hxxp://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid[.]onion

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Sample260710-ej1aaad16s

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	firefox.exe
Token: SeDebugPrivilege	2908	firefox.exe
Token: SeDebugPrivilege	2908	firefox.exe
Token: SeDebugPrivilege	2908	firefox.exe
Token: SeDebugPrivilege	2908	firefox.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe
2908	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 2908	4704	firefox.exe	84
PID 4704 wrote to memory of 2908	4704	firefox.exe	84
PID 2908 wrote to memory of 4404	2908	firefox.exe	85
PID 2908 wrote to memory of 4404	2908	firefox.exe	85
PID 2908 wrote to memory of 4404	2908	firefox.exe	85
PID 2908 wrote to memory of 3620	2908	firefox.exe	86
PID 2908 wrote to memory of 3620	2908	firefox.exe	86
PID 2908 wrote to memory of 3620	2908	firefox.exe	86
PID 2908 wrote to memory of 3620	2908	firefox.exe	86
PID 2908 wrote to memory of 1764	2908	firefox.exe	87
PID 2908 wrote to memory of 1764	2908	firefox.exe	87
PID 2908 wrote to memory of 1764	2908	firefox.exe	87
PID 2908 wrote to memory of 1764	2908	firefox.exe	87
PID 2908 wrote to memory of 3116	2908	firefox.exe	88
PID 2908 wrote to memory of 3116	2908	firefox.exe	88
PID 2908 wrote to memory of 3116	2908	firefox.exe	88
PID 2908 wrote to memory of 3768	2908	firefox.exe	89
PID 2908 wrote to memory of 3768	2908	firefox.exe	89
PID 2908 wrote to memory of 3768	2908	firefox.exe	89
PID 2908 wrote to memory of 3768	2908	firefox.exe	89
PID 2908 wrote to memory of 2400	2908	firefox.exe	91
PID 2908 wrote to memory of 2400	2908	firefox.exe	91
PID 2908 wrote to memory of 2400	2908	firefox.exe	91
PID 2908 wrote to memory of 2400	2908	firefox.exe	91
PID 2908 wrote to memory of 1692	2908	firefox.exe	92
PID 2908 wrote to memory of 1692	2908	firefox.exe	92
PID 2908 wrote to memory of 1692	2908	firefox.exe	92
PID 2908 wrote to memory of 1692	2908	firefox.exe	92
PID 2908 wrote to memory of 3640	2908	firefox.exe	93
PID 2908 wrote to memory of 3640	2908	firefox.exe	93
PID 2908 wrote to memory of 3640	2908	firefox.exe	93
PID 2908 wrote to memory of 3640	2908	firefox.exe	93
PID 2908 wrote to memory of 2136	2908	firefox.exe	94
PID 2908 wrote to memory of 2136	2908	firefox.exe	94
PID 2908 wrote to memory of 2136	2908	firefox.exe	94
PID 2908 wrote to memory of 2136	2908	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion"
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {6ae3b888-de9b-4c2d-aa30-cb98d857c09d} -parentPid 2908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2908" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {f7cf255d-3fe8-4238-be34-8697ef89035a} -parentPid 2908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 25164 -prefMapHandle 3784 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {960b8d59-4654-48c7-85e0-25173de74eae} -parentPid 2908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27276 -prefMapHandle 3980 -prefMapSize 270279 -ipcHandle 3784 -initialChannelId {8ec3b4fc-5446-44cd-95e4-dab10464f256} -parentPid 2908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2908" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3036 -prefsLen 34775 -prefMapHandle 3040 -prefMapSize 270279 -jsInitHandle 4244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3084 -initialChannelId {c2e31fbc-4267-4746-a1d3-acdb467ad81f} -parentPid 2908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4740 -prefsLen 35012 -prefMapHandle 4736 -prefMapSize 270279 -ipcHandle 4756 -initialChannelId {543465c9-53e6-4815-8c10-fbd53f5f67aa} -parentPid 2908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4908 -prefsLen 32900 -prefMapHandle 4912 -prefMapSize 270279 -jsInitHandle 4916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4924 -initialChannelId {8e45c4b2-9987-470a-bbe2-eb8597896f5f} -parentPid 2908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32900 -prefMapHandle 5192 -prefMapSize 270279 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {3071d534-1132-4efd-809c-445b876727f7} -parentPid 2908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5344 -prefsLen 32952 -prefMapHandle 5340 -prefMapSize 270279 -jsInitHandle 5336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5196 -initialChannelId {a6de747b-fc9d-44d5-ac4d-104d87cecbf1} -parentPid 2908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 10KB
SHA256 8db0fab025311afd2de9ab040dcb6c0ecddaf2d67340473e2cba9ccb4c12644d
MD5 6e3f90a9211fa6fea8d9f0b375391697
SHA1 cd9f60e88b964187f7df3f9d4694f139b9582cac
SHA512 21e6f11bcbff4df3df1b417e97d69d668c3013e3b1b72b4172d8e146d3b74a82c7d0c46598fb9de64f4bf9a2b0a1d2e7f34979d50e20ef15f1ebc7a377bbb6ef
SSDEEP 192:Hc8VFPpMrhOcXz5RqvAcdRPSHXFCPD1Oo1gyI2/qH6W6y6xHKk9aNt1fIy:H9XghOiO024Yq2/qH6W63BK8aHdIy
TLSH
T1BE225CBBAE1168D82E53D194C8B95245CD94E5FBEEE39017011C38A9CA80B15B8FD4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 947624604cb1b9fe6b092f104a60c4849a2e0595030afc2e12d481bc5560ae36
MD5 252e26a10a2d17ea57a24d10b337f0dd
SHA1 177f06b51f75fd52697b2a3b2501f5e990bb051d
SHA512 086acfd082c8ccccc36f2c42e36889c43239c93808d85c3cd4048df99dd75166e14f922f6c8395700330f2f18c36ba321f54abf4a220b1d426b4a277416ffddd
SSDEEP 96:cXSdF95/7bkW60rcEDLyUR64WZbuFW2F1FhFBF5/dd66JozGzgClKtmc0d/UK:QOv5zbowbDLyjbd61d66JozGzgCl6mcM
TLSH
T1DFC1AC65F728463BC448423BCCA61B410F76389BD84E3F1532DC64492D5A2DEBB8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 347d2ad50f1b36acf45d6463850ea7ad0e7ab65f84e7aa22e1c9227aa8e8ed97
MD5 59917f51d00df1da2ccf536308922aa0
SHA1 df5c064c34611cc2f0bd3974a627a360733ed38e
SHA512 399773c66eb25c3da80a69d4ba89000512db3184a4faf039a69e542d3f6f17b530811b9c8a3587efc10ed86db4225655bd1d0c1bc9f033c46dec00a9265b4387
SSDEEP 192:+61d66JozGzgCl6mc0dOOv5zboSZDLyjlEF:+kd66JozGzgC1j7boSZDLyjQ
TLSH
T1ADE1EDA4EA28463FC404437BCCA61F410F39389BD84E3F19369D65582D5B2DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 36KB
SHA256 5b4276d6aa16e26de6374015c5de0ed61f9d1e1255606a246632a55509a78076
MD5 7256715ad4a98e2f76da3eb7fcf20b8a
SHA1 05fe953a576cd51d3f482222d0ab2a09be8921f0
SHA512 a1b877d4f2df5f8b6ac2f008752b95979409ae92cd8f066cc13fce0144538cfd289e0d72387c7f26c5392ebb5ee01311682f45cf2c0ccf5959badb5005c8bf1f
SSDEEP 768:bsTNu5Cn5z9yVGcmhu9q1Kid6Uhe58EEiFb+bVbkbubHbgbubebFQ/ZFRBEiZrYj:bsTNu5W50C18Q/nRBEiZrY/+hxs
TLSH
T10FF2F144EB1A953FD46812BBDCA20B002F79F88995092F673A5C64782D872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 36KB
SHA256 b56b43b2e214e6438bf94f89ccd071749e30fa6b5f2f069aeb9a2be5f470faf2
MD5 96c8972529ce2458a7dda91ad961948c
SHA1 a76b481f0b05df8835d352b0dc45330c46bcbbc6
SHA512 89bdb2a41db4e7316e60786e94a42b17b2c9bc20dd1431ca91769d0aaf1e437cafe7f77523ba0b99c3e5e8401cfde94f767442dae34ac0cd01cfed40261df27a
SSDEEP 768:qE+sTNu5Cn5z9yVGcmhu9q1Kid6Uhe58EEiFb+bVbkbubHbgbubebFQ/ZFRBEiZF:usTNu5W50C18Q/nRBEiZrY/+hxV
TLSH
T138F2F144EB1A953FD46812BBDCA20B002F79F88995092F673A5C64782D872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 36KB
SHA256 fe36184f8134d4691ae9ed11531407cc407212b54fa583ad07030316e723933f
MD5 978e0c06de3772301f343663db13fc60
SHA1 27fde5f809ca962bb40fae022378a80b771c7d1f
SHA512 2095e4274e048e6d65ac8a7997937635b3b3cab2681baaaa5a8e172642c88dda0d8448e3ea1ffa91282f04f9a539dc4ac1c85a1bc44ef901630aa006da53af98
SSDEEP 768:V91E+sTNu5Cn5z9yVGcmhu9q1Kid6Uhe58EEiFb+bVbkbubHbgbubebFQ/ZFRBEF:RsTNu5W50C18Q/nRBEiZrY/+hxc
TLSH
T1FEF2F144EB1A953FD46812BBDCA20B002F79F88995092F673A5C64782D872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\events\events
Size 1KB
SHA256 06b34f9f75829de3972942fc462d2832aec5efdbff0a898dc4f2fcd11f5aa0d0
MD5 c3d0ca42101babd4a5bdbfdcd408ab14
SHA1 822ec6875c66608cc803412f47d114ca4c2ddd95
SHA512 bf82e7a1cb0221bd23360f25e2c174e153f778137b0b0544d1be9d07d849a49477f4e70f1328a3a380b0d42b465ee10a41847fce8cf13345fb8669487817f17c
TLSH
T1AA116A9C39BD8D699CC7E2AC7485128E9755CE0309871C431E22FE8CCE92ADE336946C
MD5 SHA1 SHA512 TLSH

Submit Download

5b115a6a-b86b-454d-a9f4-e67941374a68

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\5b115a6a-b86b-454d-a9f4-e67941374a68
Size 16KB
SHA256 dde904854ecf6360414e802b43e231d0edfc2783f064fedbe10df1e6842ce151
MD5 727e8a0cb6d998c0bdd6e915ee2abc63
SHA1 f6aa81db9d8a744e20574d7cf05211714412bb2b
SHA512 a235effddaaef20d05c46453cf207fd8d53fbbf5b1332a2e48b2ac51456a3a7ca3b05d471d255b70d3ce4136fb3e450b17d5c440cc0aec2e5db4c3876a9744f5
SSDEEP 192:IsQpicLyjwBTmPER1/autOHKryhc67zqaqjcqzpfqKHfV8YEO8GMd+xuHQO29K+y:IvDwwpvauMKrac67OauDlK+X2l
TLSH
T1F872DA56246055BA8251E76998FCBFC3E6F628CF4C018FCADBF47D0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b71e85c-2f31-4d8e-8b7d-9155d76a2ef5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\5b71e85c-2f31-4d8e-8b7d-9155d76a2ef5
Size 886B
SHA256 4fde4a5ca089f41918bacb946a0b4a849722d68c243e2d873c90e009bcf22e09
MD5 f79eecce930a646ddc5778596f01b92f
SHA1 5e14cde31df1eac22c9b68f9adeefc1024ca226d
SHA512 193e83316bb346daf4e8e2f92a4b3eb708f3db45c7264e478666eee0e494b240391df94083d4351b08860dcb3e3c1799ccb91bb7d61178ebd45a33f182dcac61
TLSH
T1B611C4C29B3479F2CD788347949177438BF47523C0C55A147EA15A140DBEA2FE76721B
MD5 SHA1 SHA512 TLSH

Submit Download

97f5538b-374f-4330-9207-27c893a2f4ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\97f5538b-374f-4330-9207-27c893a2f4ad
Size 883B
SHA256 f8d90d5623e7b5dfa406dddb09017f6053496019e98a5936a4dd2ab51d289212
MD5 9739202596f7edd4d802174d66035eb8
SHA1 e5cf95543b058f86bd362e3a88cb36cec30f71e8
SHA512 e03216dc6285616fa27ec95acd4e19c6ccd57bfdb0be8a4df7185c22a06f06c17412a5ef37137cb786ef31d9e862c71303209b16517cf8956807e0b9317c5b83
TLSH
T15F1104419A387872CC68C24BC8617B475BF8692380C555047DE25A140D7EA1FE36B65B
MD5 SHA1 SHA512 TLSH

Submit Download

9cf71525-2fd7-419e-84f4-46c22b1bf54a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\9cf71525-2fd7-419e-84f4-46c22b1bf54a
Size 235B
SHA256 cd3e40a74a0c4364f6ac7bd0b3ce4774c6ff299a5c7d2c8780de35a3ce2a1752
MD5 a7ab92f5689f0ad843744e2663bc4e33
SHA1 f25fbe15549c25412d39d0067efc8b2c136186cd
SHA512 7c34fecb116b0831db7c0e8befa4b2727b02ae05f571f6d4ba61b24d724aa2d12b8ddfb708ade3403088d9717d57f468bac00f865a673fbb019043754b3a2865
TLSH
T150D097C064983B1D4C180F0AB2A02AC230488C3310647C6499628878CAF99C8812280B
MD5 SHA1 SHA512 TLSH

Submit Download

e6d94a9a-ed5c-4c26-ae0f-833ff833e3bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\e6d94a9a-ed5c-4c26-ae0f-833ff833e3bd
Size 2KB
SHA256 fdbf6ee11b3ae71050c25c0d6c396441499f13f263ebc785e23f6f68dde9c699
MD5 107eb5d0464163fb7a8ac9d11965c5e0
SHA1 c67f6ce17086e6d2cded6b7f5c3d4f296bedbde2
SHA512 6cd68f3c76dc2bc3d814d8474f4c379f9ae08707f1d21f454ff674083c5e712e4e984ef3952ac525cd45a8eac05fce1f60bb3a8801a5a9c9d7c63b54e4cab2ad
TLSH
T17841345835BC4D778DEAE2DDD441378E53B0894340C22C436E52EE098D9A6AD737B47B
MD5 SHA1 SHA512 TLSH

Submit Download

ec6c7c9a-e6fa-40be-9793-dc029f496bf3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\ec6c7c9a-e6fa-40be-9793-dc029f496bf3
Size 235B
SHA256 de954abb6ac3ec42469a1f8b3685b61db0d1279ac80400159e32abe5cf07c373
MD5 d1c99d9c8eeddb16f11a48b39a5ffb43
SHA1 1db1a2fb3b1103344adf8b23076beca2a43fe57d
SHA512 976241434d3d76c4ed24f459a4f8edf3220c683adb796cccf055766c6646fb70d1cddfd27c54105c76ec9b041bd1dd88c826126e96fee65e4dfdbc6f7379760c
TLSH
T1A4D097C02888239C08200F0BF4A069CE308B4C37A860682096900074C9FAECC9152C1B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\extensions.json
Size 16KB
SHA256 150d68d5ec9f420e20d8b297a077d2994fbddefdb650f1c538c76fc2cc505ed6
MD5 e271cef029f1e9f4d72113465e3c3d14
SHA1 01df52ed24969767fc92fc3130d03135b6958ac7
SHA512 e745a01ed769fcf3af5c90267cf38dc254dfae576c1680e6c74831acb20646389fa1cce050cf0a1063d0ea65dfec00cc056717efb7bbd14ffa30c7f2e1778bc8
SSDEEP 384:B4kI4vuUmldvB8dhW694z396onL4HyL4PLL4HcL4HpL4HGk4hf:BvI42RfiXb4p6Y4g4P4W4h4n4F
TLSH
T13572521545049EB8298EA79BAA367E01C37D473B70845C38F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
Size 6KB
SHA256 d126ccb933bc000e6f88404e3d9dd554a2c2e2dfd44ec747f19c3a156ba10460
MD5 5188b2009eea5f71a5fedebc0ee9d93f
SHA1 08d0e8cc35f70400664407e40de39d34515c549b
SHA512 3e2a2a97fb308c832a0ba39f295749b6a3265eaaae8fa065682511d6148d4b66f1895507e274326d6a63128f38b8f7e9741d432528cdebd5d6b3558fff46e3a3
SSDEEP 96:xH07wUTUzqGqvf80BnN1zSQSSladv9jfn/5H1Bw88n8L4cnDOT:acORvf8iNdSSu1Bw88L
TLSH
T170E1207895088B7F64B6776CAC6888316AB2013BB7BF6CC750B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
Size 7KB
SHA256 fa1bbe299fab152557547999b7c57c8b11e3ceb8fc42c988afafb897b1d9de67
MD5 7ac9bb0019791116f845fb9489c7edd4
SHA1 24bf63dd604aa7b4c232ab55e6b6c7fd35ff8fa1
SHA512 13f1352c5b8060501ac5f7438039609e504e991dc36b84eb85d8bc79d5258a4c1df5733ad2e3aa7eb66129081e130d4560998028be7c35d4eda4837b22442a1e
SSDEEP 96:xH07wFTUzqGqvfuDT0BnNObzSQSSladv9jfn/5H1Bw88978L4cnDqT:ac7RvfuDTiN6SSu1Bw88p
TLSH
T16FF100789108CB7F64B6766CAC2889315AB2413BBBBF6CC710B954C4015CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 1487d9a5451c1e1c3ced7a1f12838a9f9846f27c83789e6175bca6903a4e7d14
MD5 e71cc97f2dc0a09cd4248681fa23c525
SHA1 f52560eff1953e6227739d404af204b3c81661e4
SHA512 5d287c13203e73ccc0c0ed453c35acbb5c7e2af7a47d28d48e020df3e080532c4938967efccbdbd071f13ab8f24c4d3ff2c477ea804cc87977a7e54461a2f29c
SSDEEP 96:xH07wUTUzqGqvf8nm1zSESSladv9jfn/5H1Bw88n8L4cnDOT:acORvf8nmRSSu1Bw88L
TLSH
T110E11E7895188B7F64B677ACAC6888316AB2013BB7BF68C750B654C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 4ffdfe1170badb7ac04f8ac541a9a20baa0873749eae1e2af0fb4f68201f48b4
MD5 52d706e919df7abcd6452d029a99e2d6
SHA1 168f950b8cb0f42d53aea86088d3c61c82dfa71c
SHA512 eb1b98fde04d903ed8f910131810e52e0dd650dbeeeb78fce6081b1c8e1f4c14b9756678a3e82f3a92eab237f8302b5a9237c78823c407618e7554bd4015539f
SSDEEP 96:xH07wUTUzqGqvf80BnNObzSQSSladv9jfn/5H1Bw88n8L4cnDOT:acORvf8iN6SSu1Bw88L
TLSH
T178E1207895188B7F64B6776CAC6888316AB2013BB7BF6CC710B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 a6e7436deb8e7e007e706a05b5c9cd7791b1c7e4395bc055a2414152e6b8e22e
MD5 432f47036e955442dc3bc88af94410eb
SHA1 e07d6d3cf3efb59edc81aa7554b00133b63b5a18
SHA512 3857e349f111101c5765b2e32451d48205172efc6ed22786917edd638d5075c8d604122aebc6a65be1bb52ca6f74a615568ad4a9318f40fa98754526268a2b88
TLSH
T13821FBC759173EB6A7A182049854CFE2C142702245B86CE0414D5F1576AE84DBFCB22D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads