hxxps://github[.]com/IMXNOOBX/cs2-external-esp/releases/tag/release-13

Resubmissions

16/07/2026, 05:11

260716-fvqqnadw5m

16/07/2026, 04:57

260716-flel2agy6t1

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
79s
max time network
81s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/07/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/IMXNOOBX/cs2-external-esp/releases/tag/release-13
Sample260716-flel2agy6t

Score

1^/10

persistence ransomware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\release.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1360	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	firefox.exe
Token: SeDebugPrivilege	4856	firefox.exe
Token: SeDebugPrivilege	4856	firefox.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4856	4504	firefox.exe	79
PID 4504 wrote to memory of 4856	4504	firefox.exe	79
PID 4856 wrote to memory of 5048	4856	firefox.exe	80
PID 4856 wrote to memory of 5048	4856	firefox.exe	80
PID 4856 wrote to memory of 5048	4856	firefox.exe	80
PID 4856 wrote to memory of 2648	4856	firefox.exe	81
PID 4856 wrote to memory of 2648	4856	firefox.exe	81
PID 4856 wrote to memory of 2648	4856	firefox.exe	81
PID 4856 wrote to memory of 2648	4856	firefox.exe	81
PID 4856 wrote to memory of 4652	4856	firefox.exe	82
PID 4856 wrote to memory of 4652	4856	firefox.exe	82
PID 4856 wrote to memory of 4652	4856	firefox.exe	82
PID 4856 wrote to memory of 4652	4856	firefox.exe	82
PID 4856 wrote to memory of 4092	4856	firefox.exe	83
PID 4856 wrote to memory of 4092	4856	firefox.exe	83
PID 4856 wrote to memory of 4092	4856	firefox.exe	83
PID 4856 wrote to memory of 1652	4856	firefox.exe	84
PID 4856 wrote to memory of 1652	4856	firefox.exe	84
PID 4856 wrote to memory of 1652	4856	firefox.exe	84
PID 4856 wrote to memory of 1652	4856	firefox.exe	84
PID 4856 wrote to memory of 6068	4856	firefox.exe	85
PID 4856 wrote to memory of 6068	4856	firefox.exe	85
PID 4856 wrote to memory of 6068	4856	firefox.exe	85
PID 4856 wrote to memory of 6068	4856	firefox.exe	85
PID 4856 wrote to memory of 5916	4856	firefox.exe	86
PID 4856 wrote to memory of 5916	4856	firefox.exe	86
PID 4856 wrote to memory of 5916	4856	firefox.exe	86
PID 4856 wrote to memory of 5916	4856	firefox.exe	86
PID 4856 wrote to memory of 3608	4856	firefox.exe	87
PID 4856 wrote to memory of 3608	4856	firefox.exe	87
PID 4856 wrote to memory of 3608	4856	firefox.exe	87
PID 4856 wrote to memory of 3608	4856	firefox.exe	87
PID 4856 wrote to memory of 3196	4856	firefox.exe	88
PID 4856 wrote to memory of 3196	4856	firefox.exe	88
PID 4856 wrote to memory of 3196	4856	firefox.exe	88
PID 4856 wrote to memory of 3196	4856	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/IMXNOOBX/cs2-external-esp/releases/tag/release-13"
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/IMXNOOBX/cs2-external-esp/releases/tag/release-13
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {e5e98c01-d55f-4724-a8cc-a3736ffb97d8} -parentPid 4856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4856" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {2ed8c178-8c2c-43bd-b299-759e4072871b} -parentPid 4856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3804 -prefsLen 25164 -prefMapHandle 3808 -prefMapSize 270279 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {2ebf2bf9-d288-4d9c-965f-3d39e482711c} -parentPid 4856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3968 -prefsLen 27274 -prefMapHandle 3972 -prefMapSize 270279 -ipcHandle 4040 -initialChannelId {894f9c4e-172a-4cb6-a9c5-adc41292b7bb} -parentPid 4856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4856" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3016 -prefsLen 34773 -prefMapHandle 3020 -prefMapSize 270279 -jsInitHandle 2636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3004 -initialChannelId {f5887134-0f14-435c-8477-99ef3b38a88e} -parentPid 4856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5068 -prefsLen 35010 -prefMapHandle 5072 -prefMapSize 270279 -ipcHandle 5080 -initialChannelId {0d13dd76-4ea8-456c-bbc4-cbb6b0771ad2} -parentPid 4856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1292 -prefsLen 32952 -prefMapHandle 1284 -prefMapSize 270279 -jsInitHandle 1288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 904 -initialChannelId {85a0ed52-0d18-4395-b749-93066fc7859d} -parentPid 4856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5652 -prefsLen 32952 -prefMapHandle 5656 -prefMapSize 270279 -jsInitHandle 5660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4540 -initialChannelId {85406d09-5a69-4c82-84a3-e993e79985cb} -parentPid 4856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5828 -prefsLen 32952 -prefMapHandle 5832 -prefMapSize 270279 -jsInitHandle 5836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5844 -initialChannelId {2af0b722-7b1a-4da7-8f45-67fe1c3773c1} -parentPid 4856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1664

C:\Users\Admin\Desktop\cs2-external-esp.exe
"C:\Users\Admin\Desktop\cs2-external-esp.exe"
1⤵
PID:1088

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\crashlog.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1360

C:\Users\Admin\Desktop\cs2-external-esp.exe
"C:\Users\Admin\Desktop\cs2-external-esp.exe"
1⤵
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qur8qcyx.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 44dd8fbeb2945dea2c7edb6bee0c9966b90726dce7828c289b39957658ac463c
MD5 63047c95ebb3aa0212a4e5f99d09a81c
SHA1 a45aa9c7b85ccf14db072b846c2355cf2ca9e69a
SHA512 cd71ea6f9f657b6205162818d7ceeb14bc19885c12a11c50afbe3bd7fa3019f71058af7f7bbe5102c4801630c972287940e337a8c33f5d28fb293ae4241081d9
SSDEEP 384:H9XghOiO024Ytdcs3hk2nhfdDE2Ba/rIVy8eoUaQUag:dX+ZYtdv3hk2nhfS2sDIVy8Lgg
TLSH
T131729DBB8F016C5D19579985C8AD936ADD04FDABCFF680B608243549C78432AB0FA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7ece5b42c9a9994162396f992231a74c3b890f757ba546e8e12348bfbec1a001
MD5 bee52439987f1be1028e1d7e85221ccf
SHA1 22afd09ff9c54b864df37b1bc8e11459786f7cd8
SHA512 572b455536c5b0ba7251e402d3189c753654946eeef39b1031173f4142fd7fd6bd7a3452fcd1b6166220cb79ec055c3aad71b3b0bd704f5c67baec2c0ad516e1
SSDEEP 192:I1d66Joz0dzgCl6mc0dtOv5zboHgZP2yj6+Y:id66JozQzgC1j8boAZP2yjG
TLSH
T197E13064EA28867FC014127BCCA61B414F35398A9C4F3F183A9C641C6D572DE3B8E5BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7c99470c98fbe0f224d04aa3bcdd80bf525f963de73d8a94e8cd88a488063aad
MD5 caedce69d00f0954d91265da967906e3
SHA1 0eda32101161aee4a8463ebc32c167b68e47ecbd
SHA512 f99b70d6aa0734ba049e4f9f15a13d6bfa61e3f46ddaa63ae90db07a6c6163c62981e5ebed51d68921a917f63db862791efc2ac6bb40abff191f9f8afe36a852
SSDEEP 192:I1d66Joz0dzgCl6mc0dNOv5zboHKP2yj6+:id66JozQzgC1jQboqP2yj
TLSH
T1B0E12064EA28867FC414127BCCA61B414F35398A9C4F3F183A9C641C2D572DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 c7946bbc37a5250bf8e0d7a4024154915e2c4517327e5b5f12dec26d58ce10a5
MD5 a625b7ccabe24ccad8422febed10af3d
SHA1 e4d0595c889d6eba5d6f00309780e458b73acf8f
SHA512 a74e0ed8979e5ecfbd08309fc563fff2953dc6e959c9985012e9b7adb483cb65f68208f3eba71eb4491d32fa6f270be030a97da3efdb1160f68dea1a44e8b76b
SSDEEP 96:zSdF95/7bkW6QXjrcEP2yUR6Ex2WZ/F12FbFaFFFf/dd66Joz0dzgClKtmc0d/UK:zOv5zboobP2yjWxH1d66Joz0dzgCl6m5
TLSH
T119C1EC28F629863BC454523BCCA60B400F36354BAC8F3F2536AC24092D572DE7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\events\events
Size 1KB
SHA256 21758c95a1a5bbf6ef4f64c39d6cbb5b0f035e45e630a050573dcf808413d278
MD5 e0ee4e91bcea5f8bbb10cb633e755fe1
SHA1 9a32c09908de07ec1241234eed47050a291d603a
SHA512 80d9c28588d52428277ee7e2f0ed8fcb06447162e2b807c9c575ebabbe278ed873c5f6fcaeca0eb1179dbf5e51b66abb342091c9213038982790ec1d23270723
TLSH
T1F5116A9C7DB98D7A99CBE25CB490128E53168A0704871D470D23FF8CCF91EDA712947C
MD5 SHA1 SHA512 TLSH

Submit Download

19c0b406-e5e7-4924-969b-f90f44cd7855

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\19c0b406-e5e7-4924-969b-f90f44cd7855
Size 886B
SHA256 e4d63380739a3cc92726d984a82f2d22568b8edf7e74fe930ebe1e1d20bb377a
MD5 0b0e19d0d2bdb10477bcdb3e4b45b498
SHA1 29d0c6f70e6e48c78948b497f3bd5b5044041b6b
SHA512 47ce5da33d101c668a0a838f42ac5563aba826446a77820f0819b9099e3f5c0eb53c36e73115b4421ce7b4e44535e4a0ff78547eed6140b39f5d8ff83e3a743c
TLSH
T1541104508950B9F2CC78975F89A1774286E4711380C74D147E954A144DBF61FE75BF0B
MD5 SHA1 SHA512 TLSH

Submit Download

2eccd572-35d2-45f7-a897-cfa12343b190

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\2eccd572-35d2-45f7-a897-cfa12343b190
Size 235B
SHA256 807f7071146dd11efd565dc6cab0a99dd4f9dc661c66e28b944ad1e86e018ed0
MD5 a99e5d5859d20b2117c22ac880731c40
SHA1 6af18c8af4c74c2587d2c0be5a884681bc6c88aa
SHA512 67764aba185f4d7eb2be8d40df5b09397dba10ad554b9e6e54c9d2cc63db9772cc22c05d40b4ce46b269885055cf2651cfb31e8f40a1f4c36136fb92f8ad4752
TLSH
T16CD09790289C6B2E0C080F12F0A428CA34444C332875A820E57145B8AEF9DCA4211957
MD5 SHA1 SHA512 TLSH

Submit Download

4935cefc-17c1-453d-8ed2-bdc79bdf40f9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\4935cefc-17c1-453d-8ed2-bdc79bdf40f9
Size 16KB
SHA256 107054ba5a23808f80e69f72f72c0513c64ffc695b1e4db1b94a67d46c4b06ba
MD5 d31452fa964cd3319e40ffcc3ca9af9e
SHA1 a81ff1f1bdb3a293bbf736b407eefad99c637447
SHA512 851fa96aed337056f40808698b2bd5f0716a849c024c03fe765751ffc2f1dcbb1f7b8b0ce7d9fa976a0b551f209e719851cdf83749ac746b023ac86e919ca027
SSDEEP 192:0rYeJHLIpEENlbql0hs0bBRQ1mU484bSODASGupem2kbaCuzi6R0aV0c/sTQ:nmrIGcRVsm3dtraNG6R0aV0Esc
TLSH
T18772A856642045BA8251E3A894ECBFC3F6F538CF4C418FCA9BE47D086DDE06E512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8043bdbb-aa48-4027-97d2-1c2d051a1710

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\8043bdbb-aa48-4027-97d2-1c2d051a1710
Size 235B
SHA256 729c7759838b251e7bc6cdc75a4c08956f004586d78594bbe64eaacc50b62701
MD5 6702925e8ac8e4b9597fc0950ae9dab2
SHA1 b0526cc4eebfc5cdf5ec79c32bacaa405ba857e5
SHA512 f1501251ce413b9a3c21ce159b69a7e6271047aac9fd522c1b862dbcedbeb881a14d51647eed3a80d927d699e25c58bc8422094515332656e868288106efebd3
TLSH
T1A1D097902C9827AD09281F0BB0A0A8CA30D44C3310A4B8508AA10038EABAAC88292807
MD5 SHA1 SHA512 TLSH

Submit Download

91db0761-4633-4fc0-ac8c-862af3bff21d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\91db0761-4633-4fc0-ac8c-862af3bff21d
Size 883B
SHA256 ebbe3d2983230d677d65b0f61638da80b8e11cb3c93c156bd8167550ed8a3598
MD5 538821790e9136c4a0ee3dd56b45b65f
SHA1 55ade396a7a9817d0f96317210c8970e9d6cd30f
SHA512 095449ca3e5719b92bae614e0ef6e338d9e16a847ece9c798ec94db93b48bd6167bc013bfedc692d0a6ebc3c1f4ab2f8d891577fd455d71d913bd9ead718a481
TLSH
T19B1100419920F9F2CC78924FC95537028BF8B62384C645182EA54D144D7BA2EB76BA0B
MD5 SHA1 SHA512 TLSH

Submit Download

cd2e2028-b753-4ec3-a282-cc94056374e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\cd2e2028-b753-4ec3-a282-cc94056374e0
Size 2KB
SHA256 88e55ebc45f7bf313765e95f112c7df4625b376b85f0cb162c40ea8cd3e8eebc
MD5 0f8313345fda2c5b3d2e79379b209997
SHA1 b2a62a11b4303b0f310bf626cd5bd6f5fedd36a6
SHA512 12ad3ae56addaaff2131d0d1db5b50b6487aa5c78126d03de3b1a336152ad0d18a9e07b59c09ee3801390b2aa3c949521a2d8c43ee1c9ace75ffcbea80916231
TLSH
T1B341106834789DB69CA6F59DD441338D837C9A1310C61C432E52DE0C8DDA69E736A53B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\extensions.json
Size 16KB
SHA256 10bd7a534c1cb9c0cd1dee94490f5e771061ed458302518b98677d5e03a307b4
MD5 83f844e939f50949653722286e61352f
SHA1 7a130820e74a32ecb139a61ce5afeb5fe8221cac
SHA512 023feeb2a16f94597c111921064f87fe3e82bb580c857d03b29194916d20eed3a6c95952dfe4e114e4560a100f3f961c7a443016a86e662a7f931dff7ed435d7
SSDEEP 384:OkI4vTUmldvOz8dhWA94zvH96oLL4HvL4PjL4H3L4Hh0nL4HrS24hs:hI47Rf3XJ4x604T434b4BY4m246
TLSH
T18272421545048E78298EA78BAA367E01C37D573B60845C78F4DD8FC842FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs-1.js
Size 8KB
SHA256 2aded143a1727df1dcf29f594a504da2c2493edc3ec307729b95ff4625191300
MD5 f525fbdc77ebb2bd8a0210d3981caad3
SHA1 1627abc88adbb2218329e0384bc0fefb67a89869
SHA512 c28b14b07eca2d7084117c704001f48194291a81c953399fa4591cac6129f7547cad5db63d69eb373b062d68a21d3395ab94cfc0e0ab13d47b9a0d6cea69ab11
SSDEEP 96:xHNdTUwPqGqznfTW2reObzSicSSl5dv9j5nGSRWRwc2uCHNBw886U8L4cnHNq:/RCRzfTW2re8cSSAS8R8NBw886w
TLSH
T1CC02FE78A404CF7F74B6366CAC2488705AB2023BB7FF68D750BA54850508F3581F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs-1.js
Size 6KB
SHA256 6cce9bbc1e396a9daea1d7a365e7c72459fe356e9e77c9ce26969fbf20e19873
MD5 64c139aafbc64527679d3f98e66e30d0
SHA1 157b51034aedba1170ffdacce6316df5727aa8d6
SHA512 1367f2b88902805d53d3e8b321f77aad840ce89a5c25258ef1a93e8b8b74017ea0882aaa19717a90d63d99c1e3e7ae111a6d8c8b749deea009369c260133467c
SSDEEP 96:xHNUTUVqGqznfkre1zSicSSl5dv9j5nGSRHyuCRBw88H8L4cnHNq:/4RzfkreDcSSAS9QBw883
TLSH
T181E11F7894088F7F74B6776CAC6888716AB2413B7BBF68C350B55485050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
Size 6KB
SHA256 c77385d697b099dcda4f44eba6a7135614d14852227b9fef9ef4efd502b2e3b7
MD5 4913a716557ed6d73cfa78125d886776
SHA1 5ce7e233c3374fa50dc4121e073a06935dd70f1d
SHA512 1077fd50da759d5e71b451f2336e1a24b56bb50e10cfc5aad84eaa3537a45125f3d72ad9b1adf95d41f9daba6b2a1c3bd213c6ca130880bbfe3ff2d46c702b57
SSDEEP 96:xHNUTUVqGqznfkWA1zSzSSl5dv9jenGSRHyuCRBw88H8L4cnHNq:/4RzfkWA2SShS9QBw883
TLSH
T15AE11E7894088F7F74B677ACAC6888716AB2013B7BBF68C750B55485050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 cd953c692c8ee5e848912250e57dea821af80fd4edc42e240d43ea0cff469689
MD5 e277491c741eddc7e4b7df186410b8c1
SHA1 b9a18136bfe1d329740ba9b15fb95eddaeb7e94a
SHA512 7af81734a9a4a6a4f42996ae0bb6155189c5a6109d59737fb67168ab5e5e9c2d05ac585e1c3ac9a9234048cec26bddf2552dfec9027ea774429dbf28c9824b10
TLSH
T1A0612A99FAAB28D79D01796280497F0DE28640936D4654F4E69C8F398102B492B5E78D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 cdac5a5701c7a38720ab0ed9ccb062974db03fa68492f73070b289e6f516841f
MD5 3f6c20c3e3f42b98809cd68f4d25977b
SHA1 608fb22025ffdea5bb8c61d6573252e2048a5d90
SHA512 4acf8997f8ea36f6c6c9e165695aefd0f3b22e65afe17ec3be4738acaf277611f96b3b34b3080bd18d346304492e7d9e2a3e80c4cb3f49da8a8473c40404d1dd
TLSH
T128714C85BBEF28E7CD01B95390097F1DE1C650D3385218A4D6A88F79824660A2B4E38D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 127395309c3ee9e1e01ed937694a6d282d3dfb6dc83670fc921c09c50e4b2f6a
MD5 51c75ec6cb2da0ba2da0139d83b5ead0
SHA1 a4c324564a3e76452a293d206769e72cf145a81d
SHA512 b0a03b57f7113c6503eba572dac8fe9191acbd5f7c2b02d8e817e00e1ea5df26747649eeed47a34f0d04fa51cd6ce841c19bcc53f5d8dee83d2fb46376d0618d
TLSH
T149714C89BBDF28E7CE01BD9390097F0DF1C610D37C4214A4DAAC4F3981456092B4E38D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 0efae545a048ccb136c9441d7d36fce4cfaf5294876056e3d3e3c4f8e505e904
MD5 050c41e29533592f20dc266e88ea3566
SHA1 044074debba0a9be1d116f282f1e7c6c04d25cb7
SHA512 679fbeafc4f58bff1306ee6984de2cb0de18bc95472261819f45d12b743d1e6c7c780202a6c0124186c459ac4c555532f456b33290942f408a0e53466dc0e9d2
SSDEEP 49152:ClPbkMngvZR+Uh3YdAgfVQ9hJxHkdar5zRFNh:qPbkMngRefVQ9hPHkdiV
TLSH
T19D2639E820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashlog.txt

Path C:\Users\Admin\Desktop\crashlog.txt
Size 32B
SHA256 a6285359847870c414f8790dea88132ca3b482dc22ca5369d3ce2c7491825cd7
MD5 fdffc9f52bf0e7ea779dd1ae15891b04
SHA1 5b95ac4cbfdddfdb634881167b0a2f19e691400a
SHA512 d66d3a231ad1f8320a18185619f39494596b4743f08fd5c2ba56c2a4ce18add9db726220a40e35b724e7c69b910078f950a89100d35d79bcd125c08194b9f9f7
MD5 SHA1 SHA512

Submit Download

release.ciGwNyla.zip.part

Path C:\Users\Admin\Downloads\release.ciGwNyla.zip.part
Size 4.3MB
SHA256 9097a1a0d286c5ffafa76284ab453ffb23ce5b11c6b82f9d701a61d7a0898def
MD5 5c34e5350669387b59fde520265c104e
SHA1 6687422acf790220c4765147d23206e2c811a71b
SHA512 a326aaef4b746aec0227280ac7dcff98b01068a0fe792b1df3d199ccc6055a8ed6a16bf54ce3d08b207d581ade87e97aaea9c1b582fc47a02774347bf9b2b5a3
SSDEEP 98304:rlDMJFO6dENyPZ1F4Id7HWSgFmHoHJbDDhOkmDlol:RIu62NE1thWSgkHopvDhOpSl
TLSH
T1E32633A3B9F6ECD3F2C4B4E24121623D7D78CB1DE57A2A1B977D0045B7CAE138191A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads