b23e799c9f2221859988082bdab0ebee4fccab4b83d9aac4ac1ae53ab19b7a73

Analysis

user interaction
yes
max time kernel
154s
max time network
190s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nox_setup_v7.0.5.9_full_intl.exe
Size 754.3MB
Sample260702-mc6sgset8k
SHA256 b23e799c9f2221859988082bdab0ebee4fccab4b83d9aac4ac1ae53ab19b7a73
MD5 e48da59c31e8cb59cb83a052a69dd394
SHA1 3163921997c850f0e73c050e85338e34c5244c5c
SHA512 822eb6776c66a5d273bfde81cf093e10ce71fac49ba1e4b586cc78c97e50947d1f1a629cc4151a5d635cc1eace27acfc55225412eb87f94b29ad176433e05fb7
SSDEEP 12582912:LHfnFcdlknp4CDGbPF3X+VYwwuyzsBdSN9LFHKixFcl5S8+wR6qzixQZ562Yd/SJ:LfnKLk+6G9+Vzw1HK2cbS7YsU5HYd9tU
TLSH
T138893302B7C29472D6D202759AE5D33BAE6976214335D0D3ABF0266B0F315D2E73E389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
219	5488	firefox.exe

Executes dropped EXE 1 IoCs

pid	Process
6284	CheckGLVersion.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nox_setup_v7.0.5.9_full_intl.exe

Checks processor information in registry 2 TTPs 33 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	nox_setup_v7.0.5.9_full_intl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	nox_setup_v7.0.5.9_full_intl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2452	nox_setup_v7.0.5.9_full_intl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5488	firefox.exe
Token: SeDebugPrivilege	5488	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe
5488	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5488	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 6284	2452	nox_setup_v7.0.5.9_full_intl.exe	90
PID 2904 wrote to memory of 5488	2904	firefox.exe	94
PID 2904 wrote to memory of 5488	2904	firefox.exe	94
PID 5488 wrote to memory of 2832	5488	firefox.exe	95
PID 5488 wrote to memory of 2832	5488	firefox.exe	95
PID 5488 wrote to memory of 2832	5488	firefox.exe	95
PID 5488 wrote to memory of 2864	5488	firefox.exe	96
PID 5488 wrote to memory of 2864	5488	firefox.exe	96
PID 5488 wrote to memory of 2864	5488	firefox.exe	96
PID 5488 wrote to memory of 2864	5488	firefox.exe	96
PID 5488 wrote to memory of 2268	5488	firefox.exe	97
PID 5488 wrote to memory of 2268	5488	firefox.exe	97
PID 5488 wrote to memory of 2268	5488	firefox.exe	97
PID 5488 wrote to memory of 2268	5488	firefox.exe	97
PID 5488 wrote to memory of 2424	5488	firefox.exe	98
PID 5488 wrote to memory of 2424	5488	firefox.exe	98
PID 5488 wrote to memory of 2424	5488	firefox.exe	98
PID 5488 wrote to memory of 1048	5488	firefox.exe	99
PID 5488 wrote to memory of 1048	5488	firefox.exe	99
PID 5488 wrote to memory of 1048	5488	firefox.exe	99
PID 5488 wrote to memory of 1048	5488	firefox.exe	99
PID 5488 wrote to memory of 2040	5488	firefox.exe	100
PID 5488 wrote to memory of 2040	5488	firefox.exe	100
PID 5488 wrote to memory of 2040	5488	firefox.exe	100
PID 5488 wrote to memory of 2040	5488	firefox.exe	100
PID 5488 wrote to memory of 6616	5488	firefox.exe	101
PID 5488 wrote to memory of 6616	5488	firefox.exe	101
PID 5488 wrote to memory of 6616	5488	firefox.exe	101
PID 5488 wrote to memory of 6616	5488	firefox.exe	101
PID 5488 wrote to memory of 6756	5488	firefox.exe	102
PID 5488 wrote to memory of 6756	5488	firefox.exe	102
PID 5488 wrote to memory of 6756	5488	firefox.exe	102
PID 5488 wrote to memory of 6756	5488	firefox.exe	102
PID 5488 wrote to memory of 4320	5488	firefox.exe	103
PID 5488 wrote to memory of 4320	5488	firefox.exe	103
PID 5488 wrote to memory of 4320	5488	firefox.exe	103
PID 5488 wrote to memory of 4320	5488	firefox.exe	103
PID 5488 wrote to memory of 2624	5488	firefox.exe	104
PID 5488 wrote to memory of 2624	5488	firefox.exe	104
PID 5488 wrote to memory of 2624	5488	firefox.exe	104
PID 5488 wrote to memory of 2624	5488	firefox.exe	104
PID 5488 wrote to memory of 5932	5488	firefox.exe	105
PID 5488 wrote to memory of 5932	5488	firefox.exe	105
PID 5488 wrote to memory of 5932	5488	firefox.exe	105
PID 5488 wrote to memory of 5932	5488	firefox.exe	105
PID 5488 wrote to memory of 5284	5488	firefox.exe	106
PID 5488 wrote to memory of 5284	5488	firefox.exe	106
PID 5488 wrote to memory of 5284	5488	firefox.exe	106
PID 5488 wrote to memory of 5284	5488	firefox.exe	106
PID 5488 wrote to memory of 5492	5488	firefox.exe	107
PID 5488 wrote to memory of 5492	5488	firefox.exe	107
PID 5488 wrote to memory of 5492	5488	firefox.exe	107
PID 5488 wrote to memory of 5492	5488	firefox.exe	107
PID 5488 wrote to memory of 4768	5488	firefox.exe	108
PID 5488 wrote to memory of 4768	5488	firefox.exe	108
PID 5488 wrote to memory of 4768	5488	firefox.exe	108
PID 5488 wrote to memory of 4768	5488	firefox.exe	108
PID 5488 wrote to memory of 2520	5488	firefox.exe	109
PID 5488 wrote to memory of 2520	5488	firefox.exe	109
PID 5488 wrote to memory of 2520	5488	firefox.exe	109
PID 5488 wrote to memory of 2520	5488	firefox.exe	109
PID 5488 wrote to memory of 6840	5488	firefox.exe	110
PID 5488 wrote to memory of 6840	5488	firefox.exe	110
PID 5488 wrote to memory of 6840	5488	firefox.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\nox_setup_v7.0.5.9_full_intl.exe
"C:\Users\Admin\AppData\Local\Temp\nox_setup_v7.0.5.9_full_intl.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Nox\CheckGLVersion.exe
  "C:\Users\Admin\AppData\Local\Nox\CheckGLVersion.exe "
  2⤵
  - Executes dropped EXE
  PID:6284

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1936 -prefsLen 27097 -prefMapHandle 1940 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {71d69064-84da-42c0-9336-e2ead6e45bb7} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2404 -prefsLen 27133 -prefMapHandle 2408 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {a6b7ffd0-cb49-47af-8c5a-fdfa1eaec741} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27274 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {5c81a55e-a330-4e15-b72e-03a4d58ada96} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27274 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4124 -initialChannelId {2b2d7625-a37c-4b59-ac0c-ccb138802a5a} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3052 -prefsLen 34773 -prefMapHandle 3056 -prefMapSize 270279 -jsInitHandle 2976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4560 -initialChannelId {2a96af3e-23de-4451-b86d-ad743491a0dc} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4988 -prefsLen 34822 -prefMapHandle 4992 -prefMapSize 270279 -ipcHandle 5000 -initialChannelId {b85df604-24fa-46a6-9b5e-dbd92f43ce25} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 32952 -prefMapHandle 3064 -prefMapSize 270279 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3116 -initialChannelId {b681c789-278e-45f3-a33e-bd3a4a669027} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 32952 -prefMapHandle 5712 -prefMapSize 270279 -jsInitHandle 5716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5724 -initialChannelId {a40ef99e-bd03-47a5-91ce-49f7a87b6d36} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5892 -prefsLen 32952 -prefMapHandle 5896 -prefMapSize 270279 -jsInitHandle 5900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5908 -initialChannelId {57f49961-4169-4270-a780-00f95cc8b2d9} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4528 -prefsLen 33031 -prefMapHandle 4548 -prefMapSize 270279 -jsInitHandle 4544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6492 -initialChannelId {c2179281-66d7-4a36-8cd4-b170359a0f63} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6764 -prefsLen 35141 -prefMapHandle 6768 -prefMapSize 270279 -ipcHandle 6776 -initialChannelId {70c7e0b4-6a1f-4789-9ce0-4604dced49a8} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:5932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7016 -prefsLen 33031 -prefMapHandle 7020 -prefMapSize 270279 -jsInitHandle 7024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7032 -initialChannelId {98b6623a-1dd7-4a92-9b72-b2d8f249f195} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7196 -prefsLen 33031 -prefMapHandle 7192 -prefMapSize 270279 -jsInitHandle 7188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7244 -initialChannelId {082f79bf-bc26-4e19-985c-86491aaf55bb} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1368 -prefsLen 33071 -prefMapHandle 6016 -prefMapSize 270279 -jsInitHandle 5976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4736 -initialChannelId {8c0ca6f6-1433-4ed7-b14b-6de7a98defb8} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:4768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 33071 -prefMapHandle 3268 -prefMapSize 270279 -jsInitHandle 2804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5968 -initialChannelId {3c5db848-b811-4f32-b8bb-241cd50d24e1} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6512 -prefsLen 33071 -prefMapHandle 6460 -prefMapSize 270279 -jsInitHandle 6492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6000 -initialChannelId {6b4df911-5a10-4db0-8adf-0c967dd9f769} -parentPid 5488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5488" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:6840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 13KB
SHA256 bd7bb924f414d73f91338e46aed49b4b7daa25fbf42e64f014f2985b76c2f0f0
MD5 fb7276689c4406434f1a7e8d414b24af
SHA1 bce0b29d10d6214354f403668c75cc287de65e93
SHA512 a8e44b24398f523ec67773cc45c9bde634f69d6b8c7d0f2307d67b5f1fed000cb586bf956d2d550c33a16cc5a2537223efa977c486a8ab73ed38048719f43596
SSDEEP 384:H9XghOiO024YKo6J+Sl1xDnZBPsac4j0lpDII+HWG:dX+ZYKo0+Sl7zZlsac4ID8LF
TLSH
T156528D7E9F0138AA1E27D090D5BE9254CD04A7BBEEE2D0651A543C14CA84BB9F4F64CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckGLVersion.exe

Path C:\Users\Admin\AppData\Local\Nox\CheckGLVersion.exe
Size 60KB
SHA256 15868cd72d0acff143b6101772190428927781334bbf6218465ed526544d76b6
MD5 ac0f922fd1f2bbd56d96f602ae44e28c
SHA1 e18b6cd5b630f65148342699048c21cc9f111187
SHA512 222e7e29d5829bccfdb5d49ac48d5359be7abd985eedb53aba5a514cc67ccfb6c4288108d008da5244ea9901dc29ae6d28092fa3a2002fa63b69cf87eb440989
SSDEEP 1536:fogSah2rmTcsrRd4TcF6lPsXA2IzliDP3rO9T50u:wXNrmTcGgcFe0XbIzliDP3re50u
TLSH
T1DA536B4A23A504F5E5638734C8F29A16E7B2F8531379834F476883A69F93382AD3D735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOX2E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\NOX2E5.tmp
Size 2KB
SHA256 dfd55944df560ef7d1d9bb058f03e0d80e53a9d4eca0461cd67077da25f680c0
MD5 f529dd5c9109598721d753efaf306acd
SHA1 69aacdef7ebb9a1f974b659c8831a59107538dcc
SHA512 689d35f0ca1889e52e55dbd50d5ae646ad8b52ad78cd76159a96508b7a4837c6d0a632584a462b4bfcd4676e7fbb62ac78d4b839874b5ed05ff36416dbe0c514
TLSH
T16E41403FEB49133626F103ABF50B28A1BB16145C432719EF949E5508330B26C17BF5E5
MD5 SHA1 SHA512 TLSH

Submit Download

NOX316.tmp

Path C:\Users\Admin\AppData\Local\Temp\NOX316.tmp
Size 14KB
SHA256 a1e348fd9ebf170ee6864f960c010fa89de32d992c6bd52c3960e7231ba04b74
MD5 90d2edf41c693375a6246787ab76987f
SHA1 874d1df6f6fecbf714881134283af3005a1de431
SHA512 41f5028f4c0a41686ab77cd09770bfa38294d599bbc26db9c2591592f93f9c935ef0d0ab8b1a7a7fd83aac74f859a36b169d5ab59f484652f09a0f854cd3d4f3
SSDEEP 192:HGTkEc+NTJS0Hi1gjaTuEnWmUOIR7zKbEWvQQPiBkR8UWZZfVPxko2i6R:mLpHiukuESOIhzuEWHaBaFqVSi+
TLSH
T1D3527DC3C90A2B2DE53C5DF51CFCE2AE2A06573D242DB059A588FE836A5047F505CBC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\AlternateServices.bin
Size 32KB
SHA256 d113b9989714ca43f4ffb38e3eab71b77cbee3027d99d57edf896bc1e025a9ad
MD5 cee867e10e4a8e66ceca3d84b4c026e6
SHA1 8d6e29db86b49f7c2b7e64856b67d8e02c6c4dc0
SHA512 8ac0bc998e06c2c97968f80c55bdc115304d582bc71ff26f9c04ae758240de0eb8f850c41c74fd3d74759ac55aad3e194c2b712dff217e3c30d3865f95a24a28
SSDEEP 384:g6oUvqB5S5CbWaC5yNCQg822DzZZOFNfiA:o223ZZ
TLSH
T162E266F71FB664A2F0628FF0809C758DDC3312299968D5D4CA14D4E712E97A5D03FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\AlternateServices.bin
Size 8KB
SHA256 2d1795aa45777264c795dfcfd73a29d4bad21b9bb266da6055fc940e44f3ee3f
MD5 77677ffcd850260f0c137396a9b38158
SHA1 0b08bcb355a6f33d8ff4789f5b3114a578d1bdcb
SHA512 3ae678a9f3604f4b52d92f1e4eb97daf56f5ae3f6a8817c06e2be002affaedb3d460b4d6594c8797da120eeceb15892fd364af62237264d342d9450e3301ad65
SSDEEP 96:xOvebOJbp3b13bB3bePgbgz63b0ObR3bsDbi3baBbG3b:xOznMJHZ
TLSH
T1610285EB1B765462F0524FF89098398DDC33426D99A8C5F4CF14D09322B97E1D03EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9c1b91c2698b2b18bf54015a447e6cfa63206ec3de60d6b5499e44dfde53c7af
MD5 776865413c462962f1aa10c877e3f5c7
SHA1 086c1a41f4faa7bdf9909b3681f9a2632bdf8214
SHA512 5805cf5e036056bcc9d0dfe36c726873c4d33234c034a674aaf6399e73f81d800026db6b0c0b2566414cc470f29c69be4985b21ff1e9e164a1a2af5e27877bb2
SSDEEP 192:RDOv5zboHGZDWryjWwh6WEak1d66JoztdzgCl6mc0d:KbomZDWryjBINd66Joz/zgC1j
TLSH
T116D1CBA9E229963BC419023BCCA61F500F36384A984F3F2531AC741D3D962DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 dedb2e39919f98e0e3c97758bb13fb2b5621f75aeafda57eeeca5dceacc21ea1
MD5 37d3f309372258db9edb34c8a475eff9
SHA1 4696d310150442ec7728bece55f5588402da81f7
SHA512 7be1c323f0ad32a999c22a3da9a00977a3c8dcff847921bbe576d9110cf9cf0d9f0c6b418188df61e2d998d1c33e136f7645d435237e768f0aacb3af1129c434
SSDEEP 192:Oh6WEak1d66JoztdzgCl6mc0dxDOv5zbo7zGZDWryjkMN:OINd66Joz/zgC1jEbo2ZDWryjX
TLSH
T145E1FDA4E628863BC408137BCCA61F510F36394A9C4E3F2975AD611C2D5B2DE778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\events\events
Size 5KB
SHA256 f833927bd50fa1d3fc61c2719df126a3666684effbfc1922635a542247e9a544
MD5 333616928484343779f8f0823b5a4ab8
SHA1 82a41095aa65d1b1e070c1fe6b7d0607136881d4
SHA512 7c01b8d08de285ee8832ec96182d2affabdd2a6d778df8b2eea5327f2d4f686857f33fa73978869d08cc9cfbe759dc63015b1538a8f8f5f913f59d26ed106d29
SSDEEP 96:U2NTAse36hFMJ45ostadlWaTdL2MLbwkRm2F:U2NTSl4cYaBTcH2F
TLSH
T160B11E5D79B90C7E289BD39CF885068D82D84742C58B2D478CD7EF48CD9AA9A321F028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7adea7259e1cad398ad9a5e098a5af6290606c827f667b2f0bd2f46a56b6e2e2
MD5 e81a1e5eebb4f040babb501f53905337
SHA1 49f61637d0e62d42226af3f931282e7d93423aa4
SHA512 1227fd4bce50996341ff92d0a56a8675f5bed378726278ac1b9d02a9978988c7045e18059e2eed44a05c3e21ee8cc4f898912557ad67172f5e6b639ad3bc0233
TLSH
T1E021978C3EB84D6A988BE29CB8400ACE53518A4745975D430E42EF8DCED5AE9322E43D
MD5 SHA1 SHA512 TLSH

Submit Download

53155af1-7ec2-4052-9905-a1a96e376aec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\53155af1-7ec2-4052-9905-a1a96e376aec
Size 886B
SHA256 95f5e014591b07139190a1e1191acd83ed448ee6bf105ecbe6e3b66c81b966d0
MD5 a75fdce15af05f7bf02d3e9f8af5ac59
SHA1 290370be8841ccc1f2f35ce3ea50b8df5b42c09e
SHA512 3bcb095c9fd41275bd7da086e25fe5fde551a16e25ed9a2bc7814ec15c283896b334a79a24a021eb8e3b6b06c72d1609e6d8f95744adbe8f24923ef97a510624
TLSH
T12D1104918624F9A2CC29D24B89A5BB5247D47133C0C71C147D71AB088DEB11EA36B20F
MD5 SHA1 SHA512 TLSH

Submit Download

582485e9-4eff-4db3-b1d4-4aa07cddb4ea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\582485e9-4eff-4db3-b1d4-4aa07cddb4ea
Size 16KB
SHA256 d5d9d800956474dc9b9cf141ade27051af33e2ea09e5cfc5ab3c4269d09c1a04
MD5 884cfd47ba88d2fbdb950bfd3878f9f1
SHA1 a45711e2621df968711a959e8712bd97c83bd600
SHA512 23515f599b64beae683b8d6634df0225a9acd2893137344cdf714ee17f67877057515087f2cfca283aa320e9b488dd8a05f377ec6c6b4a722d2975edf15420b0
SSDEEP 192:OaA9tkUukBReRnkmT1JL37Wr1J08Vxz/uRqvNt5ZxZfKLoWUjujoTeDYqRcJE/bq:StukORk+L7WrhtgALJqRckbiolKZDr
TLSH
T13972DA562860497A8651E76994FCBFC3E1F538CF4C419FCA9BF0BD086DDA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

723aba2e-b715-4082-991b-2d5fa98a1ba2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\723aba2e-b715-4082-991b-2d5fa98a1ba2
Size 883B
SHA256 a0c9a51847b3a67ce0cd281868630874aa959c1be3665cb4b62a433e44557539
MD5 c1d5e28b42a1c0630df38ed669df3ae6
SHA1 cca83ddf0a94b10dcb275783beb897d03256bbd5
SHA512 3aa856e1c3a709297124e37ee017bc81d643914ae02a1fb5ef8107d450d60d4c563e20971f98aa22712f6323ec0317d98bd13dbfae1cee4543634faf322ee5e5
TLSH
T1051104C19334F5B2CC78920FCD553B5697E4751380CB54107EB19A084DAE129E36A60B
MD5 SHA1 SHA512 TLSH

Submit Download

7b80e331-efa9-479c-bec5-2fd1d6f097e5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\7b80e331-efa9-479c-bec5-2fd1d6f097e5
Size 2KB
SHA256 85bc1aed9fa6bed2a62c2e928c0c5afac4ac948ca8c2d7081be05535d92d7540
MD5 8cf33bd7d22419906cac3e14fd3e676f
SHA1 e40949e90ababb4b6f90d3279c25456d460a7492
SHA512 638e5940a75225840cdf685338731a32b4e9c569c8315c74a2f1484a282ed9309f1f4bdf3ce3605a37434fcd8e19f907bb52ca5703d0c9ec341ce86a0e85863b
TLSH
T1A94113683A789D778C9AF24D9C52228D57A18A0301C71C436F91EF0CCE9669A737F52B
MD5 SHA1 SHA512 TLSH

Submit Download

b89fca5d-a27b-4b97-aba8-1a48b7d0fd92

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\b89fca5d-a27b-4b97-aba8-1a48b7d0fd92
Size 235B
SHA256 1e36faad1ef2fd4b9d9854a6c5a90490b69848df26b9c7696a27651275032014
MD5 4bf772057fabca22c7d1653789e4bd58
SHA1 b6bbbb667ef00385a329f1c8f099d59ac27f6a2b
SHA512 decb8e1d304afe1d1e265f6a21fe41f1847311d9319b343c557e14a70a1535135fbabb3175969457e057622f330d43faf9cecb46325b0d0301f6c2c9585fd4fd
TLSH
T1ADD097806898A7AC08040F07F0E469C630448C33107868108E5580388BFEAC84111867
MD5 SHA1 SHA512 TLSH

Submit Download

bdf42e0c-1cd4-4106-b205-e3fae91120b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\bdf42e0c-1cd4-4106-b205-e3fae91120b0
Size 235B
SHA256 70a7875821018f665f5106896b4822ba73fb4f82189cc53570ccf2048b01ad7d
MD5 140049dd0028ab772418253cb743c0b4
SHA1 ada762d13c2eb03c752c736432cda51ba350b4a7
SHA512 6ef3dfabc7b8fc736d5c4866489bc140c9f3a87b3595a4838217badd7e6a0c77fb26fdef4305203bf835263171225c9039202cc40a1c9259b79e457f95748094
TLSH
T12BD0978064A87B6E88004F2EB0F029E730644C33206468F0C66284B4DAF9FC85262806
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\extensions.json
Size 16KB
SHA256 34254fed7848ce216c58fe35be402e864ff47624b9aa0e766a7de92c15ec592e
MD5 8e84d95286faaf5968673803b1c2535a
SHA1 1802f97f862bebde5998504bb008be7d8084fe44
SHA512 27fbfd562949e1847953bb4c36f2643eb27cf8c1ae4a748fadcc39fcbf1cf46689eaf463734009903f11e6ec5a0bf0957d2966420bc9e75123f8c58e15f10674
SSDEEP 384:ukI4vPUmldvX8dhWU94zqf96ogL4HeL4PmL4HnL4HJL4HWr4hC:BI4nRfkXx406l4E4U4r4B4U4I
TLSH
T1E072521545048EB8294FA79BAA36BE01C37D473B60845C78F4DD8FC802FA5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\prefs-1.js
Size 6KB
SHA256 146a31c4a0f57dfbb27bf11c20fbff3e9ab6e6dadbb7b3f64dce38ab67a59a5b
MD5 6b66262514e66b59d044ca4c7a80c9bc
SHA1 1e92eb7d933efcdf72e717a9c6355dff03120f78
SHA512 e302ff5658e346ecb430586d0cfe777f0f6f143ee23f178120377bf543a409306e7dac2d176c869a2be9f3c7cf8ddec474761e97ebdf10f81c8d551ae3870327
SSDEEP 96:xH3UTUJ1qGqAjfN1k1zSxSSlRdv9j99nFLHDyuBw88u8L4cnlEJZy:t2REfN1kQSSNzDJBw88Wy
TLSH
T18FE121785108CF7F74B6766CAC6888716A72013B7BBF68C750B65884015CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\prefs-1.js
Size 7KB
SHA256 da397aba0c659801c0ccff4cdb521ba4c4b4a85d161daf04955097eaf13b6d6f
MD5 7859ee67868144d5b139ee6e3ae2e966
SHA1 d008c005505fa17af7e82f37dcc075e38a75fae5
SHA512 050a156df97bffc661e482a2f5f517bd9eea776d6b0ebc457b41404051879a19df57effe413a35b4623793a6e5b8c266bda3644cc84799b57b4fa5bcbff245e0
SSDEEP 96:xH3JTUJ1qGqAjfM1kNbzSxSSlRdv9j99nFLHDyrBw88EtLm8L4cnlEwZ7GS:tfREfM1ksSSNzDcBw88cLJx
TLSH
T1ACF11D7C5108CF7F64B276ACAC6448716A62023BB7BFA8D710B94885055CF3845FE6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\prefs-1.js
Size 10KB
SHA256 9af1523b5f52f422e0f461dcb5d92f92228dba57e9ead403401999c27568914b
MD5 9214b67899288fc83e1277296438c2d3
SHA1 5c8c3d2295e20bc436be5da7298df9c052ada755
SHA512 85b05a1f41b5570268276121f200beef0bccce86de0eef1217961889c4283111d993311e7917f2bff913fba31e612fd3d331ecc95493eec1348409996bcc38a4
SSDEEP 96:xH3JTUJQPqGqAjfM1kNbzSxSSlRdv9j99nFLWRa/y0lHYBw88cyOgQLSzL2R8L4+:tXCREfM1ksSSN6R6v4Bw88c6QLSzLtx
TLSH
T11732DB7C51048E3F24B2367DAC644DB029624237B7BFBCE605BD8881095CF2545EAAFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\prefs.js
Size 6KB
SHA256 2c4e9cfc4666a0fa72d4de998195d371d18cd50da572fb2e3df00e12531a245b
MD5 0595cb94a52e657fb657bd422ce63411
SHA1 bda5a520e6886b2e697be65fd78e4a604f54e890
SHA512 7c436ffbcb27a640882856bccf166b058e9ed7deabd997ea52cc0251390ce30eb90682305042f343b99966fa3e17105317ac14ec2b4043a46f596155b2cc0f43
SSDEEP 96:xH3UTUJ1qGqAjfNba1zSr5+SSlRdv9jsnFLHDyuBw88u8L4cnlEJZy:t2REfNbas+SSUzDJBw88Wy
TLSH
T1B1E11F789508CF7F74B6766C6C6888716AB2013B7BBF28C750B65884015CF3446FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\prefs.js
Size 7KB
SHA256 031f02f20ba295fa54082f7aac9bb816585fe2f02033f8a36d74bb5b0cc7f6b4
MD5 1134a60279ca0d0e8c3c273704205fb8
SHA1 396a4d01f6aea4351c8614029c8ca7dc2c024a6c
SHA512 d862f211e5a02d5e3042cbbc65f0d223e043a3e0bf68090ed48313ab98749e7acf7b36ee0b4993449171c2082af4b2a2e34dcba5fc7f7236960d342751eebe8f
SSDEEP 96:xH3UTUJ1qGqAjfN1kNbzSxSSlRdv9j99nFLHDyuBw88u8L4cnlEJZ7GS:t2REfN1ksSSNzDJBw88Wx
TLSH
T169E11F7891088B7F78B6766CAC6888716A72013B7BBF68C750B65884015CF3445FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 cbf2d085a650b107c6c972f6f27d094f34edcc1337765e6f0924aea2b5dd7080
MD5 f91db7c66fb45acd66efd2b5f634797e
SHA1 5f4ecff1be968fe0815b9a90fda34cae058d27cb
SHA512 7ab2e5179d6fbe6dc52da0e6206d0f40077048c25cc0a5caab711f07714750d1a26549e6444a969454d5dea57701c5d3cfcaa768f916237ddef8177987423cb0
TLSH
T105613BA1FCAE085ED9984143C0C45BF1F5B68543C2F188E1CD099619A99CE8C27DA6DF
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\sessionstore-backups\recovery.jsonlz4
Size 16KB
SHA256 b75c7b8b4081b35bd374293d61c3df2906b1d9867dad9b5eb7232e5c0866a4f0
MD5 940c6065a8f3b794219c263993099644
SHA1 e8211cfb460739ad0500fb087bf2b73bb45eac11
SHA512 45638e8ba8270d4b97a5bcbafaab690299a7727026bf71bfd88da8fc5b0602ea14dfb4ef2387287a9c3402e1dad4880503a5caa11f925e23795872f5500b03ae
SSDEEP 384:SZCtLVslHY80jMfP3fQGCIDyxR/I36lJQtNiQjhRfs/ie:SaKORgvIGJEOwQ2oqz
TLSH
T1E772AF8306B41BF4D6264B0010E5BA1CBBFB81072B55674BFD0FD56545BAA02AD2F34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1c3dfb5c-b5df-4b55-897d-e3286b66c87f}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\storage\default\https+++www.youtube.com\cache\morgue\127\{1c3dfb5c-b5df-4b55-897d-e3286b66c87f}.final
Size 192B
SHA256 04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee
MD5 2a252393b98be6348c4ba18003cc3471
SHA1 40f75302fcbe4a8ac2e33a8d9daf801abc2a9598
SHA512 07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198
TLSH
T113C0225846A8EE3620A3CB3CC827E2820A3B831000498484E6F94A540C8BE850129A01
MD5 SHA1 SHA512 TLSH

Submit Download

4290659884yCt7-%iCt7-%r9ebs3p3o.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\storage\default\https+++www.youtube.com\idb\4290659884yCt7-%iCt7-%r9ebs3p3o.sqlite
Size 48KB
SHA256 d9192873e979c22a716260fc1a2e1ff295b2f7a830fbefc124c21f178f8d4888
MD5 7d73ffdb9b3db2e52f76ce54a90ecfe3
SHA1 414796f1cdb56d7303c4e63db21f66ecea9f1670
SHA512 b3719888a6f403e65c43a437c55e86e380dd7cd5dac264580490cb9de53c9cf6c20af037850c392ece438c030b524ef13506979183bb1f62400c621d2b84f0a7
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEVC:Oa16S6CKnqlizbxV+2xVeU7X2B0I
TLSH
T1BF23608E3F07E511C53AF0B178A08D52BC5E321E07222AD57990D9E4C8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.1MB
SHA256 f3be17b19ae95388c3deaf590e780df3bc3e2d249626af7b8a6fcf5ac5c9b98e
MD5 18b385aed57db88cc46bc9647fb3812f
SHA1 5467154215963ae0fdfdde8f4f90ee62e222e1e4
SHA512 8d74ccdc2669499c99fd4c397aad63810db89ef7bdc8a5c24e06ca8b47fbaf324bc6a9f5a74a39efe7cc4582ee7019809759dbb0ec34c509218169831dcdbab6
SSDEEP 49152:Ji4eH0J5xV/eoY5IiuPl209pw43vt9SbPBIRLTeJKpi4tW/7NabY444CCUkT0Ia9:gz2720I43vt9SbP+
TLSH
T1CD765CE420E1D253F38640B3719993FB20EFC01C60768E44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads