hxxps://opus487qds51dsf541-development[.]zohostratus[.]com/opus487qds51dsf541[.]html/?id=7562437176111579

Analysis

user interaction
yes
max time kernel
23s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
20/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://opus487qds51dsf541-development.zohostratus.com/opus487qds51dsf541.html/?id=7562437176111579
Sample260820-mlm2qsam9z

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeDebugPrivilege	4160	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4160	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 4160	848	firefox.exe	85
PID 848 wrote to memory of 4160	848	firefox.exe	85
PID 4160 wrote to memory of 4424	4160	firefox.exe	86
PID 4160 wrote to memory of 4424	4160	firefox.exe	86
PID 4160 wrote to memory of 4424	4160	firefox.exe	86
PID 4160 wrote to memory of 4948	4160	firefox.exe	87
PID 4160 wrote to memory of 4948	4160	firefox.exe	87
PID 4160 wrote to memory of 4948	4160	firefox.exe	87
PID 4160 wrote to memory of 4948	4160	firefox.exe	87
PID 4160 wrote to memory of 3048	4160	firefox.exe	88
PID 4160 wrote to memory of 3048	4160	firefox.exe	88
PID 4160 wrote to memory of 3048	4160	firefox.exe	88
PID 4160 wrote to memory of 3048	4160	firefox.exe	88
PID 4160 wrote to memory of 4476	4160	firefox.exe	89
PID 4160 wrote to memory of 4476	4160	firefox.exe	89
PID 4160 wrote to memory of 4476	4160	firefox.exe	89
PID 4160 wrote to memory of 2940	4160	firefox.exe	90
PID 4160 wrote to memory of 2940	4160	firefox.exe	90
PID 4160 wrote to memory of 2940	4160	firefox.exe	90
PID 4160 wrote to memory of 2940	4160	firefox.exe	90
PID 4160 wrote to memory of 4520	4160	firefox.exe	91
PID 4160 wrote to memory of 4520	4160	firefox.exe	91
PID 4160 wrote to memory of 4520	4160	firefox.exe	91
PID 4160 wrote to memory of 4520	4160	firefox.exe	91
PID 4160 wrote to memory of 5084	4160	firefox.exe	92
PID 4160 wrote to memory of 5084	4160	firefox.exe	92
PID 4160 wrote to memory of 5084	4160	firefox.exe	92
PID 4160 wrote to memory of 5084	4160	firefox.exe	92
PID 4160 wrote to memory of 1044	4160	firefox.exe	93
PID 4160 wrote to memory of 1044	4160	firefox.exe	93
PID 4160 wrote to memory of 1044	4160	firefox.exe	93
PID 4160 wrote to memory of 1044	4160	firefox.exe	93
PID 4160 wrote to memory of 1600	4160	firefox.exe	94
PID 4160 wrote to memory of 1600	4160	firefox.exe	94
PID 4160 wrote to memory of 1600	4160	firefox.exe	94
PID 4160 wrote to memory of 1600	4160	firefox.exe	94
PID 4160 wrote to memory of 3164	4160	firefox.exe	97
PID 4160 wrote to memory of 3164	4160	firefox.exe	97
PID 4160 wrote to memory of 3164	4160	firefox.exe	97
PID 4160 wrote to memory of 3164	4160	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://opus487qds51dsf541-development.zohostratus.com/opus487qds51dsf541.html/?id=7562437176111579"
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://opus487qds51dsf541-development.zohostratus.com/opus487qds51dsf541.html/?id=7562437176111579
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2028 -prefsLen 27099 -prefMapHandle 2032 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {ce5d390b-049f-47a3-bcd2-8576c833282c} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2516 -prefsLen 27135 -prefMapHandle 2520 -prefMapSize 270279 -ipcHandle 2348 -initialChannelId {6b25a090-5718-469d-90d3-e537f2df792e} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3724 -prefsLen 25164 -prefMapHandle 3728 -prefMapSize 270279 -jsInitHandle 3732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3740 -initialChannelId {c7249ac4-68d1-46d6-af22-445e0560d541} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3884 -prefsLen 27276 -prefMapHandle 3888 -prefMapSize 270279 -ipcHandle 3956 -initialChannelId {5a1bd0af-ef74-4ced-b1cb-c3691022b97c} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2672 -prefsLen 34775 -prefMapHandle 1640 -prefMapSize 270279 -jsInitHandle 1440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4348 -initialChannelId {2625ffdc-8629-42b0-a0db-8b092e40c2d1} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 35012 -prefMapHandle 4908 -prefMapSize 270279 -ipcHandle 4580 -initialChannelId {067ff4b1-86ad-4c55-a179-a2c546ad31d7} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32900 -prefMapHandle 5192 -prefMapSize 270279 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {35d6cd03-b7eb-48ea-9b52-6ef5e7ef26e8} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32900 -prefMapHandle 5224 -prefMapSize 270279 -jsInitHandle 5228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5236 -initialChannelId {8e72230f-a19c-4603-9e1f-5c9a74505b33} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3200 -prefsLen 32952 -prefMapHandle 3208 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {ca3d080f-db94-4f40-a8d4-0f8fe5ff88e4} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4836 -prefsLen 32952 -prefMapHandle 4180 -prefMapSize 270279 -jsInitHandle 4184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3764 -initialChannelId {e1772989-400c-46cb-a7c9-782ccf2cbca1} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 7da18dafa521f4b3722dcff4f4fc73ef882d802a3ed25c9ed9403235818ce666
MD5 0cf31cafc42a9376b01b4453bda63963
SHA1 b13abd43353102ddfb11986d59d7c2feaeba4b40
SHA512 fa64f8cdb4333749fefdb791353c55e01fce0a624c602cc40ee8290a21e53b4a865bc0a7bdd01352944d861607e86118225a2cb8fd45a2ae85791a2b96a22e98
SSDEEP 96:cHSdF95/7bkW60rcECWyUR6IWZ9nFw2FvFkFyF9/dd66JozGzgClKtmc0d/UK:MOv5zbowbCWyjr/1d66JozGzgCl6mc0d
TLSH
T12AC1E028F639863FC805023BCCA52B510F763997A88E7F2931DC65192C5B2CE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f9ab2ac9ef77d16c498633907598010dea0d96668e34fa3752ac2c9519fc7de5
MD5 5b536e810cf2d0cd4e8603f0e83ccb7d
SHA1 9680680102632da19bd2f2503077076a44e3b094
SHA512 31f5519fc8b1805dabab0876d84156ea508b0a847221bc87535ee2fdc5cf5f6c5a3988f23fc5b043a392c201bfd20e0d9d09ee89ec53e8a9e04baefc8c13e228
SSDEEP 192:dOv5zboPvZCWyj1Mk1d66JozGzgCl6mc0dz:SboXZCWyjJd66JozGzgC1jd
TLSH
T157E12164E628863FC405027BDCA22F550F3A399BA84E7F1935DC65182C5B2DE36CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4a7961bf84d6150146c94b448551c554d6c9af1a27e533553b2b83713174960d
MD5 29a7ba1c7e906d44706b0360f5a569bc
SHA1 64fb3deb8b63a2412b19ed2bb61dcecbaa28c093
SHA512 1e51722adebd198c89818a2dbd246fdf7b4aed259c5e235bfbb6c80ba5d3c5590b25040e17fae884233d0b2d475faf4c06631ec2cbd652129362047ff90346eb
TLSH
T1E5113D5C3AF55D5A9D8BE29C7451228E5B254B4344872D434D03FFCCDE81AED326943D
MD5 SHA1 SHA512 TLSH

Submit Download

7a9bf139-a8f5-48e6-89de-c5c6e66bcab0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\7a9bf139-a8f5-48e6-89de-c5c6e66bcab0
Size 235B
SHA256 733b38344686c303b7e24d9bc65f61745841201476d85c380b141c269a811974
MD5 98b159a0029ac2d5d021170b6f929e94
SHA1 3a087793a8742f1a9536690b918ab29d2624c3d1
SHA512 21839edf9b84c64f9ace0c0af0cac83a0f969e1edece246345ebcaafb78383f075d81634118399fbeab665c663c786e4140f046076fcc6507df5255f676d7e18
TLSH
T1FED097C034E86B6D8C184F0BF0A068C230884C336474A810E69809748EFC9DC026180B
MD5 SHA1 SHA512 TLSH

Submit Download

8166b6f2-b2b4-4ff1-bf62-d4048d637503

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\8166b6f2-b2b4-4ff1-bf62-d4048d637503
Size 15KB
SHA256 9f03fbefef836df3990ab03a1a16fac056554b0942bb75061cdb69752d37478d
MD5 c8a12b078428e746cfc3d7a197f18153
SHA1 f9495703ec68f589c8187cd8c007782379c0ab0d
SHA512 af02a1c66d93b84be7785879725308513dc99270bb5ea1ac3f065a5e0836019ac7bbdc7a11dbee08737ddf72ac484c05de628fb4dfaebc881a2969f2784ec210
SSDEEP 192:k8HJGpwRisvDayhcbrbkq7KdFCuMg3f/Etaizx7FARluelBMKEK/OT1pN+:k8HJ8OvmB5tail7FARluMiKEbN+
TLSH
T1F072D8165820457A8251E36998FCBFC3E5F638CF4C019FCA9BE4BE086DDE06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba73c22c-e4d4-4004-b134-94f46de2dff5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\ba73c22c-e4d4-4004-b134-94f46de2dff5
Size 2KB
SHA256 427b663e753d91090bb97741809bd0a64460cc4f0d531525e10657db1f0ad2f4
MD5 d6bec9f1730b2e021db273f069ce978a
SHA1 8af77c3f91fcd86a0b32dadd385434397410cc41
SHA512 6a821c8ee5601f31d000dc4ecbe45970009dd7b8eca441fc09a96df5ad4ad3f21d846f2953827629278346056b6e5bba10f7a2d525cc003bd90413f53d6fa0d7
TLSH
T19C41311C76788D768ED6E19DD491338F57A04A0310C25DC32E51DF4C8C9A69D336A23B
MD5 SHA1 SHA512 TLSH

Submit Download

cbfd89c2-6701-46a9-b34e-610f064cc42a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\cbfd89c2-6701-46a9-b34e-610f064cc42a
Size 886B
SHA256 75bcf03c72183a1882dd1c8450b050af640332e2f935c4cf041c49f1073428c0
MD5 0f0419a8c0f53392a3c6f42e1e75c650
SHA1 a2be4386fe5f35dd0932ecc51ee098e7f0eccb92
SHA512 d8d990271af4b2571468857d8c96a79a617a86800fe0b65b53785812a5b9d884fe682f7e8a33e44848f78934e8592feb0cafc33aaca56e1995cbeabe07814b47
TLSH
T1D31140408674B5B3CD699287E9D177138AF93123A0C699183ED00B140CEE61EA3A6207
MD5 SHA1 SHA512 TLSH

Submit Download

e1ff4163-c43d-47fe-9c1d-77c66ddcd876

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\e1ff4163-c43d-47fe-9c1d-77c66ddcd876
Size 235B
SHA256 7f0a3422f332bcb74c64861aca418a156b4fbd97fd0410041efd972381eedb76
MD5 e29ff2c513825b49e6204b2693af394f
SHA1 736ca22a96a8c1c81655aa738e3ffa0117abd0b6
SHA512 b4c7e856b7b24fbc722d5a9fac9f51eb07bfe0b29314f8232de1059eaffc18f019889d0d677970f5e1915c094eee7c345036d81e019a631601ecf17fc648646a
TLSH
T1E8D0978028986B2D48100F27F0F0EDCA30494C3728B56820C67008B88AFCEC841E1847
MD5 SHA1 SHA512 TLSH

Submit Download

e60848cd-78fe-4e9c-a291-91f658a8639d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\e60848cd-78fe-4e9c-a291-91f658a8639d
Size 883B
SHA256 09653e4e24d1650a7f1b3ffcc563981c47311c6cdb34ee2efbc1111a85ece849
MD5 b962d4aeb476729343e282e66cf1f73c
SHA1 9acfe77399d5634acd41838b301cc35fb9c3e029
SHA512 f447a2601024ae9b3ce041222561d44337601c726f320979c3fdc3609129fb29db4a8fe04b5126fbb99849a8c3f5ea4f78265c34365acae468a6d62d56d2556d
TLSH
T190112341E230B5F2CD29D24BDD8577238FF87523A0CA90183DA15A140CBE61E63A770B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 6KB
SHA256 48a22e81afdbd80b791b591015fc33582f3afe4d9877911c25bd309724caa9a8
MD5 c8f0d68dc75ab3afe050ad4f8474a73e
SHA1 99a0ad37b2a11a2ea7049d4958f742a2714cfb13
SHA512 57a89b813d969df9646aaf252a8be209e1ebfd1291ed7b8eaa3a56022ce1f247e35fa4566a955eb5dff2e349e8e2dbb66e19f600f5f8d6977a24b7da06f777a9
SSDEEP 96:xHgUTUPDqGqnfLDz1zSqnSSladv9jGn3H8RNBw88n8L4cnFpC:yfORnfLDzdSSN8HBw885
TLSH
T145E11F789508CFBF64B6776CAC688871AAB2013B77BF68C650B554C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 8f8d3c5244f94a5d1312e8ad6b80d2ee3f5389d9b3990ca52b99eaeb4c9e12de
MD5 407c4d1ff5d6fa1d9211ad12503b5a21
SHA1 b3089b46fa5b50019f47f7b68110cf5ff5588646
SHA512 33d3e8b74d6e4d3dac953d7b26b7015e77027a220b3d9b7edaa9d5170935457a2c4363a0eeb926c861a39ab2b42e6ed82460a7216fdce939e2fe739455fa4c6e
SSDEEP 96:xHgUTUPDqGqnfLLy1zSZMSSladv9jwin3H8RNBw88n8L4cnFpC:yfORnfLLy8MSS88HBw885
TLSH
T198E111789508CF7F64B6776CAC6488716AB2013BB7BF68C650B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads