hxxps://doxbin[.]org

Resubmissions

22/05/2026, 15:00

260522-sdlftshs2x6

22/05/2026, 14:59

260522-sc2resey4j3

22/05/2026, 14:58

260522-sb9qmsg15x5

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://doxbin.org
Sample260522-sdlftshs2x

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	firefox.exe
Token: SeDebugPrivilege	3440	firefox.exe
Token: SeDebugPrivilege	3440	firefox.exe
Token: SeDebugPrivilege	3440	firefox.exe
Token: SeDebugPrivilege	3440	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3440	firefox.exe
3440	firefox.exe
3440	firefox.exe
3440	firefox.exe
3440	firefox.exe
3440	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3440	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3440	1848	firefox.exe	83
PID 1848 wrote to memory of 3440	1848	firefox.exe	83
PID 3440 wrote to memory of 1636	3440	firefox.exe	84
PID 3440 wrote to memory of 1636	3440	firefox.exe	84
PID 3440 wrote to memory of 1636	3440	firefox.exe	84
PID 3440 wrote to memory of 3168	3440	firefox.exe	85
PID 3440 wrote to memory of 3168	3440	firefox.exe	85
PID 3440 wrote to memory of 3168	3440	firefox.exe	85
PID 3440 wrote to memory of 3168	3440	firefox.exe	85
PID 3440 wrote to memory of 3112	3440	firefox.exe	86
PID 3440 wrote to memory of 3112	3440	firefox.exe	86
PID 3440 wrote to memory of 3112	3440	firefox.exe	86
PID 3440 wrote to memory of 3112	3440	firefox.exe	86
PID 3440 wrote to memory of 924	3440	firefox.exe	87
PID 3440 wrote to memory of 924	3440	firefox.exe	87
PID 3440 wrote to memory of 924	3440	firefox.exe	87
PID 3440 wrote to memory of 3080	3440	firefox.exe	88
PID 3440 wrote to memory of 3080	3440	firefox.exe	88
PID 3440 wrote to memory of 3080	3440	firefox.exe	88
PID 3440 wrote to memory of 3080	3440	firefox.exe	88
PID 3440 wrote to memory of 3368	3440	firefox.exe	89
PID 3440 wrote to memory of 3368	3440	firefox.exe	89
PID 3440 wrote to memory of 3368	3440	firefox.exe	89
PID 3440 wrote to memory of 3368	3440	firefox.exe	89
PID 3440 wrote to memory of 484	3440	firefox.exe	90
PID 3440 wrote to memory of 484	3440	firefox.exe	90
PID 3440 wrote to memory of 484	3440	firefox.exe	90
PID 3440 wrote to memory of 484	3440	firefox.exe	90
PID 3440 wrote to memory of 5672	3440	firefox.exe	91
PID 3440 wrote to memory of 5672	3440	firefox.exe	91
PID 3440 wrote to memory of 5672	3440	firefox.exe	91
PID 3440 wrote to memory of 5672	3440	firefox.exe	91
PID 3440 wrote to memory of 5632	3440	firefox.exe	92
PID 3440 wrote to memory of 5632	3440	firefox.exe	92
PID 3440 wrote to memory of 5632	3440	firefox.exe	92
PID 3440 wrote to memory of 5632	3440	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://doxbin.org"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://doxbin.org
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27097 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {f254dea0-3aa4-499c-bbd3-115375a4e1b8} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27133 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {e0bf25a0-9fa8-4589-8851-378bb6df780c} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3724 -prefsLen 25164 -prefMapHandle 3728 -prefMapSize 270279 -jsInitHandle 3732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3740 -initialChannelId {d15f45bd-d21f-4ba3-b1ae-9ad162b25e6b} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3888 -prefsLen 27274 -prefMapHandle 3892 -prefMapSize 270279 -ipcHandle 3956 -initialChannelId {a7426f0b-be58-48c6-a2f2-cdb2eedff4bb} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1696 -prefsLen 34773 -prefMapHandle 1700 -prefMapSize 270279 -jsInitHandle 2776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1736 -initialChannelId {8816dc2b-fb3a-49a3-89b7-c4c3ec348ad8} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5024 -prefsLen 34957 -prefMapHandle 5044 -prefMapSize 270279 -ipcHandle 5052 -initialChannelId {0f5993b1-4413-4608-96e2-2f0338200135} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5060 -prefsLen 32900 -prefMapHandle 5168 -prefMapSize 270279 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5040 -initialChannelId {c295a0b6-1760-4cc7-adf0-fb54410f62ca} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 32900 -prefMapHandle 5500 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {a936d273-4e86-4818-9055-9f70a8b1a341} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5700 -prefsLen 32952 -prefMapHandle 5704 -prefMapSize 270279 -jsInitHandle 5708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5712 -initialChannelId {e43afe8d-ea88-4e37-8126-5a3e385993df} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 7b2057107bf5906004b44d7b819234f3eb36331e21950a23361a0de331916a20
MD5 6deebfd41c1747c9bc806fac7bfcb5c6
SHA1 54d75802b35468e4981f7e04fb48192f8572f50f
SHA512 b95cbd8dd5ff3ec45ddcf2bed2de867b3a6fecc729a74504ea6c88500a785686c6b99d5e30f28d0e7f9c6e85859dc1ff2a6ed0b9f777f2a43c88ac25cbacd889
SSDEEP 384:HUr7iO024Yeo6J+Sl1xDnZBPsac4j0lpDII+KAVHAVV:0SZYeo0+Sl7zZlsac4ID8L8
TLSH
T16D528EBA9F0138AA2A23C191D9BD92448D05F6BFEEE2D06605143C04CA847F9F4F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 f7cd0dc30920c4379b48408cb7402e228f8fd3ec628b0b4a623f69c7c91e5707
MD5 8c83753c56258b6ee59f64ef595429af
SHA1 9172f4c68a7d5cb274ad2e1dde1a37d316f8a7da
SHA512 aaeca2e777f166bbb10e1ca4b99f491ece0cb0fbd7c3c9c7ae59b1c0b30f169314418d74aa915b978ff261f1a2fbb1776d023ed773c647efc3cdd79d5dc7fb31
SSDEEP 384:HHMO0iO024Yio6J+Sl1xDnZBPsac4j0lpDII+BdrP2:nrZYio0+Sl7zZlsac4ID8Le
TLSH
T160529DBD9F1138A91A27D1D0D9BE9244CD08A6BBDFE2C05616143C44CA447B8F4E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 19e0f142552eeddd693c3107752501c70e79d44b7c28e33921cd806efc35f77d
MD5 5abae9d14b9823f4000997d708126352
SHA1 4eb27e5c23199cf459a9864b428e9cb4a7d0834a
SHA512 00450fe663c92cca0b3f0d8ff3538d8c1f7eafa30547b7efeae774dd1ea0383ec26d112cc7bd5365254dd1a021e76936b812bdc046a31de1369347e4da9fbfc5
SSDEEP 192:OOv5zboqZLayjSRyG1d66Joz0dzgCl6mc0dz:FboqZLayj4Vd66JozQzgC1jd
TLSH
T1DEE120A8E629863FC408027BCCA60B500F35389A984F3F19359C744D2C472DD7B8E2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a297f25d5a33b968c5ef6ffc546459626c035e6eda18ef88896dee46374c33ac
MD5 813d03d0f4aed6295bd2a0c364065fce
SHA1 c9e6ceecffdcb624389c201d16bf1f81dc4832cb
SHA512 f74cd161c728b19d6b452cf1efc8c9fb0ab83dc86158112656a5dc6c5ff21541a736cf90b09035d2f75fc2e3fd1d2622787b1f466531cd2ae011532903ee65c1
SSDEEP 192:h1d66Joz0dzgCl6mc0diOv5zboHqZLayjSRy:fd66JozQzgC1jPboKZLayj4
TLSH
T1B6E12EA8E629863FC408027BCCA60B510F35389A984F3F19759C65492C472DD7B8E2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3b0093ce4008d7b6447591adf4a386c98711548da048b06bd30fb09b2ca6c073
MD5 cd349ef0cd7228cea90ffc6e4a42e69c
SHA1 410b397448e1f16efefa8f33f9484b02e1285bb6
SHA512 11f3bed8cee39178120fa0abf536fd48ae961de6820d3dbf118bc3024ed9f3a4fb16a88ca63eabc60a4b9bc4e74b7c0aa70c8abc5a49d05831774e54344344b7
TLSH
T136216AEC39BD4DBA9897E2587490029E53558E061DCB1C430D62DE8CCED5ADE326A43E
MD5 SHA1 SHA512 TLSH

Submit Download

03a689fa-7145-4517-96b0-0dd01bba95f4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\03a689fa-7145-4517-96b0-0dd01bba95f4
Size 2KB
SHA256 078ca294edbcd210b66e61fd47f895c865f8e6f319da9b087214245fb190c584
MD5 c4aa6eade6e695a2690cc704da6af9af
SHA1 3749627514027f1e372dcdb183d3d9c67580fee5
SHA512 3b06c17326ff2859dad08b685e7f0e30380dccc54e65ccdd457d71c7e073547da92cb0591a6e091d5717724dd8b488039a7eadaeff332271164f603f7e62221c
TLSH
T18A51A66A8160D8BFC978A31ADD253B828BF2140B408B190EAEDCAF0B147FD5E9359645
MD5 SHA1 SHA512 TLSH

Submit Download

0b7ea9aa-7dbc-4056-bf5a-b7661e749b0b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\0b7ea9aa-7dbc-4056-bf5a-b7661e749b0b
Size 2KB
SHA256 571131051f1a4238cea5291d33b7bf48a02f5c2a884825e4eae21773c0fc0c2a
MD5 413a79f15d77042e80cea255e2d49e9b
SHA1 3cb288a803db8df183873fca61012a69a0c13941
SHA512 ced8c4c99992fae14ff98dbb5487de3b5ffd44ebaac88d30a300d32ea3fe8040ac6215eabe7d7daa41f0d97d74d5ded7a1b6e39e891bdb760af9478014821a5f
TLSH
T13341F35C36B89CB78CDDF18DD492234D67E08A0300C62C831D65EF0D9D96669736A52B
MD5 SHA1 SHA512 TLSH

Submit Download

84cc785f-3680-4e5f-8218-581477371d0d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\84cc785f-3680-4e5f-8218-581477371d0d
Size 235B
SHA256 05ebdbeb16d047f684310b4dc8144ce45ed28c75313e0f9d6b943ee74bda5c5f
MD5 48026accf149277cb7bc41ca73bc3a98
SHA1 cdabd14a0f8304012f63664bcce94303ab70634d
SHA512 e74c91803d58c33ec56bb052cdeb47c796398f86e491eaa25f0615c33085ebb71e01efe2d35571dafbe914cf74c7d163bb0fac54b955930dbaf1e637411b516b
TLSH
T15CD0978024982F2E08100F03B0E028D630988C3354BA58A09E9149389EBA9C8011180A
MD5 SHA1 SHA512 TLSH

Submit Download

9a8b861e-4d98-43a6-92e1-09b1b6834a84

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\9a8b861e-4d98-43a6-92e1-09b1b6834a84
Size 883B
SHA256 ad81d60f20d5c3a2aa592cc62cff1736d7122873b5108ae2a824642278c3c302
MD5 f86641ff2eec2ef030745e0ab0182c3a
SHA1 c48119aef43c73fe230b71a3a4a4b5ff8a1ae4d4
SHA512 b1797aaf9da25550cca6353b0151fabd3e54d62d26bd11bb591305cee94bccb4e57b62e1e47eca4ec4098f8598efa9cf8bf6d4fdc0e62750cf65f88c12afea79
TLSH
T1FA1123819631B6F3CC7CE24FCAA577028BF4B42380C655143E955E050D7A92EA36A70B
MD5 SHA1 SHA512 TLSH

Submit Download

e52268e5-27b0-4248-9d00-b8a543463121

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\e52268e5-27b0-4248-9d00-b8a543463121
Size 235B
SHA256 4cf24832e7e5c43a8d1b186e85a5d847d83e1f26a6fcb282825e251f0fd5a75d
MD5 a85ed35cf1d6fad669cb18b75fd9745b
SHA1 78ba658bf069822eacc7dd2759f01cbc34e2c1a6
SHA512 b193dda94121db2647f5173d69c8a8ed4e1c9dbe1fd1f956a3ef2be074bae624aed0d7adf53f4644aa79775c2decfcc3cad285aabbaeb35aa3ed6e6b818e5fb7
TLSH
T196D0978A289863ACC8085F07F0A02CD230484C37206498109A920238F9FEAD90262A0B
MD5 SHA1 SHA512 TLSH

Submit Download

e9a19fee-2fdd-47b8-93ac-e357d751a1cd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\e9a19fee-2fdd-47b8-93ac-e357d751a1cd
Size 886B
SHA256 d917c3c6bc809b8ffc31e25a26b76bd6f50a9cf599b59cb80f59c165bc901123
MD5 a38b0d205533441cb15a1c3cc011f121
SHA1 b61bf629cc261820270aa8c2d829a4eb743905bf
SHA512 4377eb057d3bbbc4a1f1e6f7fcc2d46fba119229fdc01f0aee556431319981a10456a5791ddfe27c52f3e4aef49d9bbb7e976cc785ecce3fd96a56de4104813e
TLSH
T1141127858771B5F3CC3C918F89F177524AE4702380C71D047D955E040CAA51EA3AA70B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\extensions.json
Size 16KB
SHA256 38006b48a2c1bfd3b6c72822c0cc8ba821ec9c45e538a492bb90f6656ee10cac
MD5 ca1255a2db0e77542916d3a3f5fb8c64
SHA1 34101dd3a073d939d82383229c09cf4456b2163a
SHA512 cb6f1b5a6a8709154db6a8db5ad3f8afda002fafe51f38ea999d9f70f6947a5f980396bb5aee34e75b884bb5ee171625aab4d73f253e545801ac1082a42b35c0
SSDEEP 384:0DkI4v0Umldvg8dhWSD94zY96owqL4HgL4PuL4H5L4HNL4H7K4hN:0AI4cRfJXHp446Q4i484R4t4u43
TLSH
T15472411545049EB8298EA79AEA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
Size 7KB
SHA256 31d759e2be16d938f71bff9346c850c1260dd007c9bbf0957624440665c62a89
MD5 0f80f1507d4f903e36fe51f03612cb34
SHA1 ac29f3d3dc40b5dc29c5f5bcbe86d760ad1ce3ab
SHA512 55c340f83387f4942e98e7842b783e34bdba05daecabd5c4879b2fcb04c43e6b4083f6478c73fb96ba3d6e59e7f36970b764014a244cff88a551145992caccac
SSDEEP 96:xHc9TU1qGqQfCVzpNObzSMlSSlZdv9j0nJH9zKBw88AV8L4cnc1qoq:CZRQfCVzpN2lSSO9zKBw88AO
TLSH
T1C2F1FFB89018CB7FB4B6367CAC6488705A72013BBABF68D710B954C5154CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
Size 6KB
SHA256 2eb95fb292c1333bb14a48fccb926340ef0ee6c8bb7161af749897be38347bdf
MD5 086050b183bcda92d614611c7e0ce825
SHA1 e0a56c4b600b441d1af225170c35cfac0cf952a3
SHA512 eb299a6d2cca2d7b38c3bfe83097134ac0067502d789c7e66f27a9f5ea27ef03aa38d0b005487ea0004352396774cf979635373b83b1fc3a9d6e04b219375cb3
SSDEEP 96:xHcUTU1qGqQfApN1zSMlSSlZdv9j0nJH9zzBw88H8L4cnc1qGq:C4RQfApNnlSSO9zzBw88e
TLSH
T192E11E789418CB6F74B6776CAC6888316AB2013BB7BF68D710B554C5054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 6KB
SHA256 4fe76b47c72db812b3c20e5eb46e88cf6524c93cb4e3b4f17406c183e7a5f992
MD5 e912f4ca6a5a2335aaf4685dea2858b0
SHA1 aa170bd4f33d295e1f14510e0aeeb1a342071939
SHA512 cc65f15ced9d6e42c5e7e23074e9055154010101b2a1dd850f35e8ab4a95c546cf90c11d9078117e3830c19de0b6fdac9ebbc8c4f6084a5c7c9482c78626f6c2
SSDEEP 96:xHcUTU1qGqQfA151zSM9WSSlZdv9j/nJH9zzBw88H8L4cnc1qGq:C4RQfA15n9WSSF9zzBw88e
TLSH
T164E13F789408CB6F74B677ACAC6888316AB2013BB7BF68D710B554C5054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 6KB
SHA256 4564cc7dca5d3169496a7025d5cdebe200d9c7fd97d0708cda378088252b8371
MD5 0745b033b80c5fdb53f6369ac824ee82
SHA1 530bf3b008165a3b1ec2aae0c6060cf9913a2809
SHA512 db0f55944b792a77065decf10efa98b6e3d4936f9e9a93d01137636612aea6ee8aee3aeacddc044f37aaaf4309ce0b71040a4b8bc13440fa42083d1e0d9206f7
SSDEEP 96:xHcUTU1qGqQfApNObzSMlSSlZdv9j0nJH9zzBw88H8L4cnc1qGq:C4RQfApN2lSSO9zzBw88e
TLSH
T1B4E13F7894188B7F74B6376CAC6888316AB2013BBBBF68D710B554C5054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 1216244b5dc0ddc379945e72526536e893ab35e74612f4c1888425ea61b5b688
MD5 35e5ecae3411bf5b206ef54aeb107c31
SHA1 63ba66081a5f9dfa9efefc02bd51105778a42d77
SHA512 d7eaf44fb2b728f5b8e870e52024b186689e752ccd286e25ea17745f57b79f553e73ce1c0c9cc6e299f08bbfc53245d9f33691c110fdf774bb5ff667e0fb08c5
TLSH
T10E21C883896B2DE1B722E14F944A0FAD9652303086780CE0A24E0F11238D959338625A
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads