hxxps://bincheak[.]io

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/06/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bincheak.io
Sample260615-sa6mlaey7p

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3836	firefox.exe
Token: SeDebugPrivilege	3836	firefox.exe
Token: SeDebugPrivilege	3836	firefox.exe
Token: SeDebugPrivilege	3836	firefox.exe
Token: SeDebugPrivilege	3836	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3836	firefox.exe
3836	firefox.exe
3836	firefox.exe
3836	firefox.exe
3836	firefox.exe
3836	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3836	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3836	2964	firefox.exe	88
PID 2964 wrote to memory of 3836	2964	firefox.exe	88
PID 3836 wrote to memory of 6072	3836	firefox.exe	89
PID 3836 wrote to memory of 6072	3836	firefox.exe	89
PID 3836 wrote to memory of 6072	3836	firefox.exe	89
PID 3836 wrote to memory of 1504	3836	firefox.exe	90
PID 3836 wrote to memory of 1504	3836	firefox.exe	90
PID 3836 wrote to memory of 1504	3836	firefox.exe	90
PID 3836 wrote to memory of 1504	3836	firefox.exe	90
PID 3836 wrote to memory of 2972	3836	firefox.exe	91
PID 3836 wrote to memory of 2972	3836	firefox.exe	91
PID 3836 wrote to memory of 2972	3836	firefox.exe	91
PID 3836 wrote to memory of 2972	3836	firefox.exe	91
PID 3836 wrote to memory of 3460	3836	firefox.exe	92
PID 3836 wrote to memory of 3460	3836	firefox.exe	92
PID 3836 wrote to memory of 3460	3836	firefox.exe	92
PID 3836 wrote to memory of 1180	3836	firefox.exe	93
PID 3836 wrote to memory of 1180	3836	firefox.exe	93
PID 3836 wrote to memory of 1180	3836	firefox.exe	93
PID 3836 wrote to memory of 1180	3836	firefox.exe	93
PID 3836 wrote to memory of 1388	3836	firefox.exe	94
PID 3836 wrote to memory of 1388	3836	firefox.exe	94
PID 3836 wrote to memory of 1388	3836	firefox.exe	94
PID 3836 wrote to memory of 1388	3836	firefox.exe	94
PID 3836 wrote to memory of 2588	3836	firefox.exe	95
PID 3836 wrote to memory of 2588	3836	firefox.exe	95
PID 3836 wrote to memory of 2588	3836	firefox.exe	95
PID 3836 wrote to memory of 2588	3836	firefox.exe	95
PID 3836 wrote to memory of 6080	3836	firefox.exe	96
PID 3836 wrote to memory of 6080	3836	firefox.exe	96
PID 3836 wrote to memory of 6080	3836	firefox.exe	96
PID 3836 wrote to memory of 6080	3836	firefox.exe	96
PID 3836 wrote to memory of 1840	3836	firefox.exe	97
PID 3836 wrote to memory of 1840	3836	firefox.exe	97
PID 3836 wrote to memory of 1840	3836	firefox.exe	97
PID 3836 wrote to memory of 1840	3836	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://bincheak.io"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://bincheak.io
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {ecb6fda4-7c0a-4246-a5e0-9231e4294311} -parentPid 3836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3836" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {10907a55-57bb-4d01-a7e8-8aa8eb091235} -parentPid 3836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 25213 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {003998a3-aa5f-4ec0-a5bb-e0fdf7a3671b} -parentPid 3836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4028 -prefsLen 27323 -prefMapHandle 4032 -prefMapSize 270279 -ipcHandle 3984 -initialChannelId {48460d8e-536f-476c-9c3d-b69b0242bfe4} -parentPid 3836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3836" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3168 -prefsLen 34822 -prefMapHandle 3092 -prefMapSize 270279 -jsInitHandle 3060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4276 -initialChannelId {ddb20f25-d879-4530-acce-f5f3f7f4c8fe} -parentPid 3836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4384 -prefsLen 34903 -prefMapHandle 2928 -prefMapSize 270279 -ipcHandle 1632 -initialChannelId {ca33f564-a61d-4606-956f-4f6d8e4fb745} -parentPid 3836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5404 -prefsLen 32952 -prefMapHandle 5408 -prefMapSize 270279 -jsInitHandle 5412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5388 -initialChannelId {625d5aae-e5d9-4c75-993a-5d5d0c262906} -parentPid 3836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5428 -prefsLen 32952 -prefMapHandle 5432 -prefMapSize 270279 -jsInitHandle 5436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5384 -initialChannelId {8e2e357e-4c8d-48ca-b6e9-3c97a3f71937} -parentPid 3836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5748 -prefsLen 32952 -prefMapHandle 5752 -prefMapSize 270279 -jsInitHandle 5756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5764 -initialChannelId {c26c3e56-dd9d-48b0-b2e1-0bd699456cd2} -parentPid 3836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 ee9f751bc384e6f622425b436e30206a5b883e65142818e5294d747a8c8a3e08
MD5 acf270902eb4575d369f5c3bd99471f9
SHA1 ce15c34c2fe0c53196df2e26d8ae6771b603d4d4
SHA512 317d2855c7bf1336498c6e59bea0ec67e3ee1db52389fbcfde01f366ada31c94af7cee44b6c8dd4ee29401d64e2657bc16aadaf72542d5751416a91dde58a8e3
SSDEEP 384:HPC9iO024Yfo6J+Sl1xDnZBPsac4j0lpDII+MGa8:v9ZYfo0+Sl7zZlsac4ID8LX
TLSH
T135528DBD9F123CBA1927D4A4D9BD9244CD04E6BFDEE2905A09143C04CA847B9F4E68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 6fd41f7cd10a28342c4bacc4be9da887363fbd3a9603fe3df693734d5707e955
MD5 212170dda5edaa11ce91085a051d4779
SHA1 3ceaeda3cdc3ba8dc7e73548973af1220d4e88c5
SHA512 359491c6e4fe51548604bacb5e2869dd4a5c5c7a185078734377fb08d1d611001fdf5f17435b745582daf0464e166b68d4c0af9b0b1b2b0d29b1cc176a55081d
SSDEEP 3072:j3lOArlKP/2CEloOIWANl+YPz5fidzDskv3Nj8:pOPPWloDdlFzBiZskfNj8
TLSH
T13EA39EF6DFA2CD2D54FFD02D5A81883EFD262444B3A33009C963A71561CAFB87679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f15f4d29f499d7dbdc1df3b3f1074bddf8bbb5c7bfe027e0a01c351ed9ea784a
MD5 ae1b75043cdfd5655483082eaa7bc1a1
SHA1 790d3c8a3a6e6790e2cb50c3e2ed86e4cb709af0
SHA512 512b88222380fb0fbae42174fee50c2393c71dafa20578a4a72b4bfa4543614ce0e3fa9b6aacc8c46c3ffb200449addf135545b9bab99bb2ce2a717e6546e1f9
SSDEEP 192:8Ov5zbo70ZjryjFxq1d66JoztdzgCl6mc0d:/boAZjryj8d66Joz/zgC1j
TLSH
T1DED1EC58F628963BC418027BCCA61F400F35389BA84E2F1935AC744D3D5A2DE7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 884ecbaebf22be1feb98cba4d1adcc3f11cc7f2e9648bcb52a838957eaef1607
MD5 2e30c69cd4680a7d0946df6ed8802ff5
SHA1 c3595a0ed3cfbdb59474b58b43dca4a299340ada
SHA512 a3fc5f9977f3abedfb91f4dd566d325fd9725f9636e8b4d0810667c0aa10f6a0da179c0ed7e7692e12f0a68121737c8ef8f1dd997629e5a317f45fc4a513eabe
SSDEEP 96:+Fxm2FTFbFBFQ/dd66JoztdzgClKtmc0d/UU/AqSdF95/7bkW6ArcEDXryUR6YfB:N1d66JoztdzgCl6mc0dBOv5zbo8bjryQ
TLSH
T1A2C1CB28F628963BC458423BCCA61F401E35399BA84E3F1935AC74493D5A2DE7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 011c726f5eb6721ffcd05efc44e4c744fc650ac74936e261598b9611d59c1e02
MD5 568de4a0c13284a54b07778a1f4e7616
SHA1 5ff5658c5008587f67e535f7d248c59f4cbf1fd0
SHA512 1d3572b023cdc00c492c368c5d3c298bf7008eb75c257a0e6976ed66fab38b3a921dec1def66612c9ce508bdd23bbc54bc00c4b93d6f91683bf6d07534ea91ae
SSDEEP 192:g1d66JoztdzgCl6mc0dcOv5zbo7hjryjVVK:ad66Joz/zgC1jRbo1jryjC
TLSH
T145E10F68FA28967BC414427BCCA60F414F35389AA84E3F19359C74483D5B2DE7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\events\events
Size 1KB
SHA256 479130bd7806fb094dbb25ec8dd34dce8f95fc791a732183109bff44794ef81c
MD5 ebd6eb8b4b7240e29c390bc9fdc8d18c
SHA1 07f32d4e6ad221eb8c3358b4d90fdb08558a55ae
SHA512 a8e24367a8cf1167f2256ef9ef0eb39be5796b11f03b5d5733830ca10c1ab5ed4378198b4ca2b47829beccad09ad32fbac9f122933be58c9a6c1dbd9f7dce541
TLSH
T190116A9C3BB94D6EACC7E39C7451028E53514A0609C71D478D52EF8CCEE0AD9326A43C
MD5 SHA1 SHA512 TLSH

Submit Download

183a29d3-64ea-4abd-ae67-6325136ca5fc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\183a29d3-64ea-4abd-ae67-6325136ca5fc
Size 886B
SHA256 67df42b4b9a3c4602f115a8b6d11e045ec57bf0b34f45dc7f2ce4242e494ee16
MD5 70b2ac034fc31e60136bbacd5c1ffdf0
SHA1 c44b3257b6750589a83ed8c0be5eb2e1127b60a4
SHA512 dfa161857d09f75546c31c6832440da12fe7d30a743dea94c3fc6155210190eeb013c0ef725fd32b043e7a11caae07709212070f9af7fb98b246bd7506746ed1
TLSH
T10F1127809A1476F2CD7CD29B88E07B455AF43123D0C70C047D70AB440DAE51E576EA0B
MD5 SHA1 SHA512 TLSH

Submit Download

3dc9e387-7b0b-461f-a340-8cee22375bdb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\3dc9e387-7b0b-461f-a340-8cee22375bdb
Size 235B
SHA256 5295f6e260b63cc1e112d09faccd6c8475614cf8a41fd522243d9cb8e98b771c
MD5 2f5eff947962aec28fac270c2876c6e1
SHA1 cb6a0c9039313b01472973cb8eff4cf655daa891
SHA512 e34852b2c10dbf6cda2b4f4dea90fed0ab4dab3ff9a910f3980b2b61466b5837668ed7e3cb04dcfa484e9b045cb1b859d40d215cb755cb6ce2d16669f5801a95
TLSH
T14ED097863498632E08042F13B0F02EC230588C335078E810D69205B89ABEACC82A5C07
MD5 SHA1 SHA512 TLSH

Submit Download

48ef402b-0d01-4a17-8310-8a9331fbea78

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\48ef402b-0d01-4a17-8310-8a9331fbea78
Size 235B
SHA256 015dee76d0fce7ce1bee837ace7fd747c1a04808ad826fdc302ea75f2ce6becd
MD5 e181b5e47aa429d8647001500494e66f
SHA1 28ed6c550418ae3cee88d565a824bdf25a82206a
SHA512 95f5e6809b5a69b46e209bb603ff12c2c52afccad381faa0934cb860f48d3e819aafde0e1015fff17b368b5e85c90729bc3ea393388d7a7e222be5716a6e049a
TLSH
T17FD023C12C98371D48100F43F0F0A9C630494C3320787810DA93447AFDFCEC88111C17
MD5 SHA1 SHA512 TLSH

Submit Download

589ee437-aada-4406-bbb5-85e01d515830

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\589ee437-aada-4406-bbb5-85e01d515830
Size 2KB
SHA256 a16b67886d27cf84a8d1d07ce00dd11b36116bc2eb1884c8e391f0a1bb604268
MD5 928b84581485f78e88b39d1694bda3ec
SHA1 eafe8600aa291b24e7a71664733bdf443675e04f
SHA512 5c0d06db310922dbffad61c2fd7e72389c16e3a40855dd4272341268d0615ed8380b579d47db9951d01d84e01783c4bd2eae25ecd96bc54aafa2905e00d08f1a
TLSH
T1F141419C38785CBF8CDBF55DA482274E53704A0360832887AF11EF4C8D96A9E237A416
MD5 SHA1 SHA512 TLSH

Submit Download

8338500b-1fc9-4130-a836-3c527e74be83

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\8338500b-1fc9-4130-a836-3c527e74be83
Size 16KB
SHA256 cc32a6ad41b7cede944c72484c22ee6bdfc4ea686fffb21efab1cc1bc96e517c
MD5 98658293fc99496d3369f2b5c6f281a3
SHA1 30cd4102d53a28e4e66d3bff2410a2181658f5ea
SHA512 6694929833a527fa84598b10eaadca4b693d29ce49b20e1c8e69ae65de2f97ca1b66d679cc444bdd1bba143306018f0fe8c8fbceb51e90332bb675798588f4cf
SSDEEP 384:xtMhhifBiKt5RBOp/vAOg41tr138yzngko:cNwe1vMyzngko
TLSH
T15272CA5A582055BA8291E3A994F87FC3E1F628CB4C419FCEDBE47D086DDE06E1127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f13bd28d-1154-43e6-8737-0c14698e8724

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\f13bd28d-1154-43e6-8737-0c14698e8724
Size 883B
SHA256 df821a1b305ddbb2bf85a639e28dc4e49f1c7cb9e37e8262a99fdceea3032506
MD5 2a7b1cda53c08d9ab042607c36923b0b
SHA1 a73a867713130359965f76c8bba7d84e475d5698
SHA512 1c6d5f78429bc20a67e25176309f75c145e62da2f9b2b5ddfb3da76e0452869e276c882551353e3c59be0a915dca80e3480936e867c27032d3c28e16d593e2f8
TLSH
T14811E741B524B5F1DC78D14FC9953B4697F47423D0C744143DE1AE440D7E61E975AA07
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\extensions.json
Size 16KB
SHA256 061ecebce1b6368fd2c787c2d54b27a737b79c83c0281e467eaa7aad1b59d3df
MD5 748dda4aa30f5e4e0fc9513191bd58b5
SHA1 4d9c2371c2141f09e3665ec515bfdc3cb68e81df
SHA512 63463e26b1f41bd37a24a57e0497ca0cc86b86dba01750fe73ff3c22aa57f4e19af42b7bb4123e413f61b2f5d5511cc17a61e0f12d2ca0ac883d3cfcec5bc764
SSDEEP 384:ikI4vwUmldvic8dhWz94zF96o2L4HWL4PZL4HCL4HiAL4Hl94hE:VI44RfmXC4v6H484J4Q4Ci4j4+
TLSH
T15972421545149EB8294FA79BAA36BE01C37D473B60845C78F4DD8FC802FB5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\prefs-1.js
Size 7KB
SHA256 e8c25afcc21b9795364868a149fc2c57b76425f56a52380fd224741d1a5dcea7
MD5 6b158eb1a12131b454ff182e7f157bcb
SHA1 e82968c3ab736237ead5ec9a8b7f23ba0dc25d17
SHA512 fd8e4a17dcd3e0b97cf920dc0517a1d3588b9002a5a7bd6d3bf21ced284fcaecea2ee898465ec007fecb4ba02f32324fd66a6c79a5e764e95dea400c42a1980d
SSDEEP 96:xHIdTUzBqGqcfue8ObzSyzSSlBdv9jintRWRImb/H+6WBw88HIB8L4cnTghuv:qZRcfue88zSSK8RV4Bw88HB
TLSH
T11FF10E389108CF7F74B6776CAC6489315A72023BB6BF68C650B584C5050CF3846F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\prefs.js
Size 6KB
SHA256 1f0a0fa124b7b27cd3662acc5e5016fde25eb18fdf3aa88904fa42e462926eb5
MD5 44824885ce268f88d67a63eb6a21f800
SHA1 c80cfdf3ce4f2f19f33b28b6f25d7a8c2e326a76
SHA512 b97c4831224fc45ccf5db786c67008af85f32d30fcdc13bcf115a5c00a3be0a05c65d3b648d6bfe8938b93b72660deaa09bd9c8bb1f336a302305be72c555d6e
SSDEEP 96:xHIUTUzBqGqcfuoK1zSmSSlBdv9j6ntRHv/H+6mBw88u8L4cnTghuv:qgRcfuoK7SSS9vwBw885
TLSH
T1ABE11C7894088B6F74B6766CAC688C316AB2013BB7BF68C650A644C4055CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\prefs.js
Size 6KB
SHA256 f44899d573d1170569fea853a0009849689d7b51a72023456bf85113eaff97b8
MD5 1c6bd9e6614c3930f549e9f074c1082e
SHA1 4424059bad865a26eacc7cbd40ed3c392ce8a1c6
SHA512 4d81638082693a47864c4a3679095abd0d3f0b13768550ac464115cedb48999501f13a6b5d1290516466eb29eb58cf90f841fbd859ab759da979f232237ddecc
SSDEEP 96:xHIUTUzBqGqcfue81zSyzSSlBdv9j6ntRHv/H+6mBw88u8L4cnTghuv:qgRcfue8LzSSS9vwBw885
TLSH
T1EAE12E789048CF6F74B6766CAC688831AA72013BB7BF28C650A544C4055CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 dee019a434d61e24ecde9fa3ad818179bbab91a9213023174d54abf41a1fac0f
MD5 6812995420bfbcc29ae028312ff1df14
SHA1 e5ea8a6e372ea1f1e70e9543e5ee9a9ecc0fcf61
SHA512 6813f195e9139bbd60141eac3414317c320e10e65dcce377f95a3e62fe655e8a12778f1d35be9df5352dbee9063143ff3a3569c94a40c44f536f07ab1a1a95c6
TLSH
T12021EA57255A3FB5FA11920CB4C1EFF1C666317406F02CF0954C899965FDC49B78A718
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads