hxxp://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd[.]onion

Resubmissions

25/05/2026, 03:05

260525-dlfg8ad12t6

19/05/2026, 04:16

260519-ev281sfy2x1

13/05/2026, 02:30

260513-czex6sbz7t

13/05/2026, 02:28

260513-cycfnabz6s1

Analysis

max time kernel
899s
max time network
894s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion
Sample260519-ev281sfy2x

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	firefox.exe
Token: SeDebugPrivilege	2988	firefox.exe
Token: SeDebugPrivilege	2988	firefox.exe
Token: SeDebugPrivilege	2988	firefox.exe
Token: SeDebugPrivilege	2988	firefox.exe
Token: SeDebugPrivilege	2988	firefox.exe
Token: SeDebugPrivilege	2988	firefox.exe
Token: SeDebugPrivilege	2988	firefox.exe
Token: SeDebugPrivilege	2988	firefox.exe
Token: SeDebugPrivilege	2988	firefox.exe
Token: SeDebugPrivilege	2988	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2988	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 2988	4520	firefox.exe	80
PID 4520 wrote to memory of 2988	4520	firefox.exe	80
PID 2988 wrote to memory of 2004	2988	firefox.exe	81
PID 2988 wrote to memory of 2004	2988	firefox.exe	81
PID 2988 wrote to memory of 2004	2988	firefox.exe	81
PID 2988 wrote to memory of 4420	2988	firefox.exe	82
PID 2988 wrote to memory of 4420	2988	firefox.exe	82
PID 2988 wrote to memory of 4420	2988	firefox.exe	82
PID 2988 wrote to memory of 4420	2988	firefox.exe	82
PID 2988 wrote to memory of 1984	2988	firefox.exe	83
PID 2988 wrote to memory of 1984	2988	firefox.exe	83
PID 2988 wrote to memory of 1984	2988	firefox.exe	83
PID 2988 wrote to memory of 1984	2988	firefox.exe	83
PID 2988 wrote to memory of 2156	2988	firefox.exe	84
PID 2988 wrote to memory of 2156	2988	firefox.exe	84
PID 2988 wrote to memory of 2156	2988	firefox.exe	84
PID 2988 wrote to memory of 1476	2988	firefox.exe	85
PID 2988 wrote to memory of 1476	2988	firefox.exe	85
PID 2988 wrote to memory of 1476	2988	firefox.exe	85
PID 2988 wrote to memory of 1476	2988	firefox.exe	85
PID 2988 wrote to memory of 1468	2988	firefox.exe	86
PID 2988 wrote to memory of 1468	2988	firefox.exe	86
PID 2988 wrote to memory of 1468	2988	firefox.exe	86
PID 2988 wrote to memory of 1468	2988	firefox.exe	86
PID 2988 wrote to memory of 1580	2988	firefox.exe	87
PID 2988 wrote to memory of 1580	2988	firefox.exe	87
PID 2988 wrote to memory of 1580	2988	firefox.exe	87
PID 2988 wrote to memory of 1580	2988	firefox.exe	87
PID 2988 wrote to memory of 2276	2988	firefox.exe	88
PID 2988 wrote to memory of 2276	2988	firefox.exe	88
PID 2988 wrote to memory of 2276	2988	firefox.exe	88
PID 2988 wrote to memory of 2276	2988	firefox.exe	88
PID 2988 wrote to memory of 3840	2988	firefox.exe	89
PID 2988 wrote to memory of 3840	2988	firefox.exe	89
PID 2988 wrote to memory of 3840	2988	firefox.exe	89
PID 2988 wrote to memory of 3840	2988	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion"
1⤵
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27098 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {7249f6fd-8409-4dbd-aa8d-0dcb2932d946} -parentPid 2988 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2988" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27134 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {31bf666e-97e0-4276-9ad3-5424bf590aa7} -parentPid 2988 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2988" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 25164 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {91adc931-354c-49fc-9a8a-03977b7c0e94} -parentPid 2988 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2988" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27274 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {4f2fafa4-115b-4e25-a7ac-7a8666b5e5f8} -parentPid 2988 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2988" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3184 -prefsLen 34773 -prefMapHandle 3188 -prefMapSize 270279 -jsInitHandle 3232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3220 -initialChannelId {39362dcc-e812-47a8-8724-5204d9fafb11} -parentPid 2988 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2988" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4784 -prefsLen 34903 -prefMapHandle 4788 -prefMapSize 270279 -ipcHandle 4796 -initialChannelId {547d91cc-ea23-41ae-9bbd-7f9db5962855} -parentPid 2988 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2988" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2996 -prefsLen 32952 -prefMapHandle 2704 -prefMapSize 270279 -jsInitHandle 2948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3324 -initialChannelId {e16e4594-18ff-476a-801f-2b05a0269651} -parentPid 2988 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2988" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 32952 -prefMapHandle 5444 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {53f7b954-ee7e-435c-bf42-0ab8c221f729} -parentPid 2988 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2988" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5640 -prefsLen 32952 -prefMapHandle 5644 -prefMapSize 270279 -jsInitHandle 5648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5656 -initialChannelId {59b0fcbf-46b5-4b15-8672-553485dae8b8} -parentPid 2988 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2988" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wvdcag27.default-release\activity-stream.contile.json
Size 4KB
SHA256 f6ae53c0253469389321700b312f8431cf8a5146b92d2eb9a6d0563c8c1f8483
MD5 df174eed5774a34f083e5feda35886fa
SHA1 7dbae331637f921ad3d9a0b5885eb5b21aa3c7b1
SHA512 57018ead26913e93d10109df8709f0907bf23d0681985b73b9a6083585cdff1fa6000d3be7bc283d7810b184fd4fc6387431aa74d09ec92f11729e0d3f95b162
SSDEEP 96:BqVvBnlYOT+mRnTrIzV//f9PQ6jIHKY/bcYnvt6Dx0l:EVJnl0mRnTrIp/NPFjIDntwx0l
TLSH
T113A107BBC878DD574321F6F53C8927E9B1177197DAE94D4BFB818C0184D42AF80AA948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wvdcag27.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 10KB
SHA256 15f82ffbea9a66bd290b6d8a9e8b26f34bd471a3713613a26ab04fbcbf0f0fbf
MD5 26b84830ea3b572fcca8974997f3c5ec
SHA1 18828aab9aa67e5488e038a78feaca5b90effbf6
SHA512 74ce46cafd89c4ca975d80617a272834c061e78c7bf134d871a73f8dfc17ddc802ada47247d3526d196732b58de5c7e130b74c10911293443b6b569b762a65f8
SSDEEP 192:HcJplb8kcXz5RqvAcdRPSHXFCPD1Oo1u/63Htyt35nyVX/aJtV/1uSmxSmM:HUr7iO024Ytdyt35ni/qV/oSmxSmM
TLSH
T199224DFFAF5038E91A17E094D9BD81098E46F5BF9BF29027114C7C54C680B36A4F94AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wvdcag27.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 10KB
SHA256 2b1d6fd5d5b6d97fc708e6383358343fe9145945657898c02f9a04cadb3f5f09
MD5 49ce313df026b2edd6d8311d4f5e8beb
SHA1 81dc5ebe79f9ebf5ed803c83905b85084c89810d
SHA512 f06e4d2ef33d37dde4444ad6d522e74aea68023c725ec0edc7732467f1f1bd0e5a92ffda2b59fbed8503fdba54dc6f92e3f24ec712b81e0c96a457c97c4fbb3e
SSDEEP 192:HcypyOr4cXz5RqvAcdRPSHXFCPD1Oo15t63Htyt35nyVX/aJtV/1XpU4epUh9:HHMO0iO024Y58dyt35ni/qV/84nh9
TLSH
T19E224CFF5F5038E91A13E0D4E9AD911DCE45F5FBEBB29026521C3844C280B25B4F94AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GBT3PBTCKI1FZIPFO9PU.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GBT3PBTCKI1FZIPFO9PU.temp
Size 7KB
SHA256 7a9539e70d0ca7058ca59538a2c6c135efaabd5d9196e0f43677e06814e3c80d
MD5 157eede294abbc01f271d71222e72d34
SHA1 f9158245a5db4c1f5a17803f4409c05a5f9a023e
SHA512 285cd3d518c919c0f458dcc62f47deeaba8d1610b2a0fa301ed1703a496ab93827b3aa42f6e524be3d12d5034c24cedb3750a4d708ac464e10d307b4d36eb37c
SSDEEP 48:w1d/J5UgdwJdAzyqd/J/6BdwJd4yYd/J/adwJd6ATPd/Jp0tljvdwJd9L:+n/a/1p0tlju
TLSH
T1ADE1DC021BF70A61F5F3D6313A71B7536733FD01974A472EC18556490A72BA086ACFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 83a7e2e34a59ff2a6dd9581a11cbe5c8f5d04530d268924d9213da9fa30ea644
MD5 03243826ac4e855c364070472bafd537
SHA1 7076189a38cbee92d60974d3000a1764c35597ca
SHA512 86c3e0ec19533e4ad389fdbc59b658241a0c23d0f575dc04cfeb2c72797f039294c2d3283c7f1a08879c21bb96698db6768d9112ad8219c77314fc5f4c5e0ffa
SSDEEP 192:N1d66Joz0dzgCl6mc0dEOv5zboobU3yjCK:rd66JozQzgC1j1boobU3yjP
TLSH
T16CD1DE68E628463FC444423BDCA51B410F35395BDC5E3F2931DC644D2D562EE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a6096bc797a7b71b0fb0169be48279022ce52d98732c01a60a2d95892c58ee27
MD5 eb8bf29819cc48180d99f67a5d71c3c4
SHA1 ab5e56c17d1b9e82bab673170decac84f1ddcc01
SHA512 0adbc0bebef01dc1bbc05ffdd2214890cbf91727ac36fdb1e0584c54f26a53911accb1e0abba117f54c496f2ceabd62ab80350ea4027dc6830fc44550fc5f9ce
SSDEEP 192:1Ov5zboHUrU3yjf3PD1d66Joz0dzgCl6mc0dz:qbo0U3yjfJd66JozQzgC1jd
TLSH
T192E12064EA28467FC404427BCCA21B414F39389BDC5E3F19319C645C2D572EE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 272fd9591e7af43183ed07cc5e16ef7d7dcb9da59e8930f74444b128508a2c2f
MD5 ff7d44fc456ab3589b581d4404e925cf
SHA1 0c884179d906da7296add7309115f9e4556f167b
SHA512 c321d2c700574161909446ac5a150f8fc47ead607df99d5199e5e42a367fcb99f912ddbf1c3b1f01af2064c832784d8446253b97c60854a046cab186b804e6c1
SSDEEP 192:JOv5zboHhZU3yjCH1d66Joz0dzgCl6mc0d:GboBZU3yjWd66JozQzgC1j
TLSH
T1EED1DC28E629463BC458027BDCA61B400F39388BDC5F2F2931EC645D2D562DE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 371a2127e522ee1ff3a22d6f809f8836d778b845b30722efa46f834fd667614d
MD5 0cffaee21682704b5addf0a8812d0f8e
SHA1 1f75995c8671d95c1a257d682c8ff728aff4d745
SHA512 e619799b289c034fc36235c308804beb4acb886ad43f9f2f1f2eda809a476ea0c219e6f2e9f9af2223168c17a4f8761236bd0bdf7d694780df03c8e8f0ed4c47
SSDEEP 192:N1d66Joz0dzgCl6mc0dJOv5zboHUrU3yjf3P:rd66JozQzgC1j8bo0U3yjf
TLSH
T1B9E12064EA28467FC404427BCCA21B414F39389BDC4E3F19319C645C2D572EE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c9d5e64bb9260e814abdf5477964ea198879249ae6a4b16a28e55604db5f71bb
MD5 29d5e1f2fe0024a49b53b0b63034d217
SHA1 50f6137fe4d593d18bac67ea937948b0f2dbe958
SHA512 bf563a137b2559e70e092e4f149c79a4cf2852d2e32c6b66ea976d25f9793c9c225dfcb8fc8ff6742654c3f8722024b610cbe2a3f3e226b80b5828bcc6bb8409
TLSH
T142216A8C39F94DAB7887F2ACB840028E97258E4664C71C834D02DF8CCDD5AD9327E479
MD5 SHA1 SHA512 TLSH

Submit Download

15681f4c-c332-4774-98fa-05034926b6e5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\15681f4c-c332-4774-98fa-05034926b6e5
Size 2KB
SHA256 41eca267fd57064bd560eed6834eb92ebd0d1cdd653a91d39b7dbe787f5a1d37
MD5 75d73ed6c3bfddfe6f26b0b5b9027919
SHA1 b64c72b93d6aa8ab263c31b00827f64a45736a50
SHA512 ff139d2650e5a8c81c3376c9c8e7d3c2b47dd4746b76b14d99e59d6a328dce931b650f25e8845b4f825e01fb8752978e93d66981d17c570f18a7fb7e0a2db570
TLSH
T1D041426C79785CB78CDAE14DD491324E5B648A0340C61C833EA1DF0C8CDA769276B53F
MD5 SHA1 SHA512 TLSH

Submit Download

198b5710-7224-4fc8-a5e4-71c99cc425b9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\198b5710-7224-4fc8-a5e4-71c99cc425b9
Size 235B
SHA256 2a7984aeb86f3b9defe30a1e918ea40aec696819737b74de0119398875d514e0
MD5 a574e595d2abcf8851db34be3121109b
SHA1 9375e16dae84a256e8f2366e11b0438624dce664
SHA512 e9b3588f2c5ee75c1c8499feba77bd07c5f24a4ad64f3261b034c3d4d42fa42c866f3db7acae510ea9fef70f415b2e4198497626531ca88fd6dd0244177ce55d
TLSH
T162D097906C886BBE08084F0AB0E028C630848C3310B49C10D5910AB88BBABC8425291A
MD5 SHA1 SHA512 TLSH

Submit Download

2be6a404-c13e-4068-a5d8-87bd4feedf44

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\2be6a404-c13e-4068-a5d8-87bd4feedf44
Size 886B
SHA256 3dbb043025291350f9f92cc41462f71337da82cb9504d0ebd604f759010b34f4
MD5 a26d98d5a342224a3a5268a2e2ccf540
SHA1 b4790f38cf338816b626aa7fcaa7a36c717f0c6d
SHA512 8ce3533fdc8a60bbaf128f675b21981aaa881a54ea5a80e2d524231c93795a8b36b1565826dc3cfa73f77378bd3a69bd256cd7d60ba7d48679f2e6ed464775be
TLSH
T165112351D564B6B3CC78D2979AA17B028BB83523C0DB4C5C7EA45F080DBA52E67B730B
MD5 SHA1 SHA512 TLSH

Submit Download

4bf297e4-057b-4470-a639-b043aed7b90f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\4bf297e4-057b-4470-a639-b043aed7b90f
Size 235B
SHA256 4815ecabbcd502901d85f581d3d9c40013f5f05e55a2fcdfaeb02629036fd8db
MD5 f74a7afd861d2d94e7eeb785330ecc70
SHA1 470f43e03f3f33ace89ba86d8d2482f955ede000
SHA512 1479b2d7c1e9a56cdaefe09428fc33a73949aefb8baf295ee45a2699efda38161e0e720a3e421f686174eed3e709f90608e0322b1be4200dfb6ebd629104ba73
TLSH
T147D0978018A87B2C08081F02B0E02FC631F44C3350B0A850CA6241B8BAF9EC4012291B
MD5 SHA1 SHA512 TLSH

Submit Download

d3793045-2f45-49a2-883f-19b97d33f2de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\d3793045-2f45-49a2-883f-19b97d33f2de
Size 883B
SHA256 601c5d4bcfde2bf9fd40d2e91c5004f3327d6b8d73321c4c23d1773f2d04d412
MD5 721041caa2ff0a6d184ea14ba832d80f
SHA1 c5b2f36cad4d0314dbdc13382a625eabd384a9a8
SHA512 e9b8926dbb40eecc7570658e2c81c821cfe76147fa04d454e27cb46127afd29832e37765b0aba07b2833c00bc5cb62bfe2d3f8bf10c7301883a7a6e5e0652e03
TLSH
T11E11C051D635BAB3CC68D14B8A5237028FB87623C0D648183DE15E084DBA92E676B30B
MD5 SHA1 SHA512 TLSH

Submit Download

ec76e758-9f53-4e2a-81d4-a4e10c30fe71

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\ec76e758-9f53-4e2a-81d4-a4e10c30fe71
Size 16KB
SHA256 648ef2636d739a64e5a7f6451964cd4cc636ba85108b35a7354a5cf5a94db5f3
MD5 5cdc9b32587f46d54b085e37ec695888
SHA1 59838d427508c6feaa3b4247453cb9be9b2c8086
SHA512 46a05c1be2cd040b3f1866cf134b7d7d18a629cbf7ea1bf0acf2b8c2c45fedb197952c819b54d13074d756549569856f0ba23ebf77bbe0c99df40f66570f6e32
SSDEEP 192:rJ6bLt9b5nK5mzxayb3aCSqBk+KVJm9TZ2gtxvY8fJ26LQFrWchiXNkkQMA1yaaq:rWxK5mlaybKCSS92alGu2nyaa60P8
TLSH
T1AD72C9565420857AC251E7AC98FCBFC3E2F528CF4C415FCA97E4BD0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\extensions.json
Size 16KB
SHA256 cd1a0e7f5c5b0d06400fc78e0f1dbbc73e7750aae18909598bf2e4ec4856f575
MD5 8be626d885aba0a93b1c496917e1d569
SHA1 56a3c4f4c7753ea54a066a689dfa72dfe8fee2d5
SHA512 61795591a2fc1fe78c64d9045d77939a4544438470bd83e6157fab873da6dd9e3d60d268d2fc46dc31807978fc52ebec88c86934cd8527ef92dcc7c52291cecc
SSDEEP 384:ckI4vIUmldv18dhWx94z/96ofL4H4BL4P2L4HUL4H4L4HbZ4ho:zI4ARfmXY4x6k46404u464d4a
TLSH
T1D872422545048EB8294FA79AAA367E01C37D473B60855C78F4DD8FCC02FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 7KB
SHA256 948d67cdfd9418da764a6763c05d6d3dfefafd96bfbee921c332eadab2a47ee2
MD5 7e61d68d0a9c7c708f7234d05e883927
SHA1 6a6db575601cef90eeca7bd253d16a4e701156b7
SHA512 ab24e82e42e6067b704ad64cb6582a3370c45c7987efc2cabc946106c81ea62e177ac499d1b1f26d9757168625d914f1a207bc18be5b0d465270ef365e63df0f
SSDEEP 96:xHkFTUNqGqZf0ORSuObzSySSlqdv9j+numHb4nNzwjBw88I8L4cntrv:+lRZf0ORSuYSS8ob0mBw88N
TLSH
T131F10C7C9544CBBF74B676ACBC6888715AB2413BB6BF68D710B94484010CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 7KB
SHA256 0851d4973163e16061aa2ee8ac4e4df671eb36effa1afa349b63d697c9883e28
MD5 de537ef312414ed4c00b0a52385f988d
SHA1 0ce2e170e1125bb45da40f3dd9263d6b32bac020
SHA512 8642c881127cc6d638b7999000d79740fe07b7ccaac02ea0d0962e6621093a8ed1dab2ef22387c01cbd1e47ac3c030ecd3904959932ef4e0769961026796661f
SSDEEP 96:xHkFTUNqGqZfgSuObzSySSlqdv9j+numHb4nNzw9Bw8868L4cntrv:+lRZfgSuYSS8ob0sBw883
TLSH
T1A5F10D789544CB7F74B276ACAC6888715AB2413BB7BF68D710B94484011CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
Size 6KB
SHA256 1e1b1ecb43d22350e472f52f20c305ee7cd80c8d5ec45d1366c961ab2b4e6065
MD5 247b87110334ef59e80faeb6de7575d4
SHA1 2bd6ba2cfd73b56545dbdada2464ae15283453fb
SHA512 5439a9f71b51c0fe19399ca630292329041c2d78af45ec90b3e2c3d2db3b111c8551e8eed9fbec7bc99b7d7222cb1c48c73b45536ac22bf172661c55a726b5a7
SSDEEP 96:xHkUTUNqGqZfgD21zSZSSlqdv9j+numHb4nNzw9Bw88j8L4cntev:+gRZfgD2USS8ob0sBw88x
TLSH
T17FE13F7891088B7F74B676ACAC6888316AB2413BB7BF28C650B954C4015CF3446F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
Size 6KB
SHA256 d7b80c7ec3f54311b35cf3d45e54046714dd3180b2c3512afb07415966b8ae54
MD5 fe5647f5aec0131093279d47c0df5308
SHA1 a6c338795193de074296d3eba04b10fa90ddcb3e
SHA512 4ea21457cd7abe28fb2cd3050f72a1684e6d8d24e19b21520225ab9bab473fcfb0f6bb1e3a254f62edd4cc8d18971cc33c269f6a98783c7ee6323bec79eb5c08
SSDEEP 96:xHkUTUNqGqZfgSu1zSySSlqdv9j+numHb4nNzw9Bw88H8L4cntev:+gRZfgSuzSS8ob0sBw881
TLSH
T127E13F7895488F7F74B677ACAC688831AAB2413BB7BF28C750B55484010CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 65fbd0b4d7e78357876d314f54f3864bc8a191b0a8c9a545c2c93ac80f2097c6
MD5 ca714889e0feacd78824e08d306c8fd8
SHA1 36b7ce0e4947f5d70fbd9f1707ef5f49e5f58cae
SHA512 0777d3df2a53ea5221b4d917a7196981bfb0d106a21c27a641717c6d286eab5a44cf56d8d050541e517662b433b612fdab8e077b5d0597b45299a2a8b0b0448d
TLSH
T109311B833DB63EF5F6F0592AD4C04FA2D3B6202241F524F041C9999686AFC0F738524C
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.1MB
SHA256 4ffb80494f9ec40196f352d0f94fadb1394b0e6e7e39e99be4e6a99f2ffacb18
MD5 7b61832604ad0b6518838f295a44d6b7
SHA1 60211ec82c2669de1e2ccff3d0a1870e95a6e82b
SHA512 df60d07d5d306467ca46afdcc32522fbc5e0c5bdb1b2acbaec3d5ad6a3a39aa6b41d272e4ef8ab6b1188af433f385f2343528c18ec21167eb9277a5f099c4835
SSDEEP 49152:Hak9RVaAIoW8zN6wluiillxJwY8BF9f8w53mW3diQ8QEquq73QmH/fod36glh0D3:hiaod36gla5KIaDeB03Jxc7
TLSH
T163566DE420E29252F38540B3719A53FB10EFC01C6076CE44579896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads