hxxps://go[.]microsoft[.]com/fwlink/?LinkID=2091994&clcid=0x410

Analysis

max time kernel
299s
max time network
230s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://go.microsoft.com/fwlink/?LinkID=2091994&clcid=0x410
Sample260810-j5k5pseh69

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	firefox.exe
Token: SeDebugPrivilege	3556	firefox.exe
Token: SeDebugPrivilege	3556	firefox.exe
Token: SeDebugPrivilege	3556	firefox.exe
Token: SeDebugPrivilege	3556	firefox.exe
Token: SeDebugPrivilege	3556	firefox.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe
3556	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3556	3816	firefox.exe	84
PID 3816 wrote to memory of 3556	3816	firefox.exe	84
PID 3556 wrote to memory of 4004	3556	firefox.exe	85
PID 3556 wrote to memory of 4004	3556	firefox.exe	85
PID 3556 wrote to memory of 4004	3556	firefox.exe	85
PID 3556 wrote to memory of 3312	3556	firefox.exe	86
PID 3556 wrote to memory of 3312	3556	firefox.exe	86
PID 3556 wrote to memory of 3312	3556	firefox.exe	86
PID 3556 wrote to memory of 3312	3556	firefox.exe	86
PID 3556 wrote to memory of 1020	3556	firefox.exe	87
PID 3556 wrote to memory of 1020	3556	firefox.exe	87
PID 3556 wrote to memory of 1020	3556	firefox.exe	87
PID 3556 wrote to memory of 1020	3556	firefox.exe	87
PID 3556 wrote to memory of 4344	3556	firefox.exe	88
PID 3556 wrote to memory of 4344	3556	firefox.exe	88
PID 3556 wrote to memory of 4344	3556	firefox.exe	88
PID 3556 wrote to memory of 2876	3556	firefox.exe	89
PID 3556 wrote to memory of 2876	3556	firefox.exe	89
PID 3556 wrote to memory of 2876	3556	firefox.exe	89
PID 3556 wrote to memory of 2876	3556	firefox.exe	89
PID 3556 wrote to memory of 4860	3556	firefox.exe	91
PID 3556 wrote to memory of 4860	3556	firefox.exe	91
PID 3556 wrote to memory of 4860	3556	firefox.exe	91
PID 3556 wrote to memory of 4860	3556	firefox.exe	91
PID 3556 wrote to memory of 1852	3556	firefox.exe	92
PID 3556 wrote to memory of 1852	3556	firefox.exe	92
PID 3556 wrote to memory of 1852	3556	firefox.exe	92
PID 3556 wrote to memory of 1852	3556	firefox.exe	92
PID 3556 wrote to memory of 1848	3556	firefox.exe	93
PID 3556 wrote to memory of 1848	3556	firefox.exe	93
PID 3556 wrote to memory of 1848	3556	firefox.exe	93
PID 3556 wrote to memory of 1848	3556	firefox.exe	93
PID 3556 wrote to memory of 1608	3556	firefox.exe	94
PID 3556 wrote to memory of 1608	3556	firefox.exe	94
PID 3556 wrote to memory of 1608	3556	firefox.exe	94
PID 3556 wrote to memory of 1608	3556	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://go.microsoft.com/fwlink/?LinkID=2091994&clcid=0x410"
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://go.microsoft.com/fwlink/?LinkID=2091994&clcid=0x410
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2032 -prefsLen 27099 -prefMapHandle 2036 -prefMapSize 270279 -ipcHandle 2116 -initialChannelId {e467f075-5c61-416b-bad0-e5429ad6c89e} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2516 -prefsLen 27135 -prefMapHandle 2520 -prefMapSize 270279 -ipcHandle 2528 -initialChannelId {6df3f6b5-ac53-49e0-8484-663c628cca09} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3708 -prefsLen 25164 -prefMapHandle 3712 -prefMapSize 270279 -jsInitHandle 3716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3724 -initialChannelId {1e0dc87c-317d-4384-b7d5-911709aa67b2} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3872 -prefsLen 27276 -prefMapHandle 3876 -prefMapSize 270279 -ipcHandle 3960 -initialChannelId {ef2e1434-a153-425b-88fb-d5be7e44d1dd} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1636 -prefsLen 34775 -prefMapHandle 1668 -prefMapSize 270279 -jsInitHandle 4340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4348 -initialChannelId {35ddb9be-0683-4441-8137-9d72e9d3ec28} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1464 -prefsLen 35012 -prefMapHandle 1656 -prefMapSize 270279 -ipcHandle 5032 -initialChannelId {52c59b49-bdb7-40c9-9446-143505b4d6df} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4908 -prefsLen 32952 -prefMapHandle 5208 -prefMapSize 270279 -jsInitHandle 5216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5260 -initialChannelId {500c1918-c53c-473b-a455-06c9e0cb3825} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32952 -prefMapHandle 5168 -prefMapSize 270279 -jsInitHandle 5160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5268 -initialChannelId {3baeec18-faef-45f4-845c-b85d65af5838} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4860 -prefsLen 32952 -prefMapHandle 5280 -prefMapSize 270279 -jsInitHandle 5284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5292 -initialChannelId {ae76d907-1a85-4df1-8984-a69f2c1f747f} -parentPid 3556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 98a46e5d49e6f7d5ca94d1f97c916e78c60a857386ece0375622989e48965196
MD5 c3becaec68e10fca2a2debbef13d171b
SHA1 65b0193b682347f5a825cc2fa0b370894c29fc6f
SHA512 4a706677d83a0802b43ed9ff907770828fd51bdaf7e527e515ee0d6c06d8c4ddd5090fd37c7f746683fc70ea49c9f857365d0bb44d0f1bb014633723e3f9bacb
SSDEEP 384:HwCe7iO024YADL84KKDL849B7SOEAd9KVRaAcP+AWRMAQGr:QqZYADL8lKDL8CB7S/AmVAf+hRMdGr
TLSH
T1CC729E7D9F013CAC1997C0E8C5F892D98C18B6A7DFE6806D21683D0DC7989A9B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 8d0922394118da48eb0c95aae0d4716f2ff00796fd6c5a44b8721dd73a26139c
MD5 cc5231f9b61b0f5e83ef9cfa0e2e6ecb
SHA1 b4a426e5821ee02fa66ce4d60100fce2385e4e7a
SHA512 09cc36f519d4627bc36769bda64180c9d60b505a0fac17992d7c30e75ae63053e0d5458615e2eb080fa2ed9e72cdbb05ccc47f76338058ed988313f69e54302f
SSDEEP 384:HXkRyiO024YqDL84KKDL849B7SOEAd9KVRaAcP+AWRMAK:3mZYqDL8lKDL8CB7S/AmVAf+hRMv
TLSH
T173727E3D4F003CAC25A7C0E8C5B992AA4D18B7A7DFE6C06D21583D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01JFSLC2K114C6MHFEXH.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\01JFSLC2K114C6MHFEXH.temp
Size 7KB
SHA256 9bd2e06176e8da19e9f2ffe4d1c52a5e95bbdda7980c6fde5eca65b316e9d9bf
MD5 d02fb4e170147c03a9bb1620f7a463d2
SHA1 24e54f85054f33e6e56f2b43343ce5e2152c0ffd
SHA512 daa8db5f0efa7be9980b6ef3747e9cbc406dab7917c2deaf37fa31bc23010a85c1f839a50bc16287483e0aa598b63fe75c5ebe72c1d45fc3bb940b2c90e99cd5
SSDEEP 48:jHduJ5UgdwNzzuAduJ/6BdwrzumduJ/adw5zB85duJSkTwdwQSzW:aMi/PU/VFSxgW
TLSH
T11BF1BD011FFB0DA6F1F3863176317B02AB73FE01571B560ED28256880A76764C5ADBA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2a8a469477c552bb173cb29931160f83ce0eadef56cc062856c1667810f1e164
MD5 d75d54ab2c70c354e4857555c923df18
SHA1 e1569019398139cec7b47a34d87e836a4e1b4277
SHA512 d65b8c0e406dec2237c8d3c4ba2946a0ae7c60c3b1b2d5d5173ccaa0dba2fa027e139dee1a9e5d0e9ecdbc71593864be5af27b8aeb50fa1a4490568f49099658
SSDEEP 192:C1d66JozGzgCl6mc0dxOv5zboHbCWyj18w:Md66JozGzgC1jsboHbCWyjJ
TLSH
T14DD12064EA28863FC405023BCCA52F514F36399BA84E3F1935DD65082C5B2DE778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 b0b06c730207f47bb81ea05cf6cc8783ac2850b0eee904987f8f865d4c808382
MD5 4611ac410911ffcdcd708939c91ed627
SHA1 1e0813ec20ed433a5e2c25f7a23a14aa3531c7a9
SHA512 557585a07302007d3df1973549ccd773b5db7861c11204e0a311bd8593c9f65dac9c3fd662283b48ab2101e7060ffb923ea372eb00bf78986368ad67d962dbcd
TLSH
T15961B858F628863FE445413ACC965B412F347442A8AE7F2A35AC604D1E5B3CEB7CD03D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f2abbfa452921b72531e6d1acca932ed14e8e010d53dbad01996edf92eff308c
MD5 550aae0ef0519afd069101190e818043
SHA1 26387d27b48c2b798d85ecfe85eb9d29ae8c8658
SHA512 bad2b7bd873d2923286efece572c02992ce4a2677992240ede9fbc094c43b146558c50762df0fed087c944f0bedbeb84319ac39d477dded9ee03dd63278322af
SSDEEP 192:T1d66JozGzgCl6mc0d0Ov5zboPyZCWyj18w:xd66JozGzgC1jdboKZCWyjJ
TLSH
T190E11F68EA28867FC405027BCCA52B510F3A388A984E3F1935DD651C2C572DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 520181ac4090a6102e07d8ca7dc1a9598c5dacd2ecb75ad2138fb47268f6e4e9
MD5 2046e7ff5e0609e328861323102a2692
SHA1 6d8efce0dc14cd98e5b6bbf0348a5108558abac3
SHA512 d6cce2467a688dbf5d6f4d998f995a4ed7519814e647dbd5cc69691e07e359659884ac79b39cb7191199a2ae4ac3872991be1dd9ac5848db37c0885c2b05f4d4
TLSH
T100210A5C3DF84D6A698AE29C7851028EA3514B0A08871D434E56EF8DCFC5AD9326A53D
MD5 SHA1 SHA512 TLSH

Submit Download

199878ee-45b1-48d0-974a-b0d1233fb516

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\199878ee-45b1-48d0-974a-b0d1233fb516
Size 2KB
SHA256 b14546d4ddf252b032735ed536ebca2ab0443b3b787ec6d343438596b55dd20a
MD5 3bde809f2e7aafc63f8b76250393cc0a
SHA1 fdc51ffb2e8795af3b84e27a2c91c9b1b8af0d82
SHA512 1d96315ceef659d83bf3185243354a50e8f0b38f8d5258d80fc546a191b1daddd3ba30781289fdc0a2b1566dc41f03461b3350d259a634e24cc08c0dc3e4aa21
TLSH
T14241F15C35788D76CD9BF18DDD41379E57748A0300C628872E57DE0CCC9669D336A42B
MD5 SHA1 SHA512 TLSH

Submit Download

26f436b0-2abd-4d97-9bcf-dacb7bd2b13f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\26f436b0-2abd-4d97-9bcf-dacb7bd2b13f
Size 235B
SHA256 41ea01afd34e20adc30f6e70dfa588148a25d5955131832a5f220cca7ffe948c
MD5 7ca5d3ee87b80ac9ab09ce3274e0044f
SHA1 2b14ae71f6a4f0f9eda6dd95f680715909eb2565
SHA512 d5a129ef61983f4f562b400a3f70908cd14a01f634200aa4a5d4813b68f4e99d974d1d59b5545fad8b5a97548df394db1dc20f37ac6d7bca10505bb6680616bb
TLSH
T1D0D097C028F823AE98140F23F0E0A9C670884C3318F09C10DA9100B4CEBC9C4013190A
MD5 SHA1 SHA512 TLSH

Submit Download

6b8f3e99-74df-47d8-bf82-b49f63574321

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\6b8f3e99-74df-47d8-bf82-b49f63574321
Size 886B
SHA256 b684683b390c8aa2b9e61bcb6c1420ee2e1c48561338199cd9b93f9041734ae1
MD5 de726783e14e639c8e377622aa833baa
SHA1 62992cd3a46ef7823e40a0507804a3b4594c1e14
SHA512 4c5e810762b8a95069265afdfc41f52759f2585a3f7ecb305d4817c65c491ff7ab2a469936da00f14b1e1772bc10e13f57d8cebca24c11618f7063b6dddecdc6
TLSH
T1E51100808A24B5F2CD69924BD9A077538FF4752390CA59183E915B184CBE61ED767307
MD5 SHA1 SHA512 TLSH

Submit Download

9bb8dfd3-5ebe-4609-a46c-3fbe2e186d39

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\9bb8dfd3-5ebe-4609-a46c-3fbe2e186d39
Size 15KB
SHA256 9fcab0eb273eeefd39fd7c2e04775ef1ea166d65a3d09af1594292351a1619e2
MD5 9a997c115b485f7ed499d9393bfced5d
SHA1 7e069ceeb9727cd5c393a67c2f20ccf6b0562a6c
SHA512 f42a4ec5efcdb0cf9963ea3f72138fc9b3d01ebd83b39e94d309776637911c2fdc809eff4ad23634997ed5d9d31d1414fbbbe2e6f080495016904331a5185a1b
SSDEEP 192:n5gJfEXrbkUlsZNRr+5pP/RbcY1ohx54BiPO1m892kYelCJuzFcrb79bRhyRXui:KJ19nnx94f1m8cz0Ckhcrb79bRhyRx
TLSH
T11C72C75A5820557A8251E36998FCBFC3E6F638CF4C018FCA9BE47D086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b01f4950-ca97-42ae-aafd-c9e4a8795a1d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\b01f4950-ca97-42ae-aafd-c9e4a8795a1d
Size 235B
SHA256 e9759b108b244f716bbb981022842ff688f91dd49ab731d9e4f44969b61d418b
MD5 f42d2725b7d8e11f2ffdcb67fbc96bd8
SHA1 f77f7d5f06c211f0e2a31cbd944da8566befc98c
SHA512 7dd3c535e3e60ddc854a53245c7a10a3aee4427327e7ac6174af0c0cf80be2aabe0c2d6638c3ab2f4dec64a486c859f6cea9566244f0d878821edfa7c03dece6
TLSH
T1C0D0A7802898A76D0C184F17B5A06DD630948C335475B820DAA5457999B9BC45152857
MD5 SHA1 SHA512 TLSH

Submit Download

c61b49e3-3cf1-4144-81fe-35f9313721e7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\c61b49e3-3cf1-4144-81fe-35f9313721e7
Size 883B
SHA256 01e811484be132e22fe54ec45f479d737ceee6d3b4faa9ebb9fe65c437068e06
MD5 180fa94170324199823f33790ede9a64
SHA1 aa80ca4f70bff2913eaea10bccc8606d93ec4863
SHA512 2dd70eb1c2aef91d6a68bac49037401c391f26348ab6297b218711152903e578c83d2b9ee0354e703643f86817a3657353c8860cb6fe45c08344c55905b75719
TLSH
T14C112341D634B9F3CD79920BDE5177138FF5252380C990183EA11B140CBE61EA36720B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\extensions.json
Size 16KB
SHA256 88923dc5cada7f8d940c94b958f544228c3a32a7567c367fa862a9a6d4007032
MD5 76c6102d34db6b7de83c4cc613704b4e
SHA1 f3805759b4acc5380b7a984e151986aec7e6e26a
SHA512 1db512b35202e4c59de1b091c881b6f9f5a3463ec826caaf2164e9c64ee4e86b785e826991358c97b3290f102f82f1ec2aff75960056c98067c62d055a945468
SSDEEP 384:qkI4v3Umldvc8dhWA94z196o3tL4HzlL4PTL4HeL4HCL4Hm44hn:NI4PRflXV4H6Ct4p4H4E4Q4T4h
TLSH
T12872531545048EB8294FA79BAA367D02C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 8KB
SHA256 3ccd9c86f43613d8d8e5290ad7b495ebc473217d8066a3aaec24e2448a5392c1
MD5 00c79789c3652e89345a82c80d2111cd
SHA1 d6598e70c41611a45a2c4a9662fe3c851b3fffaf
SHA512 4f645bdebf6c99deb67438b31b9019c31c2092ba5d82e59f4f6189354240f746f64711234a62c60ded6df322d8cb35881103c8a895c3ea574b56162c353ce1a1
SSDEEP 96:xHgJTUPDqGqnfz6sObzSV/UmSSladv9j1n3WRagRhwBw88C8L4cnFpC:y+ORnfz6sT/UmSSXRbkBw88c
TLSH
T1C60210385404CF7F64B6376CAC688971AAB2023BB6BF68C711B954C4414CF3546F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 6KB
SHA256 5054abd2c4a04a284c40bc0ab17ad00a6698df56c9ee0835c874694d398f60c5
MD5 dbd75025f15ee7837aaa2e2a624389fc
SHA1 19e9fe6fabb27072d25ee0c1e592cf10a3146d29
SHA512 c744cc88ce6177f326128a69e23280d7995f65aa2b30657cc875d7d5f2b5552976292c762cb798c3a2e9c5da28530fae9c2c2d24f69ff7463bac56a83f9fa0c8
SSDEEP 96:xHgUTUPDqGqnfL6s1zSVUSSladv9jFn3H8RNBw88n8L4cnFpC:yfORnfL6swUSSS8HBw885
TLSH
T11CE10F789508CBBF64B6776CAC688871AAB2013B77BF68C750B554C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 6KB
SHA256 95ab13536af70fecef47037956141dda6febb20854ecd32f197875494a1a3fed
MD5 f1c82616473156015fe422cf9641f07d
SHA1 6523a3c730472d676e46e7d4d6f8efad0ab7c16e
SHA512 193dbec6d650cd11b0f899070b0e84a9117407a37925aad11f29a6fff86691982d4249ec47a83844f3267768a14aa16c3c0f2647749b2d0809d0843244f97e01
SSDEEP 96:xHgUTUPDqGqnfL6s1zSV/UmSSladv9j1n3H8RNBw88n8L4cnFpC:yfORnfL6sw/UmSSS8HBw885
TLSH
T1C2E110789508CBBF64B6776CAC688871AAB2013B77BF68C750B554C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 ac12d8bd52d6c84fc1d37ac6df0543cbde94f40ddfa93493ef6dc68fd6d8f785
MD5 98c96445cdcc1c9873bfa227cc12fca2
SHA1 ddc26c6cf4cd2e8a6c1fbe6e957a20a7e44f9a56
SHA512 9c2ba972e76e9da5cbd9658f34e7399dfc79d35aa0795b37eaf332232ab0d2a118f82884a9537378a616010867a8e281d2e5b18baeec51866cfc99b7ce6ab63c
SSDEEP 96:xHgUTUPDqGqnfL6sObzSV/UmSSladv9j1n3H8RNBw88n8L4cnFpC:yfORnfL6sT/UmSSS8HBw885
TLSH
T1DAE1107895088BBF64B6776CAC688871AAB2013B77BF68C750B554C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 4d88b7b78eb28d34fc1b1554cdb823a2dec7546ed3f7f3987a6232c19fe4b313
MD5 3158940a341a9a0f65df53623ca7ccfd
SHA1 80e6762702ecbef72949dd30853341af292e75d8
SHA512 530536272e31ebdee434e7b75e6eb0a9e49e4b81400a971fbe03152a4c4b7e05f4e6538c47624b34e5d48a6c7bcdf1920b518dded4f8d0ec31ade44add23f8c8
SSDEEP 96:xHgUTUPDqGqnfLLy1zSFSSladv9jFn3H8RNBw88n8L4cnFpC:yfORnfLLysSSS8HBw885
TLSH
T1E6E11F789508CBBF64B6776CAC6888716AB2013B77BF68C650B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 2c2b8a69c15b6cd582d351742688336673ccb2c42412d1d22f7528f39fb73f0d
MD5 a01e0a690a92895988d02047b9f2a0b9
SHA1 d85b557f64a9e05c397920dc540106e0f1d6dd78
SHA512 a471f3110905d1e78f549cda176e7a45625ee9614b5bd702daba5d28cbd7e0411aea6b4787cd5021673f7dae53b3ec5ec81163ddb8fea9d8fee189c70ea2bfe6
TLSH
T13C311987B6BA3EF33722A255C0809FF2B310307300A52CF0868E494616DF54E728E21A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads