hxxps://nexus-mods[.]net/

Analysis

user interaction
yes
max time kernel
223s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 12:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nexus-mods.net/
Sample260527-n96dnacy2m

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
976	NexusMods.exe

Checks processor information in registry 2 TTPs 42 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\NexusMods.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
976	NexusMods.exe
976	NexusMods.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	firefox.exe
Token: SeDebugPrivilege	1380	firefox.exe
Token: SeDebugPrivilege	1380	firefox.exe
Token: SeRestorePrivilege	1920	7zG.exe
Token: 35	1920	7zG.exe
Token: SeSecurityPrivilege	1920	7zG.exe
Token: SeSecurityPrivilege	1920	7zG.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1920	7zG.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe
1380	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5860 wrote to memory of 1380	5860	firefox.exe	88
PID 5860 wrote to memory of 1380	5860	firefox.exe	88
PID 1380 wrote to memory of 3000	1380	firefox.exe	89
PID 1380 wrote to memory of 3000	1380	firefox.exe	89
PID 1380 wrote to memory of 3000	1380	firefox.exe	89
PID 1380 wrote to memory of 1900	1380	firefox.exe	90
PID 1380 wrote to memory of 1900	1380	firefox.exe	90
PID 1380 wrote to memory of 1900	1380	firefox.exe	90
PID 1380 wrote to memory of 1900	1380	firefox.exe	90
PID 1380 wrote to memory of 3804	1380	firefox.exe	91
PID 1380 wrote to memory of 3804	1380	firefox.exe	91
PID 1380 wrote to memory of 3804	1380	firefox.exe	91
PID 1380 wrote to memory of 3804	1380	firefox.exe	91
PID 1380 wrote to memory of 4468	1380	firefox.exe	92
PID 1380 wrote to memory of 4468	1380	firefox.exe	92
PID 1380 wrote to memory of 4468	1380	firefox.exe	92
PID 1380 wrote to memory of 752	1380	firefox.exe	93
PID 1380 wrote to memory of 752	1380	firefox.exe	93
PID 1380 wrote to memory of 752	1380	firefox.exe	93
PID 1380 wrote to memory of 752	1380	firefox.exe	93
PID 1380 wrote to memory of 1724	1380	firefox.exe	94
PID 1380 wrote to memory of 1724	1380	firefox.exe	94
PID 1380 wrote to memory of 1724	1380	firefox.exe	94
PID 1380 wrote to memory of 1724	1380	firefox.exe	94
PID 1380 wrote to memory of 6080	1380	firefox.exe	95
PID 1380 wrote to memory of 6080	1380	firefox.exe	95
PID 1380 wrote to memory of 6080	1380	firefox.exe	95
PID 1380 wrote to memory of 6080	1380	firefox.exe	95
PID 1380 wrote to memory of 3736	1380	firefox.exe	96
PID 1380 wrote to memory of 3736	1380	firefox.exe	96
PID 1380 wrote to memory of 3736	1380	firefox.exe	96
PID 1380 wrote to memory of 3736	1380	firefox.exe	96
PID 1380 wrote to memory of 912	1380	firefox.exe	97
PID 1380 wrote to memory of 912	1380	firefox.exe	97
PID 1380 wrote to memory of 912	1380	firefox.exe	97
PID 1380 wrote to memory of 912	1380	firefox.exe	97
PID 1380 wrote to memory of 5848	1380	firefox.exe	98
PID 1380 wrote to memory of 5848	1380	firefox.exe	98
PID 1380 wrote to memory of 5848	1380	firefox.exe	98
PID 1380 wrote to memory of 5848	1380	firefox.exe	98
PID 1380 wrote to memory of 5100	1380	firefox.exe	113
PID 1380 wrote to memory of 5100	1380	firefox.exe	113
PID 1380 wrote to memory of 5100	1380	firefox.exe	113
PID 1380 wrote to memory of 5100	1380	firefox.exe	113
PID 1380 wrote to memory of 5704	1380	firefox.exe	115
PID 1380 wrote to memory of 5704	1380	firefox.exe	115
PID 1380 wrote to memory of 5704	1380	firefox.exe	115
PID 1380 wrote to memory of 5704	1380	firefox.exe	115
PID 1380 wrote to memory of 3188	1380	firefox.exe	117
PID 1380 wrote to memory of 3188	1380	firefox.exe	117
PID 1380 wrote to memory of 3188	1380	firefox.exe	117
PID 1380 wrote to memory of 3188	1380	firefox.exe	117
PID 1380 wrote to memory of 3712	1380	firefox.exe	118
PID 1380 wrote to memory of 3712	1380	firefox.exe	118
PID 1380 wrote to memory of 3712	1380	firefox.exe	118
PID 1380 wrote to memory of 3712	1380	firefox.exe	118
PID 1380 wrote to memory of 4592	1380	firefox.exe	119
PID 1380 wrote to memory of 4592	1380	firefox.exe	119
PID 1380 wrote to memory of 4592	1380	firefox.exe	119
PID 1380 wrote to memory of 4592	1380	firefox.exe	119
PID 1380 wrote to memory of 5068	1380	firefox.exe	120
PID 1380 wrote to memory of 5068	1380	firefox.exe	120
PID 1380 wrote to memory of 5068	1380	firefox.exe	120
PID 1380 wrote to memory of 5068	1380	firefox.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://nexus-mods.net/"
1⤵
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://nexus-mods.net/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2024 -prefsLen 27099 -prefMapHandle 2028 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {993e9f61-cf38-4816-9d86-f555eda29729} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2504 -prefsLen 27135 -prefMapHandle 2508 -prefMapSize 270279 -ipcHandle 2524 -initialChannelId {7f1005d1-bc10-4e7b-b0e6-63edd14897fa} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3812 -prefsLen 25164 -prefMapHandle 3816 -prefMapSize 270279 -jsInitHandle 3820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3780 -initialChannelId {fd4624b5-dbf4-44f2-813f-16b875eefa7d} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27276 -prefMapHandle 3968 -prefMapSize 270279 -ipcHandle 4064 -initialChannelId {ff15da37-141c-4401-b58e-8dd3f5893f39} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1688 -prefsLen 34775 -prefMapHandle 2736 -prefMapSize 270279 -jsInitHandle 2740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2956 -initialChannelId {ff256fda-b4aa-434b-8bb0-3bd91b1b0942} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4956 -prefsLen 34905 -prefMapHandle 4952 -prefMapSize 270279 -ipcHandle 4988 -initialChannelId {f26a2637-1c6a-4665-b110-fb699ab12b39} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5236 -prefsLen 32845 -prefMapHandle 5240 -prefMapSize 270279 -jsInitHandle 5244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5252 -initialChannelId {7ceae1f5-6cbd-47b8-9f5c-3b4ff14da483} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5432 -prefsLen 32899 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5444 -initialChannelId {196777b4-b1f8-4af8-9125-1784ff7b32a5} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32952 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4992 -initialChannelId {123373c4-95ba-4880-a198-f1337b3e5b6a} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5400 -prefsLen 32952 -prefMapHandle 3976 -prefMapSize 270279 -jsInitHandle 5396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4848 -initialChannelId {3a6bfd2c-dc0e-4003-972d-b8413ce4a8c9} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4772 -prefsLen 34372 -prefMapHandle 4624 -prefMapSize 270279 -jsInitHandle 4720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6072 -initialChannelId {d56015bc-7ade-4e49-8e83-b318da1954e8} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5684 -prefsLen 36639 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5712 -initialChannelId {d8be4e07-6468-4263-bea1-63b5c94d49dc} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6712 -prefsLen 36639 -prefMapHandle 6584 -prefMapSize 270279 -jsInitHandle 6612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6724 -initialChannelId {0a132ddb-08f2-4ea1-bd4b-f73aacbf60d4} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:3188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6780 -prefsLen 36639 -prefMapHandle 6784 -prefMapSize 270279 -jsInitHandle 6788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6796 -initialChannelId {a18ec75e-9606-4d43-9ed1-d89a92c48cc7} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:3712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6724 -prefsLen 36639 -prefMapHandle 6928 -prefMapSize 270279 -jsInitHandle 6932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6940 -initialChannelId {f8b4ed9f-d4b8-4884-ad34-e5a44173fbe0} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7008 -prefsLen 36639 -prefMapHandle 7004 -prefMapSize 270279 -jsInitHandle 7000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6880 -initialChannelId {038b2e6d-1de1-4ac0-97b8-1dfc6c5dc8fa} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:5068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7340 -prefsLen 36639 -prefMapHandle 6256 -prefMapSize 270279 -jsInitHandle 6400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7556 -initialChannelId {e8a3457e-3c53-4f1f-a15b-7e46ebeac0cc} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:2392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7344 -prefsLen 36639 -prefMapHandle 6784 -prefMapSize 270279 -jsInitHandle 7036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6756 -initialChannelId {62011c03-641e-414b-9ef5-8babd1a38cd2} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:3860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7888 -prefsLen 36639 -prefMapHandle 7892 -prefMapSize 270279 -jsInitHandle 7896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7036 -initialChannelId {767f6d74-31cd-4dab-80fc-c342ef97fdc2} -parentPid 1380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:4640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:332

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\NexusMods\" -spe -an -ai#7zMap4685:80:7zEvent18756
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1920

C:\Users\Admin\Downloads\NexusMods\NexusMods.exe
"C:\Users\Admin\Downloads\NexusMods\NexusMods.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3245

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fqkq4vem.default-release\cache2\doomed\3245
Size 51KB
SHA256 2774e210e5109b8a227a4aab4939adb367fac1eec314ccf0268b5aab277b980f
MD5 48aa8f9f0f36e4c241e0b4fe4cd79a74
SHA1 07a15b312ed07f45d185cbdf51141adc91c1b160
SHA512 047eeb18f8862a669515c34bb455b727d09fc609f089d16e54c90f4c332fe2e9908cdbf0a86965d1e29c0b2572912bc5101c3091d58b3b19489377e6a987e031
SSDEEP 1536:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlmbEVdOw21:c6nHvPxMUsglU4AEOR
TLSH
T1DC330133DF60B6454625907096D7BE882F3B7513EBB2DCA815586689AFC013858FACDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99AA36FCB2CA0201618852C8AE502A78232FDBB2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fqkq4vem.default-release\cache2\entries\99AA36FCB2CA0201618852C8AE502A78232FDBB2
Size 43KB
SHA256 8ace8b1fc801f3ec75289e6e230d3de599af1e22f5dc65173e20a6aac66d1105
MD5 8d528855aa5f7f4dcb16751fdde0bc1a
SHA1 1425fd32c5e6f40e3ce1b4f2f5ae0e2384746f0f
SHA512 200eccbe9e049ed552fc4b98ff91cc95939f64270a0e16c261aeeb87d59ffab5037f2b0a478e50c9502e1aa9d85d1af43aa30608ed0e5ab2648be523e4c6d764
SSDEEP 768:Pr8FwJ2kfmG7rCq0GJtSBVRF0UGuEuOZejwpiUCTVwiYAAItRF4N2lA0AItRF4NG:PVJ3fd7rCqduSduOZnIVVwvQ4wlF4wlJ
TLSH
T1F013F17A74022DB43F906F6098EEE08D0F59F9431DD394E9EE4DC3068254EAE58B536D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fqkq4vem.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 d81af8151c331c21813131938e22a3b347b45f6e6e903e61c0948882f57caf23
MD5 97c0af779418bd90874b6428451e4399
SHA1 661f98911b7205dc8a7379000e82d86dcc5b6212
SHA512 e51de2bf93dde4b609c68937282ed81f93a9bcb01f7ffa968fbf9d07e552fe065136f519c38fd64f982fc6f3a5b43cf95a5eb28aa31c71ed360f651f5d07f916
SSDEEP 384:HUr7iO024Yzo6J+Sl1xDnZBPsac4j0lpDII+9DgR0DgRX:0SZYzo0+Sl7zZlsac4ID8L9pM
TLSH
T18F528E7A9F0138B92A67C490E9FE9244CE05E6BFEEE2D05605143C04CA847F9F4E649F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\AlternateServices.bin
Size 12KB
SHA256 dc8141f61efd72eaabb701725673c2a4457394a34c34d8796b69949559e737ff
MD5 c6844a2eb6e2f87971b036811efe635a
SHA1 da68a251f1a6e8a2ded7aed53f3c55d257193a5b
SHA512 d4070e620e23e046dd18a40d8cc105cf54e4a6c99fe17d0b5d6b245bee4053d69db2479f4e56e4647e3d863846c39ded277e02f07ed04bb934193bcde3d26afd
SSDEEP 48:p6RJzo14zdS2k4THj3OQzCRwzuHyXzzirwz:pcxouzC4Lj3OQzC+zuHyXzzirwz
TLSH
T1FE4238E78BF69565F0BA8FB4C06972CC9C23059A3DA481406F76C0A652D6790D0AFF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f4af07dc6ea052f4443432351f55dc8f206774b39774d336150ef92e741adbd9
MD5 862b63f065e8bb2014b9c232353569f9
SHA1 d4573451dfe2158be5fe18b57fa81c182ef8da39
SHA512 bb2029ad77ba3c2f2b9d87ecca04418ba842da7e4ae005a228b03e461ce3fe3bfc122d05b5a3bd580d18b06a8eb393a682894071b45d482286c8aa31539e8603
SSDEEP 192:iOv5zbodZVTyjtHO1d66JozGzgCl6mc0d:BbodZVTyjOd66JozGzgC1j
TLSH
T1C1D1B968F63D963FC418123BCDA61B500E76389A984E3F65329C641C2C973DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 392fe5235fd2e9b6ea6e2a4d69f6556bfdad666c779f424a73df963a53e9ffcf
MD5 1c666b42b36e69bc6cb1c2736b850875
SHA1 ee4c5239515c07898081c3e726835d4be14d5dbe
SHA512 f0c1af49cbd8146aa5446bd2edbb301330185610417eafc226dd8a1c21d63542ba22bbf609c310c006e530dd561be3da1bddc9bd67312da9aaad1658563cfecb
SSDEEP 192:pO1d66JozGzgCl6mc0dYOv5zboP4ZVTyjDO:2d66JozGzgC1jxboQZVTyj
TLSH
T19CE1ED64E63D867FC414127BCDA61B410F39389A984E3F29359CA01C2C573DD768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8391eab1eba9f873b461fc74c986faff14ccd8b57be38e53666464c00eb4800e
MD5 2f948172d12103abb2ef67568408bc21
SHA1 f14552eec9a20c78a6690c347e0fa2127e8d7ac7
SHA512 a19ee8a63d9c47a198419464fd82ffdd9d2d570b0b1d281560fe8302dfd5196a40ece91d4d286b6b4adb7e975c4d52e48dd1bedd1095f5411a00fd77b6e9d551
SSDEEP 192:OOv5zboP2VTyjDO7Z1d66JozGzgCl6mc0d:Fbo+VTyjwd66JozGzgC1j
TLSH
T1ECF1ED64E639867FC418127BCCA61B514F39389A984E3F19359CA01C2C973DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 cfa8ecf1f359d94904df361698f4584070c1bc1a422724029687f396bb60fe0f
MD5 47e18d4870768697e64d3899c59c96b2
SHA1 e8ffc5ff5f28bd40616b7cb7865f29fa1bc8c9b7
SHA512 73335fe4d8720a744d975a484e0ccade40479de20c8a8b7d7f01efd9e3f3eae9222f6a6cb950d1fb4d8546731bc12c8b824f1564f98876688a9e3a352b56c327
SSDEEP 192:pO1d66JozGzgCl6mc0d4Ov5zboP2VTyjDO+:2d66JozGzgC1j9bo+VTyjb
TLSH
T1B7E1ED64E63D867FC414127BCCA61B414F39389A984E3F19359CA41C2C973DD768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 948cc91d3cf2fc4567e1bb95e9c0b43179f6a54ae3a4ab246b012f91060c47f1
MD5 697ab6ae3bc39e0e9a42c66972933d1a
SHA1 c2395ef47480b5449aa80d66874f160a54992328
SHA512 acc0d85246bd2e945fda6f9206c2770c08288707c1a59b56ed878499a8b7d895bafee8bc5921f6d2eceeadfc6dd7740aba4393f1ee0facdb0126f358b4c45937
TLSH
T17761B458F229863FE444413ACC821F412F343856A8AF7F2A39ACA04D1E4B3CD768D57E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5ebea83e0183dca968f2b54f35e7402abb3cf5e979a025a55b00c25a8397cdeb
MD5 505edfa7e61708e073723f4c11b4e09e
SHA1 121469f866a3ab520afd895c45e4cb8778a5a131
SHA512 e4cde4549861469216f70ac4478e9e1af39c6c5c9eb02ea5732729cd0eab2b6555e89e5c814dc1aa67e323ca72a33deb1ad8b5848fd8943cf58d7f8c921588b7
TLSH
T1BC21289C3EFD4D6A58DAE29CB480018E53554A0714C72D431D42DF8DCDD5AD9316B43D
MD5 SHA1 SHA512 TLSH

Submit Download

1900f62a-02eb-4f29-b149-c29600b4bfc4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\1900f62a-02eb-4f29-b149-c29600b4bfc4
Size 2KB
SHA256 357367366db880c8486e78fa65bf2991f8b9e7dc562838fdadc062bfff7237fd
MD5 beefc873518e1bfcc6be5b69f394bccc
SHA1 8435f17916b855a3cf66e2c4ec575c0def683572
SHA512 452801e0299310ccc6ba097f3e234247ca4371c89afb312cb6c9e556b71e27c55780b3594e94f927751207f1f03d774eceed3e9997ab11e907173a41331d3c2b
TLSH
T17F41F06C757C5DB69CEAF19C9882338E97644A0300C62CC72D51EE4C8CDA76D236E97B
MD5 SHA1 SHA512 TLSH

Submit Download

1bf59e5e-990f-4ca8-a193-8a16fb971fcc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\1bf59e5e-990f-4ca8-a193-8a16fb971fcc
Size 14KB
SHA256 067cfb271e88403b33df83e4577ac2e451a900140ef9eb9e7ec074815f11825d
MD5 eb70a85914f36ffea9c30677da667075
SHA1 cf4f84cfbb7dd7968aba5d489eacd95b56e93070
SHA512 5407b4c05899c5934424b6f83de42e1710ea4c1b5b27f73df8bcf8951beae3e750756b4beabcfe296ae1a3986fb14e773051c76117816fdf62f5b5dddfc7e731
SSDEEP 96:vvWNv2UgQQ2C4G/78vZMpzkkEyI5kNtT7u3/ofEboEeP8JdSPYcEjSYaMQq8fjhr:vviMV3IknUSnyUQct8wsXYB9/jC90v
TLSH
T1D962AAFDCD1201473E65E51AF2A9EDAB2057293209CCC79D6AFC483A27C6DBB0563325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87026384-b1bf-40a6-8e3e-6507aaf0fb7c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\87026384-b1bf-40a6-8e3e-6507aaf0fb7c
Size 886B
SHA256 b900eb81522dfe47265c1b0866d4db6bf8f33280a6e93bc645e5461335cbcf35
MD5 3884558059f4b5f0edc460b47935c22a
SHA1 ad89052822af5c77fb8ac7e2f058564e9b9ca6ac
SHA512 414d940a60c508439709eb95324d99da6a3caf9096cca0d5af443d520dd01399cb78a42b7eca76874690876bd575b945cdd95937aa24bbb0004618b2e3169fb1
TLSH
T1091123409679B5B3CC78A24B95E17B434BD43023C0C519147FA09A2C4CFB22EA3BA30B
MD5 SHA1 SHA512 TLSH

Submit Download

90fc3e15-a91e-4020-bc7f-bc14a3681aa0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\90fc3e15-a91e-4020-bc7f-bc14a3681aa0
Size 883B
SHA256 b873832f85bf346071ab4ae5e847088f91f51ff8c9158c801b83de7bf5b51587
MD5 a95c2f1a7717891684f97afc5fbc37e4
SHA1 6c4a254da15ae56f97e7bc4c1d0b7c78d2a860d0
SHA512 cde01f696383a2b06fa1bd37c3f52b6a0244e67ba5725aa1aaa561ae4d90bc214d44c5d2387618a9169db36a92e0ec1d7b3a04b1325796b6f42521d9dd95631c
TLSH
T1BC112351D63979B6CC7CA20BC99637025BE46523C0C655643EB09A080CBF62D93AA74B
MD5 SHA1 SHA512 TLSH

Submit Download

b71a6026-3574-49f7-b530-9d0f99caae09

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\b71a6026-3574-49f7-b530-9d0f99caae09
Size 235B
SHA256 225b8519b9412e904276b08e17847dd40d7f371f33c1dd5e5f8b8e67410bc7ba
MD5 30326ef96a42ed9808f7e33207d8953d
SHA1 5df77c252078ccbf7fd55cb373bf8fa11404a9ff
SHA512 a17ecd8c273d378ffaa1843a79acf18e60a6d505334a65ca8a76775007ce125fd34824c428f1b4dbba7896f15d80af3dc7514ef916b0225d841f7033c7eb401a
TLSH
T1F5D0A7D1A4A8A75E4C155F1BB0E0A9C631588C3314A86C3499514578D9FDEC44352957
MD5 SHA1 SHA512 TLSH

Submit Download

cc22512a-76b9-4191-92e9-8c9c8f449134

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\cc22512a-76b9-4191-92e9-8c9c8f449134
Size 16KB
SHA256 bb3990aec9e4dfb061baac9e8f59494a25b4793e586219be4c5a12d5ec147a19
MD5 fbc99f50894b4600fc98485fb9a962af
SHA1 c1f7e56d175ccf2a4da042741653963c4e389fcc
SHA512 fa0fb7f6f69632964d0d3c1439e6330064d1cf7e7f3899561d5a9ff05e96018fbfdb5c47d582a83cfc34c1fd40cef962899da1afb32bb0aee28e034a77a4bf8f
SSDEEP 192:F1Li0RyDuPdMBCEHn8iCFSj7Ns3kNsXJR/kmajdjb1mYnBsr1zphIcCqPilx:FBi0Ryar/km6jQEy1FacCqPij
TLSH
T1DA72C8162460497A8691E36894FCBFC3E6F538CF4C419FCA9BE4BD046AEF06D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7fb93fd-4302-4ace-9016-d8a0d5adadaf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\f7fb93fd-4302-4ace-9016-d8a0d5adadaf
Size 235B
SHA256 031efa23903620dff790c191d068e45b41cab3f73edda9c8c130a22631d1868d
MD5 f9407bec54d4d3e109ea35af456d4763
SHA1 763774d199ff6cabdeaa9302add059c5a74b7a42
SHA512 4ee254a91b8384565582b5f2d15de4b4f379d6e8a1adc0a533d21be20d7774ba80c9c0e7a9c69692710182ca748d29e8e4965abb28ba40fdafe2c4c60f515849
TLSH
T139D097C02898635C080D0F0AB0E0BACA70894C3320B46820D97105BC9DBDAC88272816
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\extensions.json
Size 16KB
SHA256 bb827a623476720be940bb17867ee97532c8428dd906f00298b2ad21a2ea5da7
MD5 5a67121dc6694c06012acea7cc4ed123
SHA1 99c4846b4774cd9756cda866af631e2d78721a4c
SHA512 e7df97ec9328d8498955386cd6b1abb81130a937664d3695b3fd536ed33856eee289ea6f06992ba13d3e0037921c45484bafe21d6ca7ae44bf7f6c20577b09ea
SSDEEP 384:vkI4vJUmldvi8dhWR94zE96oj5L4HtL4PDL4H+L4HRL4HUI4h/:cI4BRfHXc4c6G4N4H4k4p4F4p
TLSH
T11772421545048EB8298FA79BAA367E01C37D573B60845C38F4DD8FC802FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs-1.js
Size 11KB
SHA256 6f6b58dfd43b2ac2a8eb8efbc9b13ef0fda93622fe519a5f33e11aca5ef54686
MD5 80ba1a01a7288267c6bd837dcd47fb54
SHA1 2711dad77a2b6515a77003b0d19931bb31ab762b
SHA512 2ee7cc1f77dd3aeaa800284934f40eaee980b848ee1b81aa26d714984b509ce5fbba3b66f4766d9e960655ac1a090ec71f0231236622498160e4b4a7bfece5d7
SSDEEP 192:tXCRsfDO++SSVLRLZIQ73mBw8Oo8SsbpWZ5R1Mg3nTkwC+2Cyxr9kkq0qvXmgrgC:bYRVVIwmUY
TLSH
T19642FC3C56148BBF25B2327DBC25C9B419A1022776BFBCD315F89891041CF6941EAAFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs-1.js
Size 7KB
SHA256 dc57b95b98601048ec57c6fba564634b14d7c6b5a9cafd928f1b86ea3988a2fd
MD5 a00fd996da3859449433d7c1a75d43ee
SHA1 dc80f0d8728854cbdc23fa53430972546d257f7a
SHA512 33ff99cd9f2030c7fd682431f771cbdf29944d65e50e8b04d04f6726fb0a7e10e6b2ba6e222e0fd339c3a8741ef81bd7c980b6bea32d7ec7f145f1e5b23e9c43
SSDEEP 96:xHX9TUDqGqd2EfDO+ObzSeyOSSlDdv9jXnhWRGKZYu9WPuBw88gTgrw8L4cnaVdX:tfRRfDO++SSaRLZgPuBw88gTgrin
TLSH
T184F1FD789518CFBF65B6766CAC288C705AA2013B77BF68C710B954940508F3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs.js
Size 6KB
SHA256 71167452a69c537df1c43a586720f68a8e24c88aefb5269b2a2833861b91cede
MD5 cfbf5c5e4c4aeccfff89d146685aab25
SHA1 cc4039cd22711e09aa68382d84822c10ad9245fc
SHA512 affd7508b03e87d562cbd369d03a69fbcfc529e0b39dd7591e0170776c7ad367b1340fff581113c83123feb6cb82a9e5132e71c7a194ff7ac1489b85e4bc2747
SSDEEP 96:xHXUTUDqGqd2EfNO+ObzSeyOSSlDdv9jXnhHOZYu9fBw88n8L4cnaVQX:teRRfNO++SST8ZxBw88Ds
TLSH
T1A3E11F7895088B7F75B6766CAC6488716AB2013BB6BF68C710B954C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs.js
Size 6KB
SHA256 601a57d4f0a95fb438f2906abe5693d2097cd06052ba0323cf806026b5c6290b
MD5 adc48de9be3acf3201b578963bcba066
SHA1 a75b30518fa0544612d88efde9084ff9cc3b6740
SHA512 53305a48f38e478ec2746503e58aa681e706591e831d0b80c28a139296a6b5e950d3bc51f3ca18c29b64635557c9f0c0c00d6dc7851ae90a0d97d224faf9032a
SSDEEP 96:xHXUTUDqGqd2EfNO+1zSeyOSSlDdv9jXnhHOZYu9fBw88n8L4cnaVQX:teRRfNO+1SST8ZxBw88Ds
TLSH
T1E4E10E7895088B7F74B6766CAC6888716AB2413BB6BF68C710B954C4014CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs.js
Size 6KB
SHA256 87f3be9dfd49bdd67da2d0b2795eae9e4c160047ac7f479087cd69e668e8d815
MD5 cbae13cc85b9f82fa6f44c1dc14a9aca
SHA1 86c8a21f8c063f94f27a874d1100b8944bf4291b
SHA512 380196d49bb1e4321dd6a5ebee173d54cbfda9d7919f1eee85631efcb4298e5847fb3f839d78bfdf90116c271f29961a78f1518896c1017372bf4c07fc63ac17
SSDEEP 96:xHXUTUDqGqd2EfNt01zSeNSSlDdv9j3nhHOZYu9fBw88n8L4cnaVQX:teRRfNt0LNSS78ZxBw88Ds
TLSH
T15AE110789008CF7F75B676ACAC6888716AB2013BB7BF68C610B554C5054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\sessionstore-backups\recovery.baklz4
Size 62KB
SHA256 0124e7a684d1b5ac8abc8e2e3fce9e0bd86db55b38bb661dc95b0aa665d5b818
MD5 130de350f0a76f25bd78a16dea9d5d60
SHA1 bf51aec86d0a94d7787e07e94be478a40b4b8809
SHA512 17ff620b53e23c7e90516ab659135305741434587219bd5d8815720af8085fa7c6ff2070157e74d1fc0a3870951e7b5df94eae2d4c8ac758d9766cb3e8aeda26
SSDEEP 768:8GjRpLqq9AfRXjIs8MFGGA1VU7i9S2nTjLevtQTGKCEbkGbY/N5MmNFh5DWn37Wf:JzqfR9VG9UqjL2IGKC2k1FhFWnrWf
TLSH
T1D55302037F9EABA9808545BA4CC416078B385DEF14A456F448CCBCC687BC5B5CE2D66F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\sessionstore-backups\recovery.baklz4
Size 63KB
SHA256 6d8cb7f6c22daf3e7c598a5f46a89c8311fef5516dfd67f86c993cf61848cdad
MD5 3573b0c6cbf6c6d55475787d66e8e2fe
SHA1 d3e045c096f3674953e73fe826f883963b5ff9c2
SHA512 b8ce4b6edc911455b6dac11b1814ac44ea0e046ce23990d6dc8c7c7df4fe1545b70c3c4ccc80579bd9335d6befef17230e79f8fe53e4aeacbbc1d6e5877f664f
SSDEEP 768:W1jRpLqq9AfRXjIs8MFGGA1VU7i9S2nTjLevtQTGKCEbkGbY/N5MmNFh5DWn37W6:EzqfR9VG9UqjL2IGKC2k1FhFWnrWds
TLSH
T1465301437F9FA7A9808A45A64CD426078F386DEF54A815B444CC7CC287BC974CE2E66F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\sessionstore-backups\recovery.baklz4
Size 62KB
SHA256 5f3c4c345cfbd6a236a5681d1140840c10f72b62a5912f0da4a443d1a900bf52
MD5 67d3dfbb514223118946d8bd39138ef4
SHA1 b3dadac8ae87249dc471d9fb483dc0cae6498623
SHA512 7e5424d7cf3b851edb2a3082f3455cc37cc4832473324d204fd8a97a77ff3db593e89c8922c209993776e2498ae6adfe22d205812012ac053fd5489fe6fec4bc
SSDEEP 768:ICjRpLqq9AfRXjIs8MFGGA1VU7i9S2nTjLevtQTGKCEbkGbY/N5MmNFh5DWn37Wd:NzqfR9VG9UqjL2IGKC2k1FhFWnrWd
TLSH
T1B15302037F9EABA9808545F64CC416078B385DEF14A856F448CC7CC687BC975CE2D66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 ff2cced55c392c2d2d21739cb0911f4fd0cbfed0212d6749fffb5875b49330fc
MD5 00d0087c00e4c3773e4115e7dda528d5
SHA1 c7e51d56130189035bbe46841f05664bde1f26e1
SHA512 411ab704c5dff4710b62f30425ba9e488c079f1ddad1c802f88c425f0ec86f48b26f1b6e8b63a2a0b9cc6527ef157c6dea4d1d370369026fe8d67180a753d7d1
SSDEEP 49152:TTf9NtyjmlKH0jNpE1x8Y4gb585Z3YIRWz1OpRo:XVNIjmlKH0jNm8Y4gb5AW5
TLSH
T10A464BE860D1A243F3818073B58993EB21FFD00C6077DE4857A856A9A574CEF8E177AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NexusMods.exe

Path C:\Users\Admin\Downloads\NexusMods\NexusMods.exe
Size 3.3MB
SHA256 a65b87ad7e6f2e41027622b9c8b056f9ef4f025499829bb3df8b3dddb61c7e7b
MD5 eff563cc0fe920ffc5bf13eae72e83c2
SHA1 7e840d997040915e91ea19825898dedba6e06bf4
SHA512 5fb5a7e71f534cc79b1ea8dc90ac2e3b635ee9962466e12ab224b7cc9b0c44910ac70e659e1479afc9130b31de6b41b93387ff51312ed3a00e8ed8df17010aab
SSDEEP 49152:Rq17/vb3ZzgD2kiUhBHNuF10iFYwpoUvH0i48:RsdgDNDuF1TZpoUvH0i48
TLSH
T173F5074369DB0DE9DED277BC62C35335A774FD718F2A1E2AAA04C13129536C4AD2EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/976-1485-0x0000015D40F90000-0x0000015D40FDF000-memory.dmp

Download

memory/976-1490-0x00007FF7EFA40000-0x00007FF7EFBE1000-memory.dmp

Download