hxxp://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid[.]onion

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Sample260702-2bbchsfx2v

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3328	firefox.exe
Token: SeDebugPrivilege	3328	firefox.exe
Token: SeDebugPrivilege	3328	firefox.exe
Token: SeDebugPrivilege	3328	firefox.exe
Token: SeDebugPrivilege	3328	firefox.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3328	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 3328	892	firefox.exe	86
PID 892 wrote to memory of 3328	892	firefox.exe	86
PID 3328 wrote to memory of 984	3328	firefox.exe	87
PID 3328 wrote to memory of 984	3328	firefox.exe	87
PID 3328 wrote to memory of 984	3328	firefox.exe	87
PID 3328 wrote to memory of 1912	3328	firefox.exe	88
PID 3328 wrote to memory of 1912	3328	firefox.exe	88
PID 3328 wrote to memory of 1912	3328	firefox.exe	88
PID 3328 wrote to memory of 1912	3328	firefox.exe	88
PID 3328 wrote to memory of 112	3328	firefox.exe	89
PID 3328 wrote to memory of 112	3328	firefox.exe	89
PID 3328 wrote to memory of 112	3328	firefox.exe	89
PID 3328 wrote to memory of 112	3328	firefox.exe	89
PID 3328 wrote to memory of 4892	3328	firefox.exe	90
PID 3328 wrote to memory of 4892	3328	firefox.exe	90
PID 3328 wrote to memory of 4892	3328	firefox.exe	90
PID 3328 wrote to memory of 4208	3328	firefox.exe	91
PID 3328 wrote to memory of 4208	3328	firefox.exe	91
PID 3328 wrote to memory of 4208	3328	firefox.exe	91
PID 3328 wrote to memory of 4208	3328	firefox.exe	91
PID 3328 wrote to memory of 4772	3328	firefox.exe	92
PID 3328 wrote to memory of 4772	3328	firefox.exe	92
PID 3328 wrote to memory of 4772	3328	firefox.exe	92
PID 3328 wrote to memory of 4772	3328	firefox.exe	92
PID 3328 wrote to memory of 2844	3328	firefox.exe	93
PID 3328 wrote to memory of 2844	3328	firefox.exe	93
PID 3328 wrote to memory of 2844	3328	firefox.exe	93
PID 3328 wrote to memory of 2844	3328	firefox.exe	93
PID 3328 wrote to memory of 4688	3328	firefox.exe	94
PID 3328 wrote to memory of 4688	3328	firefox.exe	94
PID 3328 wrote to memory of 4688	3328	firefox.exe	94
PID 3328 wrote to memory of 4688	3328	firefox.exe	94
PID 3328 wrote to memory of 4476	3328	firefox.exe	95
PID 3328 wrote to memory of 4476	3328	firefox.exe	95
PID 3328 wrote to memory of 4476	3328	firefox.exe	95
PID 3328 wrote to memory of 4476	3328	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion"
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {1298a952-e7c2-47a9-8e9b-9814a7dd54bf} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {4d710e6c-04fe-4907-b84b-cec1b44a1a8c} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3464 -prefsLen 25164 -prefMapHandle 3468 -prefMapSize 270279 -jsInitHandle 3472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3480 -initialChannelId {fc465cbb-3c23-46f5-b62a-15e19df39576} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3656 -prefsLen 27276 -prefMapHandle 3660 -prefMapSize 270279 -ipcHandle 3472 -initialChannelId {f349554c-7b31-4398-a587-85ed50dc1e86} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4200 -prefsLen 34775 -prefMapHandle 4204 -prefMapSize 270279 -jsInitHandle 4208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4172 -initialChannelId {26fae51b-44ca-46a9-a9e1-39c27f0b243a} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4728 -prefsLen 34905 -prefMapHandle 4732 -prefMapSize 270279 -ipcHandle 4736 -initialChannelId {a95e82d9-6549-4b3f-a6e5-b4ffc6a32a4a} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4856 -prefsLen 32793 -prefMapHandle 4860 -prefMapSize 270279 -jsInitHandle 4708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4912 -initialChannelId {0207716d-0914-46e0-ade6-5f7f5e0fc3cb} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4504 -prefsLen 32952 -prefMapHandle 5140 -prefMapSize 270279 -jsInitHandle 4688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4980 -initialChannelId {477d98a4-dfc4-45c8-b202-4dfbc37c1503} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2628 -prefsLen 32952 -prefMapHandle 4392 -prefMapSize 270279 -jsInitHandle 2520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4408 -initialChannelId {5b64e863-6f0e-4105-9f12-2b0a56af3338} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 10KB
SHA256 66f220bba8401a9a6b89f4346d6e397213b443b7d1361763bf9e40124069b89b
MD5 0e23fd8e85d7c54605cc5cb42e201e7c
SHA1 e7ff4bb5481c11e39db1252f6db895eb68143544
SHA512 2d41b5b222f297dfd79312e232d10d4089ccdf1ce9b87a70a82d3e08558fa58110d7971b346dce897721bea19509ea4a2ac7fd7a708d44e29ce7ab1f436eb5e7
SSDEEP 192:Hc6p4h9cXz5RqvAcdRPSHXFCPD1Oo1kvbRa2znMbSqGuOB6FHRa2UpTVbb11LOLe:HPC9iO024YiRaSfcOuHRanbfLOLe
TLSH
T109225DBF9F002CA82E17E294E9BD52098E48E5BFE8E390161004385CC244726F8FA59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 10KB
SHA256 6bcea3c294398865f79b3c2ced276ad9e3786da23f045b92c3b86b71e7c1876a
MD5 6a6159b748dbf05e2df55dc782e658a8
SHA1 5bb85e7b0466ebff1df53a0838dcedd9ed946829
SHA512 27730e76afed4e396899bcee736dd10181a525f46ce526735879a56293725aca0e7630878bb4042d3da37c2d063b7c27449bcb2b9402f76928a4953c9b26c52c
SSDEEP 192:Hc8VFPpMrhOcXz5RqvAcdRPSHXFCPD1Oo1WvbRa2znMbSqGuOB6FHRa2UpTVbb1Z:H9XghOiO024YoRaSfcOuHRanbzSO
TLSH
T1D9224DBF9F4038A82F57E294E9BD5209CE95E5FBE8E38056111838ACC640715F8F909E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 55KB
SHA256 e1c3579354d2745a9725b6e7dc385329a4b5f19e517680203f598ef381dea965
MD5 a42320f79b9bc98b1dcbc2f89de24fec
SHA1 c556f686a2d93cd433e95e3bf231f60574a0ff03
SHA512 f72fcf06012ee35fb73bd841d76eb5be3bd7311fa99a3ed4ca807129d2efa14297f3f07a215d8d78b5538f44e94edf48ca4733c7ded4aec56fe02b7198035f58
SSDEEP 1536:WjS/Xf7Kh8t2oAtwsXui13MVrAo5RFgRg+xQmpxfB4:WjSvf8Epa5BC8mkZp1u
TLSH
T113431144EB1E953FD82802BA9C960B003F39F889595A2F67375C64786C872DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7c3607c65254e607559f9cf2656829b251be666985251b0a9f384d346e2e5c28
MD5 423379fedf308656e92815535be79663
SHA1 08ff28fa62bf2c24fedfb2efb4a155cacc9bf8bd
SHA512 4ddaa0c16f221de431d7f21e11f7aafeb42c76e3c0c4d4da04671a445e1a425b989a8f46a2e69860ee28aaac8a1e870d77757c033cb4df3de9fab61210b5c37d
SSDEEP 192:udxyQ1d66JozGzgCl6mc0dZOv5zboA8ZmlyjSI:qd66JozGzgC1j8bo5Zmlyjl
TLSH
T1A9D1DB68F638823BD459523BCCA61B400F36789A984E3F1932DC700D2D576DE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 55KB
SHA256 5f376a64cfd0f723cbd7a8a5757d1bac7ffad6f6a80399c4b2ea9a7d6980ade5
MD5 8fda646344c602c441623f8f2b102ee0
SHA1 3341d68d9b2baf28fb33ac4fe6956577c28032a9
SHA512 e6f9c0224bbfba44a735f56fe32c4beb1032b95ba6dbc45e684929ed46e7f6e2416b547419b45004d3d7413ba0f5bdd93c0d2879bfffca7cde6f357b5cec764a
SSDEEP 1536:vjS/Xf7Kh8t2oAtwsXui13MVrAo5RFgRg+xQmpxfBl:vjSvf8Epa5BC8mkZp1b
TLSH
T17F431144EB1E953FD82802BA9C960B003F39F889595A2F67375C64786C872DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 38KB
SHA256 62b90e17e3c8f87781ba2c47fdf4764924ddb69378c9b7ecd274f2749726b71b
MD5 a9b8ee5734606f037c5900ea5faa7052
SHA1 e126db70b6eb9cd6c3d1d1235d5695dd11706293
SHA512 26590038e838447dd53f0a44bc65fc69e02c1f0ce1a60caa58d553cb3c373e7b6333f3c0bb07abd68498553687118582283789c30920ec3faeb41c1acc178cc9
SSDEEP 768:EEaek/TmodkCvMMgGcmhu99KD7UO/sCvU0bHb/bNb2bJb9bwbKbXzrLA8QpU/Lvn:K/TmodkC0M63zrLA8QpU/LvTL
TLSH
T1F303F044FB2E953FD86812BBDCA60B002F79B88959192F57364C64782C872DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\events\events
Size 1KB
SHA256 09a38982160bec32282830dd4a0bc40cbea171d140de030af558c0aafee3f5a8
MD5 96e98e621612d3eec8d942e2de448cc7
SHA1 034403478a4b3f09efb4dc0ef502200da751c73e
SHA512 f07f213b4c4c160b0edafc1df1d9375c647a4bbd21a6f0c93c04fcc3413193e2d74057a643575da9a373b2946924b0fa573feb07f2a87a73cd4fb6a2576cac0c
TLSH
T126214B9C39F94D2AD98BF29D758106CE93258A4645871D830D12EE8DCE81ADD327A838
MD5 SHA1 SHA512 TLSH

Submit Download

0e35209c-6692-4d95-8c22-b1545e1a22bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\0e35209c-6692-4d95-8c22-b1545e1a22bd
Size 2KB
SHA256 317df0956a4b4bbedde660cf6fd9cdd872e87aa6dbd2d61cef9426df07837de0
MD5 1aa749ba37d2601306b168bfffa57368
SHA1 371cedc198f365215febba7fecb57fa31340accd
SHA512 842d1c3ca176ca2a1e3016619757c26774a9a3b19d5c5f4d4f89e74d7230ddbf915c1287348144172ab04953a8e7dc0fc4e1ddb476a70e1a94ea9bc8c6091f26
TLSH
T1C941115837789C77ADDBF19C9441234E57648A0340C218431E61DF4C8C9A69EB36B02B
MD5 SHA1 SHA512 TLSH

Submit Download

35d9496a-b226-4d38-9997-1e9b78e98908

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\35d9496a-b226-4d38-9997-1e9b78e98908
Size 235B
SHA256 b825bdddc0ae904196720426c627a6275a2816321c57b6b739bc6a2386ebd777
MD5 c4c7d66d93601acbac96cbc4cca5934d
SHA1 74234951ae1276588a027f5f3d5d8f13a20086d5
SHA512 17c5fc4d0022611f7878134d4a4e86a2c17cb5cbe187cf792222072117f5d124e30512c1345f94681b7b11f00c237b5d4288b1d8ff077a0f1eadf39e4f9577e0
TLSH
T14FD0A79538A8676D48141F5BF0E079DAB05A8C3314A45810DAA146789EFDDC8519291A
MD5 SHA1 SHA512 TLSH

Submit Download

6d8dbd00-4a49-47e0-8ba1-efc6bb07f157

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\6d8dbd00-4a49-47e0-8ba1-efc6bb07f157
Size 235B
SHA256 d75be0e6c10849ae573c870812d08a0c8c84975b6a12c28bd1c053298c02ebfb
MD5 899c0fc1f4441f4b3ac13dac72e88b2c
SHA1 c49eb0e1ff2b7089a0c0d0e6ae81fd1f77a32564
SHA512 9728143159d360b71734a66d2822f067603d3f557796a13c052fe646a287998de61815cec81906389eefb32c789683a0509f930c9140952d7eb1c6cf45a62888
TLSH
T186D0978138A8A76C0C240F0BB0A868CA30448C3320B49820C5E006348DFCAC442A2D0F
MD5 SHA1 SHA512 TLSH

Submit Download

7ded29d2-0eb3-431d-8d24-2e54fda8867a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\7ded29d2-0eb3-431d-8d24-2e54fda8867a
Size 16KB
SHA256 47babff3feb19a7187326b9725dd40e09399e5b80cc0c0177da1f371d3f6837b
MD5 a988ee4e0bf505b017532fce448de500
SHA1 31ef96ff3bb927693a2b462bc7f7df58a09b79c3
SHA512 2cd304f2605d4144b328a90736ef606d305d8cc668d28108108bea5712445113faedaafd026c5783132207b95437411e90c99bcb78637305a572174db8cfe897
SSDEEP 192:dabcESzxxjUcGaEF3elgz90VKS1U7UU6EwNVM+k5GfNiyotNW3OqN9ZWNl2Y1Y9N:HESlxjUcGn3eWzcKS1GUUr23gM
TLSH
T15E72D956686045BA8251E368D4F87FC3E5F528CF4C418FCACBE4BE0869DE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0cb304e-6629-44d9-a743-ddf1d2d864bb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\b0cb304e-6629-44d9-a743-ddf1d2d864bb
Size 886B
SHA256 6453502d0aa6c91d5efad5e58367cf1860097e9b362c97ce13ad485098899588
MD5 01f14af9fe51b84ada93c6af0b0a5e24
SHA1 54c1a137de13410c92de1a004eb4b78e1ae394a6
SHA512 b726b8efdcf4e6bee2360cff6b5ef26ee5df9136fcb1559ee4479e12ac05a4c39edc6a85b86c2bd88b84666c0c16b4d06ae930971d739e4d1277f1b372509c4a
TLSH
T1B6116781D634B4B29CBCD29F848477538BE0F523C0C615083E90EB190D7E51EA3AB207
MD5 SHA1 SHA512 TLSH

Submit Download

e8e71fc2-586a-4fb2-b968-01bf0d15d2e6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\e8e71fc2-586a-4fb2-b968-01bf0d15d2e6
Size 883B
SHA256 a18f92e0d459e5263be761b1fd29e4676b5e5a5540059d14ad9a1cc1bee7a700
MD5 47bee56df1d6be7b17f4b48c4c34250d
SHA1 f35742ed743c0b752a83d8608ef3cacac27622b1
SHA512 2747f2b36cd5fa7fffe1d5e6e93a96a15f0199a6a9a24e477ee0d300b71951c638e2190c6185886c1b1fae4fcb379da07a4f217d34b052f126a9e744904e437c
TLSH
T1E611C081A638B5B29CB9D25B855537068BF4BA2384C555083EA15A240D79D2E936B20B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\extensions.json
Size 16KB
SHA256 ca46363143b2c1d42c0c6eeef60831ec761ec2ca4058b3d40a92031704eccb41
MD5 3ecd7a7f6a57613c1b12fd1df3af5e63
SHA1 f3bff30e1b7f01d64fdab57613b9b736b7a94e1d
SHA512 c1d85b3673c8a637eb50169adac672822fd01bc09f963bf5ff5f0bc12005ba5672f7a86f56b297048f1348af9b7de85abfad816d3faeb984a26110d3655ec56d
SSDEEP 384:okI4v2UmldvV8dhWk94zH96oLL4HkL4PRL4HgL4HuL4HI7M4hIM:/I4+RfmXt4Z644e4R4i404h4h
TLSH
T15972521545049EB8298FA78BAA367E01C37D533B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig.tmp
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 7KB
SHA256 7517b42889b562ed0d39b26d5cf0a1d3ed1bb7a8f38741132a236d0b73a6a02f
MD5 bda68c4cae39d25ef3167c3653e932c7
SHA1 315ac8b9778f05444ad2f1adb2bbb4d00661c3bd
SHA512 b1e63aecbca817e87ee75e59a27c2825919799bdec80e1dea38a72fd1ed8f35c1b20b6c69424cb70c5e5b77f408b53f53a66c744be1a770314f0370063398055
SSDEEP 96:xHB1TUxVqGq5ffoWX9ObzSbSSlWdv9j/nqH/8VuBw88lC8L4cn+iGLGS:HXR5ffoWX95SS3WuBw88l4B
TLSH
T10FF10E785404CB7F64B676BCAC648D315AB2027BB7BF68C710BA5484061CF7841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 11KB
SHA256 b29e67d646e9db47df6e48cb74fb5624bbd8b445681640ef069cc77c00e6bce8
MD5 0fea8064d7f1ef5f736884ef4c37abd4
SHA1 6eeeb3f1ef1e67c5632afb987d2f4c8822c31a0b
SHA512 e806bd4e9adcaab8260023ef4fabd172fa2a02cd3dc95f3a2a67c904921f72e10128a0293cad2ba5458bbc4a38f8a1907eda4fd3b0d298d8df145ad815183395
SSDEEP 96:xH11TUxVqGq5ffoWX9ObzSbSSlWdv9j/nqpwoDRTr8SOBw88sfG6ivM72O8L4cnC:fXR5ffoWX95SSZLRwBw88snivM7dB
TLSH
T1E142CA3C51448A3F60BB327DAC214DA059A14267B7BFBCD606FD8481095CFA941F6EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 88dcae5a9c886f31d2f8012538b9763bfbaa663107e862017be12f74ee68f4be
MD5 9e0c0b62485212f74888b38c1d2ee522
SHA1 437adcb6a8f022c27030856ed95c3586d4dca694
SHA512 b3d065f129818e74999925a14748e1f8699ccec6f00020bafa232aa3c47df1275733de4a06b43ba4fd690fdac0b53fb0f10abf9e3c40e87e95c5ea2c1648b95b
SSDEEP 96:xHBUTUxVqGq5fg9o1zSiSSlWdv9j/nqH/8MBw88n8L4cn+wGC:HyR5fg9oLSS3dBw88hC
TLSH
T1FDE120789508CB7F75B676ACAC688C715AB2013B77BF28C710B65488051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 30260852561bd59ea91dbd960c16b51a9c0363085f610795532e0381040cf02e
MD5 075966837f2dfb47bea3a64d5fd0fae1
SHA1 b925896d526afdd16645a15aee6ba1032f834e7b
SHA512 96562e8ec6369f3c7d75d4e5aff9c88573087b06ee0f22980726a3f23ab6065a65fe5ad8cb680edf5ce9feb0b6f5ae9012e32593ff94915db6f5ba7dd1a12acc
SSDEEP 96:xHBUTUxVqGq5fgX9ObzSbSSlWdv9j/nqH/8MBw88n8L4cn+wGC:HyR5fgX95SS3dBw88hC
TLSH
T141E120789518CB7F64B6766CAC648C716AB2413B77BF28C710B654C4051CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 f6b6d9d59a3fb5a390db087265887bc08d0d7d52211bde007191d7ae57346e3c
MD5 3ef22307d00cc47360c98883c2f44c79
SHA1 fb174ab72372c8282fae95a8dca2ba814e0008b0
SHA512 08f86c38c7c669c923be798c46510613abf869713d56d6e883ff9f116b903b183a1c2e2b0d936778f429e5d09487dd4295bc041c066bcff990b4abe9d42f7385
SSDEEP 96:xHBUTUxVqGq5fgX91zSbSSlWdv9j/nqH/8MBw88n8L4cn+wGC:HyR5fgX9iSS3dBw88hC
TLSH
T15EE111789518CB7F74B676ACAC648C715AB2413B77BF28C610B65484051CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 56e86ed7f05e9cb64831be9d32cf0988e6dcf3cb5ad499aa6162d8c5b5119ab5
MD5 de78801bade1bdf4259ed52b0b6313a5
SHA1 1bbb57482999ba39b824f229115fdfdb48943d25
SHA512 480dbfdd7942ec7cf8d2430dd60707102151065fb68095d422de5662942769f0424cca2f78f2befc549d31ef1f2a82d4955382f299a19d5b27ebdc53299c9506
SSDEEP 96:PXLfKQ2edMk166nlWPBedSvNFfbNdPFlhxfnDuelapzPashUI8yOgh9DiowbkHe6:zKviMKWIdWXTNjHxfDAHKPw0owbkHqRg
TLSH
T12EE15B57C7DA0B59C67DC32EE5DF03E6B6FB1124C7D90513545A7DA202EF69202BA028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 8c88683b62e53a85148b2e0481123bb0557519322a50c4eba55302a2ee0d995d
MD5 9ff0638eb9ee706d715a3f3c0472d442
SHA1 3bada548209146397df0c29f4b3bce47d0467df1
SHA512 b9399694b92d5965d10ead431e4fcef10bad3fb778c097eba9136f92fa2c5e8db1cbfc4d87823c8f2467b80397e3b41f96362e83e9090c7b85f71219a4e136cb
SSDEEP 96:PXLfKQ2edMk1+6nlWPBedSvNFfbNdPFlhxfnDuelapzPashUI8yOgh9DiowbkHen:zKviM6WIdWXTNjHxfDAHKPw0owbkHqRJ
TLSH
T173E15B53C7DA0B59C67DC32EE5DF03E6B6FB1124C7D90913545ABDA202DF692067A028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 b6116452a38e9dd214a38e7dfe1bee2f2a873dceb18fc1bb959ac559dd432bac
MD5 aa4390abfd3596d43055ce9a22c7f5bd
SHA1 69f00dbc2c1fa00b5026016293502af5b0efe9a0
SHA512 264b19e713797c0f4b0ca5b9c4ecdb51d322d8907aec693690edf8b3c404d4d5bd659163a253b214dcf2a0e58a4e7d01ee21d0321a3bf3f310392a9b1f9c1ef4
TLSH
T14A21F893866F2EE1EBB3811EEC544FE18296703188BD2CF0D08D490877CA099638762D
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads