hxxp://shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd[.]onion/

Analysis

user interaction
yes
max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2026, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion/
Sample260508-jkhh3set5x

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5596	firefox.exe
Token: SeDebugPrivilege	5596	firefox.exe
Token: SeDebugPrivilege	5596	firefox.exe
Token: SeDebugPrivilege	5596	firefox.exe
Token: SeDebugPrivilege	5596	firefox.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5596	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 5596	376	firefox.exe	84
PID 376 wrote to memory of 5596	376	firefox.exe	84
PID 5596 wrote to memory of 2296	5596	firefox.exe	85
PID 5596 wrote to memory of 2296	5596	firefox.exe	85
PID 5596 wrote to memory of 2296	5596	firefox.exe	85
PID 5596 wrote to memory of 2864	5596	firefox.exe	86
PID 5596 wrote to memory of 2864	5596	firefox.exe	86
PID 5596 wrote to memory of 2864	5596	firefox.exe	86
PID 5596 wrote to memory of 2864	5596	firefox.exe	86
PID 5596 wrote to memory of 4736	5596	firefox.exe	87
PID 5596 wrote to memory of 4736	5596	firefox.exe	87
PID 5596 wrote to memory of 4736	5596	firefox.exe	87
PID 5596 wrote to memory of 4736	5596	firefox.exe	87
PID 5596 wrote to memory of 4852	5596	firefox.exe	88
PID 5596 wrote to memory of 4852	5596	firefox.exe	88
PID 5596 wrote to memory of 4852	5596	firefox.exe	88
PID 5596 wrote to memory of 1660	5596	firefox.exe	89
PID 5596 wrote to memory of 1660	5596	firefox.exe	89
PID 5596 wrote to memory of 1660	5596	firefox.exe	89
PID 5596 wrote to memory of 1660	5596	firefox.exe	89
PID 5596 wrote to memory of 5772	5596	firefox.exe	90
PID 5596 wrote to memory of 5772	5596	firefox.exe	90
PID 5596 wrote to memory of 5772	5596	firefox.exe	90
PID 5596 wrote to memory of 5772	5596	firefox.exe	90
PID 5596 wrote to memory of 5920	5596	firefox.exe	91
PID 5596 wrote to memory of 5920	5596	firefox.exe	91
PID 5596 wrote to memory of 5920	5596	firefox.exe	91
PID 5596 wrote to memory of 5920	5596	firefox.exe	91
PID 5596 wrote to memory of 5428	5596	firefox.exe	92
PID 5596 wrote to memory of 5428	5596	firefox.exe	92
PID 5596 wrote to memory of 5428	5596	firefox.exe	92
PID 5596 wrote to memory of 5428	5596	firefox.exe	92
PID 5596 wrote to memory of 2000	5596	firefox.exe	93
PID 5596 wrote to memory of 2000	5596	firefox.exe	93
PID 5596 wrote to memory of 2000	5596	firefox.exe	93
PID 5596 wrote to memory of 2000	5596	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion/"
1⤵
- Suspicious use of WriteProcessMemory
PID:376
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion/
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {c9b1d29b-20db-4789-896e-05028ac0bc2f} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2472 -prefsLen 27135 -prefMapHandle 2476 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {59747bcc-d28c-4970-a688-b9f1a2f6f845} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3888 -prefsLen 25164 -prefMapHandle 3892 -prefMapSize 270279 -jsInitHandle 3896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3904 -initialChannelId {66f22fb6-38d4-4b50-b474-b98829846615} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4048 -prefsLen 27276 -prefMapHandle 4052 -prefMapSize 270279 -ipcHandle 4140 -initialChannelId {fc1e7e29-e886-4a0c-9205-f1009f7f0061} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3228 -prefsLen 34775 -prefMapHandle 3116 -prefMapSize 270279 -jsInitHandle 3216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3000 -initialChannelId {30fd8b37-c695-4a95-92fd-2eca7056d2b2} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4880 -prefsLen 34905 -prefMapHandle 4884 -prefMapSize 270279 -ipcHandle 4892 -initialChannelId {2b55f80c-d1f1-4d2f-b3b8-e3cf5da1d517} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2832 -prefsLen 32845 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 4624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5292 -initialChannelId {52074f56-4a72-4a76-8ded-0e60cdfb4809} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5324 -prefsLen 32845 -prefMapHandle 3024 -prefMapSize 270279 -jsInitHandle 5412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {bb8fefb2-4b17-4b0c-a803-dbd6d81ed1cf} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5672 -prefsLen 32845 -prefMapHandle 5676 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5508 -initialChannelId {80ad2ee2-1c14-45b9-96c3-d4b35cabfe4d} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2j5er2dg.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 10KB
SHA256 b4cbdee8588d3373dbd0e9d127b01156f9895e2a27e3a8c1871fac998d34f7ad
MD5 0c22e9a2e055efe6ee8e2561c06650fe
SHA1 3f05f6ed72448f178c6dca3e42628371b8b1f95e
SHA512 c0b810abb29d2cbf4a85f7647313f27bbe09fd71928952eef1e87b2cdcc246fc2f549434bb60f1daee2616326376c7acc1adea53ea8677976c48727b5b95c79d
SSDEEP 192:HcypyOr4cXz5RqvAcdRPSHXFCPD1Oo1dZYuPs6+MkdNoYUfyy+aH1uZzZ0:HHMO0iO024YlZ+XdCU6UZzZ0
TLSH
T121225CFB9F203CE52A03D094CDBAC349CE46F1BFEEE74016651C2855C28476568EA4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23628ebf-d39b-4ad3-8a63-51521046acaf.zip

Path C:\Users\Admin\AppData\Local\Temp\23628ebf-d39b-4ad3-8a63-51521046acaf.zip
Size 3.8MB
SHA256 6ae235b8ff5729383d3cf219320341b1456ad9c47696a519535abde34bc06004
MD5 22d280b2b7cf41f372676e1ad87a2788
SHA1 c191fa824f41a7785a4e4423e3bb19debeb9fe76
SHA512 0dcee546cd38ec992b9d4b722c96e5c20d42ec3efdf4c48b865ef1002662e6ddd274fcf259649fda5d9516e567c041e36b8bda2723a9eec852738708ec15043c
SSDEEP 49152:5trtdv2tUMTenCTqL2NQTpkMXjumT8XwQzqiUlUsPPMLvzhOF3myTIvIeOX2hxNr:5tr1C4FtkMp89JUlUEPMZOPTLmhxNsK
TLSH
T19A06E135F67C9708CDCF83BA810E2FD29C4C5F6680D8A57B6A6AA5715CA31E21F448CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 18.9MB
SHA256 92ac4503d850d61341c2b89b0ca25ae45a875f85e7ab7018354cef9a0b37bba7
MD5 ca2e152cdecfec8997a5467b9c3ce569
SHA1 abfefa098053f20577c867069ee2fa02c768c907
SHA512 7b07d200b5a5dfa88e22cc293be9f9fe0f26e3b927ca0222958c08db650590907bba852083562577b49f58edae676594ba4a1d8163bf07f102311a77694c0c8e
SSDEEP 393216:YD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5o:rGD+l8VmuZ/S24/junfSFwUqYg4z
TLSH
T18B17E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 3120dd5da49e4a5b9da17007a85eaac6b602f8192eace9783c39088924db33a8
MD5 7b0bcd61c123517628c76008e0e3e6e5
SHA1 2bac067cc0e8bdfe120369d7f2365a7c2bf14810
SHA512 88557ac23c715eb2db2535d699a252c32e0385e0a27585b64f1daa6d2833b70ba44b554bf4c5fba0c96112e85ec77d8d426732d77c36f23d629c3ef966a31038
SSDEEP 384:TcCEsYpzOX0fGcmhu9RtOldKP5aKPbVbvvUboKXCyjBd66JozGzgC1bd:TcSYdfGcmhu9fO7KP5aKPbVbnc+pEv
TLSH
T1B7C2FF44EB2A913FC41913BBDCA507002F79B88A58092F673A8D646C6C972DC3D9E47F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 4a6ca552fa3f4bf5cec261daea86ac2deb0c7dea53edd9c7d9190d39abd2c42b
MD5 4bded3f22226b6a071465b94c5520045
SHA1 01eef9b01d7b01cad8694ca0371244d37ccbd8ec
SHA512 f06cb5ce8c36f7a7ab7b6a424b9a3b1874fc296302ea5a7454f2f4f361e1e0bbd9dad49c5bcda4a66962feb52f46c91f6f4b3663a276c1cd49135b326f5a8736
SSDEEP 96:ZwHWFeFSF9/dd66JozGzgClKtmSSd/UU/TBSdF95/7bkW60rcEXedyUR6KKWZ:11d66JozGzgCl6mSSdzOv5zbowbXCyj
TLSH
T132C1FC64E638863FC458023BCCB51B400E76399B984E7F2532DD641C2D6B2EE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 1e8bf975f7cb6a74c65b0c54f103c36daeaa00810a920db44e2abc45f051e1fe
MD5 2c08339498cab04eab15f198f251ca9c
SHA1 aebc46362e68c169ed41208bbb404ef38e17d477
SHA512 e30ca6837893f973dd3e4a1b81a3e924fdaec80f5f0d393f06749eb5859d7511fb0ba90c57c1fcc088229bef870826ac1773777315cb7f057c5f7c2d2962495e
SSDEEP 384:zd66JozGzgC1bscCEsYpzOX0fGcmhu9RtOldKP5aKPbVbvvUboKXCyjM:8EWcSYdfGcmhu9fO7KP5aKPbVbnc+L
TLSH
T1E3C2FF44EB2A913FC41913BBDCA507002F79B88A58092F673A8D646C6C972DC3D9E47F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 3b71307e3958457d5f46ef9e8698e9757fe6f8dd14444bc464a52632d5786e72
MD5 ce9560bf7741492260dc061f1c0349bb
SHA1 b6987b0163e52d437cfc95a545eb9847ca71e301
SHA512 fb50ebaeb0407a4c4ab2f1ad243b1c5ab663112b4f7d9e1f74495b425f6937432004b0974eac4e34bf6a2bb36b81c53c53bfc040471d9e152eea6f5dd6dbf884
SSDEEP 384:LboKXCyjBd66JozGzgC1bscCEsYpzOX0fGcmhu9RtOldKP5aKPbVbvv:P+pEWcSYdfGcmhu9fO7KP5aKPbVbn
TLSH
T1D2C2FF44EB2A913FC41913BBDCA507002F79B88A58092F673A8D646C6C972DC3D9E47F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 41fc0be644c83def0bb6ab84773488f48f0938c92c8cded9ce68aa61a29cdf2b
MD5 1aea417ab083d5f95052cbe8312defd4
SHA1 30d929710c6183436316d1171e38a5e1e638672a
SHA512 d3cd8e703fc82be6b5a1a74e2705069ea59b1b3396064bc5603eca87b73149919b9bc56f96a8237a00e94c7632fb445fb1115f6ada31fccda4534aea33d0b380
SSDEEP 192:11d66JozGzgCl6mSSdNOv5zboP4ZXCyjiiK:zd66JozGzgC1b8boQZXCyjM
TLSH
T162E121A4EA28863FC018027BCCB51B414F39389A9C4E7F1976DD641C2D572EE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f197e8ade6f531ae79f1eef1f7f456a20bcc8347bd44bf0c19e096f64f491372
MD5 4c5398834eefb11c6cdf678e6eec2160
SHA1 441c35b853c39707349f00ab250e1301446770b3
SHA512 42afd7dd49171549b15a115834a93b721a919066de3cd37d9767a5cde4e26803a90580176e2a7831257cdd068929bbfb9b86d92029c26f1f51366f2d5af01df6
SSDEEP 192:11d66JozGzgCl6mSSd+Ov5zbolZXCyjAI:zd66JozGzgC1bvbolZXCyjX
TLSH
T1A9D1FC68E639853FC418027BCCB61B400F76399A984E7F2532DD641C2D672DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8d504e8903ff57dd4b77ce57bef583d2859ec3087ed73c50463a1ac5de44d149
MD5 d2dd44e509be902d2d95c2124b7fec82
SHA1 5676129f30c2be734181717805c661848d5bb8df
SHA512 f1ab080ee164a51b4063e38078f928fac4f4280c106c1f9f6f0f9aae304385d87be9e6de7a557bd92afef777c129c1b4f464a5435199b73e032b28aa1e8227ac
TLSH
T1F511C05C3AF98DAA998BD29CB480028F53954E0705876D535D62DFCCCDC2ADD322E53C
MD5 SHA1 SHA512 TLSH

Submit Download

0661f123-1900-48ce-9941-15054bda59b5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\pending_pings\0661f123-1900-48ce-9941-15054bda59b5
Size 886B
SHA256 a08c2f49e672449875c449febc31e50dacc56c2c08650b93330632588b4afff4
MD5 f46f8d541d5942d2d44dcaf29ed269c8
SHA1 73c85ff286c0237bc69f0014820e17aaf33a0e30
SHA512 4d948da04c55e3314f6d03ef6bf9334f4c454be573b5fb2772cc7a3c9374f9a10262b20dd5f5736fe8ed7795ebcb0ab18223d05490e2cd9b6c479c8d4967a913
TLSH
T186114440D63074738C7C928F45A57B428BE46123C0CA5A147EA54D1849BB52B636670B
MD5 SHA1 SHA512 TLSH

Submit Download

43be106e-a74e-4b12-ac23-4381e37c969c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\pending_pings\43be106e-a74e-4b12-ac23-4381e37c969c
Size 883B
SHA256 e0067844e848e69e133bea31b9ceced91b7cb00e2197fc6d3c73f8f7d1333983
MD5 c9b362ebd5cc3b49958adb938e8b7fff
SHA1 574005a7c243edf197bdbfaf4ffe61ee1e878c76
SHA512 c6433ba6154e5231e1d53c75686b35cee1c0bb09ef3b568ae8ef1bc1a26bd190d462120f5ecd767de11a24ac3de2e4f01fddc3116fc2f84ca0c1c57d7d3fed12
TLSH
T19D116380EA347977CC7C924F85A53706C7F8552380CA59187DB34D2809BF92F936670B
MD5 SHA1 SHA512 TLSH

Submit Download

55e6e3d6-4802-4b43-b70d-39ece270b9ff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\pending_pings\55e6e3d6-4802-4b43-b70d-39ece270b9ff
Size 2KB
SHA256 edb70769ff02a4cf8f452cf37021e7c63be44b48476bc7d44ec02f53924f41fe
MD5 bfb816d38330b2bbf0ceb373fc965fba
SHA1 c5a9fbae5ead9910ba1ae94a35991b752cb13fbb
SHA512 3f2ea7958f624962bcf3cf723be7b97e5bda47aa16308e170a0d3bc1be9b2fd7c781b68dbaaf94a30580098955d2a4279989ddd63aabcf6c3091fd3108a067ff
TLSH
T14C41545C757C5C37ACDAF54D9091235EA7648A0340C62CC77D52CE0CDDA67AE336A82A
MD5 SHA1 SHA512 TLSH

Submit Download

821438ee-680b-4803-a9dd-141b8aa61e75

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\pending_pings\821438ee-680b-4803-a9dd-141b8aa61e75
Size 235B
SHA256 a397f985064f95197889a7134ad25fb53d34eb23361941ef57d293da187a9960
MD5 309da57604b5e53095d3245c91d0228d
SHA1 3e00729aee030e33b20897700ae7658d14ab3a84
SHA512 d0ab665a4e80fe6211519640fec9f923dde5097ebbcf57c684a5047218b1f5d09586decf3de97aef8204cb7174aacfb0e91e3a9b53252117c81d714953aa59b8
TLSH
T12DD0978228D8631D48004F46F0E068C630854C3310BA98208AB281349ABADC58216C16
MD5 SHA1 SHA512 TLSH

Submit Download

8530eca5-3f8b-4435-a3ca-d379255f0638

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\pending_pings\8530eca5-3f8b-4435-a3ca-d379255f0638
Size 235B
SHA256 bd4d1d8627250dd411540870829e44940e7389c2dcb373f797342ce28854d460
MD5 3f1eca7288c972e257e8f18d9a6872ad
SHA1 3326d03816dd15e248eab49fb891cc4e257a4e44
SHA512 bc14216d6cb21421cbbfd2bd8fab324570824e06be2d833e4f8d20bcf3bcdd6cecaef9736054479eddaf460f3a8e479e7abdb5f608411c33a4619f43826167f2
TLSH
T118D0978428886B2D0C101F03F0B0ADE63044CC3318E0E8208AE10474EDBAEC8011282B
MD5 SHA1 SHA512 TLSH

Submit Download

d1dafa1d-dea1-4b68-953a-23862c5c9479

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\pending_pings\d1dafa1d-dea1-4b68-953a-23862c5c9479
Size 16KB
SHA256 51492e0bd4f52a828ee340f81746a4751e3b8aadec77bc1c1e375459e732170a
MD5 7a41d09a8bf6f9a8a4e1ffe87bf2baf5
SHA1 fd8103fb749c56f1e20fbee385eb4c5aed7eab3f
SHA512 8bb6f0c489b20c5475a3935c4fc2391498771fe751a0cf8a567d8ab91d051466b461fe6cb152f7a66b1f2f88081585a2a5ca35e2b76edc1b9c425a5ad7a2fe67
SSDEEP 192:auEZ5b7QSW3iL9zTubrEBS79Hi1FYYsb8T8sBLbkHRjhu3a2YX2qaQ9u9wSTtk90:auW5b7QSW3ipP5c79H9b8T8sR83vml1
TLSH
T19772EA56286045BA8291E7A9D4EC7FC3E5F528CB4C419FCE9BE4BD082DEE05E102794F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\extensions.json
Size 16KB
SHA256 3500ee4a215500792e63c33f04c1f2e9e19c7d29ba20fa56353d1daf30eab12d
MD5 9a9d33ee68fca0c5d1b9a3e7319f09b1
SHA1 fd6b16a0af985774ca7920074bfeace8ef3eaa58
SHA512 84f1910787ebcb9c8dbd5955fadd0c2cae6b05392e19ed185a87f9c7dcbf75c7b6f17605c82cdf70e1a89dac902a5d30b925eda39b00f2289891be5354a8ddae
SSDEEP 384:KkI4vXtUmldvi8dhWh94zI96o1L4HlL4P+L4HmL4HjL4HXc4hn:tI41Rf3Xw4Q6e4l4c4s4v4M4l
TLSH
T15A72421545048EB8294EA79AAA367D02C37D573B60845C78F4DD8FC802FB5B902FBA5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\gmp-widevinecdm\4.10.2934.0\LICENSE.tmp
Size 499B
SHA256 55064d7d8fecdd90ba36cebaff34f05583c183b34686b17b40b974442fc07523
MD5 d8a9bfce875f2081d41dbb18dc618b14
SHA1 5bc4e44bd455d8838fc382b5a5525aff1a117e4b
SHA512 643b0befb7244283f08188fafb2e7f96cdf82353d06ca5c0b25ad0157eabe786809677c876faf3b12888a8c3ce38e97c8090505b06c514370a16c955db3fd8ee
TLSH
T14DF09E7EBA224772459603C7011540D47B1707FAF25422D1B358C1E4276E27982FF184
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\prefs-1.js
Size 8KB
SHA256 ccd7bada53bad77a39974a244ae47e5231792b70e546d986ae415edc158e19d3
MD5 4c2a0f27f965098a9e49e8cd5ed08577
SHA1 b1a1d93fe3c9051ab72e2ff8a18abab903b981a2
SHA512 3901dba2b3a692a0f6e9f85746c71f70be7d7ecf2a2716a2b51c4ee9b989135bc490045f60e6df4b3d84fb442784c1b274c84d9f86e3715b6ae4034ee057fbf7
SSDEEP 96:xHR+chTUiHqGqnf1DAPU8ObzSAqSSlVdv9jfnxRWRczavBw88Lm8L4cn3lB32:GcXKRnf1DAPU82qSSt8REWBw88Lvw
TLSH
T1EC020B789444CB7F65B636ACAC6889705AB2013BB7BF6CD710BA54C4051CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\prefs.js
Size 6KB
SHA256 0edbc51bbdbfa2c18879a787fb3114f5c624c4bc985bba517b60458669a8468c
MD5 e812edea18d25b40502838fd5d10c7fc
SHA1 751ce5c21818010bdab79b5784a9b3a57874741b
SHA512 3c20846c4824de232341de7c06c627014ad7b1db245b1628ff23458729fabfddf2473460c129f541ae949effd365778768f0d200d68d803a02d74415b585e6ec
SSDEEP 96:xHdUTUiHqGqnf10PU8ObzSAqSSlVdv9jfnxRHvaNBw88n8L4cn3r32:PSKRnf10PU82qSSt9vYBw88p
TLSH
T1FAE11F789548CF7F64B676ACAC6888316AB2013BBBBF68D750B544C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\prefs.js
Size 6KB
SHA256 e27d78ee5d4c7e54269946605677594b9b75f45b2d3919b03e54bd91e6f5da12
MD5 076fefd32f42b8a5c17cc2163277a718
SHA1 4b928bd4f4a974a11b8dafd8d60d34a6393577ff
SHA512 587305192a6dc6d82660dcf4f8e050e7b52ea78331064e7c5dcf0543afc12f9cebe88f358e0b8747f1703440ca29641302fffa7403156ad201298742df9a35f9
SSDEEP 96:xHdUTUiHqGqnf108L1zSJSSlVdv9jfnxRHvaNBw88n8L4cn3r32:PSKRnf108LMSSt9vYBw88p
TLSH
T1E2E11F789508CF7F64B677ACAC6889316AB2013B7BBF68D750A544C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 7474a8a2c5b20315be9da0d4100cd32b52a0b8e9d01bdec13fd06873baab6674
MD5 c0446e8ca89b3676bd646a85c8de4648
SHA1 d6a339f718ff35224bf531a5b624edbfe95b186f
SHA512 36ff936806888c5df3718190cee140276e0ebf50cdf7b0b65f235fab7b991f0c9f9de2a37afa8155d041508ed9b228ed05300d59bc67d744d3a247ba931fafe7
TLSH
T1E221D8C3687339F5BE22DA49C4414BB08A78347A85B508B0418F4A05724DE097F9C30F
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads