hxxps://bincheak[.]io

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/06/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bincheak.io
Sample260615-sa6mlaey7p

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3272	firefox.exe
Token: SeDebugPrivilege	3272	firefox.exe
Token: SeDebugPrivilege	3272	firefox.exe
Token: SeDebugPrivilege	3272	firefox.exe
Token: SeDebugPrivilege	3272	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3272	firefox.exe
3272	firefox.exe
3272	firefox.exe
3272	firefox.exe
3272	firefox.exe
3272	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3272	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 3272	4652	firefox.exe	80
PID 4652 wrote to memory of 3272	4652	firefox.exe	80
PID 3272 wrote to memory of 3032	3272	firefox.exe	81
PID 3272 wrote to memory of 3032	3272	firefox.exe	81
PID 3272 wrote to memory of 3032	3272	firefox.exe	81
PID 3272 wrote to memory of 3376	3272	firefox.exe	82
PID 3272 wrote to memory of 3376	3272	firefox.exe	82
PID 3272 wrote to memory of 3376	3272	firefox.exe	82
PID 3272 wrote to memory of 3376	3272	firefox.exe	82
PID 3272 wrote to memory of 4412	3272	firefox.exe	83
PID 3272 wrote to memory of 4412	3272	firefox.exe	83
PID 3272 wrote to memory of 4412	3272	firefox.exe	83
PID 3272 wrote to memory of 4412	3272	firefox.exe	83
PID 3272 wrote to memory of 3996	3272	firefox.exe	84
PID 3272 wrote to memory of 3996	3272	firefox.exe	84
PID 3272 wrote to memory of 3996	3272	firefox.exe	84
PID 3272 wrote to memory of 3932	3272	firefox.exe	85
PID 3272 wrote to memory of 3932	3272	firefox.exe	85
PID 3272 wrote to memory of 3932	3272	firefox.exe	85
PID 3272 wrote to memory of 3932	3272	firefox.exe	85
PID 3272 wrote to memory of 3492	3272	firefox.exe	86
PID 3272 wrote to memory of 3492	3272	firefox.exe	86
PID 3272 wrote to memory of 3492	3272	firefox.exe	86
PID 3272 wrote to memory of 3492	3272	firefox.exe	86
PID 3272 wrote to memory of 1672	3272	firefox.exe	87
PID 3272 wrote to memory of 1672	3272	firefox.exe	87
PID 3272 wrote to memory of 1672	3272	firefox.exe	87
PID 3272 wrote to memory of 1672	3272	firefox.exe	87
PID 3272 wrote to memory of 4992	3272	firefox.exe	88
PID 3272 wrote to memory of 4992	3272	firefox.exe	88
PID 3272 wrote to memory of 4992	3272	firefox.exe	88
PID 3272 wrote to memory of 4992	3272	firefox.exe	88
PID 3272 wrote to memory of 1284	3272	firefox.exe	89
PID 3272 wrote to memory of 1284	3272	firefox.exe	89
PID 3272 wrote to memory of 1284	3272	firefox.exe	89
PID 3272 wrote to memory of 1284	3272	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://bincheak.io"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://bincheak.io
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {22e61de8-d759-4535-aa9c-ce9f70d97527} -parentPid 3272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3272" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27133 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {25aaaa78-1898-4dd7-ae1b-0a8e5272bdb6} -parentPid 3272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3800 -prefsLen 25164 -prefMapHandle 3804 -prefMapSize 270279 -jsInitHandle 3808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3816 -initialChannelId {31cce872-6117-4990-93da-c2957a985eef} -parentPid 3272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3968 -prefsLen 27274 -prefMapHandle 3972 -prefMapSize 270279 -ipcHandle 4040 -initialChannelId {79090915-0add-497d-b66c-ff3ccc4898d9} -parentPid 3272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3272" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2940 -prefsLen 34773 -prefMapHandle 3300 -prefMapSize 270279 -jsInitHandle 3332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3036 -initialChannelId {a1b75487-55a8-4a07-8670-9bdf227579d2} -parentPid 3272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5048 -prefsLen 34903 -prefMapHandle 5052 -prefMapSize 270279 -ipcHandle 5056 -initialChannelId {2a21ed86-e4d1-4db8-9cbc-52ca008d4d2c} -parentPid 3272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5548 -prefsLen 32952 -prefMapHandle 5552 -prefMapSize 270279 -jsInitHandle 5556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5560 -initialChannelId {2990b322-05f1-4724-9151-c029d8710342} -parentPid 3272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 32952 -prefMapHandle 5760 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5768 -initialChannelId {ebe9f1e3-a33f-4888-b69e-964927f4b013} -parentPid 3272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5940 -prefsLen 32952 -prefMapHandle 5944 -prefMapSize 270279 -jsInitHandle 5948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5956 -initialChannelId {36ec8d11-fe57-4c20-9c0f-aa6c479fa67a} -parentPid 3272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 9a37171c6a84708d824c18e321d45846838da9b6a29e8ccb5e65013fa975db2c
MD5 0b6283bfe2d3d5002228de95c0bb9e54
SHA1 164c15386c8c2fb97aadf283bbfae3efb3ab3784
SHA512 efedfecc6da6166197482abf7806b9c40b7e555830a8e43d697cdc0192141a1e7e827c630912296480bfc1a504bbdf429324d5b1234a7d6ea0c4cef9bd9ba834
SSDEEP 384:HPC9iO024YMo6J+Sl1xDnZBPsac4j0lpDII+bkG:v9ZYMo0+Sl7zZlsac4ID8LJ
TLSH
T134529E7A9F0238AA1A27D095D5FD9344CD04E6BFDEE2D05606143C14CA847B9F4E68DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 f5309dede5c457bfb2f1e300354b472353a6e617a688ee0d75e2bd0c3e8fdb53
MD5 27dd87078e1255c98b21c8532219adaf
SHA1 9d90b20b0d78e0cdeca987b02ae87ac5c2228c46
SHA512 a837322dde710de323c9eaa397d8019aa22d905a4f942e207cd334600fdce15db07b62b594a635aed0387baa5f9ea51c146805f166eddedec46bf4f0c71f1fdd
SSDEEP 96:zkRFC2FNFzFOFY/dd66Joz0dzgClKtmc0d/UwI07IaSdF95/7bkW6QXjrvEhIKSe:o1d66Joz0dzgCl6mc0dlI07IaOv5zbop
TLSH
T11EC1CA68F628563BC408023FCCA51B500F76385BAC5E7F2931DC24592D962DE7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d21bf3a8c0ee1de40a8fe27bd9beacd09dee9f5fc2761fa5a084926c5a8f9a44
MD5 1d69f4fd7522b77241433e1a27a4eb65
SHA1 5ad0910fd907b1f152b8a13b9056198ff9c9621c
SHA512 caa990677c71969f8184e7d00f8ed6fab5d5b4f46363571bf61e2d62ba79bff1bd8f4a94b15c88cbb0a783d8404a3cd5891cd3215282ea3770b557c90c83d62b
SSDEEP 192:o1d66Joz0dzgCl6mc0dyI07IaOv5zboH4ZhIKSyjoIAxI:Cd66JozQzgC1jMzkboYZhVSyjo4
TLSH
T1A0D1EB98F628963BC414023BDCA61B500F36388A9C4E7F2931DC245D2D972DD7B9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\events\events
Size 1KB
SHA256 638d79ec06b3049ac2c1a4f37072c131b03f7b370de57d5d7a5a113c8eab31f6
MD5 1c5acb2153bcd17e5558191372c5ba58
SHA1 67d2879a14343f457d9a6a358b7da3fdd6b90eef
SHA512 73f045d4bf44219500ffce6bbc8bb9c298ec040d861e6e5f9fd23059fbb3a924a03c66efd5e9c66213a58c6986138963f3bfd6ede0929c0926c178940f2d6919
TLSH
T1CE213A9C3AF84D2F9CC7EA9C7441228E53954E57048B5D470D42FF8DCED1AD9326A438
MD5 SHA1 SHA512 TLSH

Submit Download

389b13f5-ac4b-483b-895e-cfaa08b26666

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\389b13f5-ac4b-483b-895e-cfaa08b26666
Size 2KB
SHA256 156ddf2dc44efc5fcb0a41abc8a123220680b84bb39ce375c4dc52b42ce74e65
MD5 6b2795d4983f94a676e4fb1ca5373430
SHA1 07fe61ca9ac64844e2b263f86d1214da391c140a
SHA512 f162e45436cf2b5a7a1c2b7270b231a86409f6a32106a39e5216585e2defa54a0e9ba953947fa70cfc9270050cee9df9cba8ee49c492bf658fdc9f4441534813
TLSH
T1DB41339C36789DB69C9AF69DD5C2274D47A0890300C26C932E61EF0CCC9679E336A53B
MD5 SHA1 SHA512 TLSH

Submit Download

886a17f8-0596-4d2f-8f2d-67a4bd3aa3aa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\886a17f8-0596-4d2f-8f2d-67a4bd3aa3aa
Size 883B
SHA256 9c4ad5c3df194e7edbfd1ff5db176a83487098d7842d450f279596f03d9558ee
MD5 15816428bac71a27e5d78eec09fe7ea0
SHA1 d51ff55c3b66675f39e4bc387cfac153e98d3bb2
SHA512 b2a1b2a789c31764701afdd17ae38df72d0ba44144df04f54892e373e2048e1019179571727fcb75c68846f0e21cf6689225d57915e90fb61906b71cd31d3d71
TLSH
T1D71127C19538B5B2DC38D24F8A9137428BE4752384C595543E915E140DBE57E637620B
MD5 SHA1 SHA512 TLSH

Submit Download

9e564bd2-fa30-49b9-92c7-f1339e266cbd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\9e564bd2-fa30-49b9-92c7-f1339e266cbd
Size 2KB
SHA256 0362b365cb5eb252793a48d3793a77aa7d2cc98c4b5bfb3bc050b34ac1894f00
MD5 e711fa29f5ebfe86a74029254a1a1e11
SHA1 ebc55972365971f35d05468a4198176ba21ea9f2
SHA512 da59eb364e5d0ca53d0dbcc070fa9bc783f6215c8039c12d7cb73903110057708ddc0dc65a3d0b59eb25ab8758b3152175a26fb14c8b6485f17f8bb1ac2e9660
TLSH
T19B51A66A4124DC7EC979B31BDD2137828BF3140B408B194EAEDCAF0B157FD5E9359609
MD5 SHA1 SHA512 TLSH

Submit Download

f7ac6b44-ccaf-4683-b5f2-b0e39f52b657

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\f7ac6b44-ccaf-4683-b5f2-b0e39f52b657
Size 235B
SHA256 98ef48052399494b05ba7ddf84c2e3054b80698290d6d49ea38ec1f2da599fa6
MD5 120701be1bc841b447ed877d5f1e496e
SHA1 4624e5a5be7a2011b391606f574f6404b67b1e8b
SHA512 2f3393104b8063a05bdecc145e4cd5472b7a4521fa8a3a4ae2f3d96158f0f476c27d6f77bb94be3714ca20ea2dc2937603996141184f219ea3d0e1ad7b2eb8a6
TLSH
T15BD023C2188CBF5D08240F43F0E06DC331888C3324B49820C9A0A178DAFCDCC0291C17
MD5 SHA1 SHA512 TLSH

Submit Download

f8bd7d18-4f6f-4f42-b576-f0c990e03964

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\f8bd7d18-4f6f-4f42-b576-f0c990e03964
Size 886B
SHA256 5f6ae194474fc99135adaf8c1b2db7ddbbae790f7ab2e7eed15fa1e50374d6b9
MD5 dae5eee385e1fcff510059b1620192db
SHA1 0b3f628ae22af332856bd0c392e77fe6e6375ad4
SHA512 7dc04a05845023f3acefdcf6abd7ccf3fd23b0c0837ec9466955edee5b216dbf03e4d811bcf6feb066a95bbc950e082449351ee81084fed6dff6102d829c1d0b
TLSH
T17B1100C18638B972CC28D28F95E1BB4647F47413D0C659283E945B180DAB56FA3B670B
MD5 SHA1 SHA512 TLSH

Submit Download

fd072387-7341-42eb-8eed-46487225504f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\fd072387-7341-42eb-8eed-46487225504f
Size 235B
SHA256 16e361e5bf69b3904308acf001146551407b8bd8dcad8125b8cbb525f550c83e
MD5 5ec58b9d6a0946bdf6b4d74d7426ca64
SHA1 d3417e4bf250d18741e3e14bd1d6aa99bb70294b
SHA512 12aefc6c87d116c13fa565713a50f7b49948baac61b5a3ffebef4c8736c9305a04ba2b84a80f284e6941daa4b2b548e84e424e954505167f73ce3b47d6dcb854
TLSH
T1DDD097C42488A76D0C080F4BF0A02CC630458C331860AC2196A180788EB8EC84273927
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\extensions.json
Size 16KB
SHA256 a4b2a7a0bac55a51357074dd2ff8b1f668f6f1924e9862980aa4842303d39c14
MD5 fd3dfbfde8898d373d5e6034aabdee0f
SHA1 198d3b4ceb74c7e2e0f3bdb2355b53a4d2f454ac
SHA512 d600912dd03f0138ff2523034f9f5abca5c19252d7b7e63d5ebc660dff2e927d1c0d8ae3e65695f878960fe1c3f737fb56dca3bcc2db63d22b4d41fe51c7260d
SSDEEP 384:YkI4vIUmldv68dhWR94zX896oKL4HUL4Pw5L4H3L4HRL4HCpIC4hU3:PI4ARf/Xo4M6f4u4ox4b4p4a540
TLSH
T1D772531545049EB8298FA79AAA367E01C37D433B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs-1.js
Size 8KB
SHA256 19b2d12d533ff53bd0e3044740dd548b54fba2f58abe5fe9955f9c226b69d1f2
MD5 fbd04e6d2b6949316b9f1e2f26ecc836
SHA1 93d8bd886f4cba5314de9bc3c0b5d5f4b93f76ee
SHA512 79c5c97ae11b8d83c8524bdfbc2b576e9294a77257d624fcfc8bbb7d5a41e27926316f144af7d61a605a4af23849a5ff10d6eb104bd4e8ccb14d4ad33501c35f
SSDEEP 96:xH/NTULXqGqSfootUcObzSNlSSl+dv9j5nRERWR6IgnjKLyDYBw88OGQhQ8L4cn3:h+6RSfootUcXlSSp8R6IO+Bw88ewI5
TLSH
T17E023F785104CF7F74B6766CAC2449315A72023B76BFA8C714B954D5058CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs.js
Size 6KB
SHA256 772d02bd9b9e85e1a198b8cd2cd838382a3f87a96560eb83eb3db500a01e50b9
MD5 b772618893706ab58f1d59dde45c170b
SHA1 e3be38a0a67654619ac7c4c9df34e25df7d8bba6
SHA512 47944cc299b91fdb839ecdc223c3432f1780b446f8b8bb9eb347650bc5a0f5dc50f1b0f84f8a7ebeadc2d731a23be8da1d67140b08542cfca8697d0eb0730374
SSDEEP 96:xH/UTULXqGqSfwpmk1zSBQSSl+dv9jMnnRERHPKLy4Bw88H8L4cnEiIym:hb6RSfwpmksQSSlq9PuBw888I5
TLSH
T125E13F7894088F7F74B677ACAC6888315AB2013B7BBF68C310B94485055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs.js
Size 6KB
SHA256 1e3b6d094529bd22ce7b373d30abaa7bf1ebdbfa945b5c07ad2619f1ffc6ef09
MD5 9efe41d95def5555462d8a26fd594b6e
SHA1 4268e95e7a6a23556669a07e17ed221c54288d2c
SHA512 6f0e3419d484e58bed9dec5ab73a7e8c57b197de3e09312ff72a91ee62423ae154e676d526e9f69f9caa3668bd3121e24ed6e7a003be4f58860b6c31f4716956
SSDEEP 96:xH/UTULXqGqSfwUc1zSNlSSl+dv9jMnnRERHPKLy4Bw88H8L4cnEiIym:hb6RSfwUcolSSlq9PuBw888I5
TLSH
T1F1E12F7894088F7F74B676ACAC6888316AB2413B76BF68C710B95485055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 d588323fd0eac452823f14cdbeba2bcae168eefcf58001384bd4d3bac5286058
MD5 f8fc03f2256f3a3c23c20e53df36d033
SHA1 be8e5199c6eda2260140df82fa774c4865566db2
SHA512 c98a4197c272847c75cdcdd44040ce3e4f98d8689ba4c7c3182b175245a5236605517fedaf2e74f40fe8748b1745c1398819ce0da4c3ad5d8dd88d9763fa5f7c
TLSH
T1F621E757A65B1FF7B872F14E9484ABA0C3A5742548B06CF08A8E1E02528DC97F281229
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads