hxxps://doxbin[.]org

Resubmissions

22/05/2026, 15:00

260522-sdlftshs2x6

22/05/2026, 14:59

260522-sc2resey4j3

22/05/2026, 14:58

260522-sb9qmsg15x5

Analysis

user interaction
yes
max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://doxbin.org
Sample260522-sdlftshs2x

Score

6^/10

google persistence phishing

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
122	4144	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	firefox.exe
Token: SeDebugPrivilege	4144	firefox.exe
Token: SeDebugPrivilege	4144	firefox.exe
Token: SeDebugPrivilege	4144	firefox.exe
Token: SeDebugPrivilege	4144	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4144	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4144	4896	firefox.exe	87
PID 4896 wrote to memory of 4144	4896	firefox.exe	87
PID 4144 wrote to memory of 1708	4144	firefox.exe	88
PID 4144 wrote to memory of 1708	4144	firefox.exe	88
PID 4144 wrote to memory of 1708	4144	firefox.exe	88
PID 4144 wrote to memory of 4920	4144	firefox.exe	89
PID 4144 wrote to memory of 4920	4144	firefox.exe	89
PID 4144 wrote to memory of 4920	4144	firefox.exe	89
PID 4144 wrote to memory of 4920	4144	firefox.exe	89
PID 4144 wrote to memory of 1732	4144	firefox.exe	93
PID 4144 wrote to memory of 1732	4144	firefox.exe	93
PID 4144 wrote to memory of 1732	4144	firefox.exe	93
PID 4144 wrote to memory of 1732	4144	firefox.exe	93
PID 4144 wrote to memory of 1092	4144	firefox.exe	94
PID 4144 wrote to memory of 1092	4144	firefox.exe	94
PID 4144 wrote to memory of 1092	4144	firefox.exe	94
PID 4144 wrote to memory of 984	4144	firefox.exe	95
PID 4144 wrote to memory of 984	4144	firefox.exe	95
PID 4144 wrote to memory of 984	4144	firefox.exe	95
PID 4144 wrote to memory of 984	4144	firefox.exe	95
PID 4144 wrote to memory of 3928	4144	firefox.exe	96
PID 4144 wrote to memory of 3928	4144	firefox.exe	96
PID 4144 wrote to memory of 3928	4144	firefox.exe	96
PID 4144 wrote to memory of 3928	4144	firefox.exe	96
PID 4144 wrote to memory of 5384	4144	firefox.exe	97
PID 4144 wrote to memory of 5384	4144	firefox.exe	97
PID 4144 wrote to memory of 5384	4144	firefox.exe	97
PID 4144 wrote to memory of 5384	4144	firefox.exe	97
PID 4144 wrote to memory of 5392	4144	firefox.exe	98
PID 4144 wrote to memory of 5392	4144	firefox.exe	98
PID 4144 wrote to memory of 5392	4144	firefox.exe	98
PID 4144 wrote to memory of 5392	4144	firefox.exe	98
PID 4144 wrote to memory of 5400	4144	firefox.exe	99
PID 4144 wrote to memory of 5400	4144	firefox.exe	99
PID 4144 wrote to memory of 5400	4144	firefox.exe	99
PID 4144 wrote to memory of 5400	4144	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://doxbin.org"
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://doxbin.org
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {0be936e3-61d0-4a64-9e3f-cb42c6f60c32} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {1c446338-9790-4703-b613-007704b3e9d7} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 25164 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {79aaec6a-defe-4cad-a8fb-37ddf81ce45a} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27276 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 3816 -initialChannelId {8866dcb6-aab6-46ad-b4e8-76040a4ab638} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2956 -prefsLen 34775 -prefMapHandle 3064 -prefMapSize 270279 -jsInitHandle 3212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2692 -initialChannelId {261a61dd-2a03-42ca-bf06-2a2bf1338873} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4736 -prefsLen 34905 -prefMapHandle 4708 -prefMapSize 270279 -ipcHandle 4720 -initialChannelId {0982c15e-c125-4da2-ad52-c24d7ed22ccb} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5124 -prefsLen 32952 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 5152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {22112791-2413-41ec-af6d-9aae79cca286} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5332 -prefsLen 32952 -prefMapHandle 5336 -prefMapSize 270279 -jsInitHandle 5340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {aaab0f22-2d82-439b-a15b-df5525d98c38} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5520 -prefsLen 32952 -prefMapHandle 5524 -prefMapSize 270279 -jsInitHandle 5528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5536 -initialChannelId {83496ba0-3fc4-4cf1-8fd9-3971ea8ecfba} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 77455e03a905999d062ab38f73d4db1347537bd33e90767ee58a8d2a766a20cd
MD5 27d514b95e9ef7451acd0d56c6e09c8a
SHA1 c6c5376f216d9ce66bf9f0e622bf9c05a5c2e709
SHA512 6c7b3ea17a877bf434b8d169d67744dad161ca55bb4de4b1e64bb269fb14f325a5baeb8440260ddfcb8d70e8bc5c959d64e5c8316c8b658731f15611c90dd438
SSDEEP 384:HUr7iO024Yn3o6J+Sl1xDnZBPsac4j0lpDII+KADHADs:0SZY3o0+Sl7zZlsac4ID8LD
TLSH
T1F3528DBA9F0138A92A23D191D9BE9244CD05F6BBEEE2D06615143C04CA847B9F4E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 0cc99c235bc6fdd0e7b76b0f6a1b41b2b1ef4b97505f250036e3631356eb277b
MD5 edff52ed408639bcc8c18956b7bbca17
SHA1 3f40d11f306a9d335753f0d002357efe5030529a
SHA512 ebbd878eeff5a99bc9e5f28b6eb3bf722f276d44675180af053844bcc3089d8e9b9309b6e7196ebc1fc2b6df67fd46dfc2ea1c0457ec081a8c9d3b79519f26ed
SSDEEP 384:HHMO0iO024Y5o6J+Sl1xDnZBPsac4j0lpDII+Jdv8Pc:nrZY5o0+Sl7zZlsac4ID8Lt
TLSH
T12E528DBD9F0238A91A27D1D4D9BE9205CD08E6BBDFD280960A543C01CA487B9F4F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 ab83ba700676e633e6c67ae3b78fe505e34d38e7dd2dd490445acaff1765a218
MD5 9472a0b59d28bba7144f215775abde36
SHA1 2aa0dae4f2059728f89a10d294d03cb3634012bf
SHA512 fa731e45da740eb474d94985e30e5013b4dae79715b14df684ac45a1a92a9cec3faf7094e6502b087d258f25fc7543b87b65a90195e61a435322b2d3bc64fcf3
SSDEEP 384:Jd66JozGzgC1jUbor+fyjKehHCbQRrcmhOAGcmhucmUjpDAK/u/+CbObaT:mEmxMhHHh7GcmhucLCK/u/+CbOba
TLSH
T172D20144EB2A913FC41513BBCCA54B002F79B88A591A2F573A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 c755f6d40063d4b6e15cfd74f9a450a34ba0228fa1df809304080bbfb44823e8
MD5 8436d79a05318bfbc6df2bd86a015198
SHA1 26dff7f5de4d42d7eb5b672d4f37aaff2c06bd14
SHA512 5148701f2f541cd1ee2570c35df07973df3596e7dd1a6fe056f73bdbadffb613fdf6e6e0ede3ec86dc008bfb562ab232fa583fbc683300dfc992691d0ebf1abe
SSDEEP 384:Lbor+fyjKehHCbQRrcmhOAGcmhucmUjpDAK/u/+CbObaT1d66JozGzgC1jd:PxMhHHh7GcmhucLCK/u/+CbObaCE/
TLSH
T19AD20184EB2A913FC41513BBCCA54B002F79B88A591A2F573A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 076f3022107bf9e400b032521e1ea6d16be0f763c0cafa6122cba01c4d3db043
MD5 207fe295f524ddba7a6c63957275e2fa
SHA1 6c151faae83a22310f0b0e6bd0ce6b0131cba49c
SHA512 292d08ae216d6f0c717f7b26b52bb6c70b02824e90fb9d728262664d3a7e47b90544e3b347df2ab66af8df9741bfd64296dfe5201e730caed2cc77ce6f55a29b
SSDEEP 192:y1d66JozGzgCl6mc0dgOv5zboGZ+fyjmxI:8d66JozGzgC1j1boGZ+fyj5
TLSH
T1A4D1EB28E629563BC808023BCCA61F510F35798A9C8F3F1971AC741C2C572DE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0203861f6d86c8f14ce1485e2a33eb28e915570fba2f9fddff446ae293682a7d
MD5 563175243242a6123c622cf6866aff82
SHA1 51dff534a915e237dc57927bef0557ef264d6c81
SHA512 17df203e94e0d5fd20fecef3fc9c164a39107f41ea131623e5bb33f807c0c18ef0108698e4cfbfd7c121a1b26358cb3331be64704a86c211d4e1d42335bec860
TLSH
T1142148EC3AB84E2A98CBE2987541028E53958E462C871C434D62DF8CCCD5AD9726E43E
MD5 SHA1 SHA512 TLSH

Submit Download

32ccfb27-699a-4f40-9c01-40972db35079

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\32ccfb27-699a-4f40-9c01-40972db35079
Size 15KB
SHA256 cc3c41b447bfc9b800426ebd14dbd80f2e0ecfb696838c3a9045d15f7751346f
MD5 7fd4b38251b04b07425c6de2e41dbafe
SHA1 b2682c8b6e631fb6e33ccfc7ece31c76baba3b1c
SHA512 7f3d2526e40d8da91e728b4b8697c52a4cab4bc95fa6a5a0844684efcfc2b04be736ae44795b7449edca49a7c460a8a7470a2136bb534a9511967f3ad29d5217
SSDEEP 192:zU2KNBoQMnUA1+x8WEBAIlK4iZK9Bd4Kf9jQTMQk4l0nMSPdlbOsIoP6MKlzkkuA:AZGUtx8WbIJu0zOslyMKlIrsR7D
TLSH
T1E372EA56643044BA8251E3A998E8BFC3E5F538CF4C415FCADBE4BD086DEE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5771a62b-6ae4-4ad9-8109-c4fce8f72550

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\5771a62b-6ae4-4ad9-8109-c4fce8f72550
Size 883B
SHA256 97e963fa78a8c19caad9024ccfadbde80baa371a59b6a5218d5e1b85dae16ebc
MD5 338762fd8af3e0794e7c1bcdcdfd22a5
SHA1 0fd7a7c996ae21d400a3f420759cb247c55568c6
SHA512 8fb9846765cbcab723ab2606e5163c957ed5722e2f4c312ea77444332af385f9be44fc51974b0cf8ef7bfe66d832f0877ee60c47f20f02853fc4284c1e5d6d7c
TLSH
T1381100459775B4B38C2C934B8A5637438BE8B62384CA54043EB169280D7A62E676630B
MD5 SHA1 SHA512 TLSH

Submit Download

5ea12db6-b892-4e6f-8c6a-2c1163e2eec8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\5ea12db6-b892-4e6f-8c6a-2c1163e2eec8
Size 886B
SHA256 e408237ad70ed178bd6f66fc835460b85f6394a908de8fa46c4efcafbaa55b15
MD5 c0d338f430b923488914d2a2f76c3a4a
SHA1 9bf3087cb9d3adb2a466dad025067b1364d1c543
SHA512 7849a7a5f488003f62a2f0554ab902ce9a4e2a3809bb2a850bb2498e7d42f72bd7d9a7c9ef0cbaa2b6d596529dcec2096eeb8aea45cfb36c6af0f575f2279405
TLSH
T10A1163458670B4F38C2CD38B84D277128BE0B123C4CA08047D719A280DBE92E73A230B
MD5 SHA1 SHA512 TLSH

Submit Download

751ee971-cbdb-4fe7-9a05-36582fe4879b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\751ee971-cbdb-4fe7-9a05-36582fe4879b
Size 2KB
SHA256 ea41ecc3effd14a5678903393b8b38f6f9c386d46e2b18f39c144a85138be437
MD5 506ff9ee53535f3d4f020b1cd1379eac
SHA1 02bde57dadb4795d566682d34eceb77cb5efa861
SHA512 bade97776791e5bcd38a6cf1698195d31e2ebc83601d2850a9a2e4b294f645376b898cfdbf3ffc4af19abdde33fa0f33c5af026aadd21baeeee98efbc90a22bb
TLSH
T1E441345C36B85CB79CDAE1CDD482238E9764864344C21C837D62EE0CDD966A9337A53F
MD5 SHA1 SHA512 TLSH

Submit Download

e9aba3ec-f849-4b48-bfd3-0b01d06bd473

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\e9aba3ec-f849-4b48-bfd3-0b01d06bd473
Size 235B
SHA256 9658b246e70ab8c088dc0297d89ebf7414f9008cac3e8bc53d83e49f881a380d
MD5 19edba0f95a466b3a36c54acfaf67e5f
SHA1 de4b08e8de6dd60f5411e2f0bcb53b806e78dfc0
SHA512 66c6dbab0411ca2ef0465d8b7a719f17da21588dd544b0e5907bf23ad8d01eb011290f5b21219ed0c0672967d55eac00c46360123fd0ac1c54826ed3dfd4b945
TLSH
T104D097801498331E08200F0BB1E02ACE34894C3310649820995100B889BEEC48351D56
MD5 SHA1 SHA512 TLSH

Submit Download

ef9ca5e7-6deb-420c-a86d-e7212bd378a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\ef9ca5e7-6deb-420c-a86d-e7212bd378a7
Size 235B
SHA256 6740a1940fc5cc0aef0afb9a554a419b8ca5c72a40c8d7ad12850fdfd1bf7d2d
MD5 d10b97f901b5857d5adbb6b1e0fdd54c
SHA1 39bb775245ddfa2e1cf6f722c27edd372b55e727
SHA512 dccdb360c541b47a1299fb51d18c6a96305972bf34240bd8898ac3222c791916a9e5307587860ed109d6259b6a8af37060411ff3a5087391619648fe8ae8d904
TLSH
T12ED097842888375D0D080F03F0E069C674854C3710649CA0C6A24138ADF8DC4419284A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\extensions.json
Size 16KB
SHA256 73cb2b4495344430ce78700d890ee418613af3fc79a7ad3184cd01662734b77b
MD5 8f1cdbb7e6a840655af1f9f1342cf47a
SHA1 6124715651f3364da037b8ef8bc244fcea12ab77
SHA512 68717a4c172aa1a2acbfaa1d7cf0a9caef4cb884c33ed6a21710e7e9679ff09137dc6deb302070c1bbdb83d0fd0b5f994f330068485aeb26f175e090bc8c74cc
SSDEEP 384:HkI4vYUmldvL8dhW894z/96ozL4HHL4P/L4HdL4HsL4H7q4ht:EI4gRfoXV4J684L474d4G4O4T
TLSH
T15E72531545048EB8298FA78AAA367E01C37D473B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 6KB
SHA256 7f673c934bccc80d759acaa2be5d3fd87a2003a781de88d87b3b3d61dec3d818
MD5 7295d93d749c802a2bc983fbbfc9fc10
SHA1 63071b979e928d35ed55b9e4afe6e214a355f8d9
SHA512 4562f231519f56b5977a91e31b169c265354fc561f062caa8e88b2973cbce4782ee81ffa1f9214067ae277d4e3de19dd52aec388717d07c84c134e22b116a5cb
SSDEEP 96:xHrUTUmqGq6fzEq1zS9SSlfdv9j3npRHNWyS9JODBw88n8L4cnuFNj:1BR6fzEqwSSv9NWBrODBw88Jr
TLSH
T146E12F789508CB7F74B676ACAC6488716AB2013BBBBF68C710B554C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 4efc2691f8d99d884b8fb11be72bfe83eb23774b5991a3d47e703108c6c20018
MD5 e30b3e9ba6637cd3861782f4aadd15f3
SHA1 03337d8a7d71289fb1cb73932bfbfa1afb7fb9dc
SHA512 7a2e67196ce6bfa9eb7ce45d21de5e90826c3e8bf179fb15abaa64c3eb1887b6b8fa048506bdfb535283772ebbae4ab1647ca5e89216246bbe8f76a6020b2926
SSDEEP 96:xHrUTUmqGq6fzUL1zSGSKSSlfdv9j3npRHNWyS9JODBw88n8L4cnuFNj:1BR6fzULrSKSSv9NWBrODBw88Jr
TLSH
T15AE11F789508CB6F74B677ACAC6488716AB2013BB7BF68D750B594C4050CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 7KB
SHA256 2dc770149a51da5751c42004d11948e989d72356a8363fb3eacba777591607c1
MD5 1bc96c3340eba5ac84b83c93ac40abe6
SHA1 63e9fe60e0c1444674e55c21eaae8fbaec6b87ea
SHA512 155ff3e7c07c336b97076977285606d66c80c9ea0fe8195a73d37eb25e4664ab7dbaeb4857fd086ba1733e2c86dc05c3ed913f0654bd86603e064925b2901448
SSDEEP 96:xHrNTUmqGq6fzEqObzS9SSlfdv9j7npRHNWyS9JODBw88v8L4cnuFNj:1gR6fzEqHSS39NWBrODBw88hr
TLSH
T1DFF10EB89114CB7F74B276ACAC6448715AB2013BBABF68D710B954C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 8KB
SHA256 ca3fb46be1a21d55e3c396ca22de4f5ee292cb050cf8078240180ede7d36c72d
MD5 5e0d34f022c90241a50d9fef121ffda8
SHA1 e989c874c4c607d9cef4b8f323c597b29fc92975
SHA512 f8f1ab86637033933ae1c82f4118b47394fb184392cfb604710c73a719bd1b87abafdb27789c5b58e27ed8283565fa2b1ea65355e9558c88b0e004daaa86e8da
SSDEEP 96:xHrNTUmqGq6fXW2EqObzS9SSlfdv9j7npRWRvNhWyS9JOuBw88Ngo8L4cnuFNj:1gR6fXW2EqHSS38RzWBrOuBw88eer
TLSH
T1C002F0B89154CF7F74B2766CBC2449715AB2013BBABF68D710B99484050CF3445FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 444a9edb3e3ca4c83765c8c6e6151c9cc4eb81d147441e1b968f886f3c6b445a
MD5 2a337b47a3d61eabbb1a33ff797f3727
SHA1 541fd93ddcfa5ca64f4c5ce232a553b69cb5adca
SHA512 2d475c24435fe06896f4f55cd8e62dea1c87f2d69b76b640ee384a38abab04594347f21969f0a39f24c2a9092ab8eae291493f8da56ab76fdc9f9c916838a30c
TLSH
T17621B757859F2DF6FDB3E15E49480FA8C392342588B94CF0D34ECD1691CD68BA187619
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads