hxxps://doxbin[.]org

Resubmissions

22/05/2026, 15:00

260522-sdlftshs2x6

22/05/2026, 14:59

260522-sc2resey4j3

22/05/2026, 14:58

260522-sb9qmsg15x5

Analysis

max time kernel
148s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/05/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://doxbin.org
Sample260522-sdlftshs2x

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	6028	firefox.exe
Token: SeDebugPrivilege	6028	firefox.exe
Token: SeDebugPrivilege	6028	firefox.exe
Token: SeDebugPrivilege	6028	firefox.exe
Token: SeDebugPrivilege	6028	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
6028	firefox.exe
6028	firefox.exe
6028	firefox.exe
6028	firefox.exe
6028	firefox.exe
6028	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6028	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 6028	4904	firefox.exe	83
PID 4904 wrote to memory of 6028	4904	firefox.exe	83
PID 6028 wrote to memory of 5116	6028	firefox.exe	84
PID 6028 wrote to memory of 5116	6028	firefox.exe	84
PID 6028 wrote to memory of 5116	6028	firefox.exe	84
PID 6028 wrote to memory of 1964	6028	firefox.exe	85
PID 6028 wrote to memory of 1964	6028	firefox.exe	85
PID 6028 wrote to memory of 1964	6028	firefox.exe	85
PID 6028 wrote to memory of 1964	6028	firefox.exe	85
PID 6028 wrote to memory of 5512	6028	firefox.exe	86
PID 6028 wrote to memory of 5512	6028	firefox.exe	86
PID 6028 wrote to memory of 5512	6028	firefox.exe	86
PID 6028 wrote to memory of 5512	6028	firefox.exe	86
PID 6028 wrote to memory of 1560	6028	firefox.exe	87
PID 6028 wrote to memory of 1560	6028	firefox.exe	87
PID 6028 wrote to memory of 1560	6028	firefox.exe	87
PID 6028 wrote to memory of 2220	6028	firefox.exe	88
PID 6028 wrote to memory of 2220	6028	firefox.exe	88
PID 6028 wrote to memory of 2220	6028	firefox.exe	88
PID 6028 wrote to memory of 2220	6028	firefox.exe	88
PID 6028 wrote to memory of 3528	6028	firefox.exe	89
PID 6028 wrote to memory of 3528	6028	firefox.exe	89
PID 6028 wrote to memory of 3528	6028	firefox.exe	89
PID 6028 wrote to memory of 3528	6028	firefox.exe	89
PID 6028 wrote to memory of 3480	6028	firefox.exe	90
PID 6028 wrote to memory of 3480	6028	firefox.exe	90
PID 6028 wrote to memory of 3480	6028	firefox.exe	90
PID 6028 wrote to memory of 3480	6028	firefox.exe	90
PID 6028 wrote to memory of 2616	6028	firefox.exe	91
PID 6028 wrote to memory of 2616	6028	firefox.exe	91
PID 6028 wrote to memory of 2616	6028	firefox.exe	91
PID 6028 wrote to memory of 2616	6028	firefox.exe	91
PID 6028 wrote to memory of 4248	6028	firefox.exe	92
PID 6028 wrote to memory of 4248	6028	firefox.exe	92
PID 6028 wrote to memory of 4248	6028	firefox.exe	92
PID 6028 wrote to memory of 4248	6028	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://doxbin.org"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://doxbin.org
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27100 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {3ad7f020-e5c8-4fce-a4ff-27efbd5f3847} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2524 -prefsLen 27136 -prefMapHandle 2528 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {36a762dd-fb91-44d1-b21f-1be3a54df901} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3932 -prefsLen 25164 -prefMapHandle 3936 -prefMapSize 270279 -jsInitHandle 3940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3948 -initialChannelId {15c95fe2-927c-4492-bfcc-3379deb25497} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4100 -prefsLen 27277 -prefMapHandle 4104 -prefMapSize 270279 -ipcHandle 4188 -initialChannelId {c981c112-78c4-43c5-a708-7847d33c6079} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3076 -prefsLen 34776 -prefMapHandle 3080 -prefMapSize 270279 -jsInitHandle 3048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {1ad6be51-b478-4b75-9309-d4cbd12073ad} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5000 -prefsLen 34906 -prefMapHandle 5004 -prefMapSize 270279 -ipcHandle 4936 -initialChannelId {b0532e45-6dcb-4dc5-a18e-b66b401cd31d} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5304 -prefsLen 32900 -prefMapHandle 5300 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {7a889f81-4729-4376-ad9b-e9ae967ccd93} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32900 -prefMapHandle 5228 -prefMapSize 270279 -jsInitHandle 5244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5328 -initialChannelId {7948f0d9-b2ff-407e-a324-8b923ae0975b} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {174430eb-d30e-429a-9918-277d1e8888f8} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 5567014cc35111b63eb6a3332b8a667deaf9a49a3914beb190d740b461ff943b
MD5 40cfe8bed86286e569ac08df84833317
SHA1 7e4b8b0fae0d0cf60dcb0828664d5d3ee5c1ba68
SHA512 b55cfbf73a863784b7c5f24c63bd806d6643508d9718ccf6a205f4721662d080fea4fbb2a3c1b3f04936963cc9ce9ab49c03a97bde0defa277353a0fbd656121
SSDEEP 384:HUr7iO024YXo6J+Sl1xDnZBPsac4j0lpDII+xAo8Aok:0SZYXo0+Sl7zZlsac4ID8LT
TLSH
T134528CBA9F0238A91A27C191E8BE9244CD05E6BBDEE3D06605543C14CA846B9F0E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 cdd87bbba071eb399de62396a214fdad979ae0478519af069a0039f52cd84722
MD5 59edf0a63d6abe80cece0e4e59734425
SHA1 6f7fd0e03cb8cfe6b882ced54e8bcf882124d8e4
SHA512 ae34d42046703441d384d70fdc82e05622bec5ca3aef62379cbc21cd5d4bcbfbca41b9dce60d9d826163f476eb69df5e756e58679b75464d500a62d92d955ec7
SSDEEP 384:HHMO0iO024Yso6J+Sl1xDnZBPsac4j0lpDII+mdLhZ:nrZYso0+Sl7zZlsac4ID8LQ
TLSH
T1B0529EBD9F123CA91A27D5D4E9BD9205CD04A6BBDFE280661A143C40CA447F8F4E64CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 72fac1dfac9693cecdf7f82d3c6b76081dcf5b3a6da7f58f502baa24c3e96fbd
MD5 f3f43b0a20fb0157a3c3ce864b9c8b8b
SHA1 292a4f94f100c761fcd8d0fd30c5d961c250ec0e
SHA512 ca056c686ce48fe18aa060d65509bd3dcf1ebf9eaae5c0abcdced904b8cc5133d04c156f78369def1363d0c84ec98e28af53b2630572e523739a756e1276d31c
SSDEEP 192:ArhOv5zboWZpI9yjatji1d66Joz1zgCl6mc0dz:Ar+boWZpI9yjaed66Joz1zgC1jd
TLSH
T12FD1ED19E639463BD418423BCDA60F900F36398B988E7F1931DC645C2C5A2DE7A8E57E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ebfdf57554f8937be55a846a1058a8a89822ed7926e17c7f254888e18399d2dc
MD5 810357d026ed84bc14ea99978d97ee5a
SHA1 10808e16eb8ac067cf2f7cf73b4f470a71b82bb9
SHA512 7e04078463ec18686a3e7f97d462ccd471f82c8d2b21c234c468a5536d6b2b504c6103d44cec33a2ed619cd0fe8261b2f0c1669338f0aee46385d37b1c6d4eab
SSDEEP 192:NrhOv5zboAOZpI9yjaDSqi1d66Joz1zgCl6mc0dz:Nr+bo7ZpI9yja6d66Joz1zgC1jd
TLSH
T1B7E11E68E638863BD418427BCCA20F910F35398ADC4E7F19359C645C2D4B2DE3A8E57E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 17dbef64b7bca367706411d1c04193315715f3881f4f48271418fec10a33202f
MD5 18d8815fe9553b90b25a4f290cdd1436
SHA1 fe4b662946cca7021b5afdf81547e2232839d821
SHA512 dfc7a07e5205ce1ddc7acc46b3fb20bca142e7b018a496bce1fe0041a794a2a53116630560a54ba850399e59014a8ea39be9351f226ac772a88c12c0de891ee6
TLSH
T158216AEC3ABD4D7AE8CAE29C7480018E53954E061DC71C434D22DF8CDED5AD9326A43E
MD5 SHA1 SHA512 TLSH

Submit Download

4bd5c620-23f1-4de1-888e-adead83e919f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\4bd5c620-23f1-4de1-888e-adead83e919f
Size 883B
SHA256 bee6c77c70433e4b8d41403639a3a79e2adcf4745e4241628ed56967cea909b4
MD5 ecd3b106f74fc616c8b154ce073df61f
SHA1 94f0407567c2906d01b629c5853e6dad2ef58471
SHA512 68f9f1fc2f441367b8908d7c4d18ec137f7a7eb636a3f99375d10ae84f2165cd104142ae0fce92cbea7382f0aaa1e94d2fdc3fabf5401f664138bd97e359e818
TLSH
T1F1112341A535B9B3CC78C24BC9E17B534BE47823C0C995143DA56D1C0C7E12EA36AA0B
MD5 SHA1 SHA512 TLSH

Submit Download

77ee0abc-00db-40b3-9d96-a3fd3c9655ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\77ee0abc-00db-40b3-9d96-a3fd3c9655ef
Size 2KB
SHA256 5629399530f277dca1914f40b524311b344dd8497096cdc4e3e141e5f11febd1
MD5 c6ee5c269c070439c2302e8e02f82dc2
SHA1 13132cb2375e04b7e6751eb0b7fb280b9cf27ae5
SHA512 db3258fbd00a0c2905270e9db0bf23af44298b25323a7ae0fc74a5e4640c7789c822c1c4325f651814736647814715311e65403e89f42459da077e9cd2050f98
TLSH
T14241415C79745DB74CEAF19DD181238E53A04E0240C229C72E61EE4C8C9A7AE336A93B
MD5 SHA1 SHA512 TLSH

Submit Download

81a77e62-af7d-4556-9482-cc91677f827d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\81a77e62-af7d-4556-9482-cc91677f827d
Size 235B
SHA256 a59887ef00d7d815036e7006a647862e05a18c5254452eea9c82cbb50f8e7631
MD5 30e627d96a2e3bad4ab3e7e62df4b25b
SHA1 dbf5ee3e6378f631ca11f13892c2ea28b0413131
SHA512 97ee1fb1aa65c0eb4543d104ce3ba5a3ff88ad578b54a6cfa0df98723d2dbc4e34c90bb1e5e3bebbbec89995094f7096485ac8e307e6f1cc6582e153aec4dbe9
TLSH
T1F1D0978158A8A36D08184F0BB4E4A9D234884C3350B1A820EA908AB899F9EC41132817
MD5 SHA1 SHA512 TLSH

Submit Download

82b6dda3-0320-46ec-95ba-6fc90104cbf4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\82b6dda3-0320-46ec-95ba-6fc90104cbf4
Size 235B
SHA256 4f8af28200b2f28eeb19e0c0dbd1cdbda493e32e91aa6ecb22c8aa754deb6efb
MD5 865ada5438f7ed8e89d1919e56162fa9
SHA1 ebb997136fa892e55e42c91705d2d6b149d08305
SHA512 88874cd2c115f9346bc03863d9d6f452bc2b7714c33207c2e797feec86ad7ebc1165f1b8d710a1f663ff4d5e1adc844e92e9147689c09637b30da983f054cc87
TLSH
T1D4D0A7C12498B75D08150F17F1E1ADCA3246CC3724B698609A9145789AFD9C48591C5B
MD5 SHA1 SHA512 TLSH

Submit Download

a634a847-e9e9-485c-87ac-abe97020f6ff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\a634a847-e9e9-485c-87ac-abe97020f6ff
Size 16KB
SHA256 904a0ad05257b6643d3a81b575092f5b45f39536fa44eb427b4e67b575b7ceaf
MD5 4ec496f8f988327c58edc8316fea3fa9
SHA1 9c977305b0dcb8ea702c132d8dad53bd4c4e4a0d
SHA512 dceb72103fb8424395e999bda06e03f9d82da895944026d72249567db92d459062179954b0ff34da8c1901278e0a2453467e9a4ef806bd24dcdf220c77bc6893
SSDEEP 192:/hGHyB2B921H87TKsyKRRSRzhK4JC21iq3mgjJyZ2IKFIH5dcZjdg8ZKVM1W7bxQ:0HyqJKsyQRSRFK4JZ16dWtcbxnU0cj
TLSH
T16E72FB56646045BA8291E3A8C4FCBFC3E6F528CF4C419FCADBE47D0469DE0AE1127947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c344065d-ef90-4e2a-a761-0c9ac8f4f6f5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\c344065d-ef90-4e2a-a761-0c9ac8f4f6f5
Size 886B
SHA256 a8699bfd5532df8eee6ae3b8866ab3e64607398fecd6194aa0f256a1bb80b10c
MD5 65d179abc98bafca9172ce39c34cd532
SHA1 029ab59068db06f315bfa2192f95fcd191fae5c4
SHA512 34d2d0afc923f9f4d3ac4cc1000b92c268094d4a41b19e8bdececec079ff5b6e79f8a32106129b7a9cd79bda2c09c0b2506c463022a513ed3c688546a2fe8236
TLSH
T19B116341953079B38C78C28795E1BB528BE07433C0C69A087EA49E080CBE02E636A703
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\extensions.json
Size 16KB
SHA256 6c1745bf1fca6aca0c75e2bacac1c58cb5efc9ad05dc0990f748ee5334d97a7d
MD5 de998e551e8337488dc9b8e7ab8e3c59
SHA1 705e31ad89235de6436b433108af0b1b2825258e
SHA512 6b238e5fe62c6a70438db1df7b080ce0c55e0001aae1ab4ec3a597eff44b284f93c94cfaed81151eff2c032f28b33d5bff7e16a96d6be51806c4fe2866611666
SSDEEP 384:ZIkI4vOUmldvf8dhWA94zc96oSKL4H9L4PRUL4H2TL4HPFL4HnA4hP:tI42RfsXt4k6i4945O4Wf4vl4g41
TLSH
T11F72531545049EB8294F979AAA367E01C37D473B70845C38F4DD8FC902FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs-1.js
Size 7KB
SHA256 98839724b3bf7e8462287bab8678b132cd5d4a52a76b7a9fb4e5534f4ed9b8dd
MD5 19767a29e8df3408b5468c64d8564fc6
SHA1 952f443a7a7d871c2bca9585fe4dc5d729d32323
SHA512 e20383a18f33009247714000af41ad772fb2526b80c9443dd3199728a9e7640baa695d4d4655ab2e631707194800c43ea215df180ad6c077edd503a8e63bb6fb
SSDEEP 96:xHg9TUsqGq5fCOzUaObzSMhSSloldv9janRHRDdcSUBw88l8L4cnNyy4:yaR5fCOzUa2hSS5RRcSUBw88CI
TLSH
T195F100B89014CB7FB4B6766CAC6488719A72013BBABF68D710B958C5114CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs-1.js
Size 6KB
SHA256 18863536a1d6b519877ed960b6f1b0871dcc149eb9cb73ab57945c6e86f43b9f
MD5 9486d17c6eed5206b0b18142e307e46f
SHA1 9174bd5553407edeef47d1385d07d340444e3520
SHA512 0576bfc50dafb1d140d2a27034c4a0198ed8dc7e348386ac9d1da1deae84854cbb2fdc813275aa5e1632bdcae0fb91146c40a8aaddbf2e9ea4a6a4f7ad908d47
SSDEEP 96:xHgUTUsqGq5f6Ua1zSMhSSloldv9janRHRDdcSxBw88P8L4cnNyy4:yfR5f6UanhSS5RRcSxBw88wI
TLSH
T111E1207894188F7F74B676ACAC6888715AB2013BBBBF68D750B54485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs.js
Size 6KB
SHA256 b88abf426930cb989ee0cca443afae4ef045a2ee2074aabbec08e248169df4bd
MD5 b878c1e8410062f0ae588668d46e3482
SHA1 4ce1a5b5984255e6d893aea2f26f1a62852188c6
SHA512 f25d97d090803461a55d304d4c72601a1c286cff78ccf4c09c674c911f6af6d77d2dee902c7926203dda9cfb79461ab8f9a368e0811fc444e7de5071ea335f53
SSDEEP 96:xHgUTUsqGq5f6UaObzSMhSSloldv9janRHRDdcSxBw88P8L4cnNyy4:yfR5f6Ua2hSS5RRcSxBw88wI
TLSH
T173E1207894188F7F74B6766CAC6888716AB2013BBBBF68D750B544C5014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs.js
Size 6KB
SHA256 3f79fdda8c0ddd3bfc6fe74d05da6897f2679ff34492e0222012042b160a0244
MD5 90722940f55235842428d36d7cf0bd5a
SHA1 b3d3225ee03e6771c59e20ecd7964d3401ef66c1
SHA512 22894607a016f4f475ca13df3eb3daf514ffce54f35d16251290cfad108ba73d0532dc10dcb85980f28568e1d0d4521506afca3846b066f57bd44e091f906b6a
SSDEEP 96:xHgUTUsqGq5f6v71zSM/dSSloldv9jnnRHRDdcSxBw88P8L4cnNyy4:yfR5f6v7n/dSSQRRcSxBw88wI
TLSH
T1C6E120789408CFBF74B676ACAC6888715AB2017B7BBF68D750B55485010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 f37e56aa3907d2be8165756e90a42be53fc2beaa160048af937e4a7660ef3e7d
MD5 cc9a69459e12ec638bc1fbe7380bdf5c
SHA1 b50f8f5e49e78125a839be150cb8f6aeaaca0c19
SHA512 13e44e4aa6bc36124a60835c34a153ccfa65d89affde51eb9ae4743889730687b4ca00835d1371b3389279ff897d3835fd4f9ba198fb67bf39f9e763b918c621
TLSH
T1692117CB991B2DF2FE23C18FD80A4BEDCA52312589AD0CF0D10E4C2126C99A4A38A10C
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads