hxxp://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad[.]onion/

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion/
Sample260808-z84dfsvdrd

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	firefox.exe
Token: SeDebugPrivilege	2060	firefox.exe
Token: SeDebugPrivilege	2060	firefox.exe
Token: SeDebugPrivilege	2060	firefox.exe
Token: SeDebugPrivilege	2060	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2060	firefox.exe
2060	firefox.exe
2060	firefox.exe
2060	firefox.exe
2060	firefox.exe
2060	firefox.exe
2060	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2060	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2060	4124	firefox.exe	84
PID 4124 wrote to memory of 2060	4124	firefox.exe	84
PID 2060 wrote to memory of 2928	2060	firefox.exe	86
PID 2060 wrote to memory of 2928	2060	firefox.exe	86
PID 2060 wrote to memory of 2928	2060	firefox.exe	86
PID 2060 wrote to memory of 2428	2060	firefox.exe	87
PID 2060 wrote to memory of 2428	2060	firefox.exe	87
PID 2060 wrote to memory of 2428	2060	firefox.exe	87
PID 2060 wrote to memory of 2428	2060	firefox.exe	87
PID 2060 wrote to memory of 1132	2060	firefox.exe	90
PID 2060 wrote to memory of 1132	2060	firefox.exe	90
PID 2060 wrote to memory of 1132	2060	firefox.exe	90
PID 2060 wrote to memory of 1132	2060	firefox.exe	90
PID 2060 wrote to memory of 4668	2060	firefox.exe	91
PID 2060 wrote to memory of 4668	2060	firefox.exe	91
PID 2060 wrote to memory of 4668	2060	firefox.exe	91
PID 2060 wrote to memory of 2484	2060	firefox.exe	93
PID 2060 wrote to memory of 2484	2060	firefox.exe	93
PID 2060 wrote to memory of 2484	2060	firefox.exe	93
PID 2060 wrote to memory of 2484	2060	firefox.exe	93
PID 2060 wrote to memory of 1004	2060	firefox.exe	94
PID 2060 wrote to memory of 1004	2060	firefox.exe	94
PID 2060 wrote to memory of 1004	2060	firefox.exe	94
PID 2060 wrote to memory of 1004	2060	firefox.exe	94
PID 2060 wrote to memory of 4316	2060	firefox.exe	95
PID 2060 wrote to memory of 4316	2060	firefox.exe	95
PID 2060 wrote to memory of 4316	2060	firefox.exe	95
PID 2060 wrote to memory of 4316	2060	firefox.exe	95
PID 2060 wrote to memory of 1964	2060	firefox.exe	96
PID 2060 wrote to memory of 1964	2060	firefox.exe	96
PID 2060 wrote to memory of 1964	2060	firefox.exe	96
PID 2060 wrote to memory of 1964	2060	firefox.exe	96
PID 2060 wrote to memory of 1608	2060	firefox.exe	97
PID 2060 wrote to memory of 1608	2060	firefox.exe	97
PID 2060 wrote to memory of 1608	2060	firefox.exe	97
PID 2060 wrote to memory of 1608	2060	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion/"
1⤵
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {36626edc-2eeb-420e-a62b-9595fb198eb0} -parentPid 2060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2060" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {279091e3-41f4-4129-82fb-76fc2f1e282d} -parentPid 2060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 25164 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {8515da6a-c572-4cec-80d6-ff9ca7335ece} -parentPid 2060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4016 -prefsLen 27276 -prefMapHandle 4020 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {432b6998-2b33-4355-be84-95d676337163} -parentPid 2060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2060" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2860 -prefsLen 34775 -prefMapHandle 2864 -prefMapSize 270279 -jsInitHandle 2868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3256 -initialChannelId {061291a7-4f18-40c6-a9e6-0a50971a00ed} -parentPid 2060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4800 -prefsLen 34905 -prefMapHandle 4804 -prefMapSize 270279 -ipcHandle 4776 -initialChannelId {c83d963f-24d9-4e86-91a1-a7db852a324c} -parentPid 2060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4948 -prefsLen 32845 -prefMapHandle 4952 -prefMapSize 270279 -jsInitHandle 4956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4964 -initialChannelId {7b50ea17-75b7-4f22-afe8-80c1c29e4957} -parentPid 2060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4980 -prefsLen 32845 -prefMapHandle 4984 -prefMapSize 270279 -jsInitHandle 4988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4996 -initialChannelId {3219e495-610b-4246-9fca-3e3c917d3e93} -parentPid 2060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5328 -prefsLen 32845 -prefMapHandle 5332 -prefMapSize 270279 -jsInitHandle 5336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5344 -initialChannelId {241a70fc-b6ea-4efb-88df-ee8ba1c42045} -parentPid 2060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 10KB
SHA256 4ff666ae83573b121d596e6b0c5439fbae8b06297a66510e54f7ead8f7e151e5
MD5 0ee6560ab8b222eca144a92bc146cec0
SHA1 d040b5a0003dbd77ac0fb0d303ddbed0e0c1b3e3
SHA512 5df59d6a64f77e1fce1d4f33b63b42a53f754f473b9d7067d9a321d38bf881db3cb9feaf93776a84d23621609c77bec2f5bf63b1fd7e4c020d6e907b42250d1e
SSDEEP 192:HcZpUe4wcXz5RqvAcdRPSHXFCPD1Oo135ismDk8gM7pEikNY1/1+sPg:HwCe7iO024Y6I8gMV8NYZXo
TLSH
T109226DFE9E817CB51B138090A978554C8E09D4FBDEF3903A302C3849C994B5911EB4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 10KB
SHA256 92d5e2fc044078b52a2aa061272cdf7b49d77375150abc13bdbe8fee6c28f4ad
MD5 7bd539887514e9ca908563ee94cad028
SHA1 dd01fa79af675a2ee6e60d2e9ff68884048bbe5a
SHA512 9304c455d2443d55aa27e6dc46fceb613dcb1542bc6a5cead8455a906fe623dcc0585fc8f45b26245a6d156faaa6d751782efb6d9ddd3e8bd2af3e9b9c88d636
SSDEEP 192:HcypKRycXz5RqvAcdRPSHXFCPD1Oo1g5ismDk8gM7pEikNY1Bjp:HXkRyiO024YPI8gMV8NYp
TLSH
T1F9225DBF9E403CF91B1390A4D968955D8F08E5BFDEE3D03A20183D49C994B5960EA4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 05b3eaf34a9817d23fc89478cd6c01e4d70d56c05aaf11084c2a45694d27630f
MD5 c760d0e0d325cc90256ed82283a9f774
SHA1 4df43c9d5cf2271456f7ca804b2ececd565b1cb4
SHA512 1450c327d3c18b31841774a7f8ae50580bfd2dc5bcb8fbb1888ce0bc340324d86c2b8cf9178597c7110acdb13cc58d59bf7121b3a7aadc638b2b828b82a75ee6
TLSH
T1B661B458F229863FE445423ACC861B452F307456A8AE3F2A75ACA04D1E4B2CD778D87E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 bb4357d24a94bc53f5106f1a1b67115546867611e8ecf0415fd427202af6eca7
MD5 2e087529cbd33ec751b02e583cd4cf6a
SHA1 6da58b19a9dbd2f31ea8eb899c4bf140eed7ec1b
SHA512 60fe3cecde30493b7561a21f34ea5db4435e6956c2a6a52c7b61e0095ae70f83949c1b6c6ba742d661f721bfa5f4dbef28b80928feb4c99780262e2f4a6b935a
SSDEEP 192:Ug1d66JozGzgCl6mc0dfOv5zboPhRgcyjP28:Uad66JozGzgC1jWboZOcyjV
TLSH
T1BAE12064FA39863FC418427BCCA60B454F39385A984E3F19359CA4082D5B2DD7ACE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8d82d4eee4a0b5a1ec9b8d7d788d8961627be067d8b2548ce8469bd6366e21f3
MD5 41260738f05741e283521926467231c6
SHA1 a5e8aa3580e9b17fb6ba093300fa80269f898e2a
SHA512 bc92131c0d26f604b61aecceeaaa0289940bf2333b5bc424f00891d45817a822b9ffd63fa20ec45ef4e5bb0b4905bb30a27b23d5107d31e74ac9a9e5735ce9ad
SSDEEP 192:fOv5zboPPZRgcyj5Dg1d66JozGzgCl6mc0d:QboXZOcyjdad66JozGzgC1j
TLSH
T111D1CB68F629863FC419023BCCA61B410F36389A984E7F15359CB4182D572DE7ACE57E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 cc53236ebd65a45e6c8ef7666b8cd51bda2daa727e9726816f9f16a0faba317c
MD5 3cf732488679523451520ec237b07311
SHA1 5089762d2e9027666e40494f3c636983f0798cd5
SHA512 2b585885fb7909e6fa30380c0054ac0ee7d4b69b9ed01df55d15cf3385bf528c2041217416645b0300154099dc89192663475953ea14fb84c2a40dbe306c3b54
SSDEEP 96:JsANSdF95/7bkW60rcERgepyUR6nOWZJPFZ2FPFBFZFD/dd66JozGzgClKtmc0dz:pOv5zbowbRgcyj5Dg1d66JozGzgCl6m5
TLSH
T1C1C1BA68FB39863FC419423BCCA61B410F76385B985E7F1531DCA4082D5A2DEBA8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 edff64815d3a9735e03612879e8745b0a7899e43ff604da40bd54c9b055774d0
MD5 fa0fbfa6d53085d90a3291ee501a67ef
SHA1 e5609e23efd2633005308923682fe780ce0491cd
SHA512 49ebde885587ecedd3eebaeffcf7f8c050ce77f3ee0fde21099866cf0091c1759c1eeabb30ebde488dd1347032c1ceed7aa60103cef7acddfaccea6eff6ccd01
TLSH
T1E4118C9C39F94D7AE987E399B440078E57618E0A048B1C678E52EF8DCEC0AD9322D43C
MD5 SHA1 SHA512 TLSH

Submit Download

34e574eb-efd4-46dc-842d-c98f08e986c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\34e574eb-efd4-46dc-842d-c98f08e986c5
Size 235B
SHA256 18179737a68fd7d0c8aa93cd0256ad2221867171da1c1098bb3ad56e7f86191c
MD5 fe591a4e2589c61ed75980c4ea59f7bf
SHA1 22993f0dced3f4caf688c0692a9976653625c23b
SHA512 edd5c050325e9b6b3c54ed5f26a4f85d026d3c7970e6a48c1d6e7568ec34513fdeaec6e113a8017e2d35421d7301fa8a390c9dc9ac9c7ec0cf02d24b4dc5b6f3
TLSH
T1D2D097C02498372E08100F46B0A06ACA30C98C3320A4A820CA5200789AB99EA129182B
MD5 SHA1 SHA512 TLSH

Submit Download

3cf0b7ff-03d2-4850-959d-3272d5a39f84

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\3cf0b7ff-03d2-4850-959d-3272d5a39f84
Size 2KB
SHA256 df4f78db85e981c3128cb493603f9cc803e9e8dfbda04321d982dbc4356926da
MD5 5afe5194c43df75bc17d877cbe13f728
SHA1 a3a0f812fba46b6f36da7bb256992d4fe4750301
SHA512 9bb2b965735d0609ba234d4615e1de711bf8f758c84c339f9bfc1fbed244687e8aea176dfbc6e9281389119bb07cd8c36730470396551bf404b33e04c3b435f1
TLSH
T17041532C397C5CB69CDBF18D9883378E47A48A0340C61C832D51DF088D9A699736A97B
MD5 SHA1 SHA512 TLSH

Submit Download

457ac642-740c-4e4e-a2c3-554444452ca4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\457ac642-740c-4e4e-a2c3-554444452ca4
Size 235B
SHA256 036ab513e4d658f61833887964c5539b3463b1713e7910f6c5b8e361afb84e2f
MD5 063a757bbb8e7275366ee8dc412ab44d
SHA1 ebb576d6665623d57478dfd7443638559b4caf98
SHA512 c23b041d2c085972700868a7bde3a6c8bcff5f9b781164f7114dad9cb60ae2affb514c8e7d2b98ce46f0df6f8c345d452c16c5aa4e38a5d69a9cbd9c947c1b59
TLSH
T1F5D09782189927AC0C241F17F0E128CA31488C3314FA9822D9A140389DBAEC48212C07
MD5 SHA1 SHA512 TLSH

Submit Download

8027417b-9a3f-482f-8baf-2235b700fc1e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\8027417b-9a3f-482f-8baf-2235b700fc1e
Size 15KB
SHA256 ef7fc3da2b92e5c2a849461113ac4e9e547f7a01a072024e2497a7ac8b6a1c30
MD5 fdab63692543cdd49379348446638621
SHA1 acd4dbe795f6ae161669c6848a7f9cdd086b1903
SHA512 0e224903cd61be84120658de084220ebc1e624476b022cd660358b0c6237dec35e2065d242e571fe6c25bf6a48b0804691f05c829859699e08fbed17505af1b3
SSDEEP 192:aWJlg1lBA4p2DWBVZCb7W9Bzf3+8YkjE25xzDaHnO6knCHKDzFggb+k1JSXCzxYX:aW6f7TZV7DzFP+k1JSSlY7P5Q8EW42
TLSH
T1F472DA566830457A8291E3A8D4ECBFC3E5F538CB4C419FCA9BE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9df5b9e4-5ea6-401b-9872-e5f11b52377e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\9df5b9e4-5ea6-401b-9872-e5f11b52377e
Size 883B
SHA256 52cb55d4f95058ca2797dcddd7f80b91ebe95646f2d189add046b45129190072
MD5 a629d2192eb80e72f21a8797d6e1a6aa
SHA1 7d470e3f547b3ae7edf9b3205b532e09f895842b
SHA512 5b2aa225a6e5e3594107d4b3b79edbf29ca835152c8c84b7189063aa09b72a40b70e8083b4b0a7977c6c7b650ee6ba34d3c1a2ba989204532dff8feff9dc3183
TLSH
T1BF112391AB39B9B28C7CD34FC9513B428FE4752384C694143EA08D140D7E51EE3EAA0B
MD5 SHA1 SHA512 TLSH

Submit Download

a659179f-9e05-4079-9350-04a07a4947e5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\a659179f-9e05-4079-9350-04a07a4947e5
Size 886B
SHA256 1b65fbe0d5a80480bd6d49afd5591d6994daf215453ca973dd28b5c3445acbde
MD5 346ede38bea9b361b30ec8ad2082c6f4
SHA1 d5fe49e95823f794ddae6897b5cd4dce9a7f75b6
SHA512 b0fff5bd2c416583432af52fef17901e5c452f302eae5df7f2472effe225d3e9e56c6711db4e01020201964756aeee5312f865ec99ea519672521c6b7a29d089
TLSH
T15C1127909679F8738C79D24B94A57B024FE07423C0C559147D909A140DAA51EA3EAE07
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extensions.json
Size 16KB
SHA256 cb2fc2cb0398fba1e365bdd4ae7276ae4f4ca9d5978e4453fc6b7e78c428f3ae
MD5 e7abf0365d350eec2cf6b5eb2ebaf6e9
SHA1 033100942badadc3c934dfe9417a5b58fcfe9858
SHA512 88d9cbbf8ddc8023d9b1964e81c5acabc98df6841fc3217f358a6f3f7585f6da0bbda70b2ca0949f2118d857b126cbbaa6a49f9edebd03cd9e22c7fdca5cb84f
SSDEEP 384:ghkI4vzUmldvQ8dhWo94zr96oQL4HQL4PGL4HzL4H/UL4Hzh4hg:PI4LRfJXF4F6Z4y4U4f424l4S
TLSH
T17772431545049EB8294EA79BAA36BE01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 6KB
SHA256 1e8a3cf0e4d74a930c8f33ae55fe8a803a3191146e66cb8931f6840f3a552144
MD5 bcfd4c138f5b8ad594a9592c04ab5103
SHA1 18442dacc10e5175473abd912d1aad2d4b9acdd5
SHA512 741e1fdf80fc401da3e74eb691978a0fc2412980778dc831cae7aa6f3350cac2431e3e2d2761a83dccc862be38caa2342f29afcd4519bc2a91cf39e6acba91da
SSDEEP 96:xHiUTUMqGq/fSeQ1zSaSSlmdv9jdnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSeQLSSnxisIHzsBw88J
TLSH
T1CDE130789048CF7F64B676ACAC688C716AB2013BB7BF28D650B554C4015CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 16ec48c76fa161c0dcd7985ed75946de053a13757b6dd5658b074da488da102e
MD5 ab4376a0c2378e7c8e55353003bb7b6d
SHA1 6d20a36694cf047e5478446cff1edea056c5f6fc
SHA512 71b891ac6d20229047993c7ca879a5fa088a2a56d3521246d59398ed9f30c960ff46d469e421bbefebe522e9d90beb2dd6dd3816fb0fc5419e482d17bf81641d
SSDEEP 96:xHiUTUMqGq/fSrO1zShSSlmdv9jdnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrO0SSnxisIHzsBw88J
TLSH
T10DE131789044CF6F64B6766CAC688C716AB2013BB7BF68D650B594C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 2ea747303c3cde4a2ff27bfbe35bdda224baad5010103a661a0f89b407bd6e79
MD5 fe70b20b0f622ff01ec07008c1ae94ba
SHA1 e1405bfe2847ee98963e18030021953e6945d966
SHA512 2c28dcf43ad1d2b5b45683090def08bdf70e69b3987df0c51f72cb93ea350c8984c3085302aed15dae63eba450b77c1d1da79a634f9cc973591212630b402c7b
SSDEEP 96:xHiUTUMqGq/fSeQObzSfZSSlmdv9jdnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSeQBZSSnxisIHzsBw88J
TLSH
T124E13F789048CF7F64B6766CAC6888316AB2013BB7BF28D750B594C4015CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 7KB
SHA256 2d7fd8190a7517378af9c4ff1b4b5602d2d46f88a43e99a3a6c8f0b2f3571856
MD5 2abcf3b18cede2fddbfaec994e65028f
SHA1 97874a7522c79b3cb4099f588e5b5d1e12e29ee4
SHA512 3eff464a63923339d5c435f4366df81a98c98b06b22a2ec2b40c5ff44c01dbf1b50f1aab2618844efa01b2deb76b9c4d44d7e6cff4f816bfeabe04d3fd53596c
SSDEEP 96:xHiVTUMqGq/fmoLeQObzSfZSSlmdv9jdnytHlAsO7HjvsBw880x8L4cn23U1K:UiR/fmoLeQBZSSnxisIHzsBw880j
TLSH
T1C5F12E789044CF7FA4B6366CAC288C315AB2023BB7BF68D610B994C5015CF3445F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 e32096eee0008c89f60ef6e69687fac853bf08de07cf2f6443064210fc970784
MD5 8bf0dda50fd4c6a5504c52354dddad04
SHA1 9f0797f6172d464dfaf8dba9bdf7659a86c17725
SHA512 0cf7b24012cc4b837be4611e230b7ce8a6d674386832023c06562d4bdfdb25320287a824bf7dbb4f60b98dd99f889391bf9b2fc45c929c2f6d9ca714e37d6308
TLSH
T15331D787A8232EF6FD128355D0498FE6C3AD3533047C68F0804B490A24DB5C2B38745D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 cc159a910b2754dd977d0a07d1cc7b5581d75bc551d4c84af62f680db6e9167e
MD5 fe74a5895a69a19ee8565b7a0d2d8728
SHA1 f56a548763380fdb3572881f5f9d5643a7ef5993
SHA512 cf9583a4392fd4e97cdb977ce10ecfa2a9271b86375df3c4bcbcabb92256c95c8abf71a3e74a016b15c666293a036a6fe1da30fc6e54eeab383c27d111d49005
SSDEEP 192:wp28t2jG949RnKqf+woQm+jx72DS0yZ0nJDGGQu2x8ITtn4sZXjlMDbushgrR7Ih:wplkG2HKqB9N7tnGSxHTtn4sZTfwgrRK
TLSH
T10D32D061796B2AB565B2D328E241CFD6537E1DBF0B801CC506C83E84307B6E329D6B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads