hxxp://zmcyelc4ebn7w5ly2kfc7hbhbchowczlzzvqhwmscrhmoa4bymtnvsad[.]onion

Analysis

user interaction
yes
max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://zmcyelc4ebn7w5ly2kfc7hbhbchowczlzzvqhwmscrhmoa4bymtnvsad.onion
Sample260423-jnmxzaev71

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	firefox.exe
Token: SeDebugPrivilege	4972	firefox.exe
Token: SeDebugPrivilege	4972	firefox.exe
Token: SeDebugPrivilege	4972	firefox.exe
Token: SeDebugPrivilege	4972	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe
4972	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4972	5004	firefox.exe	84
PID 5004 wrote to memory of 4972	5004	firefox.exe	84
PID 4972 wrote to memory of 6132	4972	firefox.exe	85
PID 4972 wrote to memory of 6132	4972	firefox.exe	85
PID 4972 wrote to memory of 6132	4972	firefox.exe	85
PID 4972 wrote to memory of 1592	4972	firefox.exe	86
PID 4972 wrote to memory of 1592	4972	firefox.exe	86
PID 4972 wrote to memory of 1592	4972	firefox.exe	86
PID 4972 wrote to memory of 1592	4972	firefox.exe	86
PID 4972 wrote to memory of 4620	4972	firefox.exe	87
PID 4972 wrote to memory of 4620	4972	firefox.exe	87
PID 4972 wrote to memory of 4620	4972	firefox.exe	87
PID 4972 wrote to memory of 4620	4972	firefox.exe	87
PID 4972 wrote to memory of 2144	4972	firefox.exe	88
PID 4972 wrote to memory of 2144	4972	firefox.exe	88
PID 4972 wrote to memory of 2144	4972	firefox.exe	88
PID 4972 wrote to memory of 1256	4972	firefox.exe	89
PID 4972 wrote to memory of 1256	4972	firefox.exe	89
PID 4972 wrote to memory of 1256	4972	firefox.exe	89
PID 4972 wrote to memory of 1256	4972	firefox.exe	89
PID 4972 wrote to memory of 220	4972	firefox.exe	90
PID 4972 wrote to memory of 220	4972	firefox.exe	90
PID 4972 wrote to memory of 220	4972	firefox.exe	90
PID 4972 wrote to memory of 220	4972	firefox.exe	90
PID 4972 wrote to memory of 1304	4972	firefox.exe	91
PID 4972 wrote to memory of 1304	4972	firefox.exe	91
PID 4972 wrote to memory of 1304	4972	firefox.exe	91
PID 4972 wrote to memory of 1304	4972	firefox.exe	91
PID 4972 wrote to memory of 2760	4972	firefox.exe	92
PID 4972 wrote to memory of 2760	4972	firefox.exe	92
PID 4972 wrote to memory of 2760	4972	firefox.exe	92
PID 4972 wrote to memory of 2760	4972	firefox.exe	92
PID 4972 wrote to memory of 5732	4972	firefox.exe	93
PID 4972 wrote to memory of 5732	4972	firefox.exe	93
PID 4972 wrote to memory of 5732	4972	firefox.exe	93
PID 4972 wrote to memory of 5732	4972	firefox.exe	93
PID 4972 wrote to memory of 5296	4972	firefox.exe	103
PID 4972 wrote to memory of 5296	4972	firefox.exe	103
PID 4972 wrote to memory of 5296	4972	firefox.exe	103
PID 4972 wrote to memory of 5296	4972	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://zmcyelc4ebn7w5ly2kfc7hbhbchowczlzzvqhwmscrhmoa4bymtnvsad.onion"
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://zmcyelc4ebn7w5ly2kfc7hbhbchowczlzzvqhwmscrhmoa4bymtnvsad.onion
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {a7ecde4c-bc35-4c15-9a7e-73ef96d6cc3f} -parentPid 4972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2516 -initialChannelId {462eb0e9-239d-4c79-8fc2-237685b4875a} -parentPid 4972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3800 -prefsLen 25164 -prefMapHandle 3804 -prefMapSize 270279 -jsInitHandle 3808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3816 -initialChannelId {b6247ec3-7127-46fb-a9c7-2b1afcd0c742} -parentPid 4972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3960 -prefsLen 27276 -prefMapHandle 3964 -prefMapSize 270279 -ipcHandle 4048 -initialChannelId {458dc9a5-1062-4059-b6f2-f07a904e4fc1} -parentPid 4972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4296 -prefsLen 34775 -prefMapHandle 4300 -prefMapSize 270279 -jsInitHandle 4304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4312 -initialChannelId {f9428af0-c569-4faa-b15e-67c1e9a1a597} -parentPid 4972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4832 -prefsLen 35012 -prefMapHandle 4836 -prefMapSize 270279 -ipcHandle 4804 -initialChannelId {399e2964-37af-4dd9-9142-ac6656e4a475} -parentPid 4972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5156 -prefsLen 32952 -prefMapHandle 5160 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {b5fc38e1-f7ab-4e7c-b719-4bafe42e227e} -parentPid 4972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5344 -prefsLen 32952 -prefMapHandle 5348 -prefMapSize 270279 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5360 -initialChannelId {dcc0605a-09a0-40a8-892e-5582cfaf603d} -parentPid 4972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5536 -prefsLen 32952 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {800999e9-f8de-43e8-8d48-a62d5502f481} -parentPid 4972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2860 -prefsLen 35457 -prefMapHandle 4752 -prefMapSize 270279 -jsInitHandle 4760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3004 -initialChannelId {30e9eef9-0677-4f4a-9426-88ab154c7fc7} -parentPid 4972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uqk3a6df.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 10KB
SHA256 098b31845591f02d10053bd8d519cca7019cb9a0278c58842a81aeef8b97902c
MD5 7ea7a873ceecd97464a30c054dea0874
SHA1 58a71f1cc0f7c29fd661663ae729983bfdf1ea47
SHA512 9a9a5ffa879257b76eab4994df03ea7cbc6472aaf01e94ffe7a3feeec7c482367bcd12f7bc9cfacaa79f33b298e84bc87ebf61f38e34fbbcd20ad305ad0e594f
SSDEEP 192:Hc6poFrLcXz5RqvAcdRPSHXFCPD1Oo1+0QGmTZYxMnxoGDkGmTAxVN1oj+:HbaFrLiO024YSGsZYxkxoVGsAxzij+
TLSH
T1BB225DBFAE013CE81F17D1D499A8C31D8E09A5F7E9E3901B15187D55C680369B0FE0AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 394KB
SHA256 3738e235320d4141253ce79e0b3fcc50e351d28911afec06c281621805097ea3
MD5 57f01f4c5f826799e57d2ea22b30cb2e
SHA1 0abeff29f0847237ed896031faf7333f79a9bba2
SHA512 fd95423c3bb349a8eaa48e3505085a576d20d503a9de23180045be7026de1c4f5676ceea49818259b374d2822106b3f74cd424fec4f239c7dea6745d6d0e66b0
SSDEEP 12288:rH2uLF1qHbHfl3do1X2bdVM0cQMspAvrCnQUDs:6uLvKDfb+Um3V1rC5g
TLSH
T13E8402F5F7A138E7577E420BAE14AFEE57918D12C78FE0DC482B778044BAB295E86104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
TLSH
T189A42315F4A41CDCE8B5200CCADED74501995084F126FE2A5D32EEEADDDF683E26C8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c31480902db1761b0a9ca0fa1d26dc8b6574ffcbb3ab93084ee5c79230e73fe9
MD5 932a487fcc7b1f64d819d192f6701f6a
SHA1 39ef2809d6e283b525e1144b43d83fad616fa10b
SHA512 326453a6fb1611a04b81e0ff68d640aaab436a46f73e4994719f04c8a641f1e76b3e6f7b86caf1a7633a6123fcdf243d7256049420c36d9572ae1623269304dd
SSDEEP 192:g1d66JozGzgCl6mc0dxOv5zboPyZR4yjuX7:ad66JozGzgC1joboKZR4yji
TLSH
T199E12068E628463BC408027BDDA61B804F75389AD84E3F19359CB41C2D572DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 3e25b0afc6fc6e763ea6aa3b28e77e89e92d8f111bc5bedc7387ef4b7c374b51
MD5 97c6a9ab7fe3cda95331ca491d50dfee
SHA1 54cda84a28074ebb5ddb9e03f2487583333093fc
SHA512 3711db5b225e861144cec349ef6813476755d1f5099652b3315506b53c48090994f03358dacfbbecb1ecd13ddaae1211980a4acf996437a8c1f8b5baa76b8e0e
TLSH
T1AF61C65CF2284A3FE044413ACC971B811F307456A8AE7F2A3AACA04D1E1B2CD768D13E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7120cd64d09b80bb412a202cf59b7bf4fbc2a66f4d7a70871d0263533a930001
MD5 c4b988337775427acebb9f545ee262a0
SHA1 e55cf96d3153378bc87e243100c8c629e489e279
SHA512 24e586a9a795b6df34335c4cf19bcc87ebafff409173ce8d969030f42abe7681b3cd580b78342746f416d5f4db2d67c824ca713512e3f366a08c987d289ba919
TLSH
T1A221AC4C39F84D2A6CDBF69E7441168E53508E0B04C71D834F02DF8CCD95AD9326A938
MD5 SHA1 SHA512 TLSH

Submit Download

278be03f-5738-424b-b0b7-ab1cde565b1b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\278be03f-5738-424b-b0b7-ab1cde565b1b
Size 886B
SHA256 d21ab9403055df111a4084f72d3c062898eec5828c4a217a0d7450a01ea3dab3
MD5 0b9b1b21b4b76c2f98516702e9f68411
SHA1 1d19c1659bc8f24b8618bd4cc6ed71a24e06196c
SHA512 0591faeac10c9a950a26f011c394fcc29c679214a7edc6527c0c59b71ad8044f0e9eab76849ab75fb31ece9243e868843c4e4172030c4da80bb5e0ed0cc75eef
TLSH
T14E112381863478B28C68C257D5E67B8247E87033D0C60A087EE49A2C4DBB61FE3A7347
MD5 SHA1 SHA512 TLSH

Submit Download

3755b79b-3b0d-4c79-b296-6522835672bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\3755b79b-3b0d-4c79-b296-6522835672bf
Size 235B
SHA256 547664f511ae89836666dace9312c09ce4036032fe305f101a827b618f79bc76
MD5 91982bf39ec7f9c53ffbef2a7ec34be0
SHA1 fab7d20fdcab28bfcc0b908bb1b5a24eb6e9b2b7
SHA512 dc05490e044052e1a9eec92da87ee3f6d70727857132cc9e5dde61e0a0e1c88c53a0baa7b46c297ace9dd694a2ea3c09c88add1cc748ea7909e21f7ff4028361
TLSH
T1AAD097C4149CAB1E083C0F02B0E02AC634448C3720705810C9618978DBFD9C841B1806
MD5 SHA1 SHA512 TLSH

Submit Download

87676247-9c0f-4112-8e97-48f80be8a020

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\87676247-9c0f-4112-8e97-48f80be8a020
Size 883B
SHA256 7b2db806f4b8394c19a20989c8957374c4ad0317054650657406f7b05b8403bb
MD5 810e9818e121228682217385ba821864
SHA1 2451d25e6ea557813f1302f752cd984b69a6e846
SHA512 b8b71cb42ef87e1eceab72ce2417be2f84a6e9170239a41568202e1e4db2cb5056493dd5fe94c56dd348bbd62de206f0b93690bf229860da3c5763dc009bb2a4
TLSH
T165112F81863579A2CCA8D35BC6A63B428BE47833C0DA40183EF15A080D7E51EE36B34B
MD5 SHA1 SHA512 TLSH

Submit Download

aa168fe1-b03f-4ba9-aa18-95915e0fa902

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\aa168fe1-b03f-4ba9-aa18-95915e0fa902
Size 2KB
SHA256 a96ed12e156a3ccbb4dd774328a9e80b5f3689f9ee38a9f9f6169135d7a2b467
MD5 708f3b2ab01397ace40ba7c2072d3a69
SHA1 a1279fa16fecbd58a6a55b1f2e746234f872c231
SHA512 f484b0e61f04ad6906c3d3b391fc346cfaac1cfde9681679d76522f194d45efa53a60bff137251d3a5be9085d8239d5f204d487f04ff7ab5a7c919b693b4c488
TLSH
T15541335D36B86C7B5C9AE55DD4823B8E93A04A0300C628932E51DF4CDC9279EA37A52F
MD5 SHA1 SHA512 TLSH

Submit Download

b1c82b70-d190-4723-b809-2b458b8094c1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\b1c82b70-d190-4723-b809-2b458b8094c1
Size 16KB
SHA256 fffa9e991bdffcbb1ddb4e78094bbce589912f0a25bf707b8c44fc4a259ac300
MD5 619d8b532fb453cd64f87f10f3c39234
SHA1 8eb4a4d2743736dc6ee8526943d8acc26ae01e1a
SHA512 26827d99b12c7d0778d77bb6272dd559623edf0a6ab0a162f4c2d1f8edd6c3e3bb04010ded05046af1c861adb964c3c0fdcb232ecf6a0ae5876ee3b34e7b98d0
SSDEEP 192:y05CepffPUaxegRz3hMNbCnsBunLIgmk4Qtr50s1NwKO7iz1SUkNMsBQn1SpTjWm:LcfgewrT1CKO7iBS13G0Rje+r
TLSH
T1C072D9565870497A8291E36895FC7FC3E6F528CB4C429FCD9BE0BE082DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc1fef81-6bfd-4c72-9c50-0264254d20b7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\bc1fef81-6bfd-4c72-9c50-0264254d20b7
Size 235B
SHA256 4ef7499b7b42e32e67c5e401a719842871d0abb64731ee0646c9908f20ac35a6
MD5 6f44265da88a84d838f2ad3f322861b7
SHA1 3895dc84181e78f54c9b1601c5c14dc24e43738d
SHA512 29b0f391aaf723b6e03adb01e8f21c4bb04576c5cdfa197d54b2196a0b4fbaa98a433da239c108c2b051508b7c51915a2e4cdbc3070ae399e9001953469e99cb
TLSH
T1C0D097C054C8736D08080F0AF0F07DC630454C3358E16810D6A64038A9BCACA03A1917
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\extensions.json
Size 16KB
SHA256 ddc68b1d143385ba7c8116515c42e67d81e9920cb4ebd0101c2782fd8abc6528
MD5 1721c65a9dfe27c7d14c114e27f31787
SHA1 75ab3eb2ea261c02bfdb9a0e4f7fd6a1c1b5c95e
SHA512 b93416603842b8656a0c35be1917dcc14d3edaa041aec367f17392dc1e29cf0da20023108552697255b0a0224a4ed7870de737d463337f42a4ac91ed0a5540c2
SSDEEP 384:L+kI4vmUmldvV8dhWHW94zc96oML4HLL4PSL4HSL4HlL4H7r4hi:LxI4ORfGXK04k6x434o4A4l4H4c
TLSH
T11672411545049EB8294EA79BAA36BE01C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
TLSH
T1D9358D0AF1A311E9E41BC074867EA622F639344D572568FF169587203F77BC0AB3AF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
TLSH
T176B022002803B0B0082282030C380AA02A3A3382E020082CAE2F03E0838832303AC0E0
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-widevinecdm\4.10.2830.0\manifest.json
Size 1001B
SHA256 25a702dd5389cc7b077c6b4e06c1fad9bdea74a9c37453388986d093c277d827
MD5 2ff237adbc218a4934a8b361bcd3428e
SHA1 efad279269d9372dcf9c65b8527792e2e9e6ca7d
SHA512 bafd91699019ab756adf13633b825d9d9bae374ca146e8c05abc70c931d491d421268a6e6549a8d284782898bc6eb99e3017fbe3a98e09cd3dfecad19f95e542
TLSH
T111115B00DD388D9326E4BAA21CC6580957661DAF4CC27E98379E161D8F1C8AFA37376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-widevinecdm\4.10.2830.0\widevinecdm.dll
Size 18.3MB
SHA256 eb98fa2cfe142976b33fc3e15cf38a391f079e01cf61a82577b15107a98dea02
MD5 9d76604a452d6fdad3cdad64dbdd68a1
SHA1 dc7e98ad3cf8d7be84f6b3074158b7196356675b
SHA512 edd0c26c0b1323344eb89f315876e9deb460817fc7c52faedadad34732797dad0d73906f63f832e7c877a37db4b2907c071748edfad81ea4009685385e9e9137
SSDEEP 393216:FPRzXYeXFyjsrZuvpYl5SJIhw7PJeP9TZHZMaMq0Vrq8P:DFyjs0pYl1hwDJeVT7erq8P
TLSH
T1D817E04AE26310A4E85EDCF4827AD972D0743C4E0376A7EF16D876356E727C06B29F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs-1.js
Size 8KB
SHA256 751df36461ee31e6701c95f20284ebbf16c6ac0532b9aa810ac89a904fb63c2e
MD5 6e5e56a00c82aa96fbea7b20a67f966d
SHA1 0d8780ef68a5545ec641885d44abaebf2de87a0c
SHA512 8edf987cfcb1a7e01fab9a4e87137800b09dacdf021a32f61b2a3f201d43f8e21b21deadbeffbbdafff6e6823da5b458c6d6b0b9c07b0e8fd061a35b20d1ab10
SSDEEP 192:SrjArcA4mbR0fCkFQgISSGHR2ce4a1Bw88p:Oa8HRPGw5
TLSH
T106020E785404DF6F79FA37ADAC684C705AA2013BB6BF58D750A568C4090CF3442F9ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs-1.js
Size 7KB
SHA256 da16fc67462fe8e35bd9c47d763b12a77ee709a80c1d9f73c5dbfc3007a795fb
MD5 2d86f14b68743e4a6f6345c68ba7d25a
SHA1 69b05e1ec0c43c0c51a2053e7851019f7cef57fd
SHA512 07de0d09445301cc435cb4ab44e0ed7e046713ef6080cbd19fabc59da77b9cf7f0a12950cb9c3f2782901fd992377f96c5dea69b661787dde429342efcb0c872
SSDEEP 96:xHSrUTU5QqGq0fCkFQObzSyHj0SSl8pdv9j+n1HacetBw88n8L4cn48gmdGS:4rJbR0fCkFQgISSGCacetBw88yh
TLSH
T107E1207890188F6F74B6776CAC688C716AB2413BB7BF68C750A654C4051CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs-1.js
Size 7KB
SHA256 1fd43897bc60bfbe52fdea6d3347dce4bfdea08cf81b077b26a54c889e83b6a9
MD5 3caaa464f13b576caa83c57d97e8fd12
SHA1 ab2cfad9340c9ea260fef13ef9c68fc93e0d43a0
SHA512 31e9f0ac79f2affb0ae91618925a04482265e660bf62a4ec4df462f7967faaeeb90ca611b28bf10ae56fb5bd2ffe7fb9c84ba1fe97c77ef4007f730f6cf8553c
SSDEEP 192:4rjArcA4mbR0fCkFQgISSGHR2ceoBw88p:ka8HRVw5
TLSH
T1BAF11F785104CF6F78B6776CAC684C705AB2013BB7BF68D750A65884051CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs.js
Size 6KB
SHA256 ba24e7655ced544f9d65a1e60b762796670739246e4a769f6e1ba6f86fb5d1bd
MD5 fdaf7f429a562d54efd94652f93a4504
SHA1 7f1642f7c7d73234550c2277009b0c0ce0a37c8d
SHA512 72492ca7cd4abd933c6f192ba997bba24481aa635cb015b8f2a41c4d9a24127d7e4b6360582eb433282ce502f059ecf674055af1b2cf94b4083d77920ea06c0c
SSDEEP 96:xHSrUTU5QqGq0fCkKjanjLM1zSpLvDSSl8pdv9j+n1HacetBw88n8L4cn48gmg:4rJbR0fCk13MoLvDSSGCacetBw88yi
TLSH
T158E1407890188F6F74B6776CAC688C306AB2413BB7BF68C750B65484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs.js
Size 6KB
SHA256 e3beec61ef09b6e985db517d3730878d5de05d010bc50bd8e32d0ee2e4e3e310
MD5 63e2c68f6af7b501c3de31893a63a4e4
SHA1 4284ff2de647dbbaa4d376091e989138a24b9334
SHA512 933deefe12f6859a56c08aed33d6257c902129eee9aef3f7b1ecc2330c0189b4801ea10ed9e750ffe433cb037d76fd73e18e98dbcaf46358e5bdbca6fc021d46
SSDEEP 96:xHSrUTU5QqGq0fCkFQ1zSyHj0SSl8pdv9j+n1HacetBw88n8L4cn48gmg:4rJbR0fCkFQzISSGCacetBw88yi
TLSH
T11EE1307890188F6F74B6776CAC688C716AB2413BB7BF68C750B65484051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 e67c37334c3024a75da4f4aa516ed9a7262ed513358b3e9390735b914b2218cb
MD5 e59b9f2d8f7d5dee5efcd7197ba09788
SHA1 85ac72497dcf5579fd16174ab1ef9512dd4f12d6
SHA512 9040a678b6514e54e807d707c119a79307921119a57f4c24c452eb161c8bcef637cfcbc2107a8ad6375e4e1523a457c417df16509b73c7e5d75133f5f610ec3b
SSDEEP 192:ogclT8Y4dP7C/qbkRv4gMmOfDKfQrX6oEZfP:ogQT8Jpkh4gFQ76bh
TLSH
T1CFF18DB2C6337EF0B6321049D2F12356B9E3652647D2DC948C28AB24509EBAD7E30105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 c25bb8795e3acc2b2669b33ce9106f1c1bf82d71dedac75ab7ecd9460a6f8afe
MD5 8877cecc173731c00223aef15752ebb3
SHA1 7085bc5f78e21f81342ab1cd2256081a52d3569f
SHA512 926805cbebb8c67d8660771eec6f0c56d11314986a2afea8c678348c91cd94a65af3706bceacb55edb39f2a5f51f10fb68fea6f6e9a7887367b144471fde4ae9
SSDEEP 192:sgclT83L4dP7C/qbkRv4gMmOfDKfQrX6oE2dZ:sgQT8gpkh4gFQ76bMZ
TLSH
T187F18EB2C3337FE0F6321089D3F12356B5E3556647E29C948D28AA28509DBBD7E30056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.jsonlz4
Size 8KB
SHA256 b2eb4508cc88cae1abc9919b60dc0854eaa3bdc65288bd17a4017be1e9840a3f
MD5 1ed28d19dd2f754e7ef585a2d069d410
SHA1 cfb667c86f322758375692057149fdb17a66197d
SHA512 d145dc0d5dfcbb2abc8871e7f05ff2d2c316aa91377c4451f99aec1ed94ac464f21f9b22bac6537392351682cacb652130bb7ca8d6838820622218c3485ea47c
SSDEEP 192:9gclT8h8fu9mdX6c49JC/qbkRE64gMmyfKfQrt6oEpoH3Au:9gQT8hRtvpk664gJQh6bpru
TLSH
T1F4128E72C6777EA5F632508AD2F11352BAE2552A4BE28DC84C38DE2850CDBADBB20055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 b4a5c6411a2e4901b993f11076d533d44ce16592592191fe5e01899f80ea7621
MD5 452587227480fdd1f3ad66db070e6d6d
SHA1 0c6b98eb8691b44003bef339f430bebabbf1f8f3
SHA512 44339fa0670e9d72240c62f962fe77f4a7e5a01f073142a79a36e29578f32ec0efee6603a8d30f66492c62b85a8d234f44b54a7e17e6bd383843549d02367e6a
SSDEEP 24576:EaR6O/IB6jokof6jBfXmr1Op5VIh7BJgqlbUcPA:EE2ao96NXmr1K5VIZBJgIbUc4
TLSH
T1DCF52AF820D2B357F3418033A64553EB21AFD00CA467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads