hxxps://github[.]com/thebadinteger/p2pwn/releases/tag/0[.]2

Resubmissions

04/08/2026, 04:09

260804-eq5hksvxhz1

04/08/2026, 04:06

260804-epdngacf551

Analysis

user interaction
yes
max time kernel
84s
max time network
81s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/thebadinteger/p2pwn/releases/tag/0.2
Sample260804-epdngacf55

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\p2pwn_0.2-win_x64.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	firefox.exe
Token: SeDebugPrivilege	3940	firefox.exe
Token: SeDebugPrivilege	3940	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3940	firefox.exe
3940	firefox.exe
3940	firefox.exe
3940	firefox.exe
3940	firefox.exe
3940	firefox.exe
3940	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3940	firefox.exe
3940	firefox.exe
3940	firefox.exe
3940	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3940	2148	firefox.exe	84
PID 2148 wrote to memory of 3940	2148	firefox.exe	84
PID 3940 wrote to memory of 2868	3940	firefox.exe	85
PID 3940 wrote to memory of 2868	3940	firefox.exe	85
PID 3940 wrote to memory of 2868	3940	firefox.exe	85
PID 3940 wrote to memory of 2212	3940	firefox.exe	86
PID 3940 wrote to memory of 2212	3940	firefox.exe	86
PID 3940 wrote to memory of 2212	3940	firefox.exe	86
PID 3940 wrote to memory of 2212	3940	firefox.exe	86
PID 3940 wrote to memory of 2180	3940	firefox.exe	87
PID 3940 wrote to memory of 2180	3940	firefox.exe	87
PID 3940 wrote to memory of 2180	3940	firefox.exe	87
PID 3940 wrote to memory of 2180	3940	firefox.exe	87
PID 3940 wrote to memory of 2344	3940	firefox.exe	88
PID 3940 wrote to memory of 2344	3940	firefox.exe	88
PID 3940 wrote to memory of 2344	3940	firefox.exe	88
PID 3940 wrote to memory of 4240	3940	firefox.exe	89
PID 3940 wrote to memory of 4240	3940	firefox.exe	89
PID 3940 wrote to memory of 4240	3940	firefox.exe	89
PID 3940 wrote to memory of 4240	3940	firefox.exe	89
PID 3940 wrote to memory of 4724	3940	firefox.exe	90
PID 3940 wrote to memory of 4724	3940	firefox.exe	90
PID 3940 wrote to memory of 4724	3940	firefox.exe	90
PID 3940 wrote to memory of 4724	3940	firefox.exe	90
PID 3940 wrote to memory of 4300	3940	firefox.exe	91
PID 3940 wrote to memory of 4300	3940	firefox.exe	91
PID 3940 wrote to memory of 4300	3940	firefox.exe	91
PID 3940 wrote to memory of 4300	3940	firefox.exe	91
PID 3940 wrote to memory of 2904	3940	firefox.exe	92
PID 3940 wrote to memory of 2904	3940	firefox.exe	92
PID 3940 wrote to memory of 2904	3940	firefox.exe	92
PID 3940 wrote to memory of 2904	3940	firefox.exe	92
PID 3940 wrote to memory of 1276	3940	firefox.exe	93
PID 3940 wrote to memory of 1276	3940	firefox.exe	93
PID 3940 wrote to memory of 1276	3940	firefox.exe	93
PID 3940 wrote to memory of 1276	3940	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/thebadinteger/p2pwn/releases/tag/0.2"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/thebadinteger/p2pwn/releases/tag/0.2
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27100 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {3a7e2a0c-6d0f-4288-9cb3-afcb6946dd5c} -parentPid 3940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3940" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27136 -prefMapHandle 2492 -prefMapSize 270279 -ipcHandle 2500 -initialChannelId {483859f7-559a-48f5-a329-4752466608d4} -parentPid 3940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 25164 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {a602f43e-3530-4f8e-a4c9-4e6bd61eddae} -parentPid 3940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27277 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4132 -initialChannelId {79b6b306-afce-4622-a5ac-c96a11a0e62e} -parentPid 3940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3940" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3020 -prefsLen 34776 -prefMapHandle 2788 -prefMapSize 270279 -jsInitHandle 2792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3092 -initialChannelId {00f4b6c3-54db-4a22-bd40-bb9b4fa4efd6} -parentPid 3940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4800 -prefsLen 35013 -prefMapHandle 4852 -prefMapSize 270279 -ipcHandle 2872 -initialChannelId {3ecbc503-c899-4fcb-bc0d-295d4d027565} -parentPid 3940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5184 -prefsLen 32900 -prefMapHandle 5188 -prefMapSize 270279 -jsInitHandle 5192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5200 -initialChannelId {e93013ba-7f16-42a9-9cdd-cea10abc1427} -parentPid 3940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5468 -prefsLen 32952 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5484 -initialChannelId {49ef080c-bdc4-4fe3-b88a-7165fd519ad7} -parentPid 3940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 32952 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 5628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5640 -initialChannelId {6979e3a4-ef3b-414f-bc9d-d9e74e345372} -parentPid 3940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4128

C:\Users\Admin\Desktop\p2pwn.exe
"C:\Users\Admin\Desktop\p2pwn.exe"
1⤵
PID:3948

C:\Users\Admin\Desktop\p2pwn.exe
"C:\Users\Admin\Desktop\p2pwn.exe"
1⤵
PID:3068

C:\Users\Admin\Desktop\p2pwn.exe
"C:\Users\Admin\Desktop\p2pwn.exe"
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 f3614ad000755e8c61712851a77892a00d5f92e91be803904b8fa5aca34b882a
MD5 c9ad9fe7b2d568dedfe43296e0c3a67a
SHA1 3b23f72fe267153f7bbb9dff9947ebc8768826b2
SHA512 19b0a058c0310d2f9e692c755d7e7766e865e1090a532bc8daf9b52e3954c19aa0cf7285981b288f661fba88ecdf6b29590fdc9293b092b34bd768c26907acd4
SSDEEP 384:HwCe7iO024YqDL84KKDL849B7SOEAd9KVRaAcP+AWRMAXL4:QqZYqDL8lKDL8CB7S/AmVAf+hRMIL4
TLSH
T1AD729D3E9F013CAC1997D0E8C5B992D94C19B7A3CFE6806D21683D0DCB98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 e92e150a029f9dbbe7e64499ee1d1e960ea570f8f5a0132cee82b3828789353c
MD5 607819eef4509b89b179844e4828dc62
SHA1 34c41c996791914c78d573642db0944621f1ee0a
SHA512 42c6f62068de46311ab82b7fbd9c6204ef990ccf7c1e68b84b487a9d453ffb2c46c3cc3c373c4a69d52e41bdbe540eaa5c2d29c0d757cf249035911e44ae8b64
TLSH
T10C61DB58F229863FE445513ACC965B411F343422A8AF7F2A35AC614D1E4B2CE778D87D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 dc0a3d4841661c33148509e91e29d0e59365e6921f9558e66e067394db9fe758
MD5 226a2757c3d806f9f527315a4aee7379
SHA1 6e5ad8adda0be5feac519d10d6ab6ce9dcbc7b14
SHA512 12386c9c8557ba87c1c04b5efe08c9e3bd05b983d6c79cf3cacefdd1ea2551654bf9b7c4521767b6c1ee9bcf3d6be9f53ba1a1896f180c789ab447caccad81f9
SSDEEP 192:G1d66Joz1zgCl6mc0dvOv5zboCZ6pyjw0:gd66Joz1zgC1jSboCZ6pyj
TLSH
T14EE12F64EA29863FC404527BCCA50B414F39395B9C4E3F29359C65182C9B2DE7B8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1c8eec4869855d2d87569c87dbdf11c5eb1b59af166c4128e4daa24ca8f0ff2d
MD5 63dbbe0143c2e46bbc69c28493a9b02e
SHA1 d00f79b70324b82a8ef78719fe0692972aea907a
SHA512 d6b6d00d6ae3d730f3d44e08e4d5d06833f7dfa4f37d9c9a40f3335880dea06e86c563ee0f43da725f857430161e132800e43fd487ea46d2b6989c9197682926
TLSH
T1F921678C3EB84D6A5DCBF39D7481028EA3918E07048B1D439D16FF8CCEC1AD9326A539
MD5 SHA1 SHA512 TLSH

Submit Download

1713801b-de93-4b3b-b562-ccf1769ce923

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\1713801b-de93-4b3b-b562-ccf1769ce923
Size 235B
SHA256 147090b1ffcb5d4fa9d05bd462159c20fc275a31d2a6991dc175b8f7ddf95004
MD5 495c8df0d89475c2f846730c3eeb2cbd
SHA1 a53527f5d2744910d386cfbb35aef618e7442c70
SHA512 b42c941220b382b06a1f43ffc235b36fbbfcadafb04555a84c1a7c52dcf7db493a5e2c95e5d09cebd391089348d7bc926f26e249edb70f278b0c11285b3b3244
TLSH
T162D097C0189C635C0A086F03F0E02AC230448C3724B09820D9A040BCAAFC9C8825182A
MD5 SHA1 SHA512 TLSH

Submit Download

29b9c108-d991-4c41-a483-ed6d206e37e4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\29b9c108-d991-4c41-a483-ed6d206e37e4
Size 235B
SHA256 5bd97b43440b858570d6070c1ce01712023bcf6d43dabc9eb40f4f4c4240ef7c
MD5 b3c9ed5e54de2a794d61690111339de9
SHA1 536ee4861f5c4dd9d21fdee46daec833bed9eaff
SHA512 073c7c4141b458944b0e8a13d765f201faf934c0e70d3f06044e265c30d87a1b69e04ae16edf015aad03f9469106ef630ea56f258474b386f697b21e0c658249
TLSH
T1EDD0978024FC332C18140F0AF4F5A8C270884C3324609C30D99109759DF9EC44121C1E
MD5 SHA1 SHA512 TLSH

Submit Download

77da5747-1b4e-4e80-a4bb-7db6df8f93d0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\77da5747-1b4e-4e80-a4bb-7db6df8f93d0
Size 886B
SHA256 8f3911a52905465fe42313a58c28077ecce763bbe72c6155768718ed0986b7ee
MD5 a622fabc346e9003eaf95498fc79cdf4
SHA1 db4942815b34b90d104dca281d7baad2df66f570
SHA512 91d005a42f186b0005e541d090667ec4f2bf4520810d7ae3f2bd03b5566a970e9b0b40c9bc10d0380dce038e1b63c0e65af989247791c59ded28c613a535e686
TLSH
T1991144514A3678B28C28E1CB91A5B7428FA4313380C60D147E511B280DAE12FA766B0B
MD5 SHA1 SHA512 TLSH

Submit Download

8286b1a2-c951-42b5-be80-faca6a9577ff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\8286b1a2-c951-42b5-be80-faca6a9577ff
Size 2KB
SHA256 a9fb9581a3ef8fae515b45f4314dc363661d96b65d2ad3c668fa2eae6aae71f5
MD5 dcd700517ed299108ac0792bf817ba6b
SHA1 866057f3a6150d3ef840a0c890406382cef1e85b
SHA512 151b033b514bfeb18bc29f4be9d6210fc935953c0ae431a33922ba470b4da127533e89f66a22a4b7d493f27349e10db445572d6fdb2bf7d6125f24ec895102e0
TLSH
T18541036C39789C775DDAF29DD493234E57B04E1300C61C932ED1EF0C8C9A66E736A52A
MD5 SHA1 SHA512 TLSH

Submit Download

a3178e15-61be-410c-acbd-058ec14efc4e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\a3178e15-61be-410c-acbd-058ec14efc4e
Size 14KB
SHA256 8b80cd6a149c5bd17b1b4eff88b77bb2359f73aa3f9dabfc2bc1e3e9b7442a6e
MD5 f83dc7ec93caae04df337c6a378cf12e
SHA1 c0f7258d53520a760f45484970d4467f59ff3102
SHA512 3cd3d11c4fc877786151aacfbc67c25a18cfb7dd26bddb7bbae9b636ed442dac1569ab0748a6f0fb5d167b97721a7fac0291214271e8987d776f3ec3173246fa
SSDEEP 192:tkXpEo5mrrsPhcwmONnSjKsNybSR5wzx7fGotAux21YM9XkB5JmhIYxU53AHAOmo:DNybSRql7uotAuc0rxUMA4o
TLSH
T14F62D856643049BB8691E36899EC7FC3E6F518CB4C019FCE9BE47E0859EE0AD1127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e61055fe-d65f-4728-8757-3d64c8f426a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\e61055fe-d65f-4728-8757-3d64c8f426a9
Size 883B
SHA256 ba5dbc45b58c1a399921bc2cb619b2cb6b1209d3c4673d6300c5bde0ece1daaf
MD5 0088d74035069973d683ffb79c559496
SHA1 428a50a8ecca53bc94266c41073b4fe27b04e753
SHA512 a90f141a6ec6510745c0e701d479ead404f5f1f50635b3099a530161d92782282d15d40f9eff508e7905288dd437d544e98a1d3cf609be96606364c6f7f8daf6
TLSH
T1961123419A32BCB3DC68D29BC6657707CBE43123C0C545283EA05A140C7F52EB76A70B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\extensions.json
Size 16KB
SHA256 f85efdf824c5855ffbf4caa01a692e5524c3639c9d93cdff9831751a6658225f
MD5 c48fcb049b2f2c86c46e03f24a941907
SHA1 45eeb9b33778f035067b0b05cd82cd0abf89e39f
SHA512 30c65ff1f3c8bb83a01410c4ef80def98f0c96a484c624e942d23179b39aff6f7e0188ca7c9f649059a053c7ed09a00571a82d61c0bce70087f696561e63786e
SSDEEP 384:nkI4vQUmldvM8dhW4U94zu96oFL4HQL4PuL4HBL4H8L4HaK4hV:kI44RfFXlO426m4y4M45424B4X
TLSH
T11A72521545048EB8294EA79BAA367E02C37D433B60855C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\prefs-1.js
Size 6KB
SHA256 cc2219816af193bf637405a316e0080933d854b3a1cc74f82b6c5873da4c677f
MD5 c18acd80e4983615883ebc865817a4c9
SHA1 8279edc1f2673b0228ee3cde74e827e6e2ee098e
SHA512 5ff656d0cf95544525a6955878aacc1e3adb77576fac8494d7e5c8ae9a1ab1f6fd6b0ece7541941cf5c86662023987de1bb54d3d09a7ba6d34b0b98279fb1994
SSDEEP 96:xHyUTUGqGqqfB15W1zSOwSSlVYdv9jPnGHT+Bw88P8L4cnolOKQ:AhRqfB15W/wSSbCBw88S
TLSH
T1B7E13F7894188F7F74B6766CAC6888316AB2013BBBBF68D750B95484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\prefs-1.js
Size 8KB
SHA256 76fd5641dd92d9973c756c010ad1d3e0dde5ddf3719a8a6035074fbd375e7581
MD5 a7b426d2daf76ab486a0d5d0631bbe70
SHA1 789b885084e0dd2adb57cc283e8cd14a554b3248
SHA512 5ea97cbc94d2d18a03e43aced9cab4656bae08fbd705fa03ed76827dc26d45c0bdd4c8837543bd307effa0ced85ed515dc856d117e85fb502cc8d495b654c7cf
SSDEEP 96:xHygvozvHvTU5PqGqqfU15WObzSOwSSlVYdv9jPnGWRZ4fDBw88/d58L4cnolOKQ:AgvozvH6CRqfU15WQwSSSR4Bw88G
TLSH
T164020D385504CF7F64B6366DAC644C315AB2023BB7BF68D710B9A489015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\prefs.js
Size 6KB
SHA256 e6639e0a57247a6f5c3ceda829e7623f1f763143b86807d5e08dfa6b95ba384a
MD5 38eea4ed7e0f4de2eceedcf466444556
SHA1 b82314b7e4b27e8b05121fb911b3ad129b9711c9
SHA512 bab147a75fc5762bc3318983b24c3d2acb1d87773add1e9aab2c793ce6b471507ec5b8439ecd0f791e36f326077080aa299945295b0dea9d77ef826ea1879608
SSDEEP 96:xHyUTUGqGqqfBAL1zSPSSlVYdv9jVSnGHT+Bw88P8L4cnolOKQ:AhRqfBALeSSQCBw88S
TLSH
T1ACE132789018CF7F74B676ACAC6888715AB2013BBBBF68D710B95485015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\prefs.js
Size 6KB
SHA256 d470c1c1f9c9f3decf67ddc635141a5966a5bf55b596ad514dcb94dbb0b3431f
MD5 c7ed0c04a89cb5c8ffcaae5fd1680cb7
SHA1 8119b3f3aefdbb2c3fede7720c3a2de05a28f8f9
SHA512 0d6db19ca37cf454e3055ff4f5855ade7b1ff4b7a003e9c72ad3b36ebf9c21414e67d03b1eb72785b8076c4c7b5b68940621765cc4b3a8c9ffa5e3bc24e644e8
SSDEEP 96:xHyUTU5PqGqqfB15W1zSOwSSlVYdv9jPnGHT+Bw88P8L4cnolOKQ:ApCRqfB15W/wSSbCBw88S
TLSH
T183E13F789518CF7F74B6766CAC6888316AB2013BBBBF68D750B95484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\prefs.js
Size 6KB
SHA256 ae0349b766a69634ee02c72d19d46cf0c38c1a3a213c09e136847d0774bbaf4f
MD5 d5b335ed8b9219b045a232fa690f4961
SHA1 817ffee98eedec431a9a66567873711c767cc3dd
SHA512 e6ed698f9a594cc1c1be77d1f01f287d02c038f273420d8b911490d49a023fb6f4b681f85e5068fee0273c5b0544a9a3336f564ad825b1dcd8c41e99097ca8b8
SSDEEP 96:xHyUTU5PqGqqfB15WObzSOwSSlVYdv9jPnGHT+Bw88P8L4cnolOKQ:ApCRqfB15WQwSSbCBw88S
TLSH
T16AE1307895188F7F74B6766CAC6888316AB2013BBBBF68D750B954C4014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 3085146e151408adc833b0cfe2b1f8e2b211d4cdd1f293355636bc523d02a230
MD5 d8290f5b6ab017efc0aaad8e6f93e739
SHA1 bb8b0d9fe0d736b91c13703948aa0dc05e2bfe29
SHA512 ccc80240f8db451c5df7044dc061a4e246529b71ae073b6b6aed6580455a105b33aa2824875981f1b46807b713d6fdff936eae734928c5ad6a6eadbe2651c65e
TLSH
T18B615C17695B2D974D07B8B9E0CCEF0EB68E6D33446314C2CB5B8F7A44461094B0B1AC
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 1d21217d8685fbe30f31effdb5a6e29a444702b8e3012822d0a44e5bcce28b45
MD5 34dab3486d52beb54557c781b38d7a8c
SHA1 5e84f25ceb630bcc815e18dc6dc530e62be5d0de
SHA512 67463efb05fa7000facc8f68d1a8d0c35cb7fb4a4e9ad4a92965be234cce3ca49b361a4df057c4ce3d13a793056f82a512ebd91f0816c8a19823202a57c529b9
TLSH
T199614B1B69971DA70D0378A9D0CDEF0DA64A5D630C6354D2C62B8E7E040B60C4B4A1EC
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 d140fbabc4a01ada61911c42857db1f6d850caf670db1bab0e844ca19ae35b57
MD5 0611d9e5f40bc3ad0b44a0c7c40d995d
SHA1 bad7942991ee56e1d3f8b4b852973513b2fcebf8
SHA512 f35c9d0557bf00844a2fa44a3c1b920de4cdb4dc8923a2fa9310498ff696fd6a5db1c88ecc7359e6f4fb939e4fc2030307e8b335f0553e35a740465a146078a7
SSDEEP 49152:HzWgGFJLpmov9JEl/ueIYm5g2RBb4VY7p3a:TWvFJVm49JkdIYm5g2j3a
TLSH
T1971639F824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p2pwn_0.xZTbwZSc.2-win_x64.zip.part

Path C:\Users\Admin\Downloads\p2pwn_0.xZTbwZSc.2-win_x64.zip.part
Size 1.6MB
SHA256 f1287d947f5ad080dd12911fb4a264e6fcfed6bda0d9606ca332a33e827c4bad
MD5 e87aa1a0766c1ad7ac8c85106947ca5b
SHA1 a683fbb07135c3bbf770e4c5888e1c9d4b819087
SHA512 be3aadd1fa04004165a52b59ca34f82891a31b109a5ab46164b7896833e69e575624ce04cc0c1959c304b0895ecefb90953d80176b2924b0dcee9fa24ae572a9
SSDEEP 24576:m+YELohUXhjDjj5NMr3pAOX9Emsl63YvCjW2yX6lReVP/ml0Y0+vjq5CVATx:ypqdvbMVAKVsl63ASWJN/ml0YUY6d
TLSH
T1BF7533EC7E178E2B9695D06BEC09ED632BB190AF05B395941AC5526B413C633F3C18CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads