory of 620	1808	firefox.exe	100
PID 1808 wrote to memory of 620	1808	firefox.exe	100
PID 1808 wrote to memory of 620	1808	firefox.exe	100
PID 1808 wrote to memory of 1528	1808	firefox.exe	101
PID 1808 wrote to memory of 1528	1808	firefox.exe	101
PID 1808 wrote to memory of 1528	1808	firefox.exe	101
PID 1808 wrote to memory of 1528	1808	firefox.exe	101
PID 1808 wrote to memory of 2392	1808	firefox.exe	102
PID 1808 wrote to memory of 2392	1808	firefox.exe	102
PID 1808 wrote to memory of 2392	1808	firefox.exe	102
PID 1808 wrote to memory of 2392	1808	firefox.exe	102
PID 1808 wrote to memory of 812	1808	firefox.exe	103
PID 1808 wrote to memory of 812	1808	firefox.exe	103
PID 1808 wrote to memory of 812	1808	firefox.exe	103
PID 1808 wrote to memory of 1032	1808	firefox.exe	104
PID 1808 wrote to memory of 1032	1808	firefox.exe	104
PID 1808 wrote to memory of 1032	1808	firefox.exe	104
PID 1808 wrote to memory of 1032	1808	firefox.exe	104
PID 1808 wrote to memory of 5692	1808	firefox.exe	105
PID 1808 wrote to memory of 5692	1808	firefox.exe	105
PID 1808 wrote to memory of 5692	1808	firefox.exe	105
PID 1808 wrote to memory of 5692	1808	firefox.exe	105
PID 1808 wrote to memory of 5712	1808	firefox.exe	106
PID 1808 wrote to memory of 5712	1808	firefox.exe	106
PID 1808 wrote to memory of 5712	1808	firefox.exe	106
PID 1808 wrote to memory of 5712	1808	firefox.exe	106
PID 1808 wrote to memory of 5724	1808	firefox.exe	107
PID 1808 wrote to memory of 5724	1808	firefox.exe	107
PID 1808 wrote to memory of 5724	1808	firefox.exe	107
PID 1808 wrote to memory of 5724	1808	firefox.exe	107
PID 1808 wrote to memory of 5736	1808	firefox.exe	108
PID 1808 wrote to memory of 5736	1808	firefox.exe	108
PID 1808 wrote to memory of 5736	1808	firefox.exe	108
PID 1808 wrote to memory of 5736	1808	firefox.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Fatal.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2436

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:716
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {0fc1d54c-428b-4e47-9a84-129ebd1af92d} -parentPid 1808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1808" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2460 -prefsLen 27135 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2484 -initialChannelId {9d5d2768-ad87-4a69-ad5a-2be821a75a31} -parentPid 1808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3576 -prefsLen 27276 -prefMapHandle 3580 -prefMapSize 270279 -jsInitHandle 3584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3592 -initialChannelId {2bb39528-03af-4ad1-af1b-54edee372034} -parentPid 1808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3704 -prefsLen 27276 -prefMapHandle 3708 -prefMapSize 270279 -ipcHandle 3724 -initialChannelId {0117468a-48c4-40c6-bce7-7b972da15c2b} -parentPid 1808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1808" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4332 -prefsLen 34775 -prefMapHandle 4344 -prefMapSize 270279 -jsInitHandle 4348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4356 -initialChannelId {ca5d7c73-9fb7-4f68-8250-4b51e867dfbc} -parentPid 1808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1652 -prefsLen 35012 -prefMapHandle 4916 -prefMapSize 270279 -ipcHandle 4796 -initialChannelId {e577751b-2790-4407-af34-7f51f8eee9f0} -parentPid 1808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5080 -prefsLen 32952 -prefMapHandle 5084 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5096 -initialChannelId {38beaf97-65d8-40a0-a937-e489ac315930} -parentPid 1808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32952 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5292 -initialChannelId {d766182d-5b35-4af1-82e6-2aae1e1262c7} -parentPid 1808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32952 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {9eb67b49-31a1-4a48-b1b1-e2b94a63f2d3} -parentPid 1808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\activity-stream.contile.json
Size 4KB
SHA256 a6682c9137d4654579e6a3c00594d175f37c5e9a08b58b93b2862f816d86a4b1
MD5 864748de44ef4dbf79e138807848222d
SHA1 a629213898ae17f709c74abeccc232681bff2b1d
SHA512 ad77eed45b87212d7e9368ed2e174314ec6eceb2a28235c384e5c7a07710b4306aa87ce66ff60a33ed05d86b60008df2ee1315b30aa7692a50e41ab53792c791
SSDEEP 48:YdbALreDZcyzWMfwpqQdlioOMaQjmqp4JpreDZJyzN1lQtGjy6T+jiRqMYQtnqbi:TRPM4N4+jmmETJT+mRqgtnXcjWa60Olz
TLSH
T13D91C87F89B049221631B9E5BC5B2758F107F005EDE1CFAC71659C5285BC7EE80DA848
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 673561f1bfde4a6b61a662ec9af0de32561cbaddfaa04292a2072f283dcc6abb
MD5 8be56252d1270a418fa2d61582e697ff
SHA1 9a51dbdff4e1050bdfe75131b52458e324e57e4b
SHA512 b78558626bd3f137191f27b8084c0b1bffe194ca3129bfd042db5cdb6f111c13ba0cf1eaaaadf666e9a097b4223ec6f3a033108377e358003b79aa319aab05e0
SSDEEP 768:lysDBQsDsWcDDv9d51xi+BgqLOeShiPi5hKb5oxQKOOrT4++GULJog:EsD0d/ZLXQei5hKuxQ5GUWg
TLSH
T1FA7309A3A6F8B1BB0B9037C72C0F795B66E10189E34502C9FDADCA1CC1DD654523A6BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 bc2bd70871eccd03d71a1f767399b4a0cecfdacfcdd1f35a7d5a71287766cf13
MD5 92e648d2b8f93d30daa19838a30af0f9
SHA1 26348e374fdb7d1dec6dca17a0fb72f871d7313f
SHA512 65451d30518a56079c3d5621c12cc60aefb88d8bedc07f5255abb002bd1446d4ba0515d3bf10009f3026bff3896829137bc5d123b07362981858f704b6ef51b9
SSDEEP 1536:jTrlipP/zDXTjuxdaEjOAY1P4+xcpZKUmq45BaU0h5hcXZLMoUHMudlWE0Mh9puH:j3lWjuxdE4D2q45IjhonCMilWykw6
TLSH
T19EA3AEF6DBE2CD7D64FFD4299A82883EFD266404B3A33009C923271466C6F787675248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 95a5a94e587af5a466a73b5c9d37287a69e8bad355787a38fedd367206bb90ff
MD5 1109342972b427990719db80ffb5ca8f
SHA1 36fd04531f15155fadd91fbc0c9ce0339d5ac650
SHA512 44acffbed9e57b558adb3e5e16ccd4766f8072bd631e118459df4a3dfe7175267902f84a02241b8383a5f724a032f2e091954b64cf0d14881c64b1fd6bfba419
SSDEEP 192:CX9Ov5zbo4ZOVZyjif6mth1d66JozGzgCl6mc0d:Nbo4ZO7yjfCd66JozGzgC1j
TLSH
T18AE12164EA29863FC044123BCDA61F410F35389B9C4E3F2931AC65082D6B3DE368D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2e7c33e96b5750a67a2e59a7a45a129588fa50331d05ffad0c53256b1ca6c25b
MD5 05a0d50ac782b56f6d339bd9d80c959d
SHA1 015a41131021e9ccbbab7e6446c28dda6877f7ab
SHA512 02743e1eaba6f1c9a93be4afa1680e8569ad92c6be7ae39ba8879826072f27b4bd9caba13c3bd22325c87946254d3ee593b3ec4c186ab39f52e0d2feddee4ef9
SSDEEP 192:BX9Ov5zbo5ZOVZyjif6mKh1d66JozGzgCl6mc0d:Abo5ZO7yjfLd66JozGzgC1j
TLSH
T12DE10064E629863FC404137BCDA61F414F35389A984E3F2931AC65182D5B3DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 339643b9d5441b51801ef274c7fa247393cfe60d5a6b52c567d29930ba93c67a
MD5 de347dc5756ff76a27e227619307433c
SHA1 056c96292722cb99212ea9d536b14e86313d3575
SHA512 42569c9c2025d861cc9825fd655c507eca29515c04fa23fc63b65aaec1e8efeaf4147950fd1d3fb21846fcecf9325a1fe7c51fdca2113353c575e17d10f51cbd
SSDEEP 192:BX9Ov5zboPMOVZyjifckc1/66JozGzgCl6mc0dz:AboUO7yjN/66JozGzgC1jd
TLSH
T12EE111A4E628863FC044137BCDA21F440F39389AD88E7F2935AC64582D5B2DD368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c00cb74701f784ea1ad267cbf83bf6f246c7da04730287f943775e984b108232
MD5 9557634c72061c7efe771daea6c5cf82
SHA1 89404508dc8162efbf443765b4d1d7f6d011ea0b
SHA512 1c9747cdadf03efe237deec5dfc33790494bb590deff4b659349b79b6926fd9dc54b46e57e9c30dd66aecf1bf28bc163a66438471a7cc5271ebd925f5865b278
TLSH
T13821975C3EB84E6A598BF6DCB445428E6B554E0B44871C470E02DECCCED1AD932AA439
MD5 SHA1 SHA512 TLSH

Submit Download

0a7fc2ff-f53a-44cb-8777-935054dbea40

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\0a7fc2ff-f53a-44cb-8777-935054dbea40
Size 15KB
SHA256 e86c045bb9be5d468a7e99a1b4b8b1d8f3cbecf941c4bfbcc0b61b65544b380b
MD5 bee3d9c04a80a2cf25c709a7233ae7d2
SHA1 97a6396509307fbe31d7a88aa2f103ea3edf84c7
SHA512 80335bd09a1e3bf071997d2043dc4b819090a399059561a386b9df8c10a3a680b6cad02d3d9fd61a9cab869722b8a6d03169a0482cfd86c02817da3d449d93b3
SSDEEP 192:Jnj2/8zXWkbxzRPDtLoU8avniQY2eWrD1nf+id0fANs5DrEe1B+1LtziumlbSnDE:Bj8CmUzRPbe2LaDr5GRmlbSnDaju2
TLSH
T13E72DA56682049BA8251E36994FCBFC3E5F538CF4C419FCACBE47D0859EE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12ab8f59-2204-4817-b3ca-8fce58c4a87e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\12ab8f59-2204-4817-b3ca-8fce58c4a87e
Size 235B
SHA256 8314d1c72f6eb061a3a449657da57ab06ff5e299473f7d0b3b1af29d351f61dd
MD5 487c2040e010ea2dd67f8d4aaa00196b
SHA1 020e5f2d16e48117012b40348aa1db88593d963a
SHA512 d44be9acb79dc3b1041baec71c7d365ac80344ac154207dc676eef78a0d5d9944c59cef5195c2909fc304ac4beb19dfc5cf65957a13ec135be183934512eb253
TLSH
T1D7D097809888777E4C181F0AB0B06DCA30464C3B10B8A810EDA106B4AAFDDC94152C07
MD5 SHA1 SHA512 TLSH

Submit Download

6097b9b2-1d3e-4175-ab9b-7ecb5e9036c7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\6097b9b2-1d3e-4175-ab9b-7ecb5e9036c7
Size 886B
SHA256 aa9224b4cb76a3e33692b0fda1ab8deddb9e351822c7c8052afe4e0f4fe537bf
MD5 d6ac81af488c847ae381c9b9aa44a128
SHA1 e3d8af3e06baadbb77e8d0ad7571c7171d659cdd
SHA512 113ae7b30fb0c469abd4ca47d6049020675afb7d8aa332543d705cbdb0eb3893e3eb9ea286cb4b407617bd82160c1a22d6f77db6bf8e1861174bcdc6e1b3dd8a
TLSH
T1A81100519639B8B2CD68D24BCB913B438BF4746380C95D183E649F184DBE71EA37A247
MD5 SHA1 SHA512 TLSH

Submit Download

662d4bc0-6441-409c-b786-526b2b1f799e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\662d4bc0-6441-409c-b786-526b2b1f799e
Size 883B
SHA256 8691ec51800c5cf31435515ebd526eee6d386732a0ca7b1c93391db8e68c83c0
MD5 7a457cf8d6aa65a9f582045f682b0164
SHA1 b5fc28e50c2d525fc5b63a7399dcdd2359f214de
SHA512 68d69116b4d5b7685d7a30ab3deba2409523aa21f533ad5a6ab178f90a20eac30a6ad41e733369818d76f64cd9da65462f3711a6cab971f69e6bf88c2cbafcbc
TLSH
T13F112340963A75B2CD78D24FCA523B528BF4B933C0C954143EB58E084DBE71E97AB287
MD5 SHA1 SHA512 TLSH

Submit Download

ce875ed5-1808-4e8e-a67e-9c22e2813036

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\ce875ed5-1808-4e8e-a67e-9c22e2813036
Size 235B
SHA256 0705dd0ef45e04a1c00084fa6f1f857a2dc7326909642ef04b786dd3c945c2f1
MD5 397b1f45052bbfe7ead434043d639619
SHA1 c32b270926d61fb8d727c010254aeab5ad81bbb6
SHA512 4e94544f07db0714e24f0ca5f068b8c178e828f3a3bb4599155cc267e0807c677899495f0baaddd370ab8cf36daa1dd001ade72ff5f6dc06b978e256a7a8a096
TLSH
T1D9D0978268E87B6C89080F1BB0E0BAC234888C336478A824CA610934C9F89C8429181B
MD5 SHA1 SHA512 TLSH

Submit Download

ec941a15-f53b-49d5-ab84-6f33d88b0390

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\ec941a15-f53b-49d5-ab84-6f33d88b0390
Size 2KB
SHA256 9adbf861709abaed2951c30e26f4a6142f4597e5ffb52eccbe0b156727fcbea8
MD5 21de35a87ca45b75965908009fce1c60
SHA1 f7ac3dfeb90bc0e7df09675f8f3bb592f1268549
SHA512 8634ad6743b9354bbb0708296859b4207c2a9b1c22026b1d35fe2f5cfd3c114dc88779a0676b144d052ac7672e7b6206762607438c598d1cf467645e77e74210
TLSH
T19941435C75F84C778CCAF14D9492238D97748E9740C52C532E51EF0CCDBA75E226E51A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 6KB
SHA256 ac5b84a6cc3a6fadd2be5a48197c84189831fc206f4539e4ec8496eab411f1cc
MD5 d624fc9be53295f13a2abc599c70b643
SHA1 89f66baa101446c17c4bbe1bed2582f4cda3d257
SHA512 289242020a3d8c5b29cb341e886e3dfc05c3b59e301e7cbbf0f34b71f70438eb3d22d9bc1b25a8bb9dd63ae00b433f225be0197a2865c327c185fefdc9df1579
SSDEEP 96:xHYUTUzqGqZEfU87ObzSaSSlSdv9jCnvHhW/YBw8On8L4cnt2I6:KORZEfU87ASSJo/YBw8O+6
TLSH
T145E1327895088B6F74B6776CAC688C316AB2413B7BBF68C750B584C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 6KB
SHA256 105b9112d5a67529d6009eb7e41515bdbef1e45ea0db724a6b89dea1392b4054
MD5 a13b76630a8002635f829f9de463e7e4
SHA1 3fd810aa483b757ef6899c678cf7e7901a291001
SHA512 f53b4a3e7144c52b5cc8889277069f950fbe3c0443826815a430ba58939328441a3e08eca814233f0c38c2e02ba9008b9368848c6f5e6d632567314d69bf0f34
SSDEEP 96:xHYUTUzqGqZEfUgm1zSoSSlSdv9jQnvHhW/YBw88n8L4cntGUI6:KORZEfUgmhSSHo/YBw88n6
TLSH
T17EE1307890088B6F74B6776CAC688C316AB2413B7BBF28C750B554C4011CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 6KB
SHA256 ff9987dbf8b6419922ef476df9c72588d1897a8fb2864bf92f926052a1f120c7
MD5 a11ed71d4b5b78988fb265fc310c2ce7
SHA1 0233bd8409e1d74d3010fab9d5978bcc18df228a
SHA512 02885fcc5daf1e7d6b06ad78148ab79f1eea4e4b9ab9eca892dca5a0fe38e3d7ccc4aabcff4e5ddf4b8755f1f0431a29eef1ba331f6e9fc10df1d28a8307ea0f
SSDEEP 96:xHYUTUzqGqZEfU871zSaSSlSdv9jQnvHhW/YBw88n8L4cntGUI6:KORZEfU87bSSHo/YBw88n6
TLSH
T125E1307894088B6F74B6776CAC688C316AB2413BBBBF28C750B584C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 52ae5ef72bc81f447192aa660977e99e58003fab4ca6bf7aa5713c28746ef07f
MD5 fc5d4b5c16fa3a156911b41e9a84a633
SHA1 72d3d25fef53c073f9cd7d9e3bf35cbd25038a65
SHA512 72a51728b3e80862940c739436240b407a52fa602ae1949ce87f38ebae5ed7ebe3f7d1e978f136aa1f904a6e36f310ad49d6a53e703ef1849ab20ecfe869e2cb
TLSH
T10B21C683CC3B5DF23E6590A6D08C4FE7CA193136C4B948E0A59A854772FD1492F8F029
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.1MB
SHA256 97e3a3fc6bcba671a95f83e7ab1f07478fe747fb80b9dd634ec2ca1f34d02852
MD5 9f0f0efa5a383854fcbabee3ebd8b3d4
SHA1 8a6e9b0b80dc6d5297d7c84885bb518ac75ad2a3
SHA512 9a1275f5464530c4860eb9dbdbb818d35066834866e3de82aa7fa920b33c15f75a9b4052ea96dbc17b6142c36e40a99a7d0e743adce4f1d051a1ef8e26121a57
SSDEEP 24576:dGUlohpBX/STjyJDYBRazT88rE4URiINzHjmryA1s7GS5E6JKREkfK:dGPpIGJYGS7HjsR1s7zEPRx
TLSH
T18F362AF820D1A257F3414033764593EF21EFD00C6027DA085BA99AE9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\targeting.snapshot.json
Size 3KB
SHA256 0b47cdeec8e5289dfdc9da0155e45f26473554bde256fd5d2114800d478c578c
MD5 5cc2f2cf288005100bbe62b269ef866e
SHA1 ad3fa9b45671023266bf02eaac2164991adb6d6a
SHA512 11cbeef9c1416b211727dcf69121620041eb5c81b6cb62b7dca8b988cc8044f22a28930963dea6850e422ab28876f38a2049e0b74209744f09d89cbbd6d792a5
TLSH
T1FB716F0CA51CA4BEA66BC3C0EA84BF978BBD053770406458DAFE460C55FB5FB162621B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads