hxxp://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid[.]onion

user interaction
yes
max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Sample260707-cc247afx21

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeDebugPrivilege	3868	firefox.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 3868	2756	firefox.exe	83
PID 2756 wrote to memory of 3868	2756	firefox.exe	83
PID 3868 wrote to memory of 1840	3868	firefox.exe	84
PID 3868 wrote to memory of 1840	3868	firefox.exe	84
PID 3868 wrote to memory of 1840	3868	firefox.exe	84
PID 3868 wrote to memory of 4892	3868	firefox.exe	85
PID 3868 wrote to memory of 4892	3868	firefox.exe	85
PID 3868 wrote to memory of 4892	3868	firefox.exe	85
PID 3868 wrote to memory of 4892	3868	firefox.exe	85
PID 3868 wrote to memory of 4312	3868	firefox.exe	86
PID 3868 wrote to memory of 4312	3868	firefox.exe	86
PID 3868 wrote to memory of 4312	3868	firefox.exe	86
PID 3868 wrote to memory of 4312	3868	firefox.exe	86
PID 3868 wrote to memory of 4176	3868	firefox.exe	87
PID 3868 wrote to memory of 4176	3868	firefox.exe	87
PID 3868 wrote to memory of 4176	3868	firefox.exe	87
PID 3868 wrote to memory of 3324	3868	firefox.exe	88
PID 3868 wrote to memory of 3324	3868	firefox.exe	88
PID 3868 wrote to memory of 3324	3868	firefox.exe	88
PID 3868 wrote to memory of 3324	3868	firefox.exe	88
PID 3868 wrote to memory of 2996	3868	firefox.exe	89
PID 3868 wrote to memory of 2996	3868	firefox.exe	89
PID 3868 wrote to memory of 2996	3868	firefox.exe	89
PID 3868 wrote to memory of 2996	3868	firefox.exe	89
PID 3868 wrote to memory of 2416	3868	firefox.exe	90
PID 3868 wrote to memory of 2416	3868	firefox.exe	90
PID 3868 wrote to memory of 2416	3868	firefox.exe	90
PID 3868 wrote to memory of 2416	3868	firefox.exe	90
PID 3868 wrote to memory of 384	3868	firefox.exe	91
PID 3868 wrote to memory of 384	3868	firefox.exe	91
PID 3868 wrote to memory of 384	3868	firefox.exe	91
PID 3868 wrote to memory of 384	3868	firefox.exe	91
PID 3868 wrote to memory of 4924	3868	firefox.exe	92
PID 3868 wrote to memory of 4924	3868	firefox.exe	92
PID 3868 wrote to memory of 4924	3868	firefox.exe	92
PID 3868 wrote to memory of 4924	3868	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2032 -prefsLen 27099 -prefMapHandle 2036 -prefMapSize 270279 -ipcHandle 2116 -initialChannelId {d2bb7b0e-026f-4a39-bd18-6e70a98327b5} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2516 -prefsLen 27135 -prefMapHandle 2520 -prefMapSize 270279 -ipcHandle 2528 -initialChannelId {72b9f0bc-9d55-49e3-a827-c0a34d50991f} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3680 -prefsLen 25164 -prefMapHandle 3684 -prefMapSize 270279 -jsInitHandle 3688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3696 -initialChannelId {ff37057e-1cf3-442d-b706-a2a75b65d654} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3844 -prefsLen 27276 -prefMapHandle 3848 -prefMapSize 270279 -ipcHandle 3916 -initialChannelId {5458091e-0458-4080-90f2-ec86e323c318} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2676 -prefsLen 34775 -prefMapHandle 2720 -prefMapSize 270279 -jsInitHandle 2772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2992 -initialChannelId {32e7dfb1-4bf2-4d85-838b-b4aeb42aa3b0} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4748 -prefsLen 34905 -prefMapHandle 4752 -prefMapSize 270279 -ipcHandle 4760 -initialChannelId {470a18bd-ff43-4cb6-a085-ac0f0400ab98} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4936 -prefsLen 32845 -prefMapHandle 4940 -prefMapSize 270279 -jsInitHandle 4944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4952 -initialChannelId {76564903-ea9f-4132-aa2a-ba61b5f2bce0} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5128 -prefsLen 32845 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 5136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5144 -initialChannelId {8f21cd85-f9f2-46ba-995a-f973f7f43000} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5344 -prefsLen 32845 -prefMapHandle 5348 -prefMapSize 270279 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5360 -initialChannelId {f2c14485-5e6f-4d2c-bceb-62f3cfb491b9} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 10KB
SHA256 fc6dab6967f73d051920dad366b009a8aeae7e4df5f86558a54b7bb58d2d054b
MD5 efc263620603fb2286776c8b241fa55d
SHA1 f070566f6e54fe060f3d97bd6b05214552665b1a
SHA512 1820910b7b1f3128c3ffb6c321c38704eab3be5346880b0bd77ccd8b2a0f79a67b225582bbebe9f4558fe2e819b01cf0ac98e9b9e656bc2144d207c40fc07005
SSDEEP 192:Hc8VFPpMrhOcXz5RqvAcdRPSHXFCPD1Oo1qAh4zjc4wivTXhh4l1OlrKlr7:H9XghOiO024YMzjc4Fv8lElrKlr7
TLSH
T1CF225CBF9F4128F92F57E084D8999319CE95E8BFEAF2906A11083899C344B17E4F449D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 0c972326a12d7ff688ac9290b99a5dcf150bd2db59cc375693e8a83e750b8d55
MD5 2ce729ab1ac86dc8667f67db5f9dc552
SHA1 5be7a83eda126e35118ab6fa60195c9601dacdc9
SHA512 9421f2a07583894e1d639d10195760cca4f6c3718fab606a45f9e45ef071e15cc911803dffa18ba05a55a879ad9003f7dc301f5fa5993d1e31b8c73d5699ea7a
SSDEEP 768:/fsE3lZxpxQkBGcmhuI/iqRZL5pyWjbkbDb1bHbx:tlZxpxQBqqW
TLSH
T172D21244EB2E953FD41812BBDCA54B002F79B88A98192F573B4C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 59KB
SHA256 bfa531b43709f608e90a9286b9a89d804e468f1af14cd645f793c0b51238849e
MD5 32e00a4197fde2f34b40c4ac632762f8
SHA1 8d7ccc27104de8be048546ec735663670eb835be
SHA512 1fed385f27166630d6f05a433f5543ffd396e91ea173d0deaed9cf97709086cd10226cc0f289330b232298e830b10f12c80bdac4d538ab951da61d2740ad7f1b
SSDEEP 1536:SJa1myg4tv13NWnIZ8b4utNm7sTJMbPaezd62/hFHkhkEXSE:SJamOt9wyacQCCeBBHEygx
TLSH
T1B1431244EB1E953FD82802BA9C960B003F79F8895A1A2F57375C64786C873DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 c0bafbaed0617c7c34051e75292ad7db96031a9c25d6275aa7c429f111239650
MD5 012773cd9b23cd16c6f06de452e0521a
SHA1 ae33fea2ac8e58b6764bb0302d5fafb7b0dd7834
SHA512 7fb4d1e450dde4e469a72158a9c5619ae9012fa47a3e5e20973e74358b93c499a1dfa98f79e53623d9c2aa4ae19d1bc9813c11f7fe7d83a8fe3db6c68b2a8d40
SSDEEP 768:wlZxpxQkBGcmhuI/iqRZL5pyWjbkbDb1bHbxAjTE/:wlZxpxQBqqW9
TLSH
T110D21244EB2E953FD41812BBDCA50B002F79B88A990D2F573A4D64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 207b5f363c6ec91264e9f7d11644a16e5599a0218b1f8446ffc8335e31f4e168
MD5 d0d0856b5b7f2838de6fedf929d71a45
SHA1 5a2e1012d8da7fed8b3d33642d9e6ecd73af045c
SHA512 db19f64e6af6434f5ebf86f14a701c1eefa966282de80b1036ff3069027eb0f5da8659d2afee9c456d3d41b6b581bbae3e4ca9ff510f3558236aacfe0e8e05a7
SSDEEP 768:NE3lZxpxQkBGcmhuI/iqRZL5pyWjbkbDb1bHbxHts:ilZxpxQBqqWC
TLSH
T14BD21144EB2E953FD41812BBDCA50B002F79B88A990D2F573A4D64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 cf2fc351a64fca38227841fb95836548a5387123821f822caf3580cf32389e1e
MD5 66db6b6396e6db1b65154f68e75d4448
SHA1 fbbf5f76c5bb371ae57dc37e1b9d5a1b2fadd736
SHA512 aab425635d32252df32ffa0e0e8f9c66bf4375d3bbff4b91fbf018c7ce44c4889eeecfff6506ebb4fed32e96049dff3247ccb6988d45a931215f2617172428dc
SSDEEP 768:QjFlZxpxQkBGcmhuI/iqRZL5pyWjbkbDb1bHbxzE/:KlZxpxQBqqWe
TLSH
T199D20144EB2E953FD41812BBDCA54B002F79B889990D2F673A4C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b227709086924e7d3977da7af9e62ce9189ca87a7da2d9ad45ed87b687e4e6c2
MD5 09cc3d2c46e6a786b6ea43e151e10dbc
SHA1 9f73db43205cab56b9a5563f939ad021dc922dbe
SHA512 cd20f2d7682e216c82625a9d3f7a95105c235ce6e5e015865ce9eb722929a671fdd44f90204a7a394e0939cfdbb48871dcb3be07a1c37eddf899cc2c5fb1e5e2
TLSH
T166118C9C39F94D6AA887E2AD7441128E97254F0344871D435E12EF8DCE90ADD326943D
MD5 SHA1 SHA512 TLSH

Submit Download

11a68bad-a8e6-4281-9999-5a385006c42b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\11a68bad-a8e6-4281-9999-5a385006c42b
Size 235B
SHA256 78ea6375b2f0c0b4fec1320dd0a3a207c3aa1058d2e34fde40255c27abb4e2e1
MD5 8e3fe6a1564e4c4cecb96b7acec65d0a
SHA1 32d3fcfbfd073391c34c427f5f08bbda9e2f45c7
SHA512 fbf6352e538257ed8eed8e79c4a67c3ef49ef706b8ac6e1df3f8be953031d05abac92aa1625d0d8143336a41826ca33d4acb2f835f84f439fae901ef6aa95231
TLSH
T195D097C168A867FC48244F2AB2E0A9C230448C331468A8108A7004B8EEBDFCC0261C17
MD5 SHA1 SHA512 TLSH

Submit Download

2b0079e8-3f0c-40b6-bb3e-4c0b39631aea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\2b0079e8-3f0c-40b6-bb3e-4c0b39631aea
Size 235B
SHA256 8f5987b262eb9ec00a1ba3f76798dc5a9be060a3864b67169b766184b1fc51ca
MD5 a3472ebf1e85a421c0d24b21460af45c
SHA1 14f7cea1068ed76b0898bba1f18423334d27b57f
SHA512 a41b28a0927cc836880cdd8c18fac47b0fce657f704aa5784fb5cc9ffe8918aaf8f92d712a3825e6677957653a4f43c0ac4ed39b4bea6af3abd18f3c64b88d8c
TLSH
T1A3D0978028A82B1D18151F02B0E1AED730854C3350A868A0D57208B49DFD9C5019294B
MD5 SHA1 SHA512 TLSH

Submit Download

4aea79a9-c430-4e4f-b7a1-af0967fc709e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\4aea79a9-c430-4e4f-b7a1-af0967fc709e
Size 2KB
SHA256 395c4fd20442586f7a235b673a8e91013c573b79450bbecbdcb50dd1a71725a6
MD5 fbb52792933a8f72827369286e4e4252
SHA1 83f744c199fbf000fea923ea12c27a0e82ebee31
SHA512 d5a552fc8b61d226efa33f52f7d094daaa4c547d92b14c6b935e7d1db5df30231c7e459b1ef93e5f39bff78f00e4852ace69e8061e8d09a2c4d3a2ba3cc47e55
TLSH
T17441115C75784C7799DAF18DD482238E57B08E1300C62C832EA2DF0C8DD669A776A57B
MD5 SHA1 SHA512 TLSH

Submit Download

75e0ad34-92f2-459b-ad84-13aa56f749f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\75e0ad34-92f2-459b-ad84-13aa56f749f0
Size 871B
SHA256 347b675807f34fcd99ed157d52d7c9ab864354ca523969b09fa9212ffca0f5a2
MD5 38f52992991479cc9e3e9ae44b169c49
SHA1 e18598f30295901c491c454c93377d58b6df0c4d
SHA512 dbd9e2e8377eed9aa2554367dd603b20ae4787b45b5b139dc1b30247ad7b8d738456a1c6ad7d8c941e481d2c1f22e40f6c499a46cdeacf29483c8e3d77ab563a
TLSH
T1DC112342A63479B2CCB8C35BC8617B425FF4262380CA44047EA25A140D7A62FE36B25B
MD5 SHA1 SHA512 TLSH

Submit Download

d0038011-50f7-4f4c-96a5-14c43e4a8a97

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\d0038011-50f7-4f4c-96a5-14c43e4a8a97
Size 886B
SHA256 29463d20fd10e27dcbff8ed796e7b0ec4a051d5c709bb1beef1301255778db2e
MD5 ba5ae851ce860f1509797e822fa7b4da
SHA1 67f3a245001fc7bee2c07c1f43c1920c2848de22
SHA512 752ed250178f5120c7cef62f19df3adc57fb1b9161d2209921b8ea3d826c769c759e50ca195683b711eab142a536a4316dfdf43a64b764b4c5ee373cfd3eba03
TLSH
T1D911045195287872CC688257D4A57B428BF4752380C919147DA54B140DBA61FE36635B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\extensions.json
Size 16KB
SHA256 6b9ea58ea490b4f37347a01ac004ea1812214f70caa7a38ce604302aa2c8db39
MD5 aec96f0f136e827f9a162fb1e625b436
SHA1 80c0be1329c037997d99d255f73301bd39117b0a
SHA512 a5ad6af05fd16f6cde8ca0499343dba13c076a47d6709a2894b77d229adc5bb811b1d1827f1564060378ef9e46fecffe7ee834e7188bb588f409afe3ebfde717
SSDEEP 384:B4kI4vuUmldvB8dhW694z396onL4HyL4PLL4HcL4HpL4HJZ4ho:BvI42RfiXb4p6Y4g4P4W4h4L4C
TLSH
T1E772631545048EB8294FA79AAA367E01C37D473B70845C78F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
Size 12KB
SHA256 d89a44a1dedf0e50f46072f27b5005f15c9eddd1f12b80ff2ce2b061b8897efc
MD5 6320f9f371eef8154c046e516bedbaa0
SHA1 0395453c6dc67b042844208c881ec82865f1f1df
SHA512 8c7d02f207cf1b6fda867088a712388546b95e4cd9cf374f724db7a9dbced418377fcbe339ddaef8caaf9ea653cfe2d57375b25582aeb13fa326218f14ba0324
SSDEEP 192:9cPRvfGFoTBNom2SSiLR8OBw88LRIRmH1:9OtRXw11V
TLSH
T15342CE3851408F3F24B672BD6C65497059A20237B7BFBCD309F994E6044CF2885E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
Size 7KB
SHA256 06de2f574c74bf064d7433019d8f596508123edeb6d9d05e0603d66710d8fe30
MD5 c30990a95d8150a4b77fa6b68729213b
SHA1 ade74d0df72b4a111f802194bd27620c8ab2669c
SHA512 e3c03e49ed4e5beb86ab61f2a1403c19328adf576578cd40ff468f9aa9bbca887b2626ae4a4c01cf5991bd9129460d048c1bf2a15429ae1bc779ad3110ac7338
SSDEEP 96:xH07wZTUzqGqvfGFoTBNoObzS02SSladv9jLn/5H1Bw88x8L4cnD0T:acPRvfGFoTBNom2SSm1Bw88X
TLSH
T1D8F11E789414CB7F64B6766CAC2489306AB2013BB7BF6CC714B954D9014CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 b67f9827ae3c4037993ed56bc1565e7f27fa9745453e42798ef07ff20df8f6a8
MD5 f16398c30b477aae12cd687975f59575
SHA1 543b12938219e7944be19e9b87c202c431f73ba1
SHA512 ba6762ef3d898168a9758d436d07e9c41662d6391e053756dc404f2940d446450d2dfe0ee0bd6476924923806668c0054415239b475e08f473eafbe6c4695732
SSDEEP 96:xH07wUTUzqGqvf8nm1zSlSSladv9jLn/5H1Bw88n8L4cnDOT:acORvf8nmcSSm1Bw88L
TLSH
T141E12E7894488B7F74B676ACAC6888706AB2013BB7BF28D750B654C4005CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 b03b5e911d9f7862ae7cfea2cabfacc514e113189257e2d966ec652048e2fc4a
MD5 f2b94a8597d27c9d3d663b93b089b95c
SHA1 88d8147bb014b87e3ef7975c833337d005e4016b
SHA512 aeb18be3fa210697d1fec70d2874533d42f4a331e5c08312a10e9a6603c06cdd96d5901cad02b973802797c6e1914e0a857905b8b6b95d7a0bea22649f49461f
SSDEEP 96:xH07wUTUzqGqvf8No1zS02SSladv9jLn/5H1Bw88n8L4cnDOT:acORvf8No12SSm1Bw88L
TLSH
T1CBE12F7894088B7F74B6776CAC6889316AB2013BB7BF28C710B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 17971c73d2ff9cfb8fdf8600c969881fb6d703a257eaa5ec4fd23415f29ed746
MD5 2eae01a5f4fa3ef55b33c4c9bee48c31
SHA1 bac0dc03d847c685da08f00b78352527ae4a43d6
SHA512 99f303d57cff40a45dafad1359d352341d5954c2d386210585e8a4905ddcbcdcf2a56f676c75854107ff8e9874bf909a13c94a43d438f4d6a470c8393191c938
SSDEEP 96:PXOf7DWpWeGu0fnnvNF3Nd0dFPx5tuelap9PanUI8yOgh9DiowbkQoeXRQ0uH:I7D2WDuGnvX3NCPx5tAbPw0owbklqRMH
TLSH
T164D16B238BDB0B99C67DC229A1CF43E2F6FB2014C7E54413485A7DB702EF646567A078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 26cf4a00d7dc04c045f830dda5932046e0de1b9205ee985571aa61c52b1846f8
MD5 a6a95caece10cae8e29ba3c1322b7da4
SHA1 4a4b893953b870919690b47f6ff211b7820d1a74
SHA512 93de78bb488700bafec37b0216b32e98a0a5997415517dd6e13a29d2f76828b630b2af939a32b7db8d01e0eca274e4faeec7d0d4d6e31ec739b2d73c1bd9fbf7
SSDEEP 192:17D2W5bWIdvXTNjHxfnAHKPw0owbkHqR+l:17DPDrbfnmKP/ogMxl
TLSH
T1B1E16B23DBD70B45C679C329A1DF43E7B6FB1020C7E9441249567CB702EFA82127A068
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 fc6c8db44063c5db8162a116343bec3d1b7e0390d4160e2fb128ad680adf3175
MD5 96ec106227e9f00d5eb20bcbf80cf341
SHA1 4142b49d2b7d9623abe10785563ada1bad5b68d0
SHA512 b4ea9fca7c25c82350c436c4e1ddf01ebfef63b784707a6149f8b68a4a3a9c28549cbc6d5a47529c69e16937b862e500ecf0338b4f7f5fdfd37f8eeda83612c3
SSDEEP 192:17D2W1bWIdvXTNjHxfnAHKPw0owbkHqR+m:17DrDrbfnmKP/ogMxm
TLSH
T106E16C23DBDB0B45C679C329A1DF03E7F6FB1024C7E9451349567CB602EF68216BA068
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads