hxxp://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad[.]onion/

Analysis

max time kernel
148s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/08/2026, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion/
Sample260808-z84dfsvdrd

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	firefox.exe
Token: SeDebugPrivilege	2028	firefox.exe
Token: SeDebugPrivilege	2028	firefox.exe
Token: SeDebugPrivilege	2028	firefox.exe
Token: SeDebugPrivilege	2028	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2028	firefox.exe
2028	firefox.exe
2028	firefox.exe
2028	firefox.exe
2028	firefox.exe
2028	firefox.exe
2028	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2028	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 2028	4736	firefox.exe	83
PID 4736 wrote to memory of 2028	4736	firefox.exe	83
PID 2028 wrote to memory of 3504	2028	firefox.exe	84
PID 2028 wrote to memory of 3504	2028	firefox.exe	84
PID 2028 wrote to memory of 3504	2028	firefox.exe	84
PID 2028 wrote to memory of 3944	2028	firefox.exe	85
PID 2028 wrote to memory of 3944	2028	firefox.exe	85
PID 2028 wrote to memory of 3944	2028	firefox.exe	85
PID 2028 wrote to memory of 3944	2028	firefox.exe	85
PID 2028 wrote to memory of 2644	2028	firefox.exe	86
PID 2028 wrote to memory of 2644	2028	firefox.exe	86
PID 2028 wrote to memory of 2644	2028	firefox.exe	86
PID 2028 wrote to memory of 2644	2028	firefox.exe	86
PID 2028 wrote to memory of 3428	2028	firefox.exe	87
PID 2028 wrote to memory of 3428	2028	firefox.exe	87
PID 2028 wrote to memory of 3428	2028	firefox.exe	87
PID 2028 wrote to memory of 4876	2028	firefox.exe	88
PID 2028 wrote to memory of 4876	2028	firefox.exe	88
PID 2028 wrote to memory of 4876	2028	firefox.exe	88
PID 2028 wrote to memory of 4876	2028	firefox.exe	88
PID 2028 wrote to memory of 856	2028	firefox.exe	89
PID 2028 wrote to memory of 856	2028	firefox.exe	89
PID 2028 wrote to memory of 856	2028	firefox.exe	89
PID 2028 wrote to memory of 856	2028	firefox.exe	89
PID 2028 wrote to memory of 1612	2028	firefox.exe	90
PID 2028 wrote to memory of 1612	2028	firefox.exe	90
PID 2028 wrote to memory of 1612	2028	firefox.exe	90
PID 2028 wrote to memory of 1612	2028	firefox.exe	90
PID 2028 wrote to memory of 2196	2028	firefox.exe	91
PID 2028 wrote to memory of 2196	2028	firefox.exe	91
PID 2028 wrote to memory of 2196	2028	firefox.exe	91
PID 2028 wrote to memory of 2196	2028	firefox.exe	91
PID 2028 wrote to memory of 2728	2028	firefox.exe	92
PID 2028 wrote to memory of 2728	2028	firefox.exe	92
PID 2028 wrote to memory of 2728	2028	firefox.exe	92
PID 2028 wrote to memory of 2728	2028	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion/"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {89cb1df3-7cc5-46a6-96c5-fa4cefff52b7} -parentPid 2028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27136 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {98e4648e-7d7b-4a47-881d-19a155ca43eb} -parentPid 2028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3796 -prefsLen 25164 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 3804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {54575116-0c3f-478a-b1a9-7ad4eecb1b06} -parentPid 2028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27277 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {e3e75c5d-a5be-4705-aedd-efabd00fd5dc} -parentPid 2028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2944 -prefsLen 34776 -prefMapHandle 3100 -prefMapSize 270279 -jsInitHandle 2796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3276 -initialChannelId {07c2e22b-22f6-430d-918e-26bf022ffb9d} -parentPid 2028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2884 -prefsLen 35013 -prefMapHandle 4704 -prefMapSize 270279 -ipcHandle 4824 -initialChannelId {87766e96-f706-46b2-9f6a-73cc38dc3fe2} -parentPid 2028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5048 -prefsLen 32952 -prefMapHandle 5052 -prefMapSize 270279 -jsInitHandle 5056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5060 -initialChannelId {d352afc7-74f2-43ae-9633-4c9c97298530} -parentPid 2028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5080 -prefsLen 32952 -prefMapHandle 5084 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5096 -initialChannelId {17259409-b2f6-4bc9-92c9-d9ea729394a1} -parentPid 2028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5464 -prefsLen 32952 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 5472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5480 -initialChannelId {beb2f86c-3047-4502-ab8c-1920864711be} -parentPid 2028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0olu2cg3.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 10KB
SHA256 5b47bcdc3970dae61df1546452722037b8ed6163753ffd518b2208540f173038
MD5 baf3a218feb72a8634039733c8fdc632
SHA1 0f5fe05f9f26fd3ebb5db73df3b0ad682a0af255
SHA512 c2f27d8144b9467a3a12e567dba7af8bde10af44739d7c4f4d2e52077a4b15ab138edbc4edede82f49051f21b6de2f8ec6a678169634135815f69acefc24e3d7
SSDEEP 192:HcZpUe4wcXz5RqvAcdRPSHXFCPD1Oo1UxM/n1ZfpFt/nX31S1+NPR:HwCe7iO024Yvv1Zf9vHoKp
TLSH
T139226CBEDF826CB42F17C0D4D9A9524A8E49D4FBDFF3803B2128680CCA9475562EC85D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0olu2cg3.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 10KB
SHA256 c96acea0c1e3c701a85c69313db34e98a577643808abd939ce8612952481a72a
MD5 f81dc8ddb28d80319a8b69393dfe0105
SHA1 57b239369c0da2fb2a6ec6863dcd50d083262317
SHA512 bae0c75e507823be23590d1a9bff4de552f000459261b262ace5cb34d41f76c1774d5913eb3a71352b030328421e6bdff37583dc24a4ef1f56bca921763d6ec6
SSDEEP 192:HcypKRycXz5RqvAcdRPSHXFCPD1Oo1AxM/n1ZfpFt/nX31o86:HXkRyiO024YTv1Zf9vHa
TLSH
T12C226DBE9F416CF82A13D0A8D9A9922ACF08D5BFDEE3D07B10182D0CC99475575EC49E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5c2fb6bedd3706ff955b3b07b72af343ece58ea368894dfcaa3654ddf04da3ce
MD5 a41c3ed74052e56cb778909ed9874c8e
SHA1 ad14835f4713f5e8b5f2439e8e556ff639bf1622
SHA512 b1e2a3b19750575ba010e205647f461eec59b98f5c39a5f3fb636e38682ea2f73408de58c9ec99ffc228e2be33e787696f66676482785a0712585f46bb2a9028
SSDEEP 192:WOv5zbo2Z2ByjbRb/q1d66Joz1zgCl6mc0dz:tbo2Z2ByjVYd66Joz1zgC1jd
TLSH
T136E10E64E638863FC408027BCDA61B840F39389AD84E3F15359C751D2D5B2DD3A8E6BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 fc54621034ba1072c8add72898667f3a682024bc8bd32a342f46d8ca6c3fe161
MD5 e158589030f9b071b106f6144f3c273c
SHA1 a0936e3cb21bc35b25fc5c9f94eac8518b6eaa66
SHA512 1cf0c528f9f9913dd27a4fbb235c14303c4d4704c79f77aa4540da796b107fa1d5b271a838777c8631e50170b56b4dc45a8d7b136b6722e805a2af67bb78f85c
SSDEEP 192:G1d66Joz1zgCl6mc0d7Ov5zbo/Z2ByjbRb/z:gd66Joz1zgC1jGbo/Z2ByjVn
TLSH
T154E11EA4E638863FC408027BDCA61B810F35389AD84E3F25359C251C2D5B2DD3A8E6BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d9b22fdae2eb53d24a54d3c2af529c2bd348ec83ae069f296f852ca3dee2a4a2
MD5 fe405e17dec393f20b9684c2c12835d5
SHA1 07a4d4ff8557b2c3575c3c3e4c58a0a1809db214
SHA512 da2dd32fe585a82da7bbcc39311c22ec919d26d71270af89306bff38d02111d9673c7dd3d7723758b7f14a48b60986db426860784099f3e1f70ec62fe309e644
SSDEEP 192:w1/66Joz1zgCl6mc0d6Ov5zboA72ByjbQu:q/66Joz1zgC1jPbog2ByjB
TLSH
T128E10FA8E638863FC008127BDDA61B850F35389AD84E7F15359C751C2D472DE7A8E2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 defd9edfdb20e2b2136cbe457e451d213f09f92c98f99112f90d296fdd11bde6
MD5 81c49ed9862ac6d34dc74104d02d56c1
SHA1 7c77313be8b2e0bcb45a7f12704e4d7f8958ab46
SHA512 3b32b4be95fd48ae4c9001bc486f214954fa7db0285de5d3af4d220b1a2c03897c4eb942f02a2a065ac105963ee8d9b37ba1b50ce3397c8ef468aa79175e948c
SSDEEP 192:G1d66Joz1zgCl6mc0daOv5zboAk2ByjbRb/W:gd66Joz1zgC1jrboL2ByjVK
TLSH
T193E10EA4E638863FC408027BCDA61B840F39389AD84E3F15359C751D2D5B2DD3A8E2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\events\events
Size 1KB
SHA256 83f5e07f036efb8a096a312e66c23e4a4ccac2e8fe1c1c39e03ae02d81b1c9b7
MD5 e791c73614e1c4f83acbfeced5f45e3c
SHA1 11f959e96f5e9c94d059378cf957ed9eea9bda55
SHA512 428a9e7e20187c1315327595016294ddbaeb8649082f3cdda375ec0f2a28eb4e1f5552239012f999259118b250162e3285628b2eae4f148c5669e163f3b4c771
TLSH
T14E213D9C39F94D3AA887F25DB44113CE53A54E0B044B1C678E12EF8ECE916D9326E438
MD5 SHA1 SHA512 TLSH

Submit Download

34db1346-6cb4-4f63-be0a-c6e50aec5269

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\34db1346-6cb4-4f63-be0a-c6e50aec5269
Size 2KB
SHA256 0bd8b33903c7eeecb24e46482a3d1594afefbf4962df8b2224967e4034ed5f2d
MD5 6a266bca9badad29729a47de7bcbd9d7
SHA1 f6d96bcf9cfd1cc71ed96d03d3ded1cad539125b
SHA512 240044cb284f712fa0f9e8d12e4a2d25ed0dd99f0d59e44708900ded11c789a162c11868f3bbd1044d9fbd99ca04e3ea0a6b4e7d47f17f343b6e191f53150729
TLSH
T17541236C35784D7BC9DEF18CD482338E57A04A0350C52C436DA2EF0DCDDA659376E92A
MD5 SHA1 SHA512 TLSH

Submit Download

aa4707db-1bad-458e-949f-f66d9bdb62a8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\aa4707db-1bad-458e-949f-f66d9bdb62a8
Size 883B
SHA256 00c64daff4525743077654102de514c4d895b20598b4deda51d6e373a452e013
MD5 4ccad4fcd162667adb048b8e4388594e
SHA1 588ae12ea93e311547a96df309524c2e2b571ddf
SHA512 9d5219621f1e2b742d0091c5e91a1d9885678e9791cf7e1c33be1b4689daa9817b75d05248e96f101e5a6ceb1a72ff0fb7d6908264a53d89eb4697ad76bf317f
TLSH
T1E41127C48630B7B2CC5C914FC79577824BE02523C0C554147DF16E150D7F51E976AB4B
MD5 SHA1 SHA512 TLSH

Submit Download

cd78793a-fe3d-4848-8b50-b3a66e783dac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\cd78793a-fe3d-4848-8b50-b3a66e783dac
Size 235B
SHA256 acc1cc5591899f38b9f24e179fa8d51c39359ba0ec3e87c742861aa0906b7bb1
MD5 32897adebe4a452bf0121b33ef0e597b
SHA1 e35bef01eebc8838bdf0164e5935e9c16d5f7e25
SHA512 e2c544aa743321ac508777048eae23d2615dbb38a516193c5577da39cd63b6e1b2614c97abaa2303e4e64cbc82d7dc3d491e1072fe007bca03c062f062cb7e92
TLSH
T125D097852898336C0C180F0FB0A82AD274848C3320B1E8208660017499FA9C841A280B
MD5 SHA1 SHA512 TLSH

Submit Download

d6610566-c0e8-4f75-9e24-a3cb8c4b2b7b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\d6610566-c0e8-4f75-9e24-a3cb8c4b2b7b
Size 15KB
SHA256 1bdce1e3c789bfe41ad0102aae6500dd161458b243555614672ea20f10f3969f
MD5 1fac7dbe0dd310fcc7864f07492ae889
SHA1 3f148ced022c6a61ded3b96090d06974269fdfbe
SHA512 899b09f6d344687c60d5af5b6905ab9e035749ca4977b476f562ac8a6fc28668e0dba0ad0099e5362fc7ffae69a5d7a54b77e526992bc23386dae91bdebac591
SSDEEP 192:nv6ngGvPdF9Iw2w45ZktE7ZJa9uew4219Bk3pzXs5903WtRzxib68CAd8cxS:kOrktSZOu8oENcj03WtRli/7d8cxS
TLSH
T14872C856686045BA8251E3ACD8F87FC3E6F528CF4C418FCADBE47E0859DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7323096-d0e7-4cb5-9c08-e9c2f1accc65

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\d7323096-d0e7-4cb5-9c08-e9c2f1accc65
Size 235B
SHA256 d9a177722b1b040b346958aa1d9917250de66939b54b1ee8d0052f20935a6d37
MD5 b6c8b1cd24cf2763341d0b47d5797c00
SHA1 ca203245ad298ede81ac55a19b8d6a5482ad5aa8
SHA512 203efef66acd008ac5a5f3b5c336b52b7497f8627c4a75a54032f40fd0163a11800c172639946c727f0284010cf048bdcab5091795a96c8a00f3c23b7738e7a3
TLSH
T12DD097809888672C08044F06F0B429C270544C33A8755C209AA1847CD9F89C4522283B
MD5 SHA1 SHA512 TLSH

Submit Download

ed4a8eb2-adf0-4f92-a677-bb2eab3d521d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\ed4a8eb2-adf0-4f92-a677-bb2eab3d521d
Size 886B
SHA256 3fb1f3994c6e087c167cbb43776626021dd44bd87540753f1914c1c4466f4a06
MD5 950e163d102368eb37f1524d1a32a9f6
SHA1 ca904c198ad158102b196dd2b14126ccdd1443e0
SHA512 1954b07602534062546f4938368768ce2bf0b653d5274c139f2d226acdbef40309c543c44155e22c0487aabbc560c07273dab042a2b6f10a4c5194f3e00e13d1
TLSH
T1991144808530AAB2CC6CD28B95A6734647E07523C0C519547E90AB080CAE51D67A6F07
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\extensions.json
Size 16KB
SHA256 ca8376abd3695f5ebf7fd966080f0227eee6b9dbc0ed64ef5c7968aaa6d0f462
MD5 4be5535f23f2b3a6dab98caf4d84e96d
SHA1 ef8a99d1e1d65974b6e9e53f408e4b344e6ec827
SHA512 b55441b533db469dad5ad23c5e34d9da72275b000ad160438c7f40329355d568078e9dcc884ec855ec46df861441ed36b133883d75dcb67be04b8fddc8021e27
SSDEEP 384:MkI4vcUmldvW8dhWr94zV96oetL4H5qQL4PBL4H1L4HnL4HHK4h9:DI40RfLX2436jt4ZqS4R4V4r4K4H
TLSH
T13472541545048EB8298F979AAA367E02C37D473B70845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs-1.js
Size 6KB
SHA256 e2000340fa14ae5fef87bb1bb3ffc059bd214d50b3246f6816ddfa1b01dd60eb
MD5 166640a75ebaca7797aa13474b8b44d1
SHA1 acbd6c33cb4ed95208d5e55314e27d2a47c8834a
SHA512 309cb4d48779e0653c706011297db460d37bd842d50d47a0f6e4dd2d841f80fcdbe889c575a78f5f747516455cab2c4f4c14765923339d6222821443d2c770b7
SSDEEP 96:xHXWUTUuqGqSfx9F1zSFgYSSlNdv9jOngH5XJKSIHBw88P8L4cnzbF:4ZRSfx9FWgYSSL5ZKSYBw88q
TLSH
T1E3E120789058CB7F74B677ACAC6888316AB2013B77BF68D650B554C9050CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs-1.js
Size 7KB
SHA256 a3c159a0f78cb2583d193ba51f6839a245adf7b76d49a90dcce374a869c632f6
MD5 17660c7641d2c5024015c7be71b96d2d
SHA1 822cdc67525193b623c9936f2a40c7ad87c74702
SHA512 aa0af52dfdd5d99ad78f9c8fe1bd66fabacf8fceab185ae4ef7185903ebd235f00e34c5c371999e2282f7d65b26161ff1cc19b86c42f4ebd92b86c09cde3019d
SSDEEP 96:xHXWVTUuqGqSfvoi9FObzSFgYSSlNdv9jOngWRIV9XJKSI/Bw88I8L4cnzbF:4wRSfvoi9FjgYSSCRoZKSsBw88F
TLSH
T1E4F101789044CB7F75B2766CAC288D305A72023B76BF68DB11B994D5050CF3445F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs.js
Size 6KB
SHA256 b568e121c9137d00ddb0891344758a4a15ad8e9df3028c4da9c6762fe4ae28d9
MD5 bd326a6dc4224ef8353bd8245b6e666e
SHA1 df948f242b5124369a9c12ac93191a02d7b599ff
SHA512 7569bb2b23c0de79088f246baa856daa4dad2e15b860ad956a627c9f5859f1e8902e85395a8530dd13f07e60c79bd940ba0c76ab1dfb60be2d31162bf9b01ac3
SSDEEP 96:xHXWUTUuqGqSfxH5Y1zSFxSSlNdv9jOngH5XJKSIHBw88P8L4cnzbF:4ZRSfxH5YWxSSL5ZKSYBw88q
TLSH
T1D5E110789018CB7F75B677ACAC6888316AB2013B77BF68D650B554C8051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b9ce620bb6cbeaa45f8bf04f1c79845ff5f63e033d30d9ff01e75b7ec5a7cb82
MD5 a9d47a2ecf4938a9df13905f2215cec4
SHA1 091a8d11455a3792a890a91bd82b799b92e68672
SHA512 5701c37a186fb5193f436b7f702eb5ecd9fa2f43b296e779be846b193bed331746fde139471df356576da10baecd35d3f93a5b17b2f57eaab6f3453317bd35ed
TLSH
T16431D7E388566EF5AD128BCEC88D4FE6C3A9242344A96C74C24F9C0822CB58566CA25D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 dc07f068be0761c8ce654841b16931c129f4a28a838f6027d5ca6817d2afe620
MD5 02479e90e22bc68722e3a4a8cab1c8c6
SHA1 b19864daaf6c911694ca1ec3e5ead1ec440f558c
SHA512 453d718bc421d076f2eec17ca3665cdce6926a027105b62901ce82be1f1e01da2d264ef33f1f8232809c21beac3fd9874d748de42bb7e1cf6e88cc8abc10b458
SSDEEP 192:cpiz49Rngf+woQm+jx72DS0yZ0nJDGGQu2x8ITtn4sZXjlMDbushgrR7IAx:cocHgB9N7tnGSxHTtn4sZTfwgrREAx
TLSH
T1DF32D0627A6F6AB454B39268E1418FD6A37E1DBF07801CC946C83E90307B6A218D5769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.3MB
SHA256 a370e4fbcde106ecbd831aed05643fe66c9753b0a80e3e8dfb4750c77e3ed238
MD5 26ecc08b1bda4a32af34bccab590f6e6
SHA1 93172dc749cdcf4688484dd79c97cde60933c84a
SHA512 94cf5ab8a9cfdbd6dffc8e234572847f94d862687201720a6cbad950dd906dd0169d777b19f623eb9f31261eb42a5d02d3e1349d31cab81941d75b5d8ce0ac22
SSDEEP 49152:9D+gRhaHugTUtgz/b84S6COQwKOLzLhYhf0ZTkBb+gxytQ5SSov:9qgRwRTUtgz/tbLCezv
TLSH
T1B2465BE860E19252F3824073764993EB21FFC00D5437DA4457A85AE5E478CEF8E27B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads