hxxp://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad[.]onion/

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion/
Sample260808-z84dfsvdrd

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3336	firefox.exe
Token: SeDebugPrivilege	3336	firefox.exe
Token: SeDebugPrivilege	3336	firefox.exe
Token: SeDebugPrivilege	3336	firefox.exe
Token: SeDebugPrivilege	3336	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3336	firefox.exe
3336	firefox.exe
3336	firefox.exe
3336	firefox.exe
3336	firefox.exe
3336	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3336	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 3336	4828	firefox.exe	80
PID 4828 wrote to memory of 3336	4828	firefox.exe	80
PID 3336 wrote to memory of 1928	3336	firefox.exe	81
PID 3336 wrote to memory of 1928	3336	firefox.exe	81
PID 3336 wrote to memory of 1928	3336	firefox.exe	81
PID 3336 wrote to memory of 1240	3336	firefox.exe	82
PID 3336 wrote to memory of 1240	3336	firefox.exe	82
PID 3336 wrote to memory of 1240	3336	firefox.exe	82
PID 3336 wrote to memory of 1240	3336	firefox.exe	82
PID 3336 wrote to memory of 4796	3336	firefox.exe	83
PID 3336 wrote to memory of 4796	3336	firefox.exe	83
PID 3336 wrote to memory of 4796	3336	firefox.exe	83
PID 3336 wrote to memory of 4796	3336	firefox.exe	83
PID 3336 wrote to memory of 4752	3336	firefox.exe	84
PID 3336 wrote to memory of 4752	3336	firefox.exe	84
PID 3336 wrote to memory of 4752	3336	firefox.exe	84
PID 3336 wrote to memory of 4260	3336	firefox.exe	85
PID 3336 wrote to memory of 4260	3336	firefox.exe	85
PID 3336 wrote to memory of 4260	3336	firefox.exe	85
PID 3336 wrote to memory of 4260	3336	firefox.exe	85
PID 3336 wrote to memory of 2464	3336	firefox.exe	86
PID 3336 wrote to memory of 2464	3336	firefox.exe	86
PID 3336 wrote to memory of 2464	3336	firefox.exe	86
PID 3336 wrote to memory of 2464	3336	firefox.exe	86
PID 3336 wrote to memory of 2316	3336	firefox.exe	87
PID 3336 wrote to memory of 2316	3336	firefox.exe	87
PID 3336 wrote to memory of 2316	3336	firefox.exe	87
PID 3336 wrote to memory of 2316	3336	firefox.exe	87
PID 3336 wrote to memory of 4632	3336	firefox.exe	88
PID 3336 wrote to memory of 4632	3336	firefox.exe	88
PID 3336 wrote to memory of 4632	3336	firefox.exe	88
PID 3336 wrote to memory of 4632	3336	firefox.exe	88
PID 3336 wrote to memory of 4984	3336	firefox.exe	89
PID 3336 wrote to memory of 4984	3336	firefox.exe	89
PID 3336 wrote to memory of 4984	3336	firefox.exe	89
PID 3336 wrote to memory of 4984	3336	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion/"
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion/
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {7c322caf-fd8f-437c-a61d-f389b9a1f3bf} -parentPid 3336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3336" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {4d1a16d3-1de2-4c18-b17a-c43d3c64046c} -parentPid 3336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3740 -prefsLen 25164 -prefMapHandle 3744 -prefMapSize 270279 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3756 -initialChannelId {a20c4385-34c0-4f6b-b53b-ecffd6294cee} -parentPid 3336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3912 -prefsLen 27274 -prefMapHandle 3916 -prefMapSize 270279 -ipcHandle 3888 -initialChannelId {641bccda-b443-47dd-90ec-0e6e9cbc4582} -parentPid 3336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3336" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4332 -prefsLen 34773 -prefMapHandle 4336 -prefMapSize 270279 -jsInitHandle 4340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2980 -initialChannelId {8d4600f6-c575-4b7c-a26f-7d1fd949c4c1} -parentPid 3336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3128 -prefsLen 34903 -prefMapHandle 3024 -prefMapSize 270279 -ipcHandle 4876 -initialChannelId {25e137b1-7795-43e2-9c8e-d530ff7346dd} -parentPid 3336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5028 -prefsLen 32845 -prefMapHandle 5032 -prefMapSize 270279 -jsInitHandle 5036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5048 -initialChannelId {35027160-fb21-4bc2-bb55-fb5c67b0a1d9} -parentPid 3336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5224 -prefsLen 32845 -prefMapHandle 5228 -prefMapSize 270279 -jsInitHandle 5232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {98fc93b9-67eb-485a-9ae7-94cbe497c1ee} -parentPid 3336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32845 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {ea484b56-4027-4fd1-adba-44e262868e3a} -parentPid 3336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu37ckd4.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 10KB
SHA256 cfc59e59815da1b34a7dc436802623a3e07bffc57ae4c9cf5ee98d2960a07e1e
MD5 a1f87c18b490481415cce2869e8efa53
SHA1 7f34b742d021af18641c216cbf7efe580bff7cb6
SHA512 c89e7cca337412803e4f96c21b9bb9c126306bd4e06a5177a6e18cfb3ae0f60134cc29f3830000b5d9a59b33a2eb34d79741d255a41f891c21abcb740a75d451
SSDEEP 192:HcZpUe4wcXz5RqvAcdRPSHXFCPD1Oo1Gmj+SCOtOb9wQ+SfjC1/1+sPp:HwCe7iO024Yv+SCkc9P+SmZXx
TLSH
T161225EFE9E813CE81F67D088D5A54649CD6990FB9FF3903A21283C0CCA8476593F946D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu37ckd4.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 10KB
SHA256 155af75d1efc2b58c70975672a10034de0a688571d292e23053e5ebdf702d0ba
MD5 0dea42b4ff372bb165e23a4320de6377
SHA1 325d0c2f84e6d469b57eddff3450931edf749136
SHA512 08ee2a29b6dd589457ac97b2b3c104929df3eb6f8af973b8d501ce110438ac2305e66e4aaaa56f046b4e2eb3a141a07e1b4707c58810a96c0e8e79cac0df59a6
SSDEEP 192:HcypKRycXz5RqvAcdRPSHXFCPD1Oo1xmj+SCOtOb9wQ+SfjC1iKq:HXkRyiO024YS+SCkc9P+SmK
TLSH
T141225DFE8E412CEC1F67905CD4A9431ACE18A1BF9ED3D07A10183C58C584B65B6E94AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d6a43f53e478008cccc316986195ce8ab558dfc61be7f8158a5306abcb429487
MD5 ada6dfd29b2a70aa44eb4d84756ce4e4
SHA1 fb20568aa76dfb5ab84eccbee4d85ee72c06e062
SHA512 1ec909b0c03bc6ab45930a4747df6af1f7742d47a314ac61471f619d83f459078622225a6017eaeeff7d67873c70790610ba1c3104e676b43b1c4af5e47aab19
SSDEEP 192:zOv5zboGZQgyjjf/1d66Joz0dzgCl6mc0dz:cboGZQgyjBd66JozQzgC1jd
TLSH
T1C9D1CD18E639863BC458023BCCA60F410F36395A988E3F2535DC755D2D972DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\events\events
Size 1KB
SHA256 a2e23db086848087d2fd586753323f0cc66b946e5c11d2968b223a3750d715eb
MD5 9ea0ef4aa1a543b0a8f64b4f75b26f74
SHA1 8402fefbe45497df3b32e4587bc04e28dd615c9d
SHA512 47e944e6fdc38243744760fc2fab8e79f9f71dd132fab356d2ae75175f6f76f0172aa56711105b98028b63faf1ae8b3fe940b11357052f5c377ea93478659c46
TLSH
T13D216DDC3AF94D7AA8C7E69CB45002CE53A14E0B048B1C675E42EF8DCED1AD9316A43C
MD5 SHA1 SHA512 TLSH

Submit Download

39fc1f6d-1e4b-4819-a782-0b0cb525feed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\39fc1f6d-1e4b-4819-a782-0b0cb525feed
Size 235B
SHA256 94efdf8dabbcf737c0ce54428e9f1186805ede160571189bcbbed7cd57e81a99
MD5 173f6e32fdd4653d76cbea29c6663e99
SHA1 94be2617c0c7ea9067fbdd11314df4b705cc8cdb
SHA512 a96dbd6c287eedf4b13ee66a3df353e22a68b44243de5229ff808ee7679bf3eadc6a200afa3659a45c0c18c4cfc0ac545712b8c602bf25fa8c04495ed960b67e
TLSH
T1E2D0A785149C676D08151F5FF0A5ADD670444C3314B8A86099A24575A9FEEC54291D1A
MD5 SHA1 SHA512 TLSH

Submit Download

5aa32ba5-01e2-4de5-bf58-bd585e0e85f2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\5aa32ba5-01e2-4de5-bf58-bd585e0e85f2
Size 886B
SHA256 841fbbf01d4f05ee841c292d58aaaadd3c35a598be79345e6d5fd02cc860f8c7
MD5 893154310b2e1adf361ff340df14e92e
SHA1 4dcb5085a600dda54980b84593729d84f4066876
SHA512 fa1469ea5e663f392aa93b9459c08d28474e09449322334122d6dfaab78178bb31047828f4ae8f614050063c035c152ff3b278ba897f4592b236c49329dcec54
TLSH
T12F1123408A75F5B2CC78D29BC9967B878BE0B133C0C61C147E915F184DEA56EB36BA07
MD5 SHA1 SHA512 TLSH

Submit Download

b2422751-3850-4d72-ad64-b2384521a3d0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\b2422751-3850-4d72-ad64-b2384521a3d0
Size 2KB
SHA256 c801ec20b8c53c9b9f40f0ce21d2f6855c54450dd40852d49010f0971c574dfc
MD5 1f712fac0ddee43acc78758117b2428c
SHA1 d51830899802b46ed69a4c78d066266b1d84a59d
SHA512 37c625d15c81ea384e35b55c82fa80af529cd7167463cfa0cb3ffe973ad03bd7e1c61bb113d1d662f941b28b49304761cbb1beadba2818aca6865976cba4f11d
TLSH
T1C341455836785CB78DFAF19CD482238F57544A1310C21C933E52DF4C8C8669A336B43B
MD5 SHA1 SHA512 TLSH

Submit Download

da2a389f-9221-40d4-895e-3506671dc31d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\da2a389f-9221-40d4-895e-3506671dc31d
Size 235B
SHA256 a8b5128c4c7d5d74a50a091e75d3b4ace6f4178fa18a623a6367444e690dc863
MD5 9b62505cd55d184919ce6ef8bf1b5303
SHA1 a93f1433d645c66ff348030d0b72184c07d7dba1
SHA512 b2cdcb23ac1f38dc0bc84d495bac564fa6aa87a36ec39f4f967b8dad1cec350c2803b10c03588969e913de9426af420ac3c42c01dd36d6abc772335a80bd1904
TLSH
T139D097846498636D08182F03B0A068C671598C3314B09810DAE04B34CEB9DCC0212817
MD5 SHA1 SHA512 TLSH

Submit Download

ee29bf90-609b-44db-bbfa-6b91019efcd8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\ee29bf90-609b-44db-bbfa-6b91019efcd8
Size 883B
SHA256 92df853b888f415b75551bc968eb15ccae53f2290f4d29ba4dc22d776ca1cae0
MD5 d8c583c4fce9ee48f445dc15ee96f558
SHA1 aa8bcd50b2681febd99361167f685c6d92389bd3
SHA512 3d1177c4c26421a3bd008d32e3da3a5ba395b6c6dd9afdc8040a3d4e4da8f0b91859894c854c421effc0a96fd06f72240306273259b23db76618f1d851d5fd16
TLSH
T156110041E935B5B28CB8915E8A563B838BE4352380C618103DA15A144EAEA2AA32770B
MD5 SHA1 SHA512 TLSH

Submit Download

ffe4a743-d5c0-47bc-999f-5b0a2fdb0540

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\ffe4a743-d5c0-47bc-999f-5b0a2fdb0540
Size 16KB
SHA256 4acec31a88c58670a9e8d26bd35a0374e9c48a69bda40fd255d2fa51818bf001
MD5 2773d948ca80e0ad0e3152c017d9d9ef
SHA1 1065a1c9297821ac76d50d9423ea4a0ba75232d9
SHA512 939eb576ae86a4c6fa45363bff8c82f2be810eb8c01ff81c3f701e8f5137aa81e7dd6aafe1e62554ac354be917aeefa8a62dd595af72129f4ad083e4e5fb12af
SSDEEP 192:5LN7Nv6qmn2ydm1ZSzzx0n9AOj4zFn4QtDtVVvZfZwtBwmah/C4vBMBMT1JNNPdZ:5L5NvHmvdm1ZSzl09AI4viIi69
TLSH
T13D72CA16683055BA8251E36895FCBFC3E6F528CF4C019FCE9BE4BD0869DA05D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\extensions.json
Size 16KB
SHA256 3e7ce244f3a9c2cf9c1ae9bf0c196e434ab374c8ca62b3ca3c787c2b6781e798
MD5 ed4e162522f82bdba424b99814faf886
SHA1 d5418518aab547c76376b00279932e5e13d87651
SHA512 bc888ba73ccc1b919fdf6a142c60ce73ff2c118a1218daf451977db2aedd351f46f96445e765f7fe9bd1ffd8233169047e777d53f6b31e8e7117966aaf110c01
SSDEEP 384:mkI4voUmldvw8dhWh94zw96o6L4HhL4PCL4HUL4H2L4HPY4hX:pI4QRfJXg4Y6T4Z4I4u4c4Q4B
TLSH
T19D72431545049EB8294FA79BAA367E02C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs-1.js
Size 7KB
SHA256 2adc317e558d747a441e3b90b55779d43b8949957f18b831c3b946bac0cbfda1
MD5 d3bfd11fcacf9404323091ab355f42e9
SHA1 017a11827abd5b5d866edc43788ff00fd76820c4
SHA512 ef2fce2e784cd2dc689cffc9d83e873f79fc82ebcda613d6a46fa60322a18e6d9419fcd89ce5ac531f1b4f5534d6efe87cd3217f4a14f0913693e2a38ad6f910
SSDEEP 96:xH8VTUgqGqLfvoiVlObzSESSlPdv9j/nOHtqmeBw88T8L4cnUmq4:y6RLfvoiVlCSSStqTBw88K
TLSH
T1D9F10E789044CB7F64B2776CAC288C315AB2423BB6BF68D611B99485450CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs.js
Size 7KB
SHA256 ae614502bb293264d304e054ebd6b2243ee206613d980546b1da44f1a07adacc
MD5 92f9ed1d72d6aa0e7949c20163752593
SHA1 c7f2b57c925d3e8e3c254a7b1d452c69c60778cb
SHA512 f25fb99c588f9dc5b579fa7be8cc0a00f4e6ca836972d3b6d33652dfce38259ddd5ce5223058d5ee58b524165831010d40020663473ec7d43756ddeec4b45c08
SSDEEP 96:xH8VTUgqGqLfQVlObzSESSlPdv9j/nOHtqmoBw88H8L4cnU9q4:y6RLfQVlCSSStqFBw88b
TLSH
T1C2E11F789048CB7F64B277ACAC688C315A72413BB7BF68D750B94485451CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs.js
Size 6KB
SHA256 6e51bf45a19f9521a244a2c51a1a58ef3bde0a805f01037fbef29d8cb392cbd8
MD5 fbaf80c4b38119cb952ba31e7e62e85a
SHA1 a6f2f93e1b00bfb1a4facc619b31811e7af8b8f5
SHA512 eac234ae31192dc76764def944837b53e0c24f54692b28ecfe7892aa9267c94dbef6a1ce7c41b57416db4161b46503eeb07d5048ffd87455de58ec50da6ba090
SSDEEP 96:xH8UTUgqGqLfQuO1zSsSSlPdv9j/nOHtqmoBw88H8L4cnU9q4:y7RLfQuOFSSStqFBw88b
TLSH
T156E12F3890088F7F64B677ACAC688C315AB2413B77BF68D750B95489055CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs.js
Size 6KB
SHA256 c1fa2be2a61261bee08172bea08981afe96f0b19ece2e6c6a3606998ed8deb7c
MD5 1bfb875b4184c3f70dd3771f4c43578a
SHA1 9afb92200b13b55e7a0b7962d8e2cab48cc48a49
SHA512 f85cb1792137f6bd1d0617ba4a805a62bf75ad1a38e1d7fd2d0e50ba24d42a67257c86a83b0ef4af3dd51a7bc88a013951a452c58837e8f2db3a962b7fe2cafc
SSDEEP 96:xH8UTUgqGqLfQVl1zSlSSlPdv9j/nOHtqmoBw88H8L4cnU9q4:y7RLfQVlwSSStqFBw88b
TLSH
T102E1303890088B7F64B677ACAC688C315AB2013B77BF68D750B95485050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs.js
Size 6KB
SHA256 3dbaf4e605bcffccffe19aa62eeb9c257ed8005972950457ad206b0535484463
MD5 f4bc94ad943956e1d3ef8e696368efd1
SHA1 f978ae9ce6564f815266f6802b699e9dac35f3bd
SHA512 a30ae7953fffd2bdedb20fbb02e2ad539ddc9dabb275e4916821d3a0f4417bc055a9cfd5e136d0185781ac12e4447a34568fe7a7fd75c533239c17c39c9a5317
SSDEEP 96:xH8UTUgqGqLfQVl1zSESSlPdv9j/nOHtqmoBw88H8L4cnU9q4:y7RLfQVlpSSStqFBw88b
TLSH
T1ABE130789008CB7F64B677ACAC688C315AB2013B77BF68D750B95489051CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 96d32e0f38a93029e04a02c2a1a222a95de11459bd825fec07dc6ebf6cdc6fcc
MD5 03a54a327b812f391faded40edfdac2e
SHA1 3e16c17bef5e3f91589955b626825d3ba46d40c8
SHA512 b44bcd2f44453cc4aa64bbce1ae2071a1438709dcd6c3e0d613ac297b55cd8c525ec3f52a24f8178c5f2657aca84a63e2096a7a511e2065ae8a8d3dbf33cb3fc
TLSH
T14B31D7C7ED622EB4F552924A948E1BE7C2B5303309BCBCB4915B590875EF482A3C715D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads