hxxp://om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd[.]onion/r/MfelqEowpPeYhRKpAZ0T+HbGEC+sBogiWTb1zNQBs6uG0gKRS9B5+IjKK3BAtYOvY0pyjmmWfrRJJZVrph2twXRjRzY2VFoy

Analysis

user interaction
yes
max time kernel
367s
max time network
366s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd.onion/r/MfelqEowpPeYhRKpAZ0T+HbGEC+sBogiWTb1zNQBs6uG0gKRS9B5+IjKK3BAtYOvY0pyjmmWfrRJJZVrph2twXRjRzY2VFoy
Sample260423-vrr7mscs81

Score

6^/10

persistence ransomware

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 58 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000ee60b03f7e91dc0178a7072e8591dc01a7070a2e8591dc0114000000	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\List_of_leaked_files.txt:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4560	NOTEPAD.EXE
2840	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4560	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	firefox.exe
Token: SeDebugPrivilege	436	firefox.exe
Token: SeDebugPrivilege	436	firefox.exe
Token: SeDebugPrivilege	436	firefox.exe
Token: SeDebugPrivilege	436	firefox.exe
Token: SeDebugPrivilege	436	firefox.exe
Token: SeDebugPrivilege	436	firefox.exe
Token: SeDebugPrivilege	436	firefox.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
436	firefox.exe
436	firefox.exe
436	firefox.exe
436	firefox.exe
436	firefox.exe
436	firefox.exe
436	firefox.exe
436	firefox.exe
436	firefox.exe
4560	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
436	firefox.exe
436	firefox.exe
436	firefox.exe
436	firefox.exe
4560	NOTEPAD.EXE
4560	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 436	1372	firefox.exe	83
PID 1372 wrote to memory of 436	1372	firefox.exe	83
PID 436 wrote to memory of 2280	436	firefox.exe	84
PID 436 wrote to memory of 2280	436	firefox.exe	84
PID 436 wrote to memory of 2280	436	firefox.exe	84
PID 436 wrote to memory of 5276	436	firefox.exe	85
PID 436 wrote to memory of 5276	436	firefox.exe	85
PID 436 wrote to memory of 5276	436	firefox.exe	85
PID 436 wrote to memory of 5276	436	firefox.exe	85
PID 436 wrote to memory of 872	436	firefox.exe	86
PID 436 wrote to memory of 872	436	firefox.exe	86
PID 436 wrote to memory of 872	436	firefox.exe	86
PID 436 wrote to memory of 872	436	firefox.exe	86
PID 436 wrote to memory of 2096	436	firefox.exe	87
PID 436 wrote to memory of 2096	436	firefox.exe	87
PID 436 wrote to memory of 2096	436	firefox.exe	87
PID 436 wrote to memory of 2228	436	firefox.exe	88
PID 436 wrote to memory of 2228	436	firefox.exe	88
PID 436 wrote to memory of 2228	436	firefox.exe	88
PID 436 wrote to memory of 2228	436	firefox.exe	88
PID 436 wrote to memory of 5556	436	firefox.exe	89
PID 436 wrote to memory of 5556	436	firefox.exe	89
PID 436 wrote to memory of 5556	436	firefox.exe	89
PID 436 wrote to memory of 5556	436	firefox.exe	89
PID 436 wrote to memory of 2976	436	firefox.exe	90
PID 436 wrote to memory of 2976	436	firefox.exe	90
PID 436 wrote to memory of 2976	436	firefox.exe	90
PID 436 wrote to memory of 2976	436	firefox.exe	90
PID 436 wrote to memory of 3928	436	firefox.exe	91
PID 436 wrote to memory of 3928	436	firefox.exe	91
PID 436 wrote to memory of 3928	436	firefox.exe	91
PID 436 wrote to memory of 3928	436	firefox.exe	91
PID 436 wrote to memory of 5656	436	firefox.exe	92
PID 436 wrote to memory of 5656	436	firefox.exe	92
PID 436 wrote to memory of 5656	436	firefox.exe	92
PID 436 wrote to memory of 5656	436	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd.onion/r/MfelqEowpPeYhRKpAZ0T+HbGEC+sBogiWTb1zNQBs6uG0gKRS9B5+IjKK3BAtYOvY0pyjmmWfrRJJZVrph2twXRjRzY2VFoy"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd.onion/r/MfelqEowpPeYhRKpAZ0T+HbGEC+sBogiWTb1zNQBs6uG0gKRS9B5+IjKK3BAtYOvY0pyjmmWfrRJJZVrph2twXRjRzY2VFoy
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {d0a7b997-5b8f-4f6a-884d-f2242bca54c7} -parentPid 436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.436" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2492 -prefsLen 27135 -prefMapHandle 2496 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {d14bfba7-9bf2-4e6d-a737-d50256eb1f7e} -parentPid 436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 25164 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {f152bc3e-7771-4b9c-ac8c-2f153cbd8998} -parentPid 436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27276 -prefMapHandle 3976 -prefMapSize 270279 -ipcHandle 4060 -initialChannelId {63bfdfb6-017f-42a0-952e-67591b73940e} -parentPid 436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.436" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3020 -prefsLen 34775 -prefMapHandle 3176 -prefMapSize 270279 -jsInitHandle 3356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3004 -initialChannelId {b536eafd-6172-46c4-85d2-97e024a35721} -parentPid 436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4796 -prefsLen 34905 -prefMapHandle 4800 -prefMapSize 270279 -ipcHandle 4724 -initialChannelId {addc1b04-949f-4d54-90fc-a4190870540d} -parentPid 436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32952 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5188 -initialChannelId {097ae9fa-d6d5-4c11-aac3-b4c4e7911948} -parentPid 436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32952 -prefMapHandle 5216 -prefMapSize 270279 -jsInitHandle 5204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5308 -initialChannelId {75260d57-115f-4ddc-8415-d6d766ba0e8e} -parentPid 436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5548 -prefsLen 32952 -prefMapHandle 5552 -prefMapSize 270279 -jsInitHandle 5556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5564 -initialChannelId {2c1c06d3-cb2f-4f06-9e35-dee1e2ae2374} -parentPid 436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5656

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\List_of_leaked_files.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2164

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Marnell.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uqk3a6df.default-release\activity-stream.contile.json
Size 4KB
SHA256 93982695f4f461a788b66cd5eaf6bd9f0159993956a0ab71baf59420c383f6d6
MD5 fe03a025c674f1831f06d310600f14d1
SHA1 5c04fd48f466ee09fa6ed79e8d76020ef999ed43
SHA512 753081d0206623e01f2401c62977a8b9024095b3417da17dcabd065c9897769a61c74281a12c0470e26fe58907e18471aabb71cd2af8cbce3e8bbe856e9576ed
SSDEEP 96:GitmtawxFeIbjKYXfmfO2Fc6DA+tNMF4mmouSqV6B5oG:G3tawGIbrfmHFcwA+tw4mmoeaoG
TLSH
T1E5A129EF9414C88723227BF13C8F13BEB146718B67DADA42F664CD01F0AA71681AA4C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8D75A7DD5A6BE326C036B3541C45E58BD3FD676F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uqk3a6df.default-release\cache2\entries\8D75A7DD5A6BE326C036B3541C45E58BD3FD676F
Size 10KB
SHA256 a6b6a23971f83a1eb74bde086f99402004a0cb243c8d3687d168aa8640f39feb
MD5 b97a60556986d4243acc09fa4494c754
SHA1 3df7102b84f5f404c59e5e44c0fb2c5b89662201
SHA512 db5399064c48c4c3defaee89e8a5f0ff9d37f788b6115a8908437126adb1c614ea3716ba4376d050de5f7cb651394b3dbfffd980f9af0991a583eff91169bcdb
SSDEEP 192:HcwI5XRhitcXz5RqvAcdRPSHXFCPD1Oo1DQQGmTZQv/GDtR7GmTAxVN1UYF4YFX:HRDiO024Y1GsZQv/OGsAxzWYuYR
TLSH
T142225CBF9F113CE82E13E0C4C9A9861D8E08D5FBEEE7504B21183854C684365B1F94AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C5EF9A28D3373934AEBF7A32C5E75F5FB30B331B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uqk3a6df.default-release\cache2\entries\C5EF9A28D3373934AEBF7A32C5E75F5FB30B331B
Size 216KB
SHA256 fffea80dcd99aabf374af18240e100ab78cbd0985acd2e3db6d24ed993b76328
MD5 13eacce71313f65618827a2106e2dce0
SHA1 9d0bdd4b94499a95404ddf0ddef33eb6cec09075
SHA512 d27aea14c0083518ab584a6703a08347d40f37b74bdaf13773a79d2823e88ae5e879e9de7b1f137600d3bfc6a2ef6fa7bbfb94ebf2880de04ec1d82aa19acf18
SSDEEP 6144:6/n2u5BHYJVxtx5LRv7W7H9YtzvHRvLw4BEMp:6/EJV/Rv67H9Yt7Zsmz
TLSH
T1642413FD8ACA821E6F2344605D51C34171276A87436EEB5EEE8D258821E7878B3129E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uqk3a6df.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 10KB
SHA256 074b72daf84528bf24794cfe07f05c63738b2f1e37cbf4a0243be8f6e25d0136
MD5 49af316e99db66ff0d6d9479e76c70ab
SHA1 33ee1b11780260d402b06e882d8f89a15748e7e1
SHA512 09c37a918b1ee73443df97d13b24ec758f6ac7f2c352adcf142b81bd229a9cba809ccfc0e31238bea900449659871367cc78fcb4f03bbda8b93a3943a43e6769
SSDEEP 192:Hc6poFrLcXz5RqvAcdRPSHXFCPD1Oo1pMQQGmTZQv/GDtR7GmTAxVN1vjqjM:HbaFrLiO024YaGsZQv/OGsAxzJWY
TLSH
T1E2224CBFAE413CE82E5790D4C9A9C219CE4895FBEAF3901615183D45C680369B1F909F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5VKIBAIWXYDWZPNNE3M0.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5VKIBAIWXYDWZPNNE3M0.temp
Size 11KB
SHA256 2b21b467f5395f4876c2628888e5a835e97998c4f9d4ac3128f454f21cf5fbbf
MD5 ed86cc8c11a4ac7967ef772a3723fb69
SHA1 47b4c609ad9472208a58319d9f8fa4bad0bb20aa
SHA512 8cccadbb520bb011519155f4d28170e5a92a6626d51fd6acec174d09dd2b26117ceac423634684598cf42d85cdf83495e2a16ffba0c9325da7a9becbf13edcf6
SSDEEP 96:XmIc/7I1+/LIFwu0RjK2jCII1Su0RjK2jCGI1lu8vRjK2jCEIrJ:XCH/+wZe2oSZe2Olje26
TLSH
T1763200021BF70D96F5F386317A717BA39777FA01970B466E808113454A723A085ADFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 041d294a77efff790e5621313337c9d0892cdb942255206dad3e0940bdd46ac1
MD5 ee70f48dbe87bbe1a313149ed16fb583
SHA1 94584b9f7e5606203e43e79be8369a82fd582bf0
SHA512 a25baa621f79e7c059ae6871bac29bed840d7c1cef71a262766f5dec9d6342676efc65c4b191b76eafe08ea923089aae2066b82e16ea2221ed681b0fb51039e5
SSDEEP 192:YI1d66JozGzgCl6mc0d3Ov5zbowbR4yjsC:Yid66JozGzgC1jibowbR4yj
TLSH
T1E0D10E29E239463BC848023BDDA61B400F763956E89E3F1935DC645C2D5B2CEB78E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 cc4def87fef0ecb9592c04bed249de2367c07d6971d3a070ff7c94600aaab87e
MD5 80099be076e599e12230b68fe81afe59
SHA1 62ba345755471ee2b6b18061a635a0db5b96020a
SHA512 69ea8b8516b6a2d5b8130d86bb2a83e9e00279d5b681f8c6c50a6c5c670a00b112a13f56f5ed6538ab75237291700495001befdac21d1a519051fd6f18f39388
SSDEEP 192:YI1d66JozGzgCl6mc0dfOv5zboPiZR4yjsI:Yid66JozGzgC1jmboqZR4yjL
TLSH
T1E3D1FF28E229453BC418023BDDA61B400F76389AD89E3F1975DC745D2D572CEBB8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
Size 57KB
SHA256 6fbd230857d68921cb269f379da6c3db4d1ec5b519cad6f5924e20bd53c950e0
MD5 403076cb94a53fe53c13c01f227c817a
SHA1 63738f9374a6103d04cb024e74c38a9ff5e63428
SHA512 47ef231c8f4c098242d64bb46bda5b6aee7831b9ff37ba48dbdd7793ae4b4836a1ad00ba8c584c77eeef17a80b9031d3ef076083d8d311f6075eddc43710125b
SSDEEP 1536:YLPnWES6b7D6ENqHHd/84+rHdaBXBkDANDVof3+nHQxzN:8vWESWPlOHdU4EHId22omwx5
TLSH
T1BE432245EB1E553FD82802BA9CD61B007F79F8895A0A2F673B1C54782C872DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
Size 57KB
SHA256 4052e01c82a8f6e06b4a39e3e814e89e41f14fefd8f0e0e3d0ad129163a2af57
MD5 9b29808bab3c193c304755ba623cc474
SHA1 ac898d757886e6f2a2c8ed27b1b718db3dd132a4
SHA512 84eb703ea3b95629c8cf98e377d94a93450fc0a7bb2b47e9d3b3735564cd02776fcb5d6508a952d30289e3a47ab27ffb54c3c65d4906563a28c25457e44cce11
SSDEEP 1536:bCPnWES6b7D6ENqHHd/84+rHdaBXBkDANDVof3+nHQxzN:evWESWPlOHdU4EHId22omwx5
TLSH
T1AF432245EB1E553FD82802BA9CD61B007F79F8895A0A2F673B1C54782C872DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
Size 57KB
SHA256 35401516d389b80a40fee56c6baad089a4a2c6f1a713977645b66f16abea17b0
MD5 73986f19fc9970b407594845b07f22ab
SHA1 b2b0a0286eb1c612596bcd67d95e1319bf28f430
SHA512 982acea5de726e8c18ae9ce9c1ab5e3c48301b6a9938d8ac23b6e15cedbaf0ebf1c935d7fa9055f6f9a598790ef61865c0bb2ff6924061ca9a6dcef152b88469
SSDEEP 1536:2PnWES6b7D6ENqHHd/84+rHdaBXBkDANDVof3+nHQxzZj:2vWESWPlOHdU4EHId22omwx5
TLSH
T14E432245EB1E553FD82802BA9CD61B007F79F8895A0A2F673B1C54782C872DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 6b2c3b332b8b228c4e799c598f01c5e972c51f63d4bfc58b4807d67c79ee035f
MD5 622779d8f1699eab3b4b04e59078c33f
SHA1 9c6448264b75a7673742b356254026bf3c77c97d
SHA512 d495bb7e90cf8376e35a12dce9bf6e9d21a4e14d4ccaa0c70f782e8bf40adefb887c44c4cc5b7509eb478739183a3e62cf7f60507f2e3b2cc379b399f6edb9f7
TLSH
T12761C958F2298A3FE445413ACC921B411F347452E8AE7F2A35ACA08D1E5B3CD76CD57D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\events\events
Size 1KB
SHA256 a8a452029a54171578b81d957bc93c9fe68492f9e784b3f475268ca911f8308b
MD5 2a3305256bc9aa4c4c682ef43cfe6d9c
SHA1 f9e62c11e2232eae305668576cb620be02e6ed3d
SHA512 ae4d2af636a0b6379fbf00062e20c4a43c94e10b7d00b36144ea8c3a8d6f0697f0978cb4e31618839268052925fb3f0030d7b2a4a1298fe885b2c238135524ed
TLSH
T1D4219D4C39B94D6A7CD7E6DC7441078EAB844D0E18871C434E02DE8CCDC5ED931AA83D
MD5 SHA1 SHA512 TLSH

Submit Download

a9bc06cc-113c-4b0c-8791-9830292db7a5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\a9bc06cc-113c-4b0c-8791-9830292db7a5
Size 883B
SHA256 c7ea8d838a750485aa6877209a491a88f8d1228afbc5f76f59b40a641e5ffa09
MD5 16d382a3345bea326cefaba7b34b269c
SHA1 0bd5977c9db3d574e631e98e72c0770e1555a182
SHA512 b8024e524fc5efadfd48186d5fb9fe5e6ece7e871d306341f35cf9d1f25a35b20f980cb572671f1da44166ede770a0ccdccefa39275446f0087a1a8dba85b0ea
TLSH
T19511C041923979B28D78C29BC5A537424BE87423C0C954187EF15A180D7E55EE3AA347
MD5 SHA1 SHA512 TLSH

Submit Download

b9d44bd4-6dea-437f-8081-48cc2a6bd7ee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\b9d44bd4-6dea-437f-8081-48cc2a6bd7ee
Size 886B
SHA256 2ebe2d2932a69058c8538efbd9270813374c9160435f2062bf1ed1715592abc9
MD5 7d5e297fce38e75ced7b1e301791a233
SHA1 eadffbbff8665174d3e1508436bee2ac6c4f2624
SHA512 6fe6705e09fb7ff49608eaa881d678cd0f2075ffaff673e8dd885e22d31a36f3c1aba2e8a67ac73a850362f0d54027ffe866dfc8dc3b801d0d67cdc93d833b35
TLSH
T183112741856579B38C6DD29BD5F137424BE47523D0C9180CBED55B184DAB04EE35F307
MD5 SHA1 SHA512 TLSH

Submit Download

c21c4524-b08b-4ac5-afb6-e083a920d028

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\c21c4524-b08b-4ac5-afb6-e083a920d028
Size 235B
SHA256 6740df9c96085831e526e06c1563ddcafa67165fed3f9b9ed62fdaca0e3878a0
MD5 921b0ab1c88cee9fb056342aeba61a59
SHA1 adf1dd296898a948724b34170b373f2248bb4883
SHA512 ae562b8cf8a7b9dc4e04ca795ab090f37c8b19545efe582c9dfb66464033d11174cb51a9bdeb5613066821195d4791da2fce3e636664b65b89770844c8c3bf86
TLSH
T121D0A78D58E8A76D88144F0BF4F069D670948C3718B468509BA15974DEFADCE425289A
MD5 SHA1 SHA512 TLSH

Submit Download

c7dc4f14-1e0f-4020-a5d6-4be480f3854d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\c7dc4f14-1e0f-4020-a5d6-4be480f3854d
Size 2KB
SHA256 90c753ce025b4ab00ee14451f34098a2b6f2c50b5e07f548677697469aef9629
MD5 4d0f3c67290e74020432ca95834e1ade
SHA1 735a06eafd332211a1b5b6e8a602fa4d3740ca8d
SHA512 0e15a60c392ff997790f9e1d9e11a92c1a7d92e4be0d8c6b733f375865aa11fd309f382dd60be739054b0dd6d91f474ca4a4d5ac5e60380816a25546b9aa0a3a
TLSH
T12F41316C35784CFB4CDAE54DE091338E53748A1750C62D836E52DE0C8C966DEB36E52B
MD5 SHA1 SHA512 TLSH

Submit Download

eef49cfe-03b3-4e3c-8a09-91746db67573

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\eef49cfe-03b3-4e3c-8a09-91746db67573
Size 16KB
SHA256 fa1801b7b4b5bcc179f5df8592f33cd075b48254773b657149a207f0a0478c4b
MD5 229fceaca4a934417f0c17e2f15f1fef
SHA1 3761c4f781057f90223f17c448899cc1f8b17f32
SHA512 9a9c0ff6f7ecd8f8a6133aa21e814c9ff905297739f7cf03062997ac7e2b64a37095d3d4a5e7511c7d49102d1bf7a9b78c43379b10c2b513b9173b9bc8617008
SSDEEP 192:kMJqjqoKHnHaMt62018IB8rHmxn9bNC9T2icnDfootXKVxQtIayEKeb13OBIj7uy:kPj5KHv62OaH0nlJfokjVyBRx+cacY
TLSH
T15572D95A1830497A8291E76895FC7FC3F6F528CB4C419FCD9BE4BE082DDA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6baaa40-73de-4012-b2e8-3f95556c8128

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\f6baaa40-73de-4012-b2e8-3f95556c8128
Size 235B
SHA256 0b971574d5feb5b06fa6259bcac8ea0a7e0ff52924cdb1013b1e9743cc496196
MD5 09b1296037817c3ef27984aa9762a42e
SHA1 55d0c87674ed3a5a19c339c37fccad0251a29eb5
SHA512 89d3c007530ff571bf63e50e505a63018136925b0c348532490f944e2e1a8e80854bddaf9f302796b280088a0781b54f68f595df1422225b663b686765031343
TLSH
T11CD0978424D8B39C88000F03F0E028C2308C4C3314A19820D6610678AEF9DD4022D80A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\extensions.json
Size 16KB
SHA256 468572d99b1f9d8aafd4c1bae1d9f8a84c857bfb2a5bfd2fd1a279f3cfd2f001
MD5 62f4716b3a4174b79d38981f6e82aea6
SHA1 cafb616607e4f62e79855361c0b35f207c3c534e
SHA512 56fb9dfeac500c4c723fe12edcbecf37d793be6e9646a13154fa1197f616a5ac013e72629a9dbb6b3b4e793d5873855387bff37528e58e1ca6eab9b07b6ef53f
SSDEEP 384:L+kI4vmUmldvV8dhWHW94zc96oML4HLL4PSL4HSL4HlL4Hl6GD4hW:LxI4ORfGXK04k6x434o4A4l474k
TLSH
T1B072321545049EB8294FA79BAA367E01C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs-1.js
Size 7KB
SHA256 e65c5b718236755f534d7e5c7401c40d3f4d978c64a8c4c03109c508643c7725
MD5 c2b0e5cc180011dfd5f72c23cd722194
SHA1 07b3a8544042d5087c7c62b7c5fc2f9277767881
SHA512 c902265bc5141c8578802d5c973b9f07dd4bd14be7fbcbe2ff21b4cc634872965a265978c4c84a7ebd1ecfe8537fd8e5333ba480b88e63e7bb8a4b32e40b95da
SSDEEP 192:4rN4J0oAKbR0fj9lmZSxBoSSG0RCceGliBw88C:Y4J0oAN7y00RhlwwS
TLSH
T135F1FD785404CB6F74B676ACAC684D705AB2013BBAFF6CC760BA54850518F3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs.js
Size 6KB
SHA256 865d5538936bf9899af0e848c4ea9fa54ef78ace687f0b8a1de8eb35084e63db
MD5 b648b549aaea85966bc70dd951dd2a48
SHA1 287df92c93f244fd735387fdd67871e742d8f970
SHA512 9785336c4d70da0c4edcc612abfcbc1983997eda4fed1cf411c68a296e2faef88c4482b80c92c3ecde477b0616241ad06a6da9683e8812452173d68b7303a754
SSDEEP 96:xHSrUTU5QqGq0fCkKjanjLM1zSpg0zSSl8pdv9jRn1HacetBw88n8L4cn48gmg:4rJbR0fCk13Mog0zSSGFacetBw88yi
TLSH
T182E12E7890188F6F74B6776CAC688C716AB2413BB7BF68C750B69484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs.js
Size 6KB
SHA256 b9a5a5f10f02808846a7f9dc31997e0b2e0e7d121de52c7b88a51d239979bf96
MD5 0310f1593fdbb50eaaaa52db3d86c041
SHA1 8fd2b60004f0b86c18523e77c74a749fd8847053
SHA512 1190278d584216328a2f59401f58b8ff1aacdb921763d739e93953914c8e6796dc7c2ad7c087dcc804fc42fb5dec4c49dd67036c708411d589a157f7f6375f15
SSDEEP 96:xHSrUTU5QqGq0fCkSx1zSrEFSSl8pdv9jRn1HacetBw88n8L4cn48gmg:4rJbR0fCkSxyoSSGFacetBw88yi
TLSH
T1AEE12F7890188B6F78B6776CAC688C706AB2413BB7BF68C750B65485051CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 64fea7f9f7ee5826edccb5a925908e5a16a9536e06fa5339ea34850e248ce2ec
MD5 98acf83ffc0d1b7ddb1cbbf714a2a1a8
SHA1 491bcf85de8c58f221d5cbc99ac1749d6403eb12
SHA512 c41bff4d9111ae19bbc1eacedd43488de5e8f7316ed6044bbbe2ea30a5f1e4d592784df8aa7f2609b59e80f4b03eb42249619d7b18730c54efb31248f435252e
TLSH
T191311B8B354F3DA0BD52C6DDD4808FE29B5F303543764810904E9F08E98BC6B324795D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 0464ee5c601165e5d68702cd8f2ef99b314bb99e2d8a7bbb44a2cc50befd5a02
MD5 c55ae47185394fbb3efeb010540ec90b
SHA1 3927fb71856af65d9c3c787bdc7e20ab0e253d94
SHA512 a6dcf4d9830aedf120405534ea85847bc87d957d32f94530b8fd7b6c0c5aa736ad074e3356236898b04f649cc3fa8fc8c37437f500f6517dae8ea1ace3995e56
TLSH
T18831E9972A4F3D90BE56C6E990C18BF2975A70318776C820854E5B149D8B8AB238B69C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 2c4eda7365694856fc798bbc1e1a4f2b5c6c2348db050067efdd4fd5623c1000
MD5 aa1e628b640cbbf782725332b5f28f3a
SHA1 c18e2bcf7e9d0ab5b846089407b9271da5c6d0d4
SHA512 9285b259776c8f6b611396a0367a8af891993f0e37f1655d47a0bb6a4b6362f05ae6946f4a170139993010666b7df330854a71504a564249fb37f4b84286bcba
TLSH
T18431E94B295F3DD1BE52C6EA94808FE2975F703147B58850854EAB10C89786B338696D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 602de0720b26bbebd61378d0edffd94ecfebb75de3e9ce72f9485d71922ca28b
MD5 607e7b5ad84b8caa9e1fcc794bc14061
SHA1 4901fedf6f36430cb665a6bed827a7d335c42eee
SHA512 16961baf6f2b3b3559d3c2d148f6c8f801d97c07cc0ca50cef1ba98be2938aece18d90593980bf2fa69c94d757330775671e5b3cfe4c91858f05ea85fa64163e
TLSH
T1FB31E94B2D4B3DD1BE52C6DA94C08FE2979B703547B58810858E9F10C99B86B328796D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 b3cd55dbc8c82580851c1bf1361bb9e3d651e70ae14df3577693501701473249
MD5 c139d4ec0e8250082a50b9cbc3dd76d9
SHA1 ae4e71dfac1913b80fd574b75447518077f6728e
SHA512 d8f2c9e268e642ce3324140bc40e9b646a95599717adc8f69ab17201c7269161a06289569b43909b305df08ec39c60f91531ec41e584bad8f2c83468c6384297
TLSH
T13B515E5336CABDD1ACA0835578DC4FE7DB9B203D81B70450957D9A3C06CA175A28370D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 aeab95552ffa40bfc1968b9dca83feb422bdb9a5c1208fb5828e23e06286274e
MD5 afbfbe5d94eecffd6a9c37f563a33935
SHA1 c5a3e709a1dca68e859bc27bd02c72635d9d2b81
SHA512 48f80eb7786465081e6ba957752a2b7aca788789194e6a8b51e0fc62c554580a32b9686d91ef7e5519ec9e09b061d08d4ba96f150838a9939042f1e4392a5e48
TLSH
T1F1514C932ECBBDE1B9D0838174D80BDBDA97203D85B74051595DD63846CA2B6D283A4E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 9435bfbf3429c569a595eb19ff03430f04b74d388f0e5bf0eec5556b8c17fea0
MD5 780e26a199c9de345f002964d6426925
SHA1 3fb5b389ad83784a0d3872e40230023e1345786c
SHA512 43bb8ffe2fa9d921181ce6794e104ba037943c882a7447c0e2e90f888df32bb74d75df2d48d3222162a33da5895845b539930e0a16fe8173878ce512fb4ed77f
TLSH
T1ED31194B290F3DA0BE12C6EAD4808FF2975B303147B94810848E9F00C89746A338656C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 16b1970fdeff091736d4f08c5ca6b96a8e3578e98212754a490827125417ca6a
MD5 03088ac3ade5dedbc6cb70fd48fa0093
SHA1 d3cdd09bd87bfa207fdd35dd126f13a6d1a600b9
SHA512 800a93311b003a1d936407ca1bc6126f34be5602becbd6964da4c3fd78e78194057cafd0d5412013e125aafe2f632370f7d9a44de27a9181b0d54950bf83e018
TLSH
T1F3514C533ACABDD1E9A0836578E84FE7DB9B203985B70450957D9A2802CA175A28370D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 3063911a9fd71e397b334f3bb1c4a4020795b1a5fb1c1dc34bfb96ac84e1040e
MD5 57d9346ac3a46a1fe7ffa11c32dd5e35
SHA1 d504bd07b58b266de527aee9495ed36975bbde67
SHA512 f23715f78de845d483d572db7ccc9f12c0eadd3dae9723b64a6d0304f1668435c28864c501088600c7e151f64cbcd31fab5f2f2b07cac40f1d4d024f5c05b113
SSDEEP 49152:0OkYRVaAIoW8zN6wliOAmlxFD2ORasiu1wBMfJu6tlPAuYzA6V3ik7k0pL09TzHX:4nbwpzHyZ92bpiu5nv
TLSH
T1A3565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2164-997-0x000002B998DF0000-0x000002B998F05000-memory.dmp

Download

memory/4560-960-0x000001EBD4B30000-0x000001EBD4CD1000-memory.dmp

Download

memory/4560-968-0x000001EBD4B30000-0x000001EBD4CD1000-memory.dmp

Download

memory/4560-992-0x000001EBD4B30000-0x000001EBD4CD1000-memory.dmp

Download

memory/4560-993-0x000001EBD4B30000-0x000001EBD4CD1000-memory.dmp

Download

memory/4560-995-0x000001EBD4B30000-0x000001EBD4CD1000-memory.dmp

Download

memory/4560-996-0x000001EBD4B30000-0x000001EBD4CD1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads