hxxp://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad[.]onion/

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion/
Sample260808-z84dfsvdrd

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	firefox.exe
Token: SeDebugPrivilege	4944	firefox.exe
Token: SeDebugPrivilege	4944	firefox.exe
Token: SeDebugPrivilege	4944	firefox.exe
Token: SeDebugPrivilege	4944	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4944	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 4944	5684	firefox.exe	89
PID 5684 wrote to memory of 4944	5684	firefox.exe	89
PID 4944 wrote to memory of 6024	4944	firefox.exe	90
PID 4944 wrote to memory of 6024	4944	firefox.exe	90
PID 4944 wrote to memory of 6024	4944	firefox.exe	90
PID 4944 wrote to memory of 2564	4944	firefox.exe	91
PID 4944 wrote to memory of 2564	4944	firefox.exe	91
PID 4944 wrote to memory of 2564	4944	firefox.exe	91
PID 4944 wrote to memory of 2564	4944	firefox.exe	91
PID 4944 wrote to memory of 3004	4944	firefox.exe	92
PID 4944 wrote to memory of 3004	4944	firefox.exe	92
PID 4944 wrote to memory of 3004	4944	firefox.exe	92
PID 4944 wrote to memory of 3004	4944	firefox.exe	92
PID 4944 wrote to memory of 5820	4944	firefox.exe	93
PID 4944 wrote to memory of 5820	4944	firefox.exe	93
PID 4944 wrote to memory of 5820	4944	firefox.exe	93
PID 4944 wrote to memory of 5756	4944	firefox.exe	94
PID 4944 wrote to memory of 5756	4944	firefox.exe	94
PID 4944 wrote to memory of 5756	4944	firefox.exe	94
PID 4944 wrote to memory of 5756	4944	firefox.exe	94
PID 4944 wrote to memory of 1652	4944	firefox.exe	95
PID 4944 wrote to memory of 1652	4944	firefox.exe	95
PID 4944 wrote to memory of 1652	4944	firefox.exe	95
PID 4944 wrote to memory of 1652	4944	firefox.exe	95
PID 4944 wrote to memory of 3328	4944	firefox.exe	96
PID 4944 wrote to memory of 3328	4944	firefox.exe	96
PID 4944 wrote to memory of 3328	4944	firefox.exe	96
PID 4944 wrote to memory of 3328	4944	firefox.exe	96
PID 4944 wrote to memory of 4120	4944	firefox.exe	97
PID 4944 wrote to memory of 4120	4944	firefox.exe	97
PID 4944 wrote to memory of 4120	4944	firefox.exe	97
PID 4944 wrote to memory of 4120	4944	firefox.exe	97
PID 4944 wrote to memory of 4348	4944	firefox.exe	98
PID 4944 wrote to memory of 4348	4944	firefox.exe	98
PID 4944 wrote to memory of 4348	4944	firefox.exe	98
PID 4944 wrote to memory of 4348	4944	firefox.exe	98
PID 4944 wrote to memory of 1196	4944	firefox.exe	99
PID 4944 wrote to memory of 1196	4944	firefox.exe	99
PID 4944 wrote to memory of 1196	4944	firefox.exe	99
PID 4944 wrote to memory of 1196	4944	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion/"
1⤵
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion/
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1920 -prefsLen 27097 -prefMapHandle 1924 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {5d0108cb-97ea-458a-99bc-9827e9d8fd59} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {de5c805c-0324-4073-a455-d686883e7f3a} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 25164 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {a94ce44b-7adc-4261-9429-aad412a4e632} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4024 -prefsLen 27274 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {95cc5967-bcbc-4170-9d8e-991106bbd723} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4404 -prefsLen 34822 -prefMapHandle 4408 -prefMapSize 270279 -jsInitHandle 4412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4420 -initialChannelId {4ed0b4c4-9d48-412d-84dd-13b73555ceb2} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4936 -prefsLen 34903 -prefMapHandle 4940 -prefMapSize 270279 -ipcHandle 4948 -initialChannelId {679cc72d-8e8c-4c38-9b63-6dc0e06eff20} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2688 -prefsLen 32952 -prefMapHandle 1612 -prefMapSize 270279 -jsInitHandle 1632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1640 -initialChannelId {2c3dc562-899a-423b-b13e-ee04206cde18} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5508 -prefsLen 32952 -prefMapHandle 5512 -prefMapSize 270279 -jsInitHandle 5516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5524 -initialChannelId {3e310de1-87d6-4619-bba5-34f348e792f5} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5684 -prefsLen 32952 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 5692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {0efabd41-83c3-4402-a0fa-a99af3fe2901} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5772 -prefsLen 32952 -prefMapHandle 5932 -prefMapSize 270279 -jsInitHandle 5928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6028 -initialChannelId {f5e4da6a-6b0e-4819-8aa1-7db188c4a5d9} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 10KB
SHA256 62d9ca135c09c122e055051016191e49b13f2085de44aaac5600d247e4bdd264
MD5 2f2880dc9f5d023a5244ad454f0ca483
SHA1 dd1d147eba11cfa3fbad778d61781caae4e8b5bc
SHA512 f77dd2db18d675365c5699e9d096444cd412f9d8c832187c52958ce02408e05e45ea6b3d4b94724a1d4a2db4660609a2c267d65484180834931304cbf75ef63a
SSDEEP 192:HcZpUe4wcXz5RqvAcdRPSHXFCPD1Oo1O+W5ZYRe/cY4yj5tWixxHC1g1+5PBS:HwCe7iO024YO/DYRIt4UIizi2upS
TLSH
T15F225CFE5F912CFD1B63D094D9A882498D59E5FB9EF3903B51283C08C580BA961FE46C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 10KB
SHA256 7e1fcd13cb2f8c7cac2ff43d0aefcef0a643f4dea7d3e4b43422dc87eb9ff4fe
MD5 15e048a762ac09482d38d9ef0155e81a
SHA1 a6d4829720a6345114e97fa2c0f22cfa3268df15
SHA512 4ea43eac059cad0386e94b0adf4f9564b22282e8f9c64de873807c0630c6658aa151d0998fecd4fec818db9184ed0a9be47de18ab863f67bbf5b9527561a390f
SSDEEP 192:HcypKRycXz5RqvAcdRPSHXFCPD1Oo11W5ZYRe/cY4yj5tWixxHC1iKv:HXkRyiO024YgDYRIt4UIiziP
TLSH
T187225CFD5E502CFD2B2390A8D9A98219CE08E6BFCDE7903B51183C54C590B5971FE4AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8a2c156342bb5bf12f14934bb6b5bf720316cd1e4ca22664a1d49e561faa6104
MD5 634ab3be6c77795c6044715ddd023eae
SHA1 077dddd6badceb6ed10f852879e1be7e05d22152
SHA512 d67d42496a3d9a96b3e414c4a28026ab656e6ce95d7b79176a57eba782ce0fc879ab5406ed42ffb1516e739e34cbc7d0d793cf719b78d2bd532a0590d885d556
SSDEEP 192:LP1d66JoztdzgCl6mc0dkOv5zbo7eZAmyjvX:Rd66Joz/zgC1j1boSZAmyj
TLSH
T173E120A4E628867FC409027BCCA61F444F39385A984E3F19759C740C2C9B2DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 aaf44eea35313989fbe2e8cc152f27990939ef4e2b715eb4c08f6a9f543b58bc
MD5 e10d0802bd7f387d0bd13290ffb8af3a
SHA1 7018654d3fff6668783866b3e2f34676463f3ec6
SHA512 f02b5fd48cf08a347a86be7cabf80c38da14b71b2ac7d315767582eb5b4759110d87180ada37c68cd707677e0082185a362490cd27c4bf3a6440f09b3fc83a29
SSDEEP 96:rFRN2FhCFh2Fhthw/dd66JoztdzgClKtmc0d/UsfuESdF95/7bkW6ArvEAjayUR5:LP1d66JoztdzgCl6mc0d7Ov5zbo8MAmf
TLSH
T1FCC1FE64F629863FC409423BCCA61F400F35385AA85E7F19319C780C2C9B2DE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7d6ad6aee48dab612a7a906c902ae5fff4fbefaf50a56953433a483a71ee8cc0
MD5 6647ce002e9ccd2f5eb7aa3f666b47b8
SHA1 7a633ddb4df7c2b1d011590ffefe434baa307e61
SHA512 d17653ac41d7b423700b568d662de31b8b0494084969b54cd1f6a5404df06331ae65975c7a50ea08ff7eed86878d294e9f959076102b26b5ef03320359c6c2d9
SSDEEP 192:jOv5zbo7eZAmyjZyP1d66JoztdzgCl6mc0dz:sboSZAmyjWd66Joz/zgC1jd
TLSH
T1C7D1FE68F629867FD419023BCCA61B400F35385A984F2F19719C740C2C9B2DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d725772d6ea36458b2dfecb9e98770db1482afd830ec15d96a794244453e8e61
MD5 7da3733d16bb6a6ff64bae0e89d9c1b5
SHA1 185a53ada25527e3cc60561b85023434f9a979fe
SHA512 ba3a4efd5fe2ddf827ffbfbac63e046abba9e28fa861cfc5aa2c60f3ee5a0dc9aa59c54069dceaf30f32f529516b3b54fe6f2b92ac06d5d40f4ae9c72b1af71b
TLSH
T1B1216D9C79FA4D3A9CC7E659B44007CE53618A4B44871C5B8E02EF8ECEC15D9326E438
MD5 SHA1 SHA512 TLSH

Submit Download

22df720a-9d55-4203-ac75-e01750b5567e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\22df720a-9d55-4203-ac75-e01750b5567e
Size 16KB
SHA256 acbd262a031aa1e877c3402f86d7552ba21d486f4ba4c6d0d320e701b94d3add
MD5 a3627400b3384e25edc5390fcc8e4ada
SHA1 c77c0c08161caef5436d0d76274f68e54c22fc77
SHA512 4a158d91b623d4026894c19d75d117a197b5d0e1c4ac8c1c9536c46728b6a140575211b847bfb3bda2a737dc424dfb448de4b4ec9aaf68ce5ae4d72fbadc4029
SSDEEP 192:771S81iBeVvMzR8rFjsiOGRyNeLJfKXWdMBlR0V4fpDJCqc9xkSISi5czSbibSg6:/uw+z8xRaJfR0gpvceSISi5cmbsSgvy
TLSH
T1A572C856286096BA8151E3A894BC7FC3E6F638CF4C019FCE97E4BD085DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2963f0b4-fe5c-4091-a590-7927dc3b559a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\2963f0b4-fe5c-4091-a590-7927dc3b559a
Size 235B
SHA256 68528fad78eb44446d8bccbaf592823fe38e39758c8fd9abca2d0035b8526590
MD5 026cbd963d47af01d9438bdc5f1c36a0
SHA1 e37719958130e54673240278cc9a5f9d7536757f
SHA512 17ecf8b2637a14a3c9a0ffbd894b729c7adc53a53dcaf6caa4d7f892a67e26f23d14e01d692f3a6f1c641a924effa6956383b10c322c107451ca1ec8111fbed4
TLSH
T139D0978434A8F33E08200F0AB8A0A9C730848C3750719850E9A189B4AABAEC8C122C4A
MD5 SHA1 SHA512 TLSH

Submit Download

a3dbce59-7bf7-48c7-a52d-48524d8eb5e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\a3dbce59-7bf7-48c7-a52d-48524d8eb5e2
Size 235B
SHA256 0f7489e080c2a60830bfe45dd9c3af67de4da7731763b6a62d0eff87677b05c0
MD5 94f51b3c3d0f1be508ea0043f184f57b
SHA1 01a9d4ff7088efbdbe58f17be34ca57b0f026bde
SHA512 d47308a15619588b0ebac07d8d3ccc79525f953c20c0282fd09b9bec5f08f5b7b35db65d78286f951c19f0b123bdc87b80f2cd93589f254fe1e4a66149e822e2
TLSH
T161D097815888ABAC4C040F06F0E02EC332544C3354B8E820E9B04C3899FCDC8422291B
MD5 SHA1 SHA512 TLSH

Submit Download

aee88f4c-84d9-49f5-b0a9-0f90a1622796

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\aee88f4c-84d9-49f5-b0a9-0f90a1622796
Size 2KB
SHA256 4b01200387baad4c0c234e8d3d20f1a78166e87d9e98a54ba32b20ee13f08371
MD5 3ce38fe2a6f835a9a2fabc442d1e714b
SHA1 3cc44f8f2fc1fcca8b216840de7b20e83484543d
SHA512 c1d14a4d07ae3f351d3130cb467e26d0b50dac290eeb97c668e43954bccfbc4dd9b6d8b6093d77ddeeb0012ddbf9312b5b0dd8db16debed718230cdeb54ff3bf
TLSH
T15D41335C35B84CB69CDAF58DD492278ED3658A0310C22C832E51EF0CCE976DE336A52B
MD5 SHA1 SHA512 TLSH

Submit Download

b4365f37-48cf-4c59-8b47-42bbfc6ff283

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\b4365f37-48cf-4c59-8b47-42bbfc6ff283
Size 883B
SHA256 ee9e1d2c18cad417626223e434922f43f36fb275b09de174775cacba2fcbede6
MD5 ad04c374cc268ec68c08f3cf5f681d55
SHA1 348c1d3481f1779785da26bd43cd03edb0510380
SHA512 00507becaac6f77b54e5384e383a5c72e8413feccf1b3ab3602e640cea6ed26aa41f273dd5c390ec12e9ae697db17f58a994aed5c7c99134539bfedadd2c506b
TLSH
T1D91144809634B5F1CC38C24FC99537158BE47023C0C655182DA05E040E6E52BA36E60B
MD5 SHA1 SHA512 TLSH

Submit Download

e8f2846e-735b-43ea-8c4d-475126d6c41a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\e8f2846e-735b-43ea-8c4d-475126d6c41a
Size 886B
SHA256 05aedfb93d0ffc8b70f34e7ac512032bc271750afb8c4fff1fc90a0f4809086c
MD5 30a9864ca22b8803c4b364a376cd4bb0
SHA1 d9d678e49217bab49da5d78b6a46b61ee2fe6d09
SHA512 45d8c3905ca7968fbc7f9afeb29216b8b024d032c3737aef46b353dc83e33fda8463da38887202aa0b2f468c98e1cb4b3c72cf5824c06ea8bbeb8b46e3c835fc
TLSH
T13B1144509574B5F1CC39D24F88A5771587A4702380C659087D559F080DBF01E536AB0B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\extensions.json
Size 16KB
SHA256 a5aeaa58a7f284b7f2c0a60068ba2fb1b420ce99c9120af08b5e96037099a7ac
MD5 5e2342618ccb1ee11fdc91682db1220a
SHA1 78c95de6452fdb69076107ed67af1802ae2a59ab
SHA512 f9bb3514e7ce31e6df6b4cee09bbbbccced9ffba4435e21aef1d1d2b9e58d744a00a3355a51c55754c9c0b38b47c1ca9ca7cfd2fdbf98aa6728b0f2bdca0226f
SSDEEP 384:CkI4vnUmldvO8dhWd94zt96o8L4HTL4PfL4HKL4HZL4HDx4hE:1I4vRfjXM4H6F4/4r4Y4x4t4C
TLSH
T1A072521545049EB8294FA79AAA367D02C37D433B60845C38F4DD8FC842FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 6KB
SHA256 4ebac4e41db4454f88a420d6eab48b42b40e559e3cd4a658bc86d76a35d90610
MD5 649dba2be19b17fe105dd706ddbce318
SHA1 4f0ead0d623b06b96cdf2946b4f6629910cf2a3f
SHA512 5a1a64bb74b767321b4138bb266c6a3bc170650305587dff8cac1fcf8ee30843ea0ff3face4a71472d1228db82685c323e17bd6caebbb7dbdcc8ff0453fd3f02
SSDEEP 96:xHSUTUNqGq1DfGLz1zSFgOSSlvdv9j9mnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfGLzWgOSSrn9IjzBw88jM
TLSH
T1B8E12F7890088FBF74B6776CAC6888316AB2013BBBBF68D650B554C4054CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 7KB
SHA256 f39de0f0df266b175137ab88ade29d09f450e6c49d47e393cf6ac74ce670aefb
MD5 1dfd7725f1b75795c0f13a58cfb697ef
SHA1 9e4bf8fb8743785e0a91bd04ebb7c52ac0a1c682
SHA512 744adf5fc53e69aec15bf1997d63862a36e89220a44f0bab6f60d9ef93a96f0254be31a518d66bb491383f7ac460faa4483eaa63be369b39537fbed49f5821a8
SSDEEP 96:xHSVTUNqGq1DfvDiLzObzSFgOSSlvdv9j9mnNeRHIcSqZJghBw882d8L4cn1VGp+:cZR1DfvDiLzjgOSSrn9IjzBw88z1
TLSH
T1D3F12F789044CF7F74B2766CAC6889316A72013BB7BF68DA10B954C9054CF3445FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 6KB
SHA256 88aadcd584c0565d4db4a9f9ea1f5ecf1bad105eb8a0a9fec643e33e9288240a
MD5 cc2980cde5489921f92463438c3399de
SHA1 4c7182127cc8238cc3699812180a1b00d20af991
SHA512 c41e2cabf11a70f2c3360f3ae49a8d0a6d4a898f8520ee778b94ff618b598fec4f452ce9439081007586b5023a00e85156cca46693c0d9e1d1b2b6e99e5e6b4a
SSDEEP 96:xHSUTUNqGq1DfG45G1zSOHSSlvdv9j9mnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG45G7HSSrn9IjzBw88jM
TLSH
T1EFE1217890088F7F74B6776CAC6888316AB2013BBBBF68D650B554C4054CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 6KB
SHA256 ffc74d350fd93af3204090fee6f8afeb7e75d1248386013b300b53948f344f6d
MD5 80e8f768e0d4b390d09b32b4975a864d
SHA1 b216f06cc24c0f8bfcda5133b073e51777f5ecfc
SHA512 b76f3777ea5f28233832eae55df19810a7a78b85cdd7d48d6dce8233d98ed0b24491af9f4d4b40844a19e9d1675fe0fa6ffb956f536932716d8b8877ca897e4c
SSDEEP 96:xHSUTUNqGq1DfGLzObzSFgOSSlvdv9j9mnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfGLzjgOSSrn9IjzBw88jM
TLSH
T119E1207890088F7F74B6776CAC6889316AB2013BBBBF68D610B554C4054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serviceworker-1.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\serviceworker-1.txt
Size 268B
SHA256 ac6bc4c102f932efcf7708ca97df4f2f96800752a6d20c440ccef855fc352933
MD5 1a13249c1e024d94c5c3aee03cb2e53f
SHA1 11786e1dce993268ca71b7ec069b4627fb4d63be
SHA512 ad9587b073251bc4e89dbb02783806dad716ecc7d7236b513090320134fbc86756dc12e9d2ef1a4e5a51c099ba624ea43f7687c2e0108dcdec15ff6936a1aa2f
TLSH
T124D05EDB71F038BBA5288AC9D696338C62F589CD192D207D665C1E9934C39CB1D4028C
MD5 SHA1 SHA512 TLSH

Submit Download

serviceworker.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\serviceworker.txt
Size 253B
SHA256 ccb958e2de11339c541803d5f3d67b41bda0368562ab397330e77e8396eaf618
MD5 1b29bd5e8d094c81a269384764ee62b3
SHA1 7ac6807defbb7956f7e0d404eb7953b9d9cea833
SHA512 73fcbd9b58247f67d127a2fe0f26b6850faaccea8e57548b3479d5790d820c07f51c4b6fc6494bfab00e095173aa7f134ad710473fd5f563157f9dbd4863584a
TLSH
T15ED0A7CA71F03CBBA4284AC9D7D633CC52F585CD192D207D66581ED434C35CB1D4028C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 def6103aba8494f6dff8e268c51085292dbbd1f92ea324a61c8744922e4bce27
MD5 6ebd59ea9b684fbc8dd5043d0e359b6d
SHA1 03e4fee035ffb5a4a8d157ce7e61846edbda0935
SHA512 e5f37b7b94e0ea1b53ccc588c085558e667f2845f09c944f2ddae19c50cd0554edeaac38895a54e8fb3edfc9d2d73f57e63c05f44d034150eb0ad2b999dafe8a
TLSH
T14B413CDF68627E6BAB6583F4D5450FFAC26520764D7C2CE04280685A1A7F09451C550E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 a05c6d1efa203143f1e2fa219e8ade553d9c71651da8fc861cfebfb7b6654d31
MD5 922cde4a098edb53d6794af33d2200bf
SHA1 e297792c9617bfa6264a4e1dd7364deab8f3438e
SHA512 53a489b63829e5a5b3bf238d2ce2ed28a8f2ebdcd2894debf2eddc2ac462726e3e72dc6a73cd3531de2a89d24bf20746968b91f4ce86e5e099ddfe5c464b7fec
TLSH
T1E0310A8BAC732EBDEB02C298988E0FF7C3A9203305BC2C7085465D5A24DB4C122C904A
MD5 SHA1 SHA512 TLSH

Submit Download

{5423983a-b38b-43c0-a80b-cf0b881292c9}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\storage\default\http+++darknet77vonbqeatfsnawm5jtnoci5z22mxay6cizmoucgmz52mwyad.onion\cache\morgue\201\{5423983a-b38b-43c0-a80b-cf0b881292c9}.final
Size 2KB
SHA256 f2fda107e0494c71946ea92f8a6e91cb4b4547d7ebb7a10b15d5a71946e49b46
MD5 04c14c6f6775f8afe5a6da478cde07c3
SHA1 214ccfcb757f054871163471d8df3888cb66e57e
SHA512 643669a5b43b5701dd25571cee2f3c0f5a864b51ad90e78033e0ca02c0b59a27e6b6f810c33cc7ce5ac2698973e7a57432150d155ccc0b880927c2b941dbdfb4
TLSH
T189514C380D91DDBD06B1459CDEE20E936816C360C6C294C1D4754F1C6CD8323FA79E42
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.2MB
SHA256 401a3dec17ada7bfb59d6fdb90fd429419e908a65e450e0257a476e374cecbb8
MD5 6b8f9dda50cba1ec623f2069fcac5ed2
SHA1 0260659e2cd80be6ce97b105328c7fa90ee1a031
SHA512 21062b1784b3f63aa84ea96cc8d609f5ee779432a02b4f944542c19a2f23a2ed00076ee19299c2b19bddf211e7bcb18976271df1007ef312838f1498e5052c86
SSDEEP 49152:kLELynaeUjPCAJ9mLdPzrw6QC5zYYuFLv5FeuDohPJSfjCRfnQk/pxYf1ICJYTUa:EhEjjnSOIImjZoh2ik
TLSH
T1D2767DE860E1D252F38644B3719993EB20EFC00C6036CE44579497FAA9748EB8D977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads