hxxp://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad[.]onion/post/d31502c73b53b08c83038991b9ed763b

Analysis

user interaction
yes
max time kernel
36s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion/post/d31502c73b53b08c83038991b9ed763b
Sample260507-vtlsmsby4n

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	372	firefox.exe
Token: SeDebugPrivilege	372	firefox.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe
372	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
372	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 372	2768	firefox.exe	84
PID 2768 wrote to memory of 372	2768	firefox.exe	84
PID 372 wrote to memory of 2784	372	firefox.exe	85
PID 372 wrote to memory of 2784	372	firefox.exe	85
PID 372 wrote to memory of 2784	372	firefox.exe	85
PID 372 wrote to memory of 1880	372	firefox.exe	86
PID 372 wrote to memory of 1880	372	firefox.exe	86
PID 372 wrote to memory of 1880	372	firefox.exe	86
PID 372 wrote to memory of 1880	372	firefox.exe	86
PID 372 wrote to memory of 4516	372	firefox.exe	87
PID 372 wrote to memory of 4516	372	firefox.exe	87
PID 372 wrote to memory of 4516	372	firefox.exe	87
PID 372 wrote to memory of 4516	372	firefox.exe	87
PID 372 wrote to memory of 3060	372	firefox.exe	88
PID 372 wrote to memory of 3060	372	firefox.exe	88
PID 372 wrote to memory of 3060	372	firefox.exe	88
PID 372 wrote to memory of 5068	372	firefox.exe	89
PID 372 wrote to memory of 5068	372	firefox.exe	89
PID 372 wrote to memory of 5068	372	firefox.exe	89
PID 372 wrote to memory of 5068	372	firefox.exe	89
PID 372 wrote to memory of 3488	372	firefox.exe	91
PID 372 wrote to memory of 3488	372	firefox.exe	91
PID 372 wrote to memory of 3488	372	firefox.exe	91
PID 372 wrote to memory of 3488	372	firefox.exe	91
PID 372 wrote to memory of 2300	372	firefox.exe	92
PID 372 wrote to memory of 2300	372	firefox.exe	92
PID 372 wrote to memory of 2300	372	firefox.exe	92
PID 372 wrote to memory of 2300	372	firefox.exe	92
PID 372 wrote to memory of 1972	372	firefox.exe	93
PID 372 wrote to memory of 1972	372	firefox.exe	93
PID 372 wrote to memory of 1972	372	firefox.exe	93
PID 372 wrote to memory of 1972	372	firefox.exe	93
PID 372 wrote to memory of 764	372	firefox.exe	94
PID 372 wrote to memory of 764	372	firefox.exe	94
PID 372 wrote to memory of 764	372	firefox.exe	94
PID 372 wrote to memory of 764	372	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion/post/d31502c73b53b08c83038991b9ed763b"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion/post/d31502c73b53b08c83038991b9ed763b
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {d0acc195-1867-413d-b1e4-f9866da2da6c} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {27b26cba-a52d-4754-b592-bfc3368dcf2e} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 25164 -prefMapHandle 3764 -prefMapSize 270279 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {33f0ae8b-aa86-4ef0-a878-708a18ddc623} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27276 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {424c9b73-044a-4208-9b19-99fab676ba96} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2896 -prefsLen 34775 -prefMapHandle 2900 -prefMapSize 270279 -jsInitHandle 2848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2656 -initialChannelId {ca2d3123-61e3-46a1-a8b1-45cf1ee06232} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4864 -prefsLen 34905 -prefMapHandle 4852 -prefMapSize 270279 -ipcHandle 3192 -initialChannelId {0250fd5e-cc4d-41bd-aec5-09601b1f4b13} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5068 -prefsLen 32952 -prefMapHandle 5064 -prefMapSize 270279 -jsInitHandle 5060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {4b1122ef-31ee-4e34-85b4-e0fe638e6c37} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32952 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5060 -initialChannelId {84b6378c-0892-4843-803a-7d5488dbc98e} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4608 -prefsLen 32952 -prefMapHandle 4612 -prefMapSize 270279 -jsInitHandle 4616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5444 -initialChannelId {d53bfbe5-444b-47ed-b4b3-25217cad59da} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lqvyev6p.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 10KB
SHA256 3382c96dc58791ae108a31df05d2bdb22dbd7e9c12bbf055fc4523bad5fad137
MD5 8d291e420ee3dab3763ccefa44317585
SHA1 5c0aba3633aceb4ce577c46db66c5c5969b0ec04
SHA512 bf8e4919e5602fd635de22939418d4bca006888ebc6aa514c09b8b3c6b84ae961c682d059145e6d8cc49b37e0e449b2512e3d1351c708fcb9ef9b83972439c3f
SSDEEP 192:HcypyOr4cXz5RqvAcdRPSHXFCPD1Oo1k+AFzHg3SLEE1ZMgM5S:HHMO0iO024YWzHg3SgEDMgM5S
TLSH
T147225DBF9F403CE91A12D194D8AD5219CF85F5FBEFE3801721183986CA4071978F60AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 032e6bc50221e9347889abd57fdd8ec66b88d1f1890bf1aa222da55a2e69b4a8
MD5 9f24f9fe8870236cd8b00a1a009c57c0
SHA1 322c4ab85f652cb1714fb6c5b095de0ae01b88f6
SHA512 2fc698bc118d29cdd2ee54706e42180ee408421cd3caa5ceff2214d848c00f81cd86aea3a6383731f04b7c1badaf71b4d64001a2cdb82ab763a164678e31970d
SSDEEP 96:GJFW2FcFYFsFb/dd66JozGzgClKtmc0d/UUhiMSdF95/7bkW60rcE3QiyUR6MlWG:B1d66JozGzgCl6mc0d5Ov5zbowb3zyja
TLSH
T171C1EB24E639863FC409023BCCA50B400E76359BA88E7F1936AC754D2D5B2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 d3e852ab06cdf242a710cbbec9e7841f8342f8f60d3212e2db3e43d4524473d7
MD5 995e3fa28e03ed0eec5142e2d92aae50
SHA1 b21f7d2abb6c37896f2badc03ff3d7c314e1ea04
SHA512 d77228851934f5538bce84977d4caf23f4e1b118eb5933e64f8a9131eadd7fe10b94dc96017f5fc8dbc05883c3665e80cb40e6b1cbb0abd923b7249c9aa2181e
TLSH
T12E61EC58F629863FE449413ADC921B405F347456A8AF7F2A35ACA04D1E5B3CE7ACD03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 286aba9a465c40d03a95a5f8bc8640d6cd10e94cbb444bce5f6b9d965aff725f
MD5 bbd6ebfdb5f7fbf176957f28a114330d
SHA1 13d731b8de74594f40728642859b74f0767d4f98
SHA512 7ee609f1783b0f65d7ba225d5d47792cdad9ca34c7ee4bfd5c2b69501d60ce40029c3acf50a03e570c18a6a569f79255d0d4333089e75366a337fc68a29bfb99
SSDEEP 192:COv5zboYZ3zyjjD1d66JozGzgCl6mc0dz:hboYZ3zyjtd66JozGzgC1jd
TLSH
T16AD1ED68E63D867FC419023BCCA51B400E36399AA84E3F1532AC745D2D5B2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c8927f2-218b-463e-bf3a-a821e69d3ebb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\3c8927f2-218b-463e-bf3a-a821e69d3ebb
Size 235B
SHA256 afb579554155f5ecde3cf465c125bcfe94c14957e4720506dffe1867b1ebb740
MD5 7b1edcfdf6de8dc633b16723118f56d1
SHA1 e6dfb3cfdcc8a0396ad1cbab18f70525db5cf78f
SHA512 bf20b58be9e1e1096d8f1280b56563837d4e0af65b1d5cfa513902d9917c392313625ac0eaae4d06a4fb175b16d6c9184a9850d8a46aa3e1571bc127a9c6b744
TLSH
T136D097C61C88A7FC08180F87B0E02AC231888C332074A810C9510134DAF9EC85162E6B
MD5 SHA1 SHA512 TLSH

Submit Download

46f2a5f2-0d1b-4bc0-a88b-95597f3d64ab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\46f2a5f2-0d1b-4bc0-a88b-95597f3d64ab
Size 235B
SHA256 133117ed2c110a14315deac6c620de7760dc7cdd80b21b46485b1dee7521a456
MD5 1b7bca9d3dd03b8ddf7724b70be31bcd
SHA1 80aff9482da7110d751a96d168671df4e0a5bfee
SHA512 b68f05b3befd20d8595eb128e8609c75ad52b7f3a090da32880951d44c2713c258f0f665d1bd033fe614cc178b5a352a327eaf99e96a20b96d7729e5f5daf071
TLSH
T15AD09780A4986B2D09080F12B0F068C2705C8C3350A8A8A0A9518434BEFEEC8A221807
MD5 SHA1 SHA512 TLSH

Submit Download

92074657-17c3-4118-843c-8abb1046266a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\92074657-17c3-4118-843c-8abb1046266a
Size 886B
SHA256 4ce1a8fce4001701581b6141062656a1391c4bb0e0705599ba5948a3129838da
MD5 2d5699e62a1fb2e326e93e93ca4906f8
SHA1 921157f03a517da3edc8de704132b8e39135cbcb
SHA512 1116e4cc2c3f597351d2b4b418664f4f00b72eae0f3f4f3375d4501c8f375a2c98c4073ca7b1e71b3c5adf51e5af39e4c885ed756e099e3608fdfd6a6f8d34ea
TLSH
T19C112390863CBAF39D6C925BC9E03B434BE4722390C74D047DA11B180EAF16EA357707
MD5 SHA1 SHA512 TLSH

Submit Download

b4d639f0-96cb-46be-9284-56710f80bfd5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\b4d639f0-96cb-46be-9284-56710f80bfd5
Size 16KB
SHA256 8fef073d6de057929244e4ce654f9797b0324983ac8f1b3002a31a9cb08bb672
MD5 b1b6dc4a398f73f34657fda4d8f37780
SHA1 a951b05b2b0938c3bffa733eca36ca2c07a7e937
SHA512 e6b3ca1044b6e5ae19b0710eecf9e08f490f21542663d0aecd3838f4fc0fef24396a3f25916c92937bc88b70dfcc6d36d4a48f816bdef035a7d1d64a77f20fa5
SSDEEP 192:k4jSSFy/zzai1O1XlJlNtIv4bl5ff3FByzicwCebo711hKJOSB8S1THrC4aJgLX:DSSFy/z+ikXlCnKo78OSdHrH/X
TLSH
T18C72C9162420497A8651E76999ECBFC3E5F638CB4C419FC99BF4BE082DDE09D102794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6a8757d-f2a3-434b-8439-ac30275f817b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\c6a8757d-f2a3-434b-8439-ac30275f817b
Size 2KB
SHA256 fbc9546ab73077273d3dc1fce3e6f5f45878a513297edec3279f6f233d102c4d
MD5 ed53572fca8d2bcf5710c3e02744c258
SHA1 ff342c4276653273d0a6e9ad3966ad1068a03034
SHA512 52e57f7dd46fca239aa83309da32fcd9317ff905eeac0845f0be4f0a58b2748f2ecbd345f5c8ea3e273fa85f101fa1df95428364e4e7e46958cf16d1476b2578
TLSH
T176412368357C8CBA5C8AE25DD482378E47648A0310C66C432E51DF8C8DD2A99736A52B
MD5 SHA1 SHA512 TLSH

Submit Download

d4ff3ea8-ea28-4349-b61a-b69b4de678b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\d4ff3ea8-ea28-4349-b61a-b69b4de678b6
Size 883B
SHA256 5ba884431d0a43a3f5769a3011a0ca951bdd213ed5dcfeb3492499fe21e27bd3
MD5 c991c3828dca3f4bcc1385a7da506d9d
SHA1 187685b1d79f263e46c5c250be3050f9502dc133
SHA512 268f60f3b2d79bb0c8afc732452881528dd9e83da1001da336f841a602813390f881f24266e7fa8214e99edc727759373817f211819cfcdce27cafbcf1c8dc31
TLSH
T1FB1123909678B5B3CD78924BC9653B064BE8362380C688043EB15E040DBF52EE36670B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\extensions.json
Size 16KB
SHA256 b08a800b883d36d9a2f627c52dfba3a8f529b859b332c24a47d0f4ed2aed25b3
MD5 a4641ef5d700410ebc97ee512a4aded5
SHA1 8f37e3177ac092bb6149376f569b6c09732468d8
SHA512 b16121bfc90094df08dd9837c4d6ba91282ba07f80ec9463b54fe09ef38c848e334633f6c231326a0fbf97092985f722f1ceb97f02244b8d5fd31aa180ef4483
SSDEEP 384:tkI4vPUmldvf8dhWH94z796oNL4HCL4PvL4HbL4H4L4H054hI:OI4HRfcXq4t6G4Q4r4n464c4K
TLSH
T15972421545049EB8294FA78BAA367E01C37D573B60845C78F4DD8FC802FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs-1.js
Size 7KB
SHA256 f2f99d5e13da67a688263eb77bfa78bedc33058b5be827831339d89c1daf36e3
MD5 0053ba01a220c40b5e5e52d5c7078458
SHA1 f58aea6ef60aa66a5e328cdb8bf52f88f5f27558
SHA512 04e30b5dabdec1bfd58f0a80066993a6c6e3f753adaf66653d0693ef17eb4ff7f673418a8a63e3ff2d21dc6eb662e2d945da0ed05633089f63650c0a7fcf7916
SSDEEP 96:xHsNTUxqGq7fIOpikObzSgSSl8pdv9jznEHYfYWBw887Jf8L4cnUvT:qVR7fIOpikySSGgY7Bw887Jh
TLSH
T10EF10D789508CB7F65B6776CBC6888715AB2013BB6BF28D750B944C5011CF3882F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs-1.js
Size 7KB
SHA256 75abc5a577a6c5904579f53f739576e364c181221bf96f4a7a65307daf31bcf8
MD5 0061e26ccc3e180b3e0b6b6ce9d6b684
SHA1 bd3b64165a051b3cef0312d0a719172de19b64bd
SHA512 7941f4fbae89940c75406159bbbf1358d5bd1988005eef8195657be0b0e1199d949391d14f6aa0b35d211234230b1917a85f90c8f0930b1eb6b1fee6924d5d3c
SSDEEP 96:xHsNTUxqGq7fC6ikObzSgSSl8pdv9jznEHYfYWBw88n8L4cnUvT:qVR7fC6ikySSGgY7Bw885
TLSH
T1DFE10D789518CB7F64B6776CBC6488315AB2013BB6BF28D750B944C9051CF3882F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs.js
Size 6KB
SHA256 9b482af662e36ff289d477c4537b4ac95b0538a3f245e68784d0cb324d395c11
MD5 ca59ea7f86760cc3d0e72b836553292a
SHA1 15d7d8087be637ebf4a6ce1c56e93c4b1beff7e8
SHA512 e1688a4eac158da15c050dbdb2656174b8bf5dec2bdd389b04dad353f3668fbc3159ac74b45c8726ff6997f7c32daa90f8295e8f405ca5628622954dc4a312ff
SSDEEP 96:xHsUTUxqGq7fC6KjNnjy1zSpkYSSl8pdv9jznEHYfYWBw88n8L4cnU8WT:q8R7fC66eokYSSGgY7Bw88Ws
TLSH
T1A3E12F789508CB7F74B6776CAC688831AAB2413BB7BF68D750B95485010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs.js
Size 6KB
SHA256 580cab41f0d963b895d20e1186268cf0967b9b42ea4d2d5f8cc85705f0d8f7a8
MD5 4b74fed5debd631d8439b463721613f2
SHA1 011688b408c363df17b61f7ee600d2c167726248
SHA512 b42e2910adfbed445c8f2d92fad3552975b9e3f08dd4e837a2034cb21544ee7039bc35e0e49ceace1e108a98ba4d2511e64984b8e45b88d62f179fb63a700161
SSDEEP 96:xHsUTUxqGq7fC6ik1zSgSSl8pdv9jznEHYfYWBw88n8L4cnU8WT:q8R7fC6ikZSSGgY7Bw88Ws
TLSH
T1A2E11E789508CB7F64B6776CAC6888316AB2413B77BF68D750B54485050CF3882F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 fb9872e71f0952a8161e76967b7314edc4ac6ea7f37b07d2c140230ce517d55a
MD5 80d3788ac49945d0ce683f05a1abbaee
SHA1 d37c3a18f4505e219f13f7294282b10464fb5872
SHA512 6b9f288e8dff314808118b95b6a647a63614c970f75029ff0da733d6c248ecc7192d752a7ded61a76eb010c14ff42ec92a8eed2fe2ab396f760038fc12f140d5
TLSH
T1D321CA435C6A3DF475509156E0465FF1C74A3031857064E0D15DDD42529E44CB3CA60D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads