ed133d6531a16f2afaa7b93f7d8ca6fc0f107fb1c0d8c7414f924ed51da160f0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
popup.html
Size 505B
Sample260815-cqmlnaxyey
SHA256 ed133d6531a16f2afaa7b93f7d8ca6fc0f107fb1c0d8c7414f924ed51da160f0
MD5 d065ab8655f23f4769233f6d5a0ae89e
SHA1 ea1e4ab96af019db57eb679d2c630a53fe009f93
SHA512 c69ae386453bc7bb627e390ee5c080e426c291d9392f5ad48bc7f03627de0d9a73bfa91c1d69445c8e4d684019c5aab75451c10585d750f02b1f267905f25add
TLSH
T12EF09EFBD10544065200C3C1ADD0BA16CC47860B0B889690B3E180AA9AA52E6846795E
MD5 SHA1 SHA512 TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4872	firefox.exe
Token: SeDebugPrivilege	4872	firefox.exe
Token: SeDebugPrivilege	4872	firefox.exe
Token: SeDebugPrivilege	4872	firefox.exe
Token: SeDebugPrivilege	4872	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4872	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4872	4708	firefox.exe	85
PID 4708 wrote to memory of 4872	4708	firefox.exe	85
PID 4872 wrote to memory of 3844	4872	firefox.exe	86
PID 4872 wrote to memory of 3844	4872	firefox.exe	86
PID 4872 wrote to memory of 3844	4872	firefox.exe	86
PID 4872 wrote to memory of 984	4872	firefox.exe	87
PID 4872 wrote to memory of 984	4872	firefox.exe	87
PID 4872 wrote to memory of 984	4872	firefox.exe	87
PID 4872 wrote to memory of 984	4872	firefox.exe	87
PID 4872 wrote to memory of 2964	4872	firefox.exe	88
PID 4872 wrote to memory of 2964	4872	firefox.exe	88
PID 4872 wrote to memory of 2964	4872	firefox.exe	88
PID 4872 wrote to memory of 2964	4872	firefox.exe	88
PID 4872 wrote to memory of 1784	4872	firefox.exe	89
PID 4872 wrote to memory of 1784	4872	firefox.exe	89
PID 4872 wrote to memory of 1784	4872	firefox.exe	89
PID 4872 wrote to memory of 3316	4872	firefox.exe	90
PID 4872 wrote to memory of 3316	4872	firefox.exe	90
PID 4872 wrote to memory of 3316	4872	firefox.exe	90
PID 4872 wrote to memory of 3316	4872	firefox.exe	90
PID 4872 wrote to memory of 1104	4872	firefox.exe	91
PID 4872 wrote to memory of 1104	4872	firefox.exe	91
PID 4872 wrote to memory of 1104	4872	firefox.exe	91
PID 4872 wrote to memory of 1104	4872	firefox.exe	91
PID 4872 wrote to memory of 840	4872	firefox.exe	92
PID 4872 wrote to memory of 840	4872	firefox.exe	92
PID 4872 wrote to memory of 840	4872	firefox.exe	92
PID 4872 wrote to memory of 840	4872	firefox.exe	92
PID 4872 wrote to memory of 4736	4872	firefox.exe	93
PID 4872 wrote to memory of 4736	4872	firefox.exe	93
PID 4872 wrote to memory of 4736	4872	firefox.exe	93
PID 4872 wrote to memory of 4736	4872	firefox.exe	93
PID 4872 wrote to memory of 204	4872	firefox.exe	94
PID 4872 wrote to memory of 204	4872	firefox.exe	94
PID 4872 wrote to memory of 204	4872	firefox.exe	94
PID 4872 wrote to memory of 204	4872	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\popup.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\popup.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {4a6129b2-8039-47ce-b0f1-0deada437d5a} -parentPid 4872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4872" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2344 -initialChannelId {0b109915-6777-412b-acae-c9c23234b27f} -parentPid 4872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3984 -prefsLen 27276 -prefMapHandle 3988 -prefMapSize 270279 -jsInitHandle 3992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4000 -initialChannelId {f3567017-9437-4031-8f91-06278a9d6212} -parentPid 4872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4152 -prefsLen 27276 -prefMapHandle 4156 -prefMapSize 270279 -ipcHandle 4224 -initialChannelId {f9a194f2-287d-4362-b875-2e581d281f48} -parentPid 4872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4872" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3124 -prefsLen 34775 -prefMapHandle 3144 -prefMapSize 270279 -jsInitHandle 3148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2816 -initialChannelId {239e17db-c1aa-45b2-a025-21c167ba6de9} -parentPid 4872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5040 -prefsLen 35012 -prefMapHandle 5036 -prefMapSize 270279 -ipcHandle 5024 -initialChannelId {9e36c879-a12d-443c-8da2-848007182791} -parentPid 4872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5232 -prefsLen 32952 -prefMapHandle 5236 -prefMapSize 270279 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {6df80acb-9a75-44ba-9c4a-2109d520fc46} -parentPid 4872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32952 -prefMapHandle 5268 -prefMapSize 270279 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {f24983d4-3db9-46f9-92c9-8ac227bffff2} -parentPid 4872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 32952 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 5628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5636 -initialChannelId {a8462091-3798-47fa-b012-be0716ef4f92} -parentPid 4872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 27ac93b684822045b7a3d3c4c8ebe64fee8e75b1497d89c867989c1c0169d438
MD5 9610f9b816b0554ccf12ce529751a4d4
SHA1 d621728c9525f3d4543687cbb720b98a3e149eb5
SHA512 d0c4e75d31b8e98db984979a501d372d60071d6eed9c58d4e59b808a4ee4ef0324c66af86c9a7ef6f610ad73f66030c6ae189653860a084dbf5f25e845f2db50
SSDEEP 384:HXkRyiO024Y3DL84KKDL849B7SOEAd9KVRaAcP+AWRMAY:3mZY3DL8lKDL8CB7S/AmVAf+hRMZ
TLSH
T15D727E3D5F003CAC25A7C0E8C5A992AA4D18B7A7DEE6C06D21183D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 d4df2e454c0bf28d74c09f9ed9c1d048f85010759d4f1d6d8458063b8c92c268
MD5 a34e5a3a62e0e5e05233f4a51dd29986
SHA1 aa0b8bc980414badb6fc12bd1dcf5d083aedd7e6
SHA512 80b69398a77829e08928a688ed62e165e07f8685fb5a00ebebd0775dc709a163a03adecbba48ab9121ff4caf7057866ede606d557669e566f90744965f9b71f1
SSDEEP 768:MELzNk7FdkGcmhuqgRagriplbEbNbkbObn4:ZzNk7TZgvU
TLSH
T187D21284EB1A953FD42912BBDCE117042F79B88998092F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 58f9918032c3aec5c36ea3a9810c2ef71f8cdbd947b7e94c4a454277b89d7222
MD5 4e275ceb3d1ba001d69c960dceeb2209
SHA1 482e5e36571bb1df4c4dc5ae502c03f5d9e8c90f
SHA512 a98ed6b288da3fc195418809f60d25f2581751b85e7e4655d658ded0b9b75768b41c55d7f842ce55fcca66941738ff3fe6b8b51d03bfacb18e09d38c298712a0
SSDEEP 768:MEkYmzNk7FdkGcmhuqgRagriplbEbNbkbO:czNk7TZgv
TLSH
T18DD21244EB1A953FD41912BBDCE557002F79B88958092F673A8C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 78fd84faeedef5e70abc2fda86b636d317cb7ca5b524b318758315179112c6e5
MD5 e976a4b43058ca7270be99af7fa842fe
SHA1 e018b98922c47cfebe32d0bc51a371a13c381cad
SHA512 f57374f302751bf86d57cf7f1b41c82b06632dfd6a90c9077a53f7fe56308663b0af2c7eb3abb942f5023c7b8f3767aee286be73a43ff48011e547ffbc6c7a43
SSDEEP 768:WxyzNk7FdkGcmhuqgRagriplbEbNbkbOiE/:RzNk7TZgvH
TLSH
T1A1D21284EB1A953FD42912BBDCE157042F79B88998092F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e1732e8c60ce9fec49ce9770f6a5bfe6acf62e05c324ca388600d82e3272bcc2
MD5 c1e7e3b14e6b5320498ecdee0685761d
SHA1 f2e23ed3f43d55db380a4078e672d5eba3c3313e
SHA512 16e157bf5e0435ab7cfed016e93fa6a58768a8798262e4e8db005666c8bfa34b2fd3b258124d3141e1143e7457529ad0636f099cc6ce76c456a8d4632feb1519
TLSH
T12721484C39B94D7EE8C7F29C7585028E63558E0B04C71D434E13EE8DCEA1AD932AA478
MD5 SHA1 SHA512 TLSH

Submit Download

4a167a7f-dd2d-45f2-8f8d-a38875c61baf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\4a167a7f-dd2d-45f2-8f8d-a38875c61baf
Size 2KB
SHA256 d65168fee7c3e1041e22b02b95ff0a7ee369a0f3fc1a02dd7c963caa5ce3854a
MD5 a5b175044e2bcfcf8b299fad2922d5c5
SHA1 76dbd3c736e59a20ff842c8ed552ea21e49d7e6a
SHA512 262642dfbc6d549b536019775f04703495dd95ff6ca51bc2e57c64c42947add8b1fa6826b0d21c72cbf46304ca17dabc8217d09b2092c3cc1457aa95243e7b9f
TLSH
T18141005C75749CB78DD7E19DD882338E57604A1300C268832E62EF0CCCDAB99336A56A
MD5 SHA1 SHA512 TLSH

Submit Download

9ac4b4c3-170a-42d6-9554-7711133dde65

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\9ac4b4c3-170a-42d6-9554-7711133dde65
Size 235B
SHA256 39b5c57fb7311cfd6dc03aaa5a3ba0db8de840f4f34dd39b906752357e1c8291
MD5 749342e5be5368cf3d779063c0e655dc
SHA1 a88b54cb0178655ea987651f6b8e162ef3a0c46b
SHA512 93b249d5ca07e985992e3a3331d7a5dd6adefb6c527e1a02f6c20469ca2005e89619a6e4ae5d044a2aa3d690372b912df56b7ca43ea9aafaefce7d56c582c5d8
TLSH
T1DDD09780248CA77D08140F03F0B0BCEA30694C37A0A47860C6B005788ABAEC8932680A
MD5 SHA1 SHA512 TLSH

Submit Download

c0b437d4-ff24-47c5-83e7-a3a798458001

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\c0b437d4-ff24-47c5-83e7-a3a798458001
Size 871B
SHA256 0c1a9f179d4744225db22f17c9041d76f5a775f1598b711134c0aa480ecb2190
MD5 7909880f4c598cb97c9c2239c4a54e3d
SHA1 45f9e4860f803f279775854a27fe7bcb2ad9fe63
SHA512 b6f7ad9cbf5487b1c2d2d26e355d40118af97e299b68f354baeaf74802b87cb729206f7fd9b7350b26c6a26b673a396021481594352c29b7049a9efb5172de39
TLSH
T1031123819530B5F3CD79D24B8D5177668FF8761390CA90043EE00F144C7E61E9357247
MD5 SHA1 SHA512 TLSH

Submit Download

cb28f3ee-8103-4598-b4c9-eda94403ad5a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\cb28f3ee-8103-4598-b4c9-eda94403ad5a
Size 886B
SHA256 787d60150c8f947d5bfeb24aacee5653df4119b8caafeb4912b47a30b7e7ff5a
MD5 124f754884f250491beb06a05cb7250c
SHA1 6130c2e8efc4a9a4eacb272b7e03e953f081de60
SHA512 232fa2cf4849f90673705b02f3edc1bb486393bc005e8ac5a469f908064d4f614402c864b88b989ed7ef59055c7436176aa3b87033cafb95ba1e7e8182b32392
TLSH
T1CD110C808A71B5B2CD79E24BEDD177538EF4352380CA19087ED01B184DEEA1E636730B
MD5 SHA1 SHA512 TLSH

Submit Download

ea93c7c7-0a64-4a37-bc53-2edd63c6f55c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\ea93c7c7-0a64-4a37-bc53-2edd63c6f55c
Size 235B
SHA256 33f1ae8db2b5a3e3dc708542c44a5bc801521454f7caffb99b710920af09d11f
MD5 c102dfc4bbaccae463365c1ff2f3f18f
SHA1 760f1ac77906225ab52a13f0a99a14ca2a52921f
SHA512 0700a8c64b57c3a2381fd8d67c00a724f9674214ce0ee6b9f895f8f65a2cac1ce6e0779c0c609bca73750ec66bb5a686f427e6430f721ceca46185e2c197c8e3
TLSH
T15BD097882488A76C08144F03F0F02EC73059CC3B28606810C6A0A4349AFDDC4415285A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\extensions.json
Size 16KB
SHA256 6bdd07ad3a5d96fdce33ad267f64210c15c2a8998e59ad4b717cbe125d764461
MD5 b5d0d0fbeb19596a8d46316f128b9618
SHA1 3cdc26de2492c2fb3db42f6e0460fa82f13a96c5
SHA512 db53db05280aca10b8d061a86ab2fdcdefd2acb88780dcac3a70499372dd3dffd1b81acd69533588c5e76a05f9c4477bbfad1fc2a5e42bba9c4446be7f6dec92
SSDEEP 384:qkI4v3Umldvc8dhWA94z196o3tL4HzlL4PTL4HeL4HCL4HmT4h6:NI4PRflXV4H6Ct4p4H4E4Q4U4o
TLSH
T13772311545048EB8294FA79BAA367E02C37D473B60845C78F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 8KB
SHA256 8eb9a0bb25db1d0d03e52181af63829f4033fe91dfd0d6331eabe6782a87738f
MD5 553007d4cc78595b63b1fc3c86437b9f
SHA1 ba3e765f78dd077135744c08bfea441d799e60be
SHA512 320113bba4fe0cc995fed9c1fa3733d83b889711bad7c564ee02c1329af00d68cf556b52f02e54093ef239658c1c0fb21eb3281b69f067ddc0a642fcf05405aa
SSDEEP 96:xHgxTUPDqGqnfoGoObzSJFSSladv9j3n3WRj/gRRZBw88kUl8L4cnFpC:yWORnfoGoLFSSxRj4VBw88vf
TLSH
T1FC02EB385104CB7FA4B6767DAC6889715AB2023BB7BF6CC750B95485011CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 67a02034a9baf5b07441f3b0e901717104453872fc5aca27c8832838d38fba09
MD5 bf52d05958d548923dcd5e74c2c80c6c
SHA1 f8766c104c66d300db9194332b77533139fea449
SHA512 2a607075ce014aae63a91a31da9d3fd5391acc42bfa49788ec477c904d24c6c9f8687f265cecffdcfabea0502cde1f317e06d0d9d61b89ff651e1e20c91b470e
SSDEEP 96:xHgUTUPDqGqnfLLy1zSdESSladv9jCn3H8RNBw88n8L4cnFpC:yfORnfLLyAESS98HBw885
TLSH
T1C5E12F7895088BBF64B6776CAC688871AAB2013B77BF68C650B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 aab4d55ea9683d9602edc1177f1ea7611af5fe4ed116b70c4f167420c78946e4
MD5 26bc684db4505340187cdc065d5a069d
SHA1 172965aa494057a27e598b49c55bf419ce4a8d93
SHA512 1e1be164f328e8fcb3e2d845e9bcf4b56f01655dc64f3b77f819a889651fe3c9a04cf8744de15b70e9dd5aa9a14cc1377b91b8f04eaaebab4ad956e558540a86
SSDEEP 96:xHgUTUPDqGqnfLGo1zSJFSSladv9j3n3H8RNBw88n8L4cnFpC:yfORnfLGowFSSU8HBw885
TLSH
T197E12E789508CB7FA4B6776CAC6888716AB2013B77BF68C750B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 0bc425681f226d3c5c29dc3b84bbe2d36178e423cc34ac902be1333011f5c13e
MD5 e7e6639989a1797313f136a56e91b82d
SHA1 5c8541ed62a4a1c7274ba6b4aba8f168b5761793
SHA512 67f2fcc880d9064270945253f6a4fb9ca8e32895b3bf3c6ac3dcaf79b6994473e84a53c0319084c2e73fd3499174cf6405fad72da76e8fb71f8521f447ea77f1
SSDEEP 96:xHgUTUPDqGqnfLLy1zSJFSSladv9jCn3H8RNBw88n8L4cnFpC:yfORnfLLywFSS98HBw885
TLSH
T12FE12F789508CB7FA4B6776CAC6888716AB2013B77BF68C650B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 e06dd9faf6dabe0faae0c3d21d1fb960fe13d4fc8886909f8d5c03eb1759b0d5
MD5 40d3073b5fd1f7f1a136607690daedcb
SHA1 8756ea5d206a78b6deb1b17af8727b8f6cbc6e15
SHA512 d310e62982be6a9aede67e80ab625745c921eab37b35d125889846c4839f0bb1125e8537a6e9a013486369594a946db55ab05c561cda7e421def2df139be4664
SSDEEP 96:xHgUTUPDqGqnfLGoObzSJFSSladv9j3n3H8RNBw88n8L4cnFpC:yfORnfLGoLFSSU8HBw885
TLSH
T11BE12E7895088B7FA4B6776CAC688871AAB2013B77BF6CC750B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 64c103c4cfe284f1b546da2fa21145a230652a40347e52ae3dcb4b8ce539ff41
MD5 f48dd3090dcf2189d65f0ae76b30baf8
SHA1 4fd775215cba7cea587d799de6595b757d838aca
SHA512 afaaaae17b7273b54768e8abf4ad97e6fb313cbbe2cbdd424d572fd09ae8a50588080587421573be7b07922e46b2b11b381f036ca50ff75d688664d101c57db4
TLSH
T1A321D882896B3EF2FB634199D4848BF09E95303188750CB0D6874F46219F81DB28E21C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads