hxxps://data3[.]exloader[.]net/ExLoader_Installer[.]exe

Analysis

max time kernel
109s
max time network
112s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/07/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://data3.exloader.net/ExLoader_Installer.exe
Sample260718-ev3jsaf15n

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	1436	firefox.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\ExLoader_Installer.exe:Zone.Identifier	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\ExLoader_Installer.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	firefox.exe
Token: SeDebugPrivilege	1436	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1436	firefox.exe
1436	firefox.exe
1436	firefox.exe
1436	firefox.exe
1436	firefox.exe
1436	firefox.exe
1436	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1436	firefox.exe
1436	firefox.exe
1436	firefox.exe
1436	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1436	2636	firefox.exe	80
PID 2636 wrote to memory of 1436	2636	firefox.exe	80
PID 1436 wrote to memory of 3556	1436	firefox.exe	81
PID 1436 wrote to memory of 3556	1436	firefox.exe	81
PID 1436 wrote to memory of 3556	1436	firefox.exe	81
PID 1436 wrote to memory of 3376	1436	firefox.exe	82
PID 1436 wrote to memory of 3376	1436	firefox.exe	82
PID 1436 wrote to memory of 3376	1436	firefox.exe	82
PID 1436 wrote to memory of 3376	1436	firefox.exe	82
PID 1436 wrote to memory of 3916	1436	firefox.exe	83
PID 1436 wrote to memory of 3916	1436	firefox.exe	83
PID 1436 wrote to memory of 3916	1436	firefox.exe	83
PID 1436 wrote to memory of 3916	1436	firefox.exe	83
PID 1436 wrote to memory of 3568	1436	firefox.exe	84
PID 1436 wrote to memory of 3568	1436	firefox.exe	84
PID 1436 wrote to memory of 3568	1436	firefox.exe	84
PID 1436 wrote to memory of 1568	1436	firefox.exe	85
PID 1436 wrote to memory of 1568	1436	firefox.exe	85
PID 1436 wrote to memory of 1568	1436	firefox.exe	85
PID 1436 wrote to memory of 1568	1436	firefox.exe	85
PID 1436 wrote to memory of 1308	1436	firefox.exe	86
PID 1436 wrote to memory of 1308	1436	firefox.exe	86
PID 1436 wrote to memory of 1308	1436	firefox.exe	86
PID 1436 wrote to memory of 1308	1436	firefox.exe	86
PID 1436 wrote to memory of 236	1436	firefox.exe	87
PID 1436 wrote to memory of 236	1436	firefox.exe	87
PID 1436 wrote to memory of 236	1436	firefox.exe	87
PID 1436 wrote to memory of 236	1436	firefox.exe	87
PID 1436 wrote to memory of 5836	1436	firefox.exe	88
PID 1436 wrote to memory of 5836	1436	firefox.exe	88
PID 1436 wrote to memory of 5836	1436	firefox.exe	88
PID 1436 wrote to memory of 5836	1436	firefox.exe	88
PID 1436 wrote to memory of 3204	1436	firefox.exe	89
PID 1436 wrote to memory of 3204	1436	firefox.exe	89
PID 1436 wrote to memory of 3204	1436	firefox.exe	89
PID 1436 wrote to memory of 3204	1436	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://data3.exloader.net/ExLoader_Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://data3.exloader.net/ExLoader_Installer.exe
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {e66b7040-9a1b-4964-90ba-59fb19e5e427} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27133 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {c9a4da77-cf74-4aa5-b8c0-89de88d3c03d} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 25164 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {1d7332b5-41dc-445e-b1e0-39d21be64b80} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27274 -prefMapHandle 3968 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {6341ae6b-c637-41be-aec6-5c3055793ede} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4340 -prefsLen 34773 -prefMapHandle 4344 -prefMapSize 270279 -jsInitHandle 4348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1668 -initialChannelId {0460e5cf-f6d5-4251-9bc4-1a9e0e5ad54e} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2752 -prefsLen 35010 -prefMapHandle 4984 -prefMapSize 270279 -ipcHandle 2760 -initialChannelId {02fff042-f9c4-415c-9c06-6028f63a99e1} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32900 -prefMapHandle 5268 -prefMapSize 270279 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {91c94a9d-d382-414d-8749-af0f820da267} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5468 -prefsLen 32900 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5484 -initialChannelId {bac733ec-025f-4b94-b901-32fbb95e7005} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5660 -prefsLen 32952 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {eedbb46f-e1e5-46da-9f70-376d08fba632} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qur8qcyx.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 6265b7a5bfbb7733a33b064ac2721481dae8e6f90d3d3ebfa3394689d6f988fd
MD5 18e48113509f41b0961e80f746d2f966
SHA1 55a8e95ef1509c43e2ba61f414ff259293a9b832
SHA512 27d49d2ae91ef22b5e2f9c69ace47c55faea0119512f509de9a7290f0729c5fd86dfac8786cfebb169cb4bd8e2bff4ef461c37750f5eb9845cdbb2424e3a827c
SSDEEP 384:HwCe7iO024Y2dcs3hk2nhfdDE2Ba/rIVy8eMeq+oeq+V:QqZY2dv3hk2nhfS2sDIVy8h+A+V
TLSH
T177729EBBDF416C1C1927D989C4AD83A5EC15F9BBCBF690B608203049C784326B0FA4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qur8qcyx.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 9c79534b2adf3274aa0f5f640533b347a3c88aeb9bd22b5cc11e8f03999c524a
MD5 bd5432758ba615d8f6d01307dbbca9cc
SHA1 6e2aaff75a16dd0cc1a534375b4a3333f370b1aa
SHA512 237161c3992023498da215680148c7b75218157f9418eda40cdbf63ff3dbfdd6930b84256e329cbb15f9a5887eabecab1de1d6cbe651f1119d01862e0062d883
SSDEEP 384:H9XghOiO024YUudcs3hk2nhfdDE2Ba/rIVy8eh0L:dX+ZYUudv3hk2nhfS2sDIVy87
TLSH
T149728EBB9F116C5D1967D586C8AD4369DD14F9BBCFF680A608243449CB8432AB0FA0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 712c46cc254492f74495b8c2d5f301c4365ab3c2cc342c77d0970ce8aed0b752
MD5 a9657de773984f5f6c49513ae80e90de
SHA1 ddf459b3e1e68875bca3d76f8f39b92b45d7a88e
SHA512 74f034457272ce9ed67896381711f8f1770b2cae2bfbf670925172db397700771cea02d3c118ce89bf04eed637a3f248b7b82af31a5413d5c527bd9f31b574b1
SSDEEP 192:Y1d66Joz0dzgCl6mc0dtOv5zboTZP2yj6d6:yd66JozQzgC1j8boTZP2yjh
TLSH
T1C0E12E64EA28867FC404127BCCA61B404F35398BDC4E3F1936AC64082D572DE3B9E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b935cbe9f1eada10c482bb055ad0f5bba61e79efcca1cdf915b5d9ee869a742a
MD5 f20d0ebaa6ef0d9b14a9ad74d21bb23a
SHA1 39bffe2e8affec5f1e18a4eb6b296464bd469b97
SHA512 1481787f0b6bcdc1e45262d487981741bb7bffa62e75e8aea872634142299200d90c7b754cbad3cab124a3825d590fdfdad8318ade605bcd2b02ffa25997a600
TLSH
T17B213A5C36F94D2E6987E26C7842168E53558B0708871D430D53FF8DCE81EA9326A439
MD5 SHA1 SHA512 TLSH

Submit Download

00fa8465-5415-4b4b-b7ab-ee6dfd709395

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\00fa8465-5415-4b4b-b7ab-ee6dfd709395
Size 883B
SHA256 a7c94504d860100df5b078393199b6cc2c325db535eabb127d590423661e4a1b
MD5 97d2edbcf952a3fea5712158d1a1a957
SHA1 7c49629b6020e77e8222175f47f595e5fe7672f7
SHA512 fb20f5d99f211e0f59d48afb05166bd47700a5513de96444de3ec649441d0f318cb4e638ac8ecc6265330230d6595f8ac283e4f3c5c707173fbf1d3fcbf41b98
TLSH
T1491100409925B6F2CCB8D20FC95677018BE4762380C988143FE54E144D7E91EA76AB0B
MD5 SHA1 SHA512 TLSH

Submit Download

49121235-6b91-41d4-b582-d2ea23c9bed9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\49121235-6b91-41d4-b582-d2ea23c9bed9
Size 886B
SHA256 7f7871113b85dff6a827bafd758ee792a5caced9555f60ae9eb45fb0d3a24338
MD5 bfb8caefa78bf0e812dfda2f405fef9c
SHA1 47adf3d906c930e65e190b6dd2a70247b81ca5c2
SHA512 5fa0575a7da442ef47f603d1ba7e5d0fe437f331aecd6c3d291d22196266fae13a77a559cf0c708717691d9b0d04f5d4d0366fae6422f7b1b67e37773fb1a4ef
TLSH
T10B1100408925B5F2CC64A28FC9A17702CAE4712384CA4D147F655B188EBA91FA777B07
MD5 SHA1 SHA512 TLSH

Submit Download

abfd4b4f-3006-4849-9b3f-37b56b8c67e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\abfd4b4f-3006-4849-9b3f-37b56b8c67e2
Size 16KB
SHA256 f2125e30c9a87b00a0b4b2bb9d3cdfdf983b973b01a597f57ec2806c9d08c85a
MD5 bd2a2e3ec3d0124f6ae4c99e25d9e9cb
SHA1 dcbd645a0529da38db24a316ecafee1db49d81a0
SHA512 b3e404f8665190bb39ee3e39f15fe4eb02a2ddc84da55fade75d8ceff70aa9cbb4d0100832be616516b862675b57b18f74c7d34d0ed4b0a90b1f5a7587f068d9
SSDEEP 192:JXKD3T6ktbCzxg1aVSKgueN8Yvh+Wzk9OaZw6sw0vsfWP0sbu3dTb1nBolD:BKv6ktOlg1aVSKgiu+Wz1HERsb2HQ
TLSH
T1B172B856642045BA8251E3A894FCBFC3E6F538CF4C418FCA9BE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac685ed3-5529-4dd6-940c-0e4bc51924c0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\ac685ed3-5529-4dd6-940c-0e4bc51924c0
Size 235B
SHA256 8102d5528ab7696536a5fbc4ab783be22fb3bde3f657938e76f25f71922ef9a2
MD5 54c53c55606739538357f08e24844e67
SHA1 0cf60bfbbf98df4b82b3237d64d439f542fb3926
SHA512 c4a28969f5a4c2c4487e00c3c58ef85360a51606c87d5748c2bc3ff822002c30e08e7f3c96dd7ca92575603a69559156204486d58d292023f171eea1a105f70d
TLSH
T1D8D097C028AC376C0C280F1AB0E068DA31884C3398B46810A962883A8DB9AC48212817
MD5 SHA1 SHA512 TLSH

Submit Download

ace6edec-75e5-4641-b8dd-47ea9bfc655c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\ace6edec-75e5-4641-b8dd-47ea9bfc655c
Size 235B
SHA256 ba119a21a7a5271ccf286a0fe0bc92c9d0e25cc35050b88052b9fd6c81c1c022
MD5 38700fd7f00635b24a1822ad590b0e98
SHA1 b8941716aec879637136174076aaa46ecd482e14
SHA512 efdef4216702e7734e48fd5a935c8de862960c8d915772826c62088c4bcd3fbd65777a4c5a816103452f7ba4c95517ae0b6b221accb8c863de0db4b6672e7738
TLSH
T1B2D0A78528A86B7D0C161F06B0E56DC670548C3355645820EAA25674D9FD9DC42B2857
MD5 SHA1 SHA512 TLSH

Submit Download

ca6935bc-85cb-45dd-a166-e0ac7dc43054

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\ca6935bc-85cb-45dd-a166-e0ac7dc43054
Size 2KB
SHA256 d5b23f84de5d7d9bdfc4fb1a4b55d70cbddd99f3f67f6e156641ba547d05202b
MD5 5f3b1a987384527f775004b32730c12b
SHA1 c4ed9e995f684a036e3aa524e69d9e86783d068d
SHA512 f2b5347d085bdef171caf063d2bfc73bf5ab6e2b5a293b7dcd026f75d4b0154e094b4d87e78efe60256f597640b3efe1c229cde02e0b35a04fb5e523cbe43ae0
TLSH
T1EB41215839B84CB69DDAE58DD482334D57E05F0300C61C932EA1EF0CCD9679E336A56B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\extensions.json
Size 16KB
SHA256 41e9a4c23ed6ffc969f533cd9e73717308f9f30b4758eef4f30c6929a5e570c0
MD5 1a55ec953afd12e043be78b97b86c5d0
SHA1 4cb3da630bd4cccf89b1dc121d833ce05822b8ce
SHA512 ccf77419735325bacd50b187222d567ab6b41f796cd993d01b7f7f194ac2f029e75c6760903c8228405a1994d144afbe9a34f7b3d61ab8db32ab7831a1ca5b6d
SSDEEP 384:OkI4vTUmldvOz8dhWA94zvH96oLL4HvL4PjL4H3L4Hh0nL4HMy4hd:hI47Rf3XJ4x604T434b4BY474z
TLSH
T14B72431545048EB8298EA79BAA367E01C37D533B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs-1.js
Size 7KB
SHA256 124b7ad3fe4f8048ba8a5c2e14940ef26faae3a2adc4b0c33b5ac0a949aa4c13
MD5 ea5a503e565abcafc8f3554a4f5fce14
SHA1 e4d16e1383307a1620c8dc4dc89d315bff185e10
SHA512 c018a9c7ed632ea2d8630b192b34b21327b5c65e54f9374cfe4d83bad9a7a4156e6e4c0a4ea131a78635442af0587941947094b0423e2fc74e28a09819c9f56e
SSDEEP 96:xHNRTUwPqGqznf8Bz0ObzSDFOSSl5dv9jenGSRWR82uCMjKBw882Me8L4cnHNq:/1CRzf8Bz0BFOSShS8R8jKBw88xS
TLSH
T111F10D785004CF7F74B6767CAC244D716AA2423BBABF68C710BA55890548F3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs-1.js
Size 6KB
SHA256 46d8530fa34c05599bc2d1e46aa040fee0fc7fe56e4500fec5fc3608cb1d989b
MD5 18c49d30574b428589e6d6085d335d04
SHA1 7bb9626bcf1d1a07255bc59b922ce29e499598fa
SHA512 10e6adc5bbf8c99d33695c0c83075baf851459becfa796190227dbe5ba073a6339359aefd423dd00ca9355edc40ff52455811817393edeb030cc5e8094b8f342
SSDEEP 96:xHNUTUwPqGqznfkz01zSDFOSSl5dv9jenGSRHyuCRBw88H8L4cnHNq:/gCRzfkz0SFOSShS9QBw883
TLSH
T106E11E7894088F7F74B6776CAC6888716AB2413B7BBF68C350B95484051CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
Size 6KB
SHA256 8e57225f147a6289277b42ba3d5d3c372ddb4d63655e66016cc3b0f9720fb98b
MD5 ed6acc157e99b605cebc69b55fb04141
SHA1 85144a1107f7e09881ba5e3a33b219e56aa7b2ab
SHA512 d8a7f008686f097b6be4f699b12a4d7b5311a16f249dda3298f124cd81df5d635d2531344c1b2e2676cc7a2b983782a06e1ebf63fa4daf0f19dc39b907c1d4c0
SSDEEP 96:xHNUTUVqGqznfkWA1zSCSSl5dv9jNEnGSRHyuCRBw88H8L4cnHNq:/4RzfkWAbSS1S9QBw883
TLSH
T180E1207894088F7F74B677ACAC6888716AB2013B7BBF68C350B55485051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 a47cc7c53ae9694843c68d7e7bab3e4b8ad6e5d8f5df7fbf70fa24d2c5f15f85
MD5 c61949c1bbc0c2405d5699b16eaf511f
SHA1 4e096e57aebb5844fca4229daa58aa01b3034553
SHA512 b1db5db10a84fcdd59f11a2432cad88e09b8d7409a45cb2e9655106a145d93550f93d86816ff14a8d2a641e192dc9eccc3129a390fb186afbe27dfb717272c8e
TLSH
T11121FBC354A73DA2F611D1165C858FB5C61230328D700CB0478A9F41D2C9C563686358
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 0000a52cff1d0c747f8c72c8078c2cb7dbe319be1cf9de225f57481ba67a1cf7
MD5 b3185c0ae8b560075c6d2eac0b69adec
SHA1 36775b2124f443d2f8e705bc7d60f84da3fc2940
SHA512 3c2f1f35f0f9949cc6f1b390253a76d8f2c88b1a225b23e6987017a8d49a99ae151b9ceda28b9ff16f26ddd60b879e99646d99a719d718193971efbb611866c8
SSDEEP 49152:ClPbkMngvZR+Uh3YdA1fVQ9hJIHkdaE5zUTU+:qPbkMngRTfVQ9haHkdHv+
TLSH
T1C61639F824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExLoader_Installer.exe

Path C:\Users\Admin\Downloads\ExLoader_Installer.exe
Size 22.2MB
SHA256 59d78963e8f56b25b95c18d5c672789ddb62ee0e186eda49250cef99edad78b9
MD5 e6316f8cf95a39fa15ae3b429bdee860
SHA1 43f39b21c1af9616c387a10e29394e2bafb067b9
SHA512 c6147f0adff15e71e2541ee1f9cea43b88343799b256012a68cd26ff9e5a50950aba5fb7ed2c4b56e474e0c7772c90d87446295d997a098902c24f588a638614
SSDEEP 393216:Fy7xm6OlKHpbsjgPHa7kyzzFBQPzql6s+HsdRDFhudYQI4OZMKmargPG1IqAysE2:wZOlKHEgpyvFC+l6uRgtI4O6Kma8ZqGf
TLSH
T1403733C1BBCD61BDE431D8BEE0166182D11BBF954199F22A9B6BD2CCCC936405C36B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads