hxxps://firehosting[.]free[.]nf/download[.]php?id=qwxyy4gwis

Analysis

user interaction
yes
max time kernel
101s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://firehosting.free.nf/download.php?id=qwxyy4gwis
Sample260819-raq2gawbmb

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\FrontierX Setup 0.1.0.exe:Zone.Identifier	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\FrontierX Setup 0.1.0.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	firefox.exe
Token: SeDebugPrivilege	1584	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1584	firefox.exe
1584	firefox.exe
1584	firefox.exe
1584	firefox.exe
1584	firefox.exe
1584	firefox.exe
1584	firefox.exe
1584	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1584	firefox.exe
1584	firefox.exe
1584	firefox.exe
1584	firefox.exe
1584	firefox.exe
1584	firefox.exe
1584	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 1584	2996	firefox.exe	87
PID 2996 wrote to memory of 1584	2996	firefox.exe	87
PID 1584 wrote to memory of 2672	1584	firefox.exe	88
PID 1584 wrote to memory of 2672	1584	firefox.exe	88
PID 1584 wrote to memory of 2672	1584	firefox.exe	88
PID 1584 wrote to memory of 4944	1584	firefox.exe	89
PID 1584 wrote to memory of 4944	1584	firefox.exe	89
PID 1584 wrote to memory of 4944	1584	firefox.exe	89
PID 1584 wrote to memory of 4944	1584	firefox.exe	89
PID 1584 wrote to memory of 2024	1584	firefox.exe	90
PID 1584 wrote to memory of 2024	1584	firefox.exe	90
PID 1584 wrote to memory of 2024	1584	firefox.exe	90
PID 1584 wrote to memory of 2024	1584	firefox.exe	90
PID 1584 wrote to memory of 2928	1584	firefox.exe	91
PID 1584 wrote to memory of 2928	1584	firefox.exe	91
PID 1584 wrote to memory of 2928	1584	firefox.exe	91
PID 1584 wrote to memory of 1556	1584	firefox.exe	92
PID 1584 wrote to memory of 1556	1584	firefox.exe	92
PID 1584 wrote to memory of 1556	1584	firefox.exe	92
PID 1584 wrote to memory of 1556	1584	firefox.exe	92
PID 1584 wrote to memory of 4048	1584	firefox.exe	93
PID 1584 wrote to memory of 4048	1584	firefox.exe	93
PID 1584 wrote to memory of 4048	1584	firefox.exe	93
PID 1584 wrote to memory of 4048	1584	firefox.exe	93
PID 1584 wrote to memory of 4996	1584	firefox.exe	94
PID 1584 wrote to memory of 4996	1584	firefox.exe	94
PID 1584 wrote to memory of 4996	1584	firefox.exe	94
PID 1584 wrote to memory of 4996	1584	firefox.exe	94
PID 1584 wrote to memory of 960	1584	firefox.exe	95
PID 1584 wrote to memory of 960	1584	firefox.exe	95
PID 1584 wrote to memory of 960	1584	firefox.exe	95
PID 1584 wrote to memory of 960	1584	firefox.exe	95
PID 1584 wrote to memory of 2640	1584	firefox.exe	96
PID 1584 wrote to memory of 2640	1584	firefox.exe	96
PID 1584 wrote to memory of 2640	1584	firefox.exe	96
PID 1584 wrote to memory of 2640	1584	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://firehosting.free.nf/download.php?id=qwxyy4gwis"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://firehosting.free.nf/download.php?id=qwxyy4gwis
  2⤵
  - Drops desktop.ini file(s)
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {c08a041c-96ab-4634-adff-b336b701f7a1} -parentPid 1584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1584" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {e48a606a-f2af-4a0e-b191-f0c5f33ea9f9} -parentPid 1584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 25164 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {ecfaaeee-377a-45a8-a8bf-f75ac9d07b6a} -parentPid 1584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4024 -prefsLen 27276 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 4132 -initialChannelId {0d454cc8-35ff-4f70-affc-c8b0b6871743} -parentPid 1584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1584" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4412 -prefsLen 34775 -prefMapHandle 4416 -prefMapSize 270279 -jsInitHandle 4420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {55fa14a8-3e3f-4973-b7ed-cacb218138f8} -parentPid 1584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5108 -prefsLen 35012 -prefMapHandle 5112 -prefMapSize 270279 -ipcHandle 5088 -initialChannelId {3a4319e3-17a0-4571-9617-93694638c322} -parentPid 1584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5312 -prefsLen 32952 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5328 -initialChannelId {111b1ba4-cb64-4525-943c-4e8808c7825c} -parentPid 1584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32952 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5364 -initialChannelId {805e196c-6f37-4fa3-8e91-04eb1808c0b0} -parentPid 1584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5380 -prefsLen 32952 -prefMapHandle 5384 -prefMapSize 270279 -jsInitHandle 5388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5396 -initialChannelId {cf7871cc-03dc-4006-9835-8c22c37e4986} -parentPid 1584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 c820b13af08e26e64a2c3ecff548c8f80b6f13bfbbea6a1487f2816ecf709206
MD5 651afe67243627140df3e47648147a42
SHA1 07a3c455978cdd59e7fdea9497c8dcab07aa828e
SHA512 84106aff1dce76f7d11c9c411f2515bdc9fbde4a6f4ae8d2c87312b509d8cc8957d7b5a5fe2740bc71997d23c24b69d2d4f837d6769f25177e3e3714325c6f0a
SSDEEP 384:HXkRyiO024Y9DL84KKDL849B7SOEAd9KVRaAcP+AWRMAakcO:3mZY9DL8lKDL8CB7S/AmVAf+hRMPO
TLSH
T153727D3D4F003CAC15A780FCC5A982A98D18B7A7DEEAC06D21583D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a7af05b-a9f0-4217-834f-1f125b25deed.zip

Path C:\Users\Admin\AppData\Local\Temp\8a7af05b-a9f0-4217-834f-1f125b25deed.zip
Size 3.8MB
SHA256 df4a1cd562eef86e117e9a79497f799c3bb82d7a1c5ac8d9c240abf8640ff159
MD5 95ba08187ddb4e27dd69430be0320e72
SHA1 ac31024971fe7cfb8b0f78f5fd711b67121875cb
SHA512 c4db61248a74a17417310c47b4c11d11b3299de2a3180541429dfc2d42a9adb4174381c54a321bec3a59dfc37ab6e2429c635f61b1ffc402833285d435d9d0cd
SSDEEP 49152:YRbffsMDFFzwF7YyPeit5NFn1ZG6joqDtaSi+Fk7mJe8K12MxH3+qcxDoegA3oE6:6bf2YXc/1ZLAAFk7Ge8sxVEh3oEVg
TLSH
T13606F135D65C1609CDFF83BA8D0D2FC2B84C4FAE8054B96B6A6A99715CE31E21F44B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 6b297c834505e605c6a2eb75db3a8b58c0d75fadcdb5db250c225b8eb36b488e
MD5 c8c131d396a26773d4c208c144b1cacf
SHA1 26d4ec6fe9daa9908077d7042be3ae99227999eb
SHA512 3f66465991443c1e0ed68da458563f46f59b163a29af1737637ff9a640472485051fd8e3c739894e565f992cfa5752e4021dd6c099f0c051383ac472c255a077
SSDEEP 384:RboLNpyjCgCaiJUk+GoV3E3GcmhucmbOHHKDMJJ+bDbAO3r2d66JozGzgC1jd:huZgkUkS3uGcmhuc7nKDMJJ+bDbfrXE/
TLSH
T1EBD2F084FB2A553FD41512BBDCA507002F79B88A58192F6B3A4D646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 c5dbe072b32cb010ff842075a3acf9724fc23fdb61637a98890623293d263f3d
MD5 24281f9c5e3ca23acf4e932adeeb567c
SHA1 ab181ed06f3edf465738a70e1215fb125465d51c
SHA512 a11e0e8a9b2221df53c2ffd71697944deb1428e038effe1f42338e1123cc2992f33edbea7e03c9f74612d37d25e963b2b66986eee7135d39401465a1a5d808e3
SSDEEP 384:nd66JozGzgC1jRgCaiJUk+GoV3E3GcmhucmbOHHKDMJJ+bDbAO3rwboLNpyj6:QEPgkUkS3uGcmhuc7nKDMJJ+bDbfr4u1
TLSH
T17ED2F084FB2A553FD41512BBDCA507002F79B88A58192F6B3A4D646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 dcce7bf440deb1775b06fdb9e1ab63ca71d58c8c6e5b060d43455007a6abeec7
MD5 5999f492e40afe1a198dab73c2bd41ea
SHA1 481d21ab1f9feed1232b7ae631ef9d263cf16848
SHA512 f720e4eb497e456378819d72d83111780743a2e355d1145e5d4ecf880a5b503007a620a24bf233924ed437f7b0cdd17cb2c843e04b6dceb7fd88371d61e27554
SSDEEP 96:RjFS2FHoFXFeF3/dd66JozGzgClKtmc0d/U3QcSdF95/7bkW60rcExLpyUR6OkxT:dn1d66JozGzgCl6mc0dyQcOv5zbowbxS
TLSH
T115C1EC64F629463FD449023BCCB61B414F35355B984E3F2931EC74192C9B29E7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 4026b5418432f6bac499614d3907eddfd433808943a9d6074ac421e9acdf94d5
MD5 94e27a593ffbccfa69684f9bc8c7ebff
SHA1 846e26060ca15d428b189c345827d5554d0ccc14
SHA512 be0246c540596c6d5db2ef786a7b50219bc928e4a1e57eff6589a9b5c9b55fecb2f5b8942ef8acff5eb32c93008f34565d43a282696034688e4b4c6e3211554a
TLSH
T1AB61C958F629863FE445423ECCA71B415F30745698AE3F2A34AC608D1E172CE768D03D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6bb44ead962f7c1d786390b5128cbadf3d71420eb3c5b90c24aa4dd2ef0f2f99
MD5 ab62a4a41369d0d1dfc2485c0e001275
SHA1 8e5d4c31118c0fda4d9de91fc88e67e9523cdbe7
SHA512 62b8ebf60c4e80de8215e7f19005e2dcad36feb42a5cc3c7875db936aba61b7fb1df8946834f67b578e909b24fcb1f1619304f5022bfaf73988e6da4ab9ed562
SSDEEP 192:dn1d66JozGzgCl6mc0d9QcOv5zboPfZxLpyjO1+o:nd66JozGzgC1jebo3ZNpyj6
TLSH
T14CE13F64FA29463FC408027BDCA61B414F39389A9C4E3F29359D741D2C872DE7A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6c6b9fd4487161ac152cb4871670e723dca369adbf2792a534389ee05b2527ba
MD5 10bdf6a37fcb432d719a98841ab6298c
SHA1 c675edae1392521f13581988859be40aa495282a
SHA512 e165de21ec34fbc22b8d59c63368b666125ef882da5c93bd41323da7a5d464a3cff12d167394c42d505e87067c7ec8de1ab04376d132b8ac7583f897efa48ae3
TLSH
T1BA11AD8C79B84E6ABCDBE2ACB842028D53354F0314875D434D12FF8ECEA0AD9312947D
MD5 SHA1 SHA512 TLSH

Submit Download

5680cefc-fb8d-4b69-a8b0-d4e201022b1c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\5680cefc-fb8d-4b69-a8b0-d4e201022b1c
Size 235B
SHA256 621948f9669627243e8c38bc27f94cc3cb77a45842ed8d1513e221530e077ff8
MD5 105970d5932b8a66d5c55ec88d44a7ae
SHA1 64c6a61abe2f816385e941a7ffcd82efe42fd51d
SHA512 78aa130c058aef74657a4da20feeec1fdccbad1c49cd8377fb1f63122a24084f27678ae0f8812593783f03e1884198077fafca95ed50f51707b022339315760e
TLSH
T129D097C018D8632C08140F1AB0E029C231948C33246468A0DAA54A3499B9ECC02E2816
MD5 SHA1 SHA512 TLSH

Submit Download

61be9b47-a54b-48d0-af3a-db18bbc6eb41

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\61be9b47-a54b-48d0-af3a-db18bbc6eb41
Size 2KB
SHA256 a00bfab5a259ddc027d9c5e3026306c5db193fd214bdc8818a7bd6df354edab0
MD5 59f216e96bfe3e289cfbbd5910293083
SHA1 d9cac4addd38d4a51da6785f60eefa32c0297f8c
SHA512 79a2c25cb5a6ee06595a99b863f98ae625249cc56582e11c182ef67e3a7bc98b70380d9c31d7a406e7b566c69e4b45db2ed24faeac05375137c7296310eac9c2
TLSH
T1ED41455C36784C7A5DEAE18DD052338E57A48A0710C358532D52FF0C8CD769D336A43E
MD5 SHA1 SHA512 TLSH

Submit Download

85511ee7-d06a-4daa-befc-8d66cfb741f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\85511ee7-d06a-4daa-befc-8d66cfb741f6
Size 235B
SHA256 64bd7248043b939e8ecc7a707bc9d75560aa6625d098cf398079b1d6acb602e5
MD5 c72bcdd1bb38652e253b89a73bca9199
SHA1 ea3ce3f3c578a832e92f34a9e9ab45ce29fe3ff9
SHA512 a0d02e19778fbf04e9d3692ddb5f46a59f368640f2ea1079bdcddb78027bdb659ace7645218ab0c11da272a8cfd09f91bd66425f1740382e7db30276c657c3c1
TLSH
T147D097886C88276C08000F03F0E26CC770494C33A8B45810D6A10AB889B9BC942A281B
MD5 SHA1 SHA512 TLSH

Submit Download

8e57323d-6fa2-43ec-9d49-dde34fd02aed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\8e57323d-6fa2-43ec-9d49-dde34fd02aed
Size 16KB
SHA256 27769a4fcc0eeb5ccf2ca611b6fd4cad13d107c357e1e4da1af406abc3790d5b
MD5 6bc4e270c16f08faac2aac8ce752b822
SHA1 b8dd232da7327f5d07ea2c6419a8384c083ee8e9
SHA512 eea8755c9c9f45b6a77032a84044ca3620593f8358ae65db4f3ee53ba3cab42a4cbc2c15d85a3346d690a1914552000d71d01cbc828572a13628d0db3f0bfee0
SSDEEP 192:vkgMWKiczae5GbuzWE7nU/kVYNxKlbag4Z9VujTW43VdeBuT68tRK5jT4YvBOI1a:vRMWKic+eUbuz9TUMV0xKlqNx9/j0qA
TLSH
T17272D8162830457A8251E7A9D4F87FC3E5F528CF4C419FCA9BE4BD086DDE0AE512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd14073a-9a4f-4131-b4c9-0edca7376bbc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\bd14073a-9a4f-4131-b4c9-0edca7376bbc
Size 886B
SHA256 44df4cb82be80cf9d516d881ce02fbd148ce7713fb46f52275c64a8e667d79cd
MD5 80acaf8a185e4095663b1f70623e3312
SHA1 6c3aa59d911a348f069f1aead2e653d7015c637d
SHA512 24306daf88b1094a294b4b4371845f63c47d57484fdb1afff06fe00375661411df76386c7f2fa727f8ad0397f5ebfbf830c162023d6c3634632186d76ff26a44
TLSH
T1381144405A7970B28C68D25F90B53746CAF47113C0C908247DA15A184CEB51E936720B
MD5 SHA1 SHA512 TLSH

Submit Download

e75fd44c-57ae-4f47-9735-989c8c37ab43

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\e75fd44c-57ae-4f47-9735-989c8c37ab43
Size 883B
SHA256 7b8a71acc45468ea971f28c264443909522884b3e2dd3b47e91f7427de077f54
MD5 4a64dfdc293149903dbf8a3d07228458
SHA1 ea38f0e941e7a54d6af4f4bffeacdcc49d3c70ee
SHA512 3df1558f9810f154af4d08c8fccaf85281b412e139e5f420db7fc1b06b7e9fa94bdf8c48520b447ec139c25095c4ee1945af6a80fbc55a17fc5cbe67144ec867
TLSH
T111110081AA35B5B68CA8C24F855537468BF4721380C954246DB2AA280DBE92E936A30B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\extensions.json
Size 16KB
SHA256 b27963a33c7eaa9891d52d4695808235ca83091459dcd14560ead9951ce7996b
MD5 b40a78ba7988b885845ded222f029635
SHA1 0ac6087b984d5f681fb96c0017c262e28a4a57eb
SHA512 c13da3ac8faebb4e64d592985d4643659296a09fa57d495038122710ff8b7ac69915dac9a3d3c95ccf1c2ad88630cdffb56af11f64dcb3d2dab5d53076be7c5d
SSDEEP 384:8kI4v3Umldv18dhWE94zh96oaL4HIL4PtL4H2L4H/L4H7v4hy:TI4vRf2XZ4D634q4V4c4D4L44
TLSH
T1F772521545049EB8298FA79BAA367D01C37D473B60845C78F4DD8FC802FB5B902BB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 8KB
SHA256 6733cf23458b33f361a3fe577f5f4a5c387edae42fb204551ca2d850f13f334b
MD5 7ff5e97e477b70a9e74aa6696fbc37b5
SHA1 66d56b17c124fdb68d433e4ed5f96e5cc79ba297
SHA512 babb545589a676920609abf84c1246f7b80ea856f0b1d63afb69d16d444e624dff01e906acda70867957914d0120188320ec57492d74b3165f12db024eda5528
SSDEEP 192:L+SrwTnnfCRgaf0hktSSYG5lfWWJspDyBw88C1UV:LcaHrtwS1E
TLSH
T12E122F3C95048F3F25B632BCAC6949705AB2063BB7BF68D700B994D9015CF3841E96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 79c6e9f742f9a89665dcdcebdb37a47547d91cdf836fb38b410b4e9488eeb267
MD5 bf3088433ddd5e1f9699c95d66e4cab2
SHA1 2c057868196e403baa96a1bf88e0ef8c81b5844e
SHA512 09415f3a99e35e6e4b49d717757ccd04f820484ba441e270e4b2b3d16f1ae3666db56bd65ac30ca3557aa1f5ee0dbc7c28733c2c396747348fc1207381764cc9
SSDEEP 96:xHi+UTUHqGqgaf0io1zSOSSlmdv9j3nuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0iovSSH5lfWTBw88qV
TLSH
T117E13F7894088B7F74B677ACAC688C71AAB2013B77BF68D750B55484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 1f5a4770d807ab3aceb4e3e5c88e46187182cfc4131de2752e241474a4c23846
MD5 bf8870e1272d734948b864ec248479fe
SHA1 63a9890115196692c967ab92b396b511b0152377
SHA512 f1f2ac9e5514a8ddda851675f334dfe8b4c525807f09403239fd37b46c3619be4ebbaaeb64cc4f5ad85b74b53830773e83e6e949393be4c517e4b56e746dfb92
SSDEEP 96:xHi+UTUqPqGqgaf0hk1zSTSSlmdv9j9tnuH5lNdHWTBw88n8L4cn3XH1:k+aCRgaf0hkqSSYG5lfWTBw88qV
TLSH
T10AE12E7894088B7F74B676BCAC688C716AB2013BBBBF68D350B55485015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 d80e9e2c1b46c1d4947385beee0ac595d344e9df7341f59f9f370a98ec6f1b04
MD5 42e3da4068699f95578f57f0b53a2a88
SHA1 a2a99165f89daabf316d01dc0eefb9b6804c14c0
SHA512 32ae7e9bd5057246dd344a75e6f538bb5f783a743ee10306ad2c3520dc57e33e4b61469966603fa092ea3322e3cc580c35108462fc4943f2448852a4505974ac
SSDEEP 96:xHi+UTUqPqGqgaf0hkObzSTSSlmdv9j9tnuH5lNdHWTBw88n8L4cn3XH1:k+aCRgaf0hktSSYG5lfWTBw88qV
TLSH
T193E12D7895088B7F74B6767CAC6888316AB2013BBBBF68D350B59485015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 7KB
SHA256 a125a2cbc7e3b478e26e6faa4e790e153e048d69396c2f80074c726fef7a3931
MD5 52952c503414297c3304bfd2c5570986
SHA1 cf3f37ead0e5d7b51839ce77611cbd04466a4ca9
SHA512 26ad37880c7342d8a49ad9a39fea0d507273cca9e5fa7529d486ac0427140fbedf8e9724ae7d1672c33feaf543cf5bbcdee6978b1952ccf95d37990e824f311e
SSDEEP 96:xHt+UTUqPqGqgaf0hkObzSTSSlmdv9j9tnuH5lNdHWitNBw88a8L4cn3XH1:L+aCRgaf0hktSSYG5lfWitNBw889V
TLSH
T16DF12F7895048B7F74B636BCAC6848716AB2013BBBBF68D350B994C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 9KB
SHA256 546bb407e634c383c3da210a994ec57476cb9fbbcfe859b7d3fb047878d87a12
MD5 2b6cd3a30c7278dd9c307c3c52424062
SHA1 43a5e099294d66138fafb35604fa37af178fc83d
SHA512 13121b9dedabf94d21305316d14fa70478832930a0926d465fda78d12198551d8df80745413a012b39d428e002d74ea77f9b52a7f84c69ffbb4eae059344fecd
SSDEEP 192:L+SrwTnnfCRgafLMhktSSYjRelfWpJsptsSQOBw88xSAWV:LcaiRGjwhhi
TLSH
T1B3220F389504CF3F65B6327CAC6949705AB2063BB6BF68D700B9A499051CF3441E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 d142ec896c1221547cfefbaa990f2ed753258678cff49847abb350a9c88aa419
MD5 7e00dd3abb65df686ace9f60def43d1d
SHA1 f5b7042dfebd6d406990bd45ca386e3a78497bfd
SHA512 6d244b55920c23080d0c8d15e1d3d5c312d0b48216d86d55a0c4b541e71fd9e007620c95c5245cc53c496f4c92ea975a209181c1364ccfb5c3a1de21f51e1a57
TLSH
T11B2128C74B4B1CE0BA26431CC8484FAA4B4C3423847818F0C16E5E4927E909C630B66E
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 2e140a0d318abd916014850ba69fde7c82c0e884c14bba4f1773084d02e78ba1
MD5 6731cc7d0903d8f22adfd5362d99666e
SHA1 8da1ffc71ec526ce6bd2d081c9eedc1532195b72
SHA512 a18f7454396cae9345870cdfe842fd821d1da6988005e57afe695cdccd87e843a0b8f55b900248d7f661614dfde0e9561354cd2e78852f81dee8bc8dd7e2cf3b
SSDEEP 49152:miwbkMngvZR+Uh3YdAifVQ9hJxHkdar3wvFh+:RwbkMngRMfVQ9hPHkdcC
TLSH
T1B12639E820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads