hxxps://ankergames[.]net/game/naruto-shippuden-ultimate-ninja-storm-4

Analysis

user interaction
yes
max time kernel
9s
max time network
86s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/06/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ankergames.net/game/naruto-shippuden-ultimate-ninja-storm-4
Sample260621-e7yflacv2z

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3168	firefox.exe
Token: SeDebugPrivilege	3168	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3168	firefox.exe
3168	firefox.exe
3168	firefox.exe
3168	firefox.exe
3168	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3168	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 3168	3260	firefox.exe	87
PID 3260 wrote to memory of 3168	3260	firefox.exe	87
PID 3168 wrote to memory of 4420	3168	firefox.exe	88
PID 3168 wrote to memory of 4420	3168	firefox.exe	88
PID 3168 wrote to memory of 4420	3168	firefox.exe	88
PID 3168 wrote to memory of 2284	3168	firefox.exe	90
PID 3168 wrote to memory of 2284	3168	firefox.exe	90
PID 3168 wrote to memory of 2284	3168	firefox.exe	90
PID 3168 wrote to memory of 2284	3168	firefox.exe	90
PID 3168 wrote to memory of 2112	3168	firefox.exe	92
PID 3168 wrote to memory of 2112	3168	firefox.exe	92
PID 3168 wrote to memory of 2112	3168	firefox.exe	92
PID 3168 wrote to memory of 2112	3168	firefox.exe	92
PID 3168 wrote to memory of 2248	3168	firefox.exe	93
PID 3168 wrote to memory of 2248	3168	firefox.exe	93
PID 3168 wrote to memory of 2248	3168	firefox.exe	93
PID 3168 wrote to memory of 2800	3168	firefox.exe	95
PID 3168 wrote to memory of 2800	3168	firefox.exe	95
PID 3168 wrote to memory of 2800	3168	firefox.exe	95
PID 3168 wrote to memory of 2800	3168	firefox.exe	95
PID 3168 wrote to memory of 3704	3168	firefox.exe	97
PID 3168 wrote to memory of 3704	3168	firefox.exe	97
PID 3168 wrote to memory of 3704	3168	firefox.exe	97
PID 3168 wrote to memory of 3704	3168	firefox.exe	97
PID 3168 wrote to memory of 4300	3168	firefox.exe	98
PID 3168 wrote to memory of 4300	3168	firefox.exe	98
PID 3168 wrote to memory of 4300	3168	firefox.exe	98
PID 3168 wrote to memory of 4300	3168	firefox.exe	98
PID 3168 wrote to memory of 1808	3168	firefox.exe	99
PID 3168 wrote to memory of 1808	3168	firefox.exe	99
PID 3168 wrote to memory of 1808	3168	firefox.exe	99
PID 3168 wrote to memory of 1808	3168	firefox.exe	99
PID 3168 wrote to memory of 2616	3168	firefox.exe	100
PID 3168 wrote to memory of 2616	3168	firefox.exe	100
PID 3168 wrote to memory of 2616	3168	firefox.exe	100
PID 3168 wrote to memory of 2616	3168	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://ankergames.net/game/naruto-shippuden-ultimate-ninja-storm-4"
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://ankergames.net/game/naruto-shippuden-ultimate-ninja-storm-4
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {9dc696ef-9f34-4ac0-8f82-e7cbb5b17e3c} -parentPid 3168 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3168" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {105c0dff-86bc-43f3-8f62-951826017c82} -parentPid 3168 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3168" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 25213 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {c3a2f2d3-2c9b-4051-9531-b8d52708cb94} -parentPid 3168 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3168" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4048 -prefsLen 27325 -prefMapHandle 4052 -prefMapSize 270279 -ipcHandle 4060 -initialChannelId {3163ac12-3d50-425a-b418-7077a6efa8ee} -parentPid 3168 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3168" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2952 -prefsLen 34824 -prefMapHandle 3068 -prefMapSize 270279 -jsInitHandle 3224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3080 -initialChannelId {60ecf01a-4c87-4df2-85b6-733f52508fe3} -parentPid 3168 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3168" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5148 -prefsLen 35012 -prefMapHandle 5144 -prefMapSize 270279 -ipcHandle 5136 -initialChannelId {42162ce8-2ab2-42a7-9504-32c0f168b57a} -parentPid 3168 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3168" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5320 -prefsLen 32900 -prefMapHandle 5324 -prefMapSize 270279 -jsInitHandle 5328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3144 -initialChannelId {d4e67d59-c7ef-4d71-b010-6f1fb6575254} -parentPid 3168 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3168" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32900 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5012 -initialChannelId {b50d18c8-4895-4225-aa9e-431beac1e921} -parentPid 3168 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3168" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32952 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5316 -initialChannelId {1730c12b-4e15-45c2-a039-9a3ca155674f} -parentPid 3168 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3168" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6436 -prefsLen 39798 -prefMapHandle 6320 -prefMapSize 270279 -jsInitHandle 6448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4676 -initialChannelId {01f528fd-aea1-4360-8fd7-7a9a93edffe3} -parentPid 3168 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3168" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 09179220461334e95182a981b0f99a05ca66e0724d4038ff3b22c7fbb1b3a6cc
MD5 ba5192ab9295cdac1f70dd3067a765d8
SHA1 a4a16006259b8d066fefed393a6e4380f7e89f05
SHA512 86794ce961667bfe113969703c18fbabc87977e308cb20d241de4b39d966fdcf0baffb5cad236a0858b7e5c973da261c1ceb49325e537f66d98593dfb942e9a0
SSDEEP 384:HPC9iO024YAo6J+Sl1xDnZBPsac4j0lpDII+DN16N1k:v9ZYAo0+Sl7zZlsac4ID8L1
TLSH
T1A9528DBE9F0239AA1927D1A4D5BE5354CD04A7BFDEE2906605143C00CA84BBDF4E68DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 56d0f95923b13641ced7af5eb784de0769644edc5876b1207fd38d184cb716e6
MD5 4ed12014161918453437fa8bc10e9b0f
SHA1 c6572114d389a0268ff5704aa44e47a2ea450ec2
SHA512 600417580c868c873548c173090e79680a1089f8eefde5ce4a104965ead53d0efa2aa72f2b4d4447b404e44734fef99c78aedc806ceca4b9ae31f526ea60fc1b
SSDEEP 1536:jTrliLmSQUq/XHuquKLlZc0frc+HLOE17Sx/zonq3yyhztj0+qYhoNB8FkyPDTeH:j3l/uqu63jZrFlSx8bSBuAoE//dVs
TLSH
T1A8A3BFF6DBE2C97D65FFD01CAAC2893EFD262404B3A72409C923376152C6FB46675248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 1e4235c267a5348e5820bada0a102ba152bf327e5d580763f62a37eee39075f2
MD5 c4b1d99c981d7756145dd56d754086a2
SHA1 3185e8d95ffd89d930a3f16e0414ce9bb454c58d
SHA512 e9c638c31bcda0e96cea2a24e4812a44a542576fe36fdcd1c37ab6475869e2555b2db867726565bfdc0831c27f65b81e34f4ce8e39bb0b913cecf0e73d768693
SSDEEP 768:gEoBqRox+pGcmhucxK1G5LbibcbCFWWSM:qBqRoQsZqFB
TLSH
T1CBE21244FB2E553FD41512BBDCA50B002F79B889581A2F6B3A5C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 69KB
SHA256 6ed42b9854af32724818e8dcb9ef586ff6bf61c9458c0dde20b6c423ca015732
MD5 90f34c218a3f347a3e6643ea4ac65ae4
SHA1 9fad86721c82c57535027d1d9fd67c163fbf2a76
SHA512 f07eefa9850bf018f63ded98153e0fb25d81f2a88e9726e1c02798bebc4b8a8dbb32745bcd98e133a537c56f16ec905bdb97925bbdb6747f7528182d1f1b133f
SSDEEP 1536:DBj20xgQgfMOTko9ACCWFvA6+R0aAaCaIv9tDUO:DBaSgQYXKC2v/GRnT
TLSH
T190631244EB1A943FD82803BAACD21B143F79F8895A1A1B6B375C54782C873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 072ea2560f8ec7caf6bc2bb5eade9d0845ae0293f716c060acdb83864aace139
MD5 6697a6991523171e3d88367e2327371e
SHA1 71b4516195cace24142a9fbc4586211f1b0c3f3a
SHA512 8cc64336f9d9cc429098e832bb652fa25e3c1f79f18046ec6dacf167ba16b83ebd00a4253d80b900186412a6752d94aaa41abded2f01c52628ec78b1a6bbe2d0
SSDEEP 768:pBqRox+pGcmhucxK1G5LbibcbCFWREAgM:pBqRoQsZqF0
TLSH
T118E21244FB2E553FD41512BBDCA50B002F79B889580A2F6B3A5C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 13f687f5f50f42abfe573e3d72b77cf9f508a04825a6229c8fbe9ea2f18e8ce6
MD5 f15645e06c7b603c9b976d333455f8cf
SHA1 2256fb76562d6e647a05874fa10c56e51d7cd897
SHA512 97788e51c701dd93319721b72af915af6bbe2bddccc04419d8765d760dc1a0362a043c61548c8f8191a6ee174fea244be1bcf35d055b1b41ea198b5a77e36ac9
SSDEEP 96:AjFS2FOFzAFWFo/dd66JozGzgClKtmc0d/UUtQcSdF95/7bkW60rcExLpyUR6OpG:o1d66JozGzgCl6mc0dPQcOv5zbowbxLI
TLSH
T14FC1CA24F629463BC449023BCCA61B410F363557A84E7F2935ECB4092D9B69EBB8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 03b8e2842a0e7886285ad9d4625670430501debbf71ffbaab613172cf4dc5daa
MD5 9f13ef1d51a48c006c2105ca2d9523a1
SHA1 9f159f0f3027076f4c46a3f200a9f00cdbbf50c9
SHA512 1aa2a84f26b8cf26dae95b4096ce050a1c3b3a0ec6cb90d91ed4303b436a33e3796a71fba92566bc5098a21351202db2bde314c75a5c8090fcec266ed2ab0b70
SSDEEP 192:o1d66JozGzgCl6mc0dnQcOv5zboSZxLpyjO1Av:Cd66JozGzgC1j4boSZNpyjv
TLSH
T1D9E11C64EA28463FC408123BDCA61B414F39399AD84E3F2935EDB4092C9B2DE778D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8c52ab2d0bdcdca4d2b65070dbaa0764278a6859241a8b3a2cddd71277290f6e
MD5 740565531a7d868c5c142a4c24d4866b
SHA1 c5ecec59f186b30d38630f1dd905b2e6cbc68368
SHA512 25d4f588802aa5238a537182756d031dcc72c0db84728078a5bff933c99bdfd66b6c714b566146d3822a3ea4c40815428ad6d0d4b403c805d53f24ad18050950
TLSH
T12B116D9C7EB94D69D9CBE2AC7844028D53654D4605C71D430D62FF8CCEA1AD9323E43D
MD5 SHA1 SHA512 TLSH

Submit Download

390b1b77-dada-4ef7-b3ed-db7dc9eaddaf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\390b1b77-dada-4ef7-b3ed-db7dc9eaddaf
Size 886B
SHA256 5d2c5779f84125b77f2744b9653f77e8b0c9ee1433df31c198728045f7146b89
MD5 6b574ce65f640debb7a5f6405592d3a6
SHA1 037f4cbf333ddcdc55c111b5057c978a42315e36
SHA512 c734d404e247a50e19e52e5e07af3a0655f8519843fadf4ce0b2bba654e99332431230420fbda3ce789c118dc4542c21ec8d16d95fbada63229652137b9a6318
TLSH
T1561144405A7476B28D6CD28BD4A177468BF07213C0C645247DB2AA181CFE41ED3A720B
MD5 SHA1 SHA512 TLSH

Submit Download

44156592-8f70-4b02-9a48-ed99f2462e25

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\44156592-8f70-4b02-9a48-ed99f2462e25
Size 883B
SHA256 9e65476fbd864bb249576433b198149dabe9ea4bee8e518f95ab936c1a284123
MD5 79e47b7ee07bb295c2532c0106e8bcfc
SHA1 1aabdbca7812d60d6e80aa6df795df42521f411c
SHA512 e96bfbb0600bb959e56fb369f9453a25a7057d794b3cdcc7361d48cb07b3c98e19ae9eb5c79e542c569fe64133bdfb720981a9981a48c6c139ea4308122fc8de
TLSH
T1B11100416A39B5B2CC7CD24F855137428BF47623C0C995243DF19A180CAFA2ED3AA60B
MD5 SHA1 SHA512 TLSH

Submit Download

5430ab87-3b8d-4192-9614-d482be30ef43

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\5430ab87-3b8d-4192-9614-d482be30ef43
Size 2KB
SHA256 a698fe8ffc0f11024ea57018b3fc694c1ef09a85714e05c0de5eeead5f20e206
MD5 baf39213377be571f2a1e14516299fe1
SHA1 fc109da3672f9f20b48b83aa67529169254acb1e
SHA512 319bd70d547898f6ea4a95aa36b5430c459125383f3caec9295d3eeee3a81b9f0d9d6335d5cd899742fdc789db5f9d87c76a10bd23d5e0d5b9f978b715814e85
TLSH
T16D41135C36784D778CEAE55DD041278E57A8860310C51C532EA3EE0D8C9B55D636A53B
MD5 SHA1 SHA512 TLSH

Submit Download

ba3749a2-dc29-47fe-9c8a-ff7817433df1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\ba3749a2-dc29-47fe-9c8a-ff7817433df1
Size 16KB
SHA256 8180a94382baca7a2d8ad35255b047ac743e502b9e16822ce09b6c7b6941a8ba
MD5 405b201bb6f7d061ace68c3b6483c311
SHA1 eaf213d8e0801a4553cf7675855e382d519351f9
SHA512 6f3170798f5f7a70acf3e06aaef1134484ea9e7add8d46fdade62199d5e3dd73d5efd28f0a5643606e159242f2ba3270a27f215f98bf9b86a2c0800d26ec6f21
SSDEEP 192:8ic7ijnzxjhVDc3dxmMdoq7BkgR+qbKdMNvlYJ9J+NjTvpGnIBMy7m1TmWmKaIhN:s7ijnlVVDc3dzrHeavpGnIiy5ZK7hN
TLSH
T1ED72E916243045BA8351E7A8D4F8BFC3E6F528CB4C019FCA9BE4BD086DDE0AD512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9b2b5eb-9139-4284-ab6b-63baed7cbaaa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\c9b2b5eb-9139-4284-ab6b-63baed7cbaaa
Size 235B
SHA256 7182a131e5ee4094d77be62dc25eb1abbb8fbec47c5a076c1bd5cdccb83f83b7
MD5 e8efdb6c3e1aa0c557fce9fbca8ae0b1
SHA1 cc5cfe4148e01fff3e2a853d71988cebb5fd18ed
SHA512 329ae69396a8f637ba1dd7f9c9118342821ed15679feaa77cbaa7f7722693cc6063149e77bf28d97135a1b80c08e449ec003bc2b04415dd8f6a0dd96372b9a2f
TLSH
T139D0979064E8237E08080F0AF1E028CB71988C3310719820EA620178A9F8EC402A2A4F
MD5 SHA1 SHA512 TLSH

Submit Download

d10942b9-7343-479c-b474-85ae205a71a2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\d10942b9-7343-479c-b474-85ae205a71a2
Size 235B
SHA256 154315ab959d56c043172a8b9a57aa6537d4a9a1d30c460e7798462e6a011d16
MD5 36cb8a56efe79be710b6b35842881cac
SHA1 fd12453aeebe703ac521e47ddb0278e645ad05f5
SHA512 14058b59b33146afb022db7619da19e83f263b579732a952170e2938f1cb82eed9c7867e733e5f503a408e876634dc94991f8602b52ecf1ecb5cef6758aa475a
TLSH
T1BDD0A790A4E8676D0C241F07F0A16AEA74958C376464A820DAA14578DAB9FCC5255916
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\extensions.json
Size 16KB
SHA256 6514dbfe72ceafbe6087ce5c79d692174c9a9e7eb26f1e6ea960939bcf4c9715
MD5 33271d4f092fd821746b37e2a9dfc2b2
SHA1 0530a2a8f0e391a6b61537ec991d1d7c97ffac42
SHA512 472120d1d53e62f1070d217db061a9cb323bb803aeae47e126556d7cf6e7b5f5a1ea46882434b86c47e3641f97fca0ba2d8e3a83f3d3b2b06264c79b90f2c8df
SSDEEP 384:8kI4v3Umldv18dhWE94zh96oaL4HIL4PtL4H2L4H/L4H9a4hF:TI4vRf2XZ4D634q4V4c4D4s47
TLSH
T14672531545049EB8294FA79BAA367D01C37D433B60845C78F4DD8FC802FB5B902BB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 4fdca69f893eea0dd1f6a39139a2fe43008e778be5eddbdf1ad255de3547a25a
MD5 6469172a40c2eed202a92ca07e7c7455
SHA1 408ed7382f20234ae6a647fbf96cbada953f4606
SHA512 0dcc3375475039a98100159792f1340f593e6509000515c7f85ed75017e3588e8ac035fc0702f21a60f35765184cbd07d56e48d1d738cb57e199c09b3976f675
SSDEEP 96:xHi+UTUHqGqgaf0yh1zSjAySSlmdv9jCnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0yhaAySSG5lfWTBw88qV
TLSH
T159E12E7895088B7F64B677ACAC688C316AB2013BB7BF68D750B55485014CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 fc56b7d1890ffc33994b3d2f3f76d09b9368a6a42dd8393c5fef36ea9b1e05d9
MD5 f91c3625de3cd83acd5335bda8027a47
SHA1 2182de9099e59fbc53f10e595fddb2aedf7eb47a
SHA512 1897fed37c4ddd4aca6a18386797ac82dc2832792feb6e5ad9270fd1cc9f17bc02c328cb856619971f45d1f30cd435323517b4fbf7131eb6ea03e256a37af984
SSDEEP 96:xHi+UTUqPqGqgaf0yhObzSjAySSlmdv9jNnuH5lNdHWTBw88n8L4cn3XH1:k+aCRgaf0yhZAySSh5lfWTBw88qV
TLSH
T164E12E7895088F7F74B6766CAC688C716AB2013B7BBF68D350B59484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 7KB
SHA256 e05595d15b67647863458cdbb4ca35dd8001967c07352e3495d6f053606d2f6f
MD5 c08a24b92bd2d9c72e324d4653f6567e
SHA1 aaebb704b8b8b8194e81acd4f3d5a08cda067788
SHA512 940c0e188286bf6c8c6d0b8b18b3338dfe5e13619c747db909fe143d1cbaf797f16b2a83dbb2221c988c50305d518177f30e9d6fba701fce115195f97570ece1
SSDEEP 96:xHi+dTUqPqGqgafZyhObzSjAySSlmdv9jNnuH5lNdHWGBw88uMM8L4cn3vH1:k+vCRgafZyhZAySSh5lfWGBw885V
TLSH
T1C1F10C789104CB7F64B6367CAC2849715AB2023BB7BF68D750B95484015CF3446FEAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 3f6fc9290ef86498a98656ca613dd7d31b98e0d3795f56ebb3ee2c506478250c
MD5 5fde77e3c03ed8ac01ff86b5bc836277
SHA1 230ca1b10598f480c67c130e98863cbfb35e9368
SHA512 8fa3c48c6529fdc3754757795ba5031d525240e9c28a9cd5f872eae550294c5fad677153aa5d7f8b2e94a203b4f2d5583425fd591278942b8e860c62a8b25aa8
SSDEEP 96:xHi+UTUHqGqgaf0io1zShSSlmdv9jCnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0io8SSG5lfWTBw88qV
TLSH
T126E12F7891088F7F64B677ACAC688871AAB2013B77BF68D750B55485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 005d1f415df69836658077764b098f9f4f016e39232f5cdd831049a23b7136b1
MD5 336a67fb6f69350d573bd6026a10757f
SHA1 1eff0ff5b4e37a5492687e5661ee69d593e052f2
SHA512 c034242f0e34ead1841aba3d3d708106c23a159f560776ad1ce5ee8d2a7e6485ac3ed5f30a4a8889d73a163d3d22d390f359884882a859ac03863245ef403516
SSDEEP 96:xHi+UTUHqGqgaf0yhObzSjAySSlmdv9jNnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0yhZAySSh5lfWTBw88qV
TLSH
T13CE12E7895088F7F74B676ACAC6888716AB2013BB7BF68D750B59484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 795e955107495d761e49218a29af68781c80f1aa5be4cdc315d907c858726737
MD5 2fa9b0816c0f3aaae5b15cda99bc4b44
SHA1 4782d2103206c58bd0c082c28ac8c038c6666a86
SHA512 c75639e29b0708f503d751821e3b1a47f3dcf040929b7c0efa749677183b3531ec9b9209c494ec89cb794809f19e602da5c078b264c80c561ca2b61c63d5c06c
TLSH
T15A715B900C5E756396DF907900F9FB6C4FC8116B4ADA3CC0E5A9DF96445771D194C44C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 999f8cdd9f62a5bc27d087093583e0c48ce74456d8fdc123455cb63cfb72cd32
MD5 92205262352d92b0036efd1dd26281cd
SHA1 67d07d7a665fdd09e6a6a301d0316624ed1d6cf0
SHA512 c4bf7d523e286d297aa794ace52e77e3ca7536258677cbf561c6bbc1e6292a6e4351c7a74f7723fea9e7e4f50fa323f5068351261e069808d80ab274cc48b6e7
TLSH
T17D717DD40C1B3CB1459F917500F43F9CEA9450BB4BA8BCC4DDEADF4644D961452CD95E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 82595217a9f91645a1d315f4e4694ae3e261ad81f15f1eb1afcffbf40bea8f11
MD5 490204677ca515a068b14d1118299e60
SHA1 3e01a47c644e88248fc21d94b9eb72d6cc8d9311
SHA512 d36a19a5bb870d15281788ef0aaf2951ebcc8f7ea129ff5d11d0cb49d23816e3614cf9063e336b8221a2046ee7e2dae5d386a8a31aa7faa3b902b98b29f8dee6
TLSH
T1D9210843D87E2DF16A1203AED4C58FAECF4D3813007968E0E19CE24116DA05D22CB28D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 ba10d253610c82cb8f6f9fcad86362054fe2f5db1fdbf3a3a9ba6e947571c64b
MD5 b4fadc459aa936ca942af587dc20e679
SHA1 0db5ed40ae76f28f5e6663b028356e3ef0dcbc0f
SHA512 671a652dc9602c1af77033ddb19618f9c64b5a3c641494a526e14dcd27d6d4997d5673d947fd0701ae83dc3a8c01aee6ebf65993bb055cf6ea374eccfe3bdc6e
TLSH
T10C717E54045B3CF186AB81B240B87BFF9F5934774EE47CC0D9DACF59C49A6198B8E418
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 cf9151e8c33af07548e59229ddc5126fa494c4d2e8f76789ee37736ac074d4a8
MD5 9ad87e0c0e499af47db0b3de7d0eaf3f
SHA1 d2fbb14bcd75a36cc446586ff14efce270f3f561
SHA512 84009ebda77e39b6443cc217b9b3b5c81a9d8a8e61386748fce281b862d657af62966891242d28531461c2d895a9f5e3367ab2e7d50f6885664bdf9807dbc7f5
TLSH
T18B715B90888724A2426FC0A510FE7FB98DE850BB4A9DACC4FBDE8E074459A2D994D458
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 082184eeea5dd19271f1d38103d8fb1b9f88ffad5af4c290310f608cf618f832
MD5 703ff9c97217ea6dcd6faff0169e7347
SHA1 13541a219a9cb09cec6428c1ed2a3a57ba62aec8
SHA512 9bcb4a66c0064634f15d16f871eeda9a22c47133587a90c4fbcb59d10cd487b90acdd45b75d53fe282aa1ec0ebfbe2cbf4037ec7166ed7dde0363e3302571dca
SSDEEP 49152:TiwbkMngvZR+Uh3YdAifHQ9hJNHkda55z3Fi2:uwbkMngRMfHQ9hrHkdMw
TLSH
T1252639E820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.9MB
SHA256 8c17fd1d3d70850a841396da28b86845f79f9d28aa7c4e57da3ad10a99b6aa94
MD5 5b000f9c5001660657ba9e2135822f95
SHA1 7e4e8192e44e469e1e08250a78bf0b79c973880a
SHA512 aea48a041874e30dfe64d5cacb0249bbbbc6718739474e465fb504ac34ee497367a069eccd282952bd04f0ae4f9c98eb00f395239973b5244d95cd4a3959dea3
SSDEEP 49152:dLRLynaeUd6QC5zYYGk7JgtaeSZECWbwDiDshLWRxEMUK7AYNYxffJwzYhGRqgaw:UghqgaNhfaaADVHX
TLSH
T1451639F820D2A257F3814033669553EB21AFD00CA077DD440B9966F995B8CEF9E06B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads