ee11ab5b0613e22d75c38e84190a161c1edaca1b73dccc48bd5f36daad1987cc

Analysis

user interaction
yes
max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fatal.py
Size 5KB
Sample261024-thb9dsay3w
SHA256 ee11ab5b0613e22d75c38e84190a161c1edaca1b73dccc48bd5f36daad1987cc
MD5 36739eed6bdf2ad85a1cd4c1258ec3f2
SHA1 6a86d3ba97cb7cffa23c22878588cc30dada20e5
SHA512 72c31930ceb4dea3b0a1029f55816c6dab63bf61a697441be7b20dace8b6783802eb3caca48ba31dcf076e1a177ea4b4d328fc4ef819fd679e4cf86ebd74be23
SSDEEP 96:DoHgT/ovafa+aU/+Qcd+GTHxvRGrKnOHHHHsiEDQ1y4U/8rLDH:Do2/Hfa+aUqd+QREE0M4UErLT
TLSH
T1F2C1D9629E065460D0B3CC6E6D02B04BF71E4727863DAA1779BD53A52F7C4218AE0FBC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3892	cmd.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3432	firefox.exe
Token: SeDebugPrivilege	3432	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5172	OpenWith.exe
3432	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5172 wrote to memory of 4608	5172	OpenWith.exe	90
PID 4608 wrote to memory of 3432	4608	firefox.exe	91
PID 4608 wrote to memory of 3432	4608	firefox.exe	91
PID 3432 wrote to memory of 4884	3432	firefox.exe	92
PID 3432 wrote to memory of 4884	3432	firefox.exe	92
PID 3432 wrote to memory of 4884	3432	firefox.exe	92
PID 3432 wrote to memory of 3348	3432	firefox.exe	93
PID 3432 wrote to memory of 3348	3432	firefox.exe	93
PID 3432 wrote to memory of 3348	3432	firefox.exe	93
PID 3432 wrote to memory of 3348	3432	firefox.exe	93
PID 3432 wrote to memory of 4384	3432	firefox.exe	94
PID 3432 wrote to memory of 4384	3432	firefox.exe	94
PID 3432 wrote to memory of 4384	3432	firefox.exe	94
PID 3432 wrote to memory of 4384	3432	firefox.exe	94
PID 3432 wrote to memory of 1864	3432	firefox.exe	95
PID 3432 wrote to memory of 1864	3432	firefox.exe	95
PID 3432 wrote to memory of 1864	3432	firefox.exe	95
PID 3432 wrote to memory of 5368	3432	firefox.exe	96
PID 3432 wrote to memory of 5368	3432	firefox.exe	96
PID 3432 wrote to memory of 5368	3432	firefox.exe	96
PID 3432 wrote to memory of 5368	3432	firefox.exe	96
PID 3432 wrote to memory of 2832	3432	firefox.exe	97
PID 3432 wrote to memory of 2832	3432	firefox.exe	97
PID 3432 wrote to memory of 2832	3432	firefox.exe	97
PID 3432 wrote to memory of 2832	3432	firefox.exe	97
PID 3432 wrote to memory of 4236	3432	firefox.exe	98
PID 3432 wrote to memory of 4236	3432	firefox.exe	98
PID 3432 wrote to memory of 4236	3432	firefox.exe	98
PID 3432 wrote to memory of 4236	3432	firefox.exe	98
PID 3432 wrote to memory of 980	3432	firefox.exe	99
PID 3432 wrote to memory of 980	3432	firefox.exe	99
PID 3432 wrote to memory of 980	3432	firefox.exe	99
PID 3432 wrote to memory of 980	3432	firefox.exe	99
PID 3432 wrote to memory of 3936	3432	firefox.exe	100
PID 3432 wrote to memory of 3936	3432	firefox.exe	100
PID 3432 wrote to memory of 3936	3432	firefox.exe	100
PID 3432 wrote to memory of 3936	3432	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Fatal.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Fatal.py"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\Fatal.py
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 1940 -initialChannelId {b0c96de1-37b9-4333-9d7b-2c9489c3b811} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {2abb88f1-92f9-4ce8-88e0-0c8383ae8778} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:3348
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 27274 -prefMapHandle 3884 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3896 -initialChannelId {b7fef8cb-4865-49f5-aa49-28368e870497} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4384
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4044 -prefsLen 27274 -prefMapHandle 4048 -prefMapSize 270279 -ipcHandle 4116 -initialChannelId {9f637158-7953-4d2b-a88a-346ad1df8660} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2956 -prefsLen 34773 -prefMapHandle 3024 -prefMapSize 270279 -jsInitHandle 3028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3004 -initialChannelId {6c16cb4e-11c3-41d9-94d0-a3ac31eaf839} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5368
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5100 -prefsLen 35010 -prefMapHandle 5096 -prefMapSize 270279 -ipcHandle 5088 -initialChannelId {deb4e794-30a5-4d3d-a76e-fbab02ef0e30} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32900 -prefMapHandle 5256 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5268 -initialChannelId {48d79ad9-c2ae-4b54-a931-0574d57ce0b1} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4236
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 32900 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {3b8d0086-7d48-4c9b-9e92-e41355805d1a} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32952 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4892 -initialChannelId {3ba6037b-d7e0-4bb0-b38d-ea4ba6051adc} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\activity-stream.contile.json
Size 4KB
SHA256 a6682c9137d4654579e6a3c00594d175f37c5e9a08b58b93b2862f816d86a4b1
MD5 864748de44ef4dbf79e138807848222d
SHA1 a629213898ae17f709c74abeccc232681bff2b1d
SHA512 ad77eed45b87212d7e9368ed2e174314ec6eceb2a28235c384e5c7a07710b4306aa87ce66ff60a33ed05d86b60008df2ee1315b30aa7692a50e41ab53792c791
SSDEEP 48:YdbALreDZcyzWMfwpqQdlioOMaQjmqp4JpreDZJyzN1lQtGjy6T+jiRqMYQtnqbi:TRPM4N4+jmmETJT+mRqgtnXcjWa60Olz
TLSH
T13D91C87F89B049221631B9E5BC5B2758F107F005EDE1CFAC71659C5285BC7EE80DA848
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 63fb7ce2e87b62b03f134e7a71ee18449ab0a854eaa8c43a5b7410d7f3d35afc
MD5 d63646be644a79ee5f9e8c277776a8fc
SHA1 bd57cd60f4049b689c130233ea0c0b34a0ae1213
SHA512 d79a7db724b69918a1770f5c365f22c47f2fce01a9fb49b6c8ebfb8cfe6ba37fdf6b9254729556370995f81b9c3ed34d4f6c7711d20242bf3b65d8eabf7c2c04
SSDEEP 768:Aywg9gDYzPsHi+VaPZyWhsIig96gD51KRqrOOrAhj7HRi+GO+aV5KkO2JZBg:b99ShawW2IBEgtoRqMxGTaV5s
TLSH
T109731AA3E6E8B1FB0BB137C72C0F795B52E20185E74506C9FCEDCA1C81DD654113AAA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 3f7a6eaac0898c7890dad2b78cf31b997f72de759099ce94b36100b959f40a74
MD5 3397c8256943ad86c45aecc4d4ebe2f6
SHA1 30dd3bc17e0ae78bd255da7876bda65f5562d85f
SHA512 1387bb9edd4221a7675a5a4b7e504f4fa66f60ccd6ac24edf6d18d020ee392601305cb5a3b79f0ef7d2a1f2d04a16988e3dd63485126a20bc91fcce4d15f8ef9
SSDEEP 1536:jTrliEhooUD/OOdPKmKm1caFI0LWETExa8mj8zdXMoy/iSHF7/IzRnaXkqEoouc9:j3l6dPKc19VTEbtXMoXaXcSB3f5AT57L
TLSH
T111B3AFF6CBA2897D24FFD42DABC2893EFD262414B3933009C963675465C6FB47279248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 acc41b14d275894bcacddf939d85a64181037caf3b304414fc91e935261ae40e
MD5 ac0f5087efd95917e895f2da4e527c90
SHA1 9cc47573f2ba3927e68b0bd9bb70e3fc04c7aaa5
SHA512 aa779b8dcac684fe3f4fe257e9dad97fdbbdd7f02692d0bf52318b04b610757bc6290798ae9e12cae75290f5123b91e66a24a355e6aba4a50aa0c361c06c3f61
SSDEEP 192:BOv5zbo7PZjlyjH6mq1d66JoztdzgCl6mc0d:ebo7Zjlyjabd66Joz/zgC1j
TLSH
T179E11F64EA28863FC418027BCDA51B404F39389B984E3F2875EC651C2D5B2DE769E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e8cc4d68ef2d57ee8a4295f60e2716d1c8260dd2e07ccd45000084c16a6ec4a2
MD5 33c60543be2694fe216e295c26980dda
SHA1 923127d9e0829cfc12df6466962d64f9cd010c64
SHA512 05c191ed9be3e2130d8829cb8b650562f205070cfff3e20c02b48d8526ec32d7ba94de16e4b8e55f20eb41f49e560a59cf3fa5f6da2d22701a0f47c95e9fdd0b
TLSH
T15E21675C3DB88E2EAC87F698B445428E93594A0B04871C470E03DECDCDD5AD932AA43D
MD5 SHA1 SHA512 TLSH

Submit Download

133e15f1-96d3-4ca9-9200-8a29fc83915e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\133e15f1-96d3-4ca9-9200-8a29fc83915e
Size 2KB
SHA256 ff2307a23b97f2557d348be03f3ce4ce281c8ff208a0caa9f7eb42a5df5a862e
MD5 6bd17eeb9e6aec999e3f497a3e455da6
SHA1 a9ce1ea1e7e4fba2e4e0dda6179d985345dca3a8
SHA512 b877108cbc08a8a08ba77f1949b71bed8cd7f527a7402416b485c54670c12b583f74c6dea439146fe6018b7a57dbd7e75e9e0b9c5e051c7ec7795ec4d95625f3
TLSH
T11D41431C79B89C769CAAF14D8442238E53A04A5344C61C836E92EF4CCDE279A337A91A
MD5 SHA1 SHA512 TLSH

Submit Download

17bf549c-71ad-406a-bbd9-615a20a06c1f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\17bf549c-71ad-406a-bbd9-615a20a06c1f
Size 886B
SHA256 00d4fb7dbe8e4fa2c4b722df7d6d7ab7c4444e6bf5eaa237ef16fe8620ead62f
MD5 b3b14133d29081e8643dd5db873000b8
SHA1 3206de3b0077013e323bc77f7b5371e31c919275
SHA512 bf5202a4d399eadbb1af1e2fc3635d1a8a91adce41563dbcdcc00277a7ed020ab81cc0eabec386c9448482f875a05324daad7a45ef0875145c6afedd44e7c303
TLSH
T13D11C0418A34B5B6CC3C929B8990375287E47073C0CA5D587EA5AB184DEE65FA3BA207
MD5 SHA1 SHA512 TLSH

Submit Download

6bac82aa-c869-4684-add9-a1da4e6f4aac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\6bac82aa-c869-4684-add9-a1da4e6f4aac
Size 883B
SHA256 c2d174b43aa99743acfc2ff625c38695181f1c979a955ca9f39e3959e0c983bb
MD5 e076ddb1907a95dfe5d861b7cce5f0aa
SHA1 3e11321b65784d3625962ea55926f342b1638d8a
SHA512 2225288ed1d4b24bbcfbdf19701fb6917c8fd2f7db4f28dbe6abe660d73ed8e506302325ee86cd423d545b89072e032c943ab13b5ad2eeb8cdaaa0c2c4a82cee
TLSH
T156110000DA34B5B2CC78920BCA51370297E4753380CA95083DF55A044DBE65E637A207
MD5 SHA1 SHA512 TLSH

Submit Download

940a1f12-f83d-4012-8b1e-8c907010b99e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\940a1f12-f83d-4012-8b1e-8c907010b99e
Size 734B
SHA256 c8e9f3e177e8bf1ebfed8e1afc555d9e3c03e4e4f2fb79cf309f74ab7db1838d
MD5 92686eb0fcd535ea29af85b8aeae988f
SHA1 ddcbb360b2ae8f9b34acf9693a2980b324036ca2
SHA512 4ae1f1a0d0e22a2adc721b3e37f544df0be2daa522171b07aee3e37dda04839f480884c3c41c5fe2c166537ddc1f9af0ae4f7333dc390d2cd23557ff81d21a95
TLSH
T16C01B8924622B5B3DCB8D30E8A59771687E56432C0CA84186EF8EB144DFF12BA229707
MD5 SHA1 SHA512 TLSH

Submit Download

ab817af5-d94e-4df3-87e3-f04ce8fdf9a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\ab817af5-d94e-4df3-87e3-f04ce8fdf9a7
Size 235B
SHA256 30c4665e95b128e6088e599c546894a4ff027b4d76c1edacae3709ab404e9d34
MD5 a3c7a89a64e35b6ca327879cae6f20d4
SHA1 795adf5092ffd915e68d9c1f3c6011721025b0f7
SHA512 cab890795a0186bb5083e4c9e869ae7ca8a8d8ec95bb270bb02d8a3b5fbdfb9a65f2ad2400832b117cf81936d55d1075143a9eef56586e1b75d1fc1ba5c9304d
TLSH
T10DD097E018DC636C8C141F03F1A07ACE72488C3310629810E6609A348AB9DC8039284A
MD5 SHA1 SHA512 TLSH

Submit Download

b5c463e1-257e-4d7c-b68d-80f7ad4112e8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\b5c463e1-257e-4d7c-b68d-80f7ad4112e8
Size 16KB
SHA256 26d852bfbf395385b55925d29ce400d94a586240c63f4bd22fdf9921ce80212b
MD5 1b664ae22cddb36fb3a1d7c2a4d5df33
SHA1 be3507d85045050d04a4e7ee8028257f2effc0a0
SHA512 47c0f2237dfaa8b00be1c3c2cba54ef24fd348e9d6cb7b9a8d6f5cce85e035de0bcbed83bbf606835cd5ddfc1fdee6b9657873f4c7ffed51e4cc9cef76274fcd
SSDEEP 192:2BAUCg1+n9Oi5Ky0mlDjzDODVdbZVsVR3Mi+S1YJ2d1OqKWnKDj/dFQCTm/JaXdO:2nq9Oi5Ky0mlHnODDOuSDnWFQCqheaoI
TLSH
T19472BA16686055BAC591E369D4FC7FC3E6F628CB4C419FCA9BE0BD081DDE0AE102784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bce802dc-b8e6-414c-b018-1b3fec724fab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\bce802dc-b8e6-414c-b018-1b3fec724fab
Size 235B
SHA256 d9c876efd36ef8e5020bab7fa9c8d1c697ff333b748560cab1bae406487c5a40
MD5 13f36e9791befb3dd2492be0c0daa512
SHA1 0b051eea031ff51db1977edd5c278c448e0141de
SHA512 16e1d9bf16c48a9f457e924ed9a41c720f3c2512b472f7bb5a27660131e0b030e05c929db07a7027e05991aa45b331c903911ef09976dfa91fed674e7aa48776
TLSH
T18FD0978C14C8736E09240F27F0A8ABC6309C8C3314A6987099604874C9BAFC40251827
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs-1.js
Size 6KB
SHA256 cbc3c7ca9dacb15c0dcb6dd38b9f66291a4e0b3fc641957d0663cea92cc1bc87
MD5 09934869062928b360a027ed35ac3bfc
SHA1 5e9ff59ade6f55a9e61f707d73f599ce98c632be
SHA512 abe1bb112dadd84dcb4641cbfe5cf20b529fb0ff2f808492e85b3eedbd9c724c38f32518b0a598e299fb6193899dc2f78776748d1d4a2fd774a3f9c0d5aa2dca
SSDEEP 96:xHSUTUNqGq3Jfb4vS1zSfSSl4dv9jMnbHtXsdSBw88u8L4cnKM5I3J:EAR3JfsvSeSSRtX6SBw88y
TLSH
T1D0E11E7894088B7F74B676ACAC688C319AB2013BBBBF68D750B654C5054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs.js
Size 6KB
SHA256 c0108c9e4aa0be5bcb4a057bf5540359212bb27ffb6a6ad2b071a7733d0c96ef
MD5 98dc2797c79ccd9abecc9e4bb5a14f57
SHA1 d6f6355ddb7d21d68a135d51fdb4d9650323444b
SHA512 31d5ec239af72f07e112f4b1527f8ed48a5194afed04a72f641aee021543ec7d37f0b125e70c06a1df6fd5f08f56f7aa6390acdec53df9d613aa3d20c4f1a54f
SSDEEP 96:xHSUTUNqGq3Jfb4/H1zSOSSl4dv9jfnbHtXsdSBw88u8L4cnKM5I3J:EAR3Jfs/H7SSatX6SBw88y
TLSH
T11FE11D7894488B6F74B6776CAC688C315AB2013BBBBF28D650B55485015CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 193B
SHA256 ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
MD5 2ad4fe43dc84c6adbdfd90aaba12703f
SHA1 28a6c7eff625a2da72b932aa00a63c31234f0e7f
SHA512 2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc
TLSH
T165C012C2C6565071CF8365ADB26C7B659E3E04F67665064470ACD54C147B027421B443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 5ff1efb5856bf7bf57425c7d37a719c1cd75fcde7b1ca4bfc9881782956e3db6
MD5 f13fcc60b661ff07656f46bbf01b08bb
SHA1 42a32427a0d538574df92b20464d78c3fe132cbd
SHA512 c8154f234f3ce716bf60e2fe4f1012b08fcb87d7b52e956eec4f7629d65fffdb6e7b26c2f6deebd990e2a090e0acf9ef40bc528ebd11872fbdd6b0de0a74b4dc
TLSH
T16321FB93B4CA2FF27964950AA4C65FF5C29A346740B848A1810DCA8101CB55B7B8691C
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 58b59dab6c2e9eb77da26ab5bfbbc0bedac0afa14d1223f3eac977a6c2088c7f
MD5 6c4927f374b1daeb1a422815229aec2f
SHA1 a199795a49403b64c7252db6395923807a9f7df3
SHA512 b7f00c17ad29582c78dd1d166a2088b7b1ad1ae62eb9d34cace111b227bc77992b09ef1cd7679e9467df2af1f87a70cc86c681cb15784de4ac71a665ae7b9a6e
SSDEEP 24576:5NJwu7DmsTOPjPh5YoMkhlthBDNDWEhDQPhTJxK9Z15P7UBqspAhe3QNoWJ5zm:5Nx/kDbYQh10JxmT5P75zhsqoai
TLSH
T1E34629E820D1A297F3814073724593EB21EFD00D5037DA085BA99AE9A574CEF8E17B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\targeting.snapshot.json
Size 3KB
SHA256 971180451014960872b4b0f77c479b871d32c76ddba0af3cd630943e4d8bf654
MD5 0dd27db2e614937e760499825f06301e
SHA1 9404345d83c759cb0256c6866c3c8882ab4b2555
SHA512 40f490d3f21f8c00659aa681a8014f0f864924380bd51d6cbe227f988d21fe19d9f6010b6982bb712b6791a7d822d1ac9af21b0628b54944a92c4dd23288f308
TLSH
T1A171720C961CA4BEA66BC3C0E6447F978BBD053770447458DAFE460C85FB5FB152A11B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads