hxxp://google[.]com

Resubmissions

29/07/2026, 04:07

260729-epycwagl4y7

29/07/2026, 04:07

260729-eppqqsgl4w1

Analysis

user interaction
yes
max time kernel
2s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260729-eppqqsgl4w

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4584	firefox.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 4584	1552	firefox.exe	84
PID 1552 wrote to memory of 4584	1552	firefox.exe	84
PID 4584 wrote to memory of 1764	4584	firefox.exe	85
PID 4584 wrote to memory of 1764	4584	firefox.exe	85
PID 4584 wrote to memory of 1764	4584	firefox.exe	85
PID 4584 wrote to memory of 3968	4584	firefox.exe	86
PID 4584 wrote to memory of 3968	4584	firefox.exe	86
PID 4584 wrote to memory of 3968	4584	firefox.exe	86
PID 4584 wrote to memory of 3968	4584	firefox.exe	86
PID 4584 wrote to memory of 4132	4584	firefox.exe	87
PID 4584 wrote to memory of 4132	4584	firefox.exe	87
PID 4584 wrote to memory of 4132	4584	firefox.exe	87
PID 4584 wrote to memory of 4132	4584	firefox.exe	87
PID 4584 wrote to memory of 1208	4584	firefox.exe	88
PID 4584 wrote to memory of 1208	4584	firefox.exe	88
PID 4584 wrote to memory of 1208	4584	firefox.exe	88
PID 4584 wrote to memory of 3832	4584	firefox.exe	89
PID 4584 wrote to memory of 3832	4584	firefox.exe	89
PID 4584 wrote to memory of 3832	4584	firefox.exe	89
PID 4584 wrote to memory of 3832	4584	firefox.exe	89

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://google.com"
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://google.com
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2024 -prefsLen 27099 -prefMapHandle 2028 -prefMapSize 270279 -ipcHandle 2116 -initialChannelId {0c6db3d2-a2bb-41d7-abd6-a3fb2e83558f} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2516 -prefsLen 27135 -prefMapHandle 2520 -prefMapSize 270279 -ipcHandle 2528 -initialChannelId {6906d71d-87d5-448d-8b5d-43f449ff9af4} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3888 -prefsLen 25164 -prefMapHandle 3892 -prefMapSize 270279 -jsInitHandle 3896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3904 -initialChannelId {d696bda8-7679-49a4-bcf3-a98e3b05df7d} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4076 -prefsLen 27276 -prefMapHandle 4080 -prefMapSize 270279 -ipcHandle 4128 -initialChannelId {db075d73-039e-4427-b1b0-b89315cc252a} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2768 -prefsLen 34775 -prefMapHandle 2804 -prefMapSize 270279 -jsInitHandle 2700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2732 -initialChannelId {689d8a34-3668-4456-b123-4374ebed9c5d} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    PID:3832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4432 -prefsLen 35012 -prefMapHandle 3012 -prefMapSize 270279 -ipcHandle 4916 -initialChannelId {f3bcc366-c0cc-459e-a7a5-9603794e26e2} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    PID:2144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5124 -prefsLen 32900 -prefMapHandle 5128 -prefMapSize 270279 -jsInitHandle 5132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5140 -initialChannelId {e82e04d4-b39f-498b-a4a7-a1cecbd7181b} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    PID:2240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4896 -prefsLen 32952 -prefMapHandle 5528 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {a5e5e792-99cb-4fc2-8f13-420a1a8f9c8d} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    PID:2076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32952 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 4884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5260 -initialChannelId {591db29b-8cfe-4a2a-8b87-f7616c76ace4} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5832 -prefsLen 32952 -prefMapHandle 5836 -prefMapSize 270279 -jsInitHandle 5840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5844 -initialChannelId {a017d9af-0c85-4b25-a214-1df67c0043f4} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\AlternateServices.bin
Size 8KB
SHA256 693a2cc2626d1020d7fff40f1049e7d470c06c0ed2fb8308ec85d6fb3108fd5f
MD5 7f839d11bd855e4b74e13cd3cb20cd9a
SHA1 5dd1595cd586587729ec4a9bbc9ba0af83acb25f
SHA512 c671a217b9e4b4c0f7b517da2baf2837ebf5bf080ba7f67f0832f0dc26688095ad251d5dd2d44102fd8faf2b14fdcb8994fdd6d049937cc5a3b41ad0c3a0b0b8
SSDEEP 24:RuhMZj91s69BuqN9xiW9VvUX9lzc9Bbk:lGYQqHMMBUtBO9k
TLSH
T17A0252F76FB16672F0D28FB08058B29D9C330325156C9594CE04D4F302E9BA9913EBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 3dd76c4c389eb46fd303d29f045bba43d9478e3e0885e752e8ad51ae8cee2c1b
MD5 702ecb82cda5c47896c6ace28956ba4c
SHA1 06ba204d115abb534f8b60507779ad7c0c1082a6
SHA512 da65047541ac7b3818ce383a66cc5a61d90e321738d60a3c0f272adb35642b8c04d3f9860af39fe182cdc3f3bae3cfc514e7ab69e43a6f3f5c13b39a2ec54f58
SSDEEP 192:S11d66JozGzgCl6mc0diOv5zbozZCWyj1Uy:Szd66JozGzgC1jPbozZCWyjz
TLSH
T175E11F64F628867FC405027BCDA52B454F3A389A9C4E3F1935DC65182C5B2DE36CE27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 80e56a0821eb8571b0149edabf61362c832232aae4de68535b55e2037bf24372
MD5 9ef76a0e3bd6e828cb224f46fa18803e
SHA1 21b54550ce11f1ce6c563aea9f7b9c73a28b3d84
SHA512 3b263911593f71ecd2d847413c3b443d8c9c21ce9ebc79ca4255e1e4dde5a08caf18484fa2d2bda6d20dbae7cdec173a51225f9c19f0f4b8135108fcb79f62b6
TLSH
T12C21499C3DF94D2A9DCBE3AC7445028E53158F0604875C474E02EF8ECEE5AD9326A439
MD5 SHA1 SHA512 TLSH

Submit Download

495c3cf0-0ba1-44fc-874b-7c04cdc397c6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\495c3cf0-0ba1-44fc-874b-7c04cdc397c6
Size 2KB
SHA256 188a1711db5189353809f7e951855a3574d18aaff4e876681caf58598c014d0d
MD5 d955d4c3e7b166fcda86c6dd9244227f
SHA1 3bc9283a9cbd2d80f464971feee498dcd3447af0
SHA512 de1a61e187dc51aefaeb8b6641f16a4802b03ef3f79dc3271a57156b4d4a112d520a4471aeb5e87a33380601cfe7cca3f8d70f36b1bb482d7afcf74e9e8ae5c2
TLSH
T11241F15C35789CF68DDBE69DD881338E57748A5300C228832E52DF0DCC9A79E236A56A
MD5 SHA1 SHA512 TLSH

Submit Download

59e3de93-bfa9-4b3f-96ed-4f1c9d45f19f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\59e3de93-bfa9-4b3f-96ed-4f1c9d45f19f
Size 886B
SHA256 af73955f59c13c7174d9073aada86d94932792cd3b1d327ffe9fbc5f3699d7fa
MD5 aa38144871b874576f3e73d56d40d831
SHA1 76b17a1d94d020435dbfd39322ced18519cd43ea
SHA512 bc44b1979a3a23fdf29651052374b39d10f24ab554dbac130d80afd05c0e41c1077e40636c49b874320613443e2b8b20bd7e0e85cbb9f1e3145136e228fa4aae
TLSH
T14A110440DA34B972CC2992479A9077838EE8752380C519183D9017180CAE61F53B6307
MD5 SHA1 SHA512 TLSH

Submit Download

83fb0f70-8524-46b6-ab28-8e59ed2d9613

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\83fb0f70-8524-46b6-ab28-8e59ed2d9613
Size 883B
SHA256 98047fd0ac7c900ea310fd125c22d55549ae2ad88203857147803d937d2c0686
MD5 84144d244ad5020544d3c748f8f37ef8
SHA1 6fceaea82edfac164d3a3c507aa7a1b319ba3589
SHA512 6e11d061305643cbd91f926cf48c097b102c566547329c418c22c1784032dd84481036a3649118541d157ec7bb25ead45c1cd4955b1ffa147c6275b9c00def17
TLSH
T1A5110041E630B9B2CD789207CA5177568FF9652380C991183EA11F144CBE65F936630B
MD5 SHA1 SHA512 TLSH

Submit Download

b47bdca1-2923-46db-bc07-fd79ff7479dd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\b47bdca1-2923-46db-bc07-fd79ff7479dd
Size 15KB
SHA256 317164603d7f1f80ce5e2ac22e2c02ed16b2a9c9086801f5c7c98941f1ebc39b
MD5 b20782047f48373e9fc9a9391b2893da
SHA1 4f1ce84c019a17a878244c5b0374996d94e35a8d
SHA512 fed6baf310b3300c9d035d064a2c409076ee528f4f7055596aa6885980c33d75634dfaad22eb37515ebd0b90bc69aa7ec81a15c7449436efb7ae6e2e135f5d0e
SSDEEP 192:LOoeV5P27NGLGb0PoRzeNIt186oBJNRUXfzz1EMBHewbuIxg5QjbF3wusq:CoSP2ELGb0PoR+IQlrEfz/BPwu9
TLSH
T18372C9565830557A8251E36898FCBFC3E5F638CF4C019FCA9BE4BE0869DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b894a3b6-b34a-4b2e-bde7-65ba7767f71b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\b894a3b6-b34a-4b2e-bde7-65ba7767f71b
Size 235B
SHA256 2df43671f35cbdea851d03e91472f9345862f8f908c0496bcd654d8a26c1179e
MD5 55791c9920800e0bb6286ecc8fd4b479
SHA1 894c35dc9f3f481f473a1d3e40fe989cc4fe30e0
SHA512 be64d9526e03da1ba74b60fd3487a8cda3edd9e1fac2793365eae6bed449c3b4cec4ce45fbd9633cc6ba3128691593429476d66999cacf6f9a9f501975e9108d
TLSH
T143D097942488A72E0C150F33B0E43AC330448C3710789820D59041B8AAFDAC8011288A
MD5 SHA1 SHA512 TLSH

Submit Download

dec65658-f4d2-4428-94e5-dcfb4aa1ab84

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\dec65658-f4d2-4428-94e5-dcfb4aa1ab84
Size 235B
SHA256 ab896d8199a47d783dc2cea989e73044271b3c10755b32cac88a1b08758f54ae
MD5 bc17aced5ddd7a148f43a27e72aa48fa
SHA1 24c507491592051a5ff6c3662611b32b69172a67
SHA512 ac2980bb09643209b036323182cc1675ce9b3ac87fbece88d72694f95c5f725484d2708f1431f82ece9dcaac4f8f61d03687c74c4cd440f36f3423ce12c5a908
TLSH
T100D0A7C09998B75D4C181F07F0A069D635848C335475B820DAA1557CAAF9DC542A591B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 6KB
SHA256 e4a09e23b355a7f73a0bc48cafd3e7dc21b3dbe4884a66c4cde3a103e5810c90
MD5 be25ceb1ef1a05c05829d87fc776053b
SHA1 adac196fed930d7191f5eb09b48d198d4f8716eb
SHA512 693996dffb617ead804f9e095109db3dd9d2060f3d759314772207e0ea60ef64ae38a3b03c727f3a392925a9745025d75084714ba2bf03aef30934b286b76dc7
SSDEEP 96:xHgUTUPDqGqnfLi71zS4eSSladv9jEn3H8RNBw88n8L4cnFpC:yfORnfLi71eSSb8HBw885
TLSH
T155E11F789508CBBF64B6777CAC6888716AB2013B77BF68C650B594C5014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 2ad9b28fdd5153e40aec2d71f49828c964b59d83333b5fa1671972e95bd1b2bd
MD5 8ada5446a5e6f52b4a1e7f470a956de9
SHA1 fa0061f383f3d170ee9095006652fdfd5db01b75
SHA512 d50e88f2f89a623696ae02e90b440bd1d689cde3343825d567bfb1799c06b15d65481cbe95b4ffd5be2f7ce9b2284d4d2bea9290b2e4988636fd00c8ce0c8f04
SSDEEP 96:xHgUTUPDqGqnfLLy1zSHSSladv9jnn3H8RNBw88n8L4cnFpC:yfORnfLLyKSSI8HBw885
TLSH
T1FBE120789508CBBF64B6776CAC688871AAB2013B77BF68C750B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads