hxxp://6nhmgdpnyoljh5uzr5kwlatx2u3diou4ldeommfxjz3wkhalzgjqxzqd[.]onion/

Resubmissions

25/08/2026, 06:18

260825-g2p85seq8s1

24/08/2026, 22:39

260824-2lb2ssvbqb1

Analysis

user interaction
yes
max time kernel
121s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://6nhmgdpnyoljh5uzr5kwlatx2u3diou4ldeommfxjz3wkhalzgjqxzqd.onion/
Sample260824-2lb2ssvbqb

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	firefox.exe
Token: SeDebugPrivilege	1768	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1768	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1768	1948	firefox.exe	83
PID 1948 wrote to memory of 1768	1948	firefox.exe	83
PID 1768 wrote to memory of 2500	1768	firefox.exe	84
PID 1768 wrote to memory of 2500	1768	firefox.exe	84
PID 1768 wrote to memory of 2500	1768	firefox.exe	84
PID 1768 wrote to memory of 1756	1768	firefox.exe	85
PID 1768 wrote to memory of 1756	1768	firefox.exe	85
PID 1768 wrote to memory of 1756	1768	firefox.exe	85
PID 1768 wrote to memory of 1756	1768	firefox.exe	85
PID 1768 wrote to memory of 2952	1768	firefox.exe	86
PID 1768 wrote to memory of 2952	1768	firefox.exe	86
PID 1768 wrote to memory of 2952	1768	firefox.exe	86
PID 1768 wrote to memory of 2952	1768	firefox.exe	86
PID 1768 wrote to memory of 332	1768	firefox.exe	87
PID 1768 wrote to memory of 332	1768	firefox.exe	87
PID 1768 wrote to memory of 332	1768	firefox.exe	87
PID 1768 wrote to memory of 3228	1768	firefox.exe	88
PID 1768 wrote to memory of 3228	1768	firefox.exe	88
PID 1768 wrote to memory of 3228	1768	firefox.exe	88
PID 1768 wrote to memory of 3228	1768	firefox.exe	88
PID 1768 wrote to memory of 5112	1768	firefox.exe	89
PID 1768 wrote to memory of 5112	1768	firefox.exe	89
PID 1768 wrote to memory of 5112	1768	firefox.exe	89
PID 1768 wrote to memory of 5112	1768	firefox.exe	89
PID 1768 wrote to memory of 3736	1768	firefox.exe	91
PID 1768 wrote to memory of 3736	1768	firefox.exe	91
PID 1768 wrote to memory of 3736	1768	firefox.exe	91
PID 1768 wrote to memory of 3736	1768	firefox.exe	91
PID 1768 wrote to memory of 3848	1768	firefox.exe	92
PID 1768 wrote to memory of 3848	1768	firefox.exe	92
PID 1768 wrote to memory of 3848	1768	firefox.exe	92
PID 1768 wrote to memory of 3848	1768	firefox.exe	92
PID 1768 wrote to memory of 3832	1768	firefox.exe	93
PID 1768 wrote to memory of 3832	1768	firefox.exe	93
PID 1768 wrote to memory of 3832	1768	firefox.exe	93
PID 1768 wrote to memory of 3832	1768	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://6nhmgdpnyoljh5uzr5kwlatx2u3diou4ldeommfxjz3wkhalzgjqxzqd.onion/"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://6nhmgdpnyoljh5uzr5kwlatx2u3diou4ldeommfxjz3wkhalzgjqxzqd.onion/
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {0ccb8d7d-8612-48ae-8754-9d7349b9ded5} -parentPid 1768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1768" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {567df2c1-ceb8-4820-834a-fee0ca59e2c3} -parentPid 1768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3804 -prefsLen 25164 -prefMapHandle 3808 -prefMapSize 270279 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {d859873c-2b84-4308-887b-2d5f3807d2a7} -parentPid 1768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27276 -prefMapHandle 3976 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {30554ce6-6024-472d-980f-d1bcbeb0256a} -parentPid 1768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1768" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2652 -prefsLen 34775 -prefMapHandle 2716 -prefMapSize 270279 -jsInitHandle 3012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4304 -initialChannelId {4033f241-22d3-480d-9cfd-256dbd534f3e} -parentPid 1768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4732 -prefsLen 34905 -prefMapHandle 4736 -prefMapSize 270279 -ipcHandle 4740 -initialChannelId {c92f0679-d9ac-4d54-bf8a-55ce2c01fc5a} -parentPid 1768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3084 -prefsLen 32900 -prefMapHandle 4736 -prefMapSize 270279 -jsInitHandle 4660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4944 -initialChannelId {6967ac57-e9d7-41a6-9290-00fb996772fb} -parentPid 1768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4972 -prefsLen 32900 -prefMapHandle 4976 -prefMapSize 270279 -jsInitHandle 4980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4988 -initialChannelId {e0f83a80-3114-4b37-be65-f01e37594b44} -parentPid 1768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5328 -prefsLen 32952 -prefMapHandle 5332 -prefMapSize 270279 -jsInitHandle 5336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5344 -initialChannelId {860cab41-ee4e-4dce-961b-ee117dd20149} -parentPid 1768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 10KB
SHA256 91ac0c4a0e9b8e1f2ea246b1cee7c0360e3b1f940945166f3c106fcfc4c96cc3
MD5 80444158b2049d2589254373d2d53bfb
SHA1 b54a19a1ed2caa4ebd29251d2b1aa9ab3001a681
SHA512 40a68ff7fd5d38ec7333a13bfbcb951f39090ce0d26511533e34203224ac95a1ecb9b970f2ed1ca5ade13ac39b6f4c961200517b6c2c81b9f1545a14328b46e8
SSDEEP 192:HcypKRycXz5RqvAcdRPSHXFCPD1Oo1+fj+SCt/cjw5w+SfjC16:HXkRyiO024YU+SCtkjGw+Sm4
TLSH
T130226EBE8F002CF81F77C05CD8A54619CE58A1BBEDE7C07E20243C58CA94B2576F9499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d58e66ac9ac8d0025540e86c0164eef64c79d6a654386daf0c92fc0e8abcf043
MD5 a690f9fb0b5ffed6d920cf6a9a6d3f80
SHA1 d61af37dffd056b25081d789b493c8a752cf5db2
SHA512 f46c9d620f6b51644019c3454c09331158c47b8c81aff81707e01fa20ff90673089b7156df26fdf20677cf8b16c74e01c9530c563701040ae419c8fe3427d8ee
SSDEEP 192:LOv5zboPMZbWyjOQ31d66JozGzgCl6mc0dz:UbokZbWyjNd66JozGzgC1jd
TLSH
T1B9E11E64E628867FC008027BCCA21F814F3A389A984E7F1535DC64082D576DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 baac4285118ef54727bf32d25cc150533fcc98b1cb4aff66c76984dcd082a70e
MD5 f9d371cab1252e9375039cb8c3a04f2f
SHA1 001faef357807df5281e41124d2a5f6b5e16bf53
SHA512 ec70172ed8575531cc3cdc5d54cc9e0488954543dda83233ea8b61c76a4b8ff45e114ddab723198f9d8a23d750178a229d529a9ccd8a26dacf4ac76559e20247
SSDEEP 192:0Ov5zboxZbWyjMj1d66JozGzgCl6mc0dbI:XboxZbWyjcd66JozGzgC1jC
TLSH
T1AED1DC28F229463BD419027BCCA61F800F36389AD84E7F1531DC644C2D976DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d1f952ccbc45f337789d023d7312d26c1ecd62b72e6345e2105dccbddbfad61b
MD5 a4d8bb63670f76a6c704eb0eaf96c3d0
SHA1 64dd1dfa2c7acd44fdea7f4090631be724f78573
SHA512 1abd5c23418acc885c964c08744f33bee627cfb91c698555e25735b6d9b0fd7f5a612fa26202808c08b72d4d5e30037672b5116066cb2aeeba41547c5a98e119
SSDEEP 192:0Ov5zboxZbWyjMj1d66JozGzgCl6mc0dz:XboxZbWyjcd66JozGzgC1jd
TLSH
T1AFD1DC68F229463FD419027BCCA61F800F36389A984E7F1532DC644C2D976DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c541cd08d6b45ec51144b79ffc53d82ab6504598e9163e17c7ae4f196a0ec5d4
MD5 5038cc41ffebfd82eb8b3fd82581b086
SHA1 2faa8e79c97bc6db027e58b0267a796ed575296c
SHA512 a26e77ca3ebe494ff53fdcb0b514ae4586a39458473d412355f17c5fb3765872517fb7d1cabc696610ea15ce4c8c9562ecd988924223bb9dc55040c4840d638d
TLSH
T13021495C3AB88D6AA8DFE25C7484068F93958E0708871D470D52FF8DCED5AD9316A43D
MD5 SHA1 SHA512 TLSH

Submit Download

1ac5e5ae-963d-401b-bda2-b6ec1ca93a8c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\1ac5e5ae-963d-401b-bda2-b6ec1ca93a8c
Size 883B
SHA256 faffaa9c1808e531dabc9047e2507b3acdb22ef077bd918ad1a27f34acda7b11
MD5 5ca5c4cd076a2c009b98a19f695a1568
SHA1 af7e10be2938bac78646393fe044c48cba0d6558
SHA512 fdbc45287ea9e742b705bfee137f914e5f3dfe8d104ef5c36ebddc0d96472ba306ae9e7214b8048b3f491f0c9d91e4717785744f5957317dbf56c2ce483489a5
TLSH
T1F5110080A37479F2CCA8C29BC55137428BF47513C0C9A4043EA04A140C7EA2E97BA70B
MD5 SHA1 SHA512 TLSH

Submit Download

6e21e7df-2770-4a00-90a8-2a73d0207468

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\6e21e7df-2770-4a00-90a8-2a73d0207468
Size 235B
SHA256 dd0679ca45c8ccd379ec62e1301bf467d988aba48b107ba8f27901fecea0089c
MD5 45843e89cbc0e4487a66474b85fe459a
SHA1 41ed4bbdeb4dd79373c091c4f9d54be23612cbe3
SHA512 29f924911ad8691763f9e0501cf10dc55b5d5539b02e52b04a6df08cc5e7e2713109d3994a9ab61a813471544de2112eaaa1a7aefd8316df392e00ae9a803760
TLSH
T1A0D0A7906498776D58184F17B1B069D672CD4C33287D68109AA146749AB9EC44361817
MD5 SHA1 SHA512 TLSH

Submit Download

741e9b49-538a-4b43-ae75-9da0ce1b6b98

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\741e9b49-538a-4b43-ae75-9da0ce1b6b98
Size 2KB
SHA256 6c1aa4d4dc1a67f3a231c4dadb54768faae7b64fad27cabde540b91e0c931464
MD5 b6804ba8a1fc9c32a127d450110ea4d6
SHA1 00a1256e8c928c0810e565a94f0493fcc69e7a0c
SHA512 d985222fbe1979b5259bf7b9c686b0a390fa3c1d37a2f41ab9c041bbf5fe5f1918e71c1c780680b871376cc5c7696cff19a75fb9458b127ec24da7b6ac485768
TLSH
T1BA41405C75788DB68DAAE19DD052338E57608E0200C62CC72E52EE4CCC97A6D337A57B
MD5 SHA1 SHA512 TLSH

Submit Download

8ec5ed75-f743-468c-80c4-9b16a337770f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\8ec5ed75-f743-468c-80c4-9b16a337770f
Size 235B
SHA256 ef2a3adc92af910124d3bc0d1c5885e15bef0691f5cb9ed88fd326e9b634a616
MD5 b63bf6b504de513d6a02f11557b30e9b
SHA1 9c197bbc0f9e756bb79b1e5e953c1a788a735bb7
SHA512 d087b489560bc1e3e0948dcc0a44bc4dd7d1a3ff198b74be7877c1bb984ee882c9505ba741093c17b98cedbda9b1826bcb90aa9c55b6812941e25f051ca29743
TLSH
T111D097C42C9CB75C08100F0BF0A07EC232A88D3350E0A8909A5081B88AFE9D841A2C4B
MD5 SHA1 SHA512 TLSH

Submit Download

b29eeb62-7a2a-42e1-abce-2a7c3cc07654

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\b29eeb62-7a2a-42e1-abce-2a7c3cc07654
Size 886B
SHA256 49016b4c0fc24692296f179bc72d7eadccd4fdc0446488935fc63454344bbe2c
MD5 aabb87e64915e73c3be58c57f525f0d0
SHA1 8523959ea101ab274c982c55f28ebcb5a43fb542
SHA512 34acf111cc7454996b60d8b2c4468024a788328ed3fd401e77aec8fd27a1a2939f26c13e07de5cd56fd8ed713cbc85c89248b2a9a290691acef2e01b6c3045d2
TLSH
T134110050A674BAF2CC6CD2DBD5A27B868BE07163C0C95C547E901E184CBE92E56B630B
MD5 SHA1 SHA512 TLSH

Submit Download

be4adbf8-0f24-4dc8-9e83-b844326ccaf4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\be4adbf8-0f24-4dc8-9e83-b844326ccaf4
Size 15KB
SHA256 7eb1372c4ad41386dec4a38c034297e461d7f78e76c388758f3736001c03d84c
MD5 344d437cc9bf5346040a6e6a778914d7
SHA1 a28b5fe2803201cc7b14ba195ba5c075725e96ad
SHA512 bf0889932b5da087b9e43d6a7da01e59ae31cb20062b5131d24ff30a0c58246ba047a2909b6749ee6e89d87c0b3d6e6baf7af5fafd099519ab2856d80f0f5d50
SSDEEP 384:y/c8SAUz14P1eXC1dilt3RB4JgHb5Hfry:y/9SjzqAy
TLSH
T1DC72B9562830497A8651E3AC94FCBFC7E5F528CB4C419FCA9BE4BD086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extensions.json
Size 16KB
SHA256 b1c9817050e98e69f89874416db764c8f0300a0a1ad6203cb4304e2df786f134
MD5 d39b7567ee84436d320bc0837ed98585
SHA1 69784a092ed677d4ee230a0e6a5bfd55dca2b492
SHA512 b6d8eca2bf4289d44a72981b647d7743a4e7304330428f32f3d0f26b8a74dab98bc92c9eb25d5b259118729d615c57c4bccd00b5a557d63f486dd3da9246dc43
SSDEEP 384:AkI4vyUmldvXf8dhWnV94z6196opL4HBL4PlL4HDL4HfL4Har4hu:nI4qRf/0Xen4K6W454d4P4j4w4g
TLSH
T1A472521545448EB8294FA79BAA36BE01C37D433B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 7KB
SHA256 46a028c9577b334b52fd1bad3841c63b0c172728f3f170daf35127964541d425
MD5 0039afdaaa526c01629454f924fa99b1
SHA1 94301e4e2a839396b6ffea0e570355b80af58f05
SHA512 301daff0df8667b5e8b7670696a53ccf58a14455834b7f63b762e22393ac691d9c53ea967424d99308c68aa6d6cb644d9f8286ad88a020255187e4d80dcf6a16
SSDEEP 96:xHHZPUDVVWTUZfvqGqqkfz/pWv1R1ObzSZPmSSlDdv9jEnLWRN2HL4/3y3UBw88m:9FRFfrpuv1WSSvRNa4/3pBw88GM4
TLSH
T1F3F1FE78A144CBBF64B6766CAC288D315A72023BBBBF68D710B954C4054CF3445FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 8f759ca078c6ffd22d2b651b179a9bd8bba4d9bd24a7fd53286949240a04f33e
MD5 9d58815fddbf3c8a475cac9f4a5d10e2
SHA1 06661fb04d67ce56062813307c004325e7ef200c
SHA512 4763e461df32662ddd9afdd0ac6fbfd226f735c9aa26f0ffa6cc042d6e63a3dc34ebcba52d082219dabe90cdd5e455ff252f07327de0ce9a95e9df3b0c277158
SSDEEP 96:xHHUTUZfvqGqqkf+upX1zSuGSSlDdv9jEnLHH4/39Bw88n8L4cn/MVzW:9QRFf+upXESSaH4/39Bw889g
TLSH
T1F2E11D789108CF7F64B677ACAC2889716AB2013BB7BF28D650B65484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 22265149080398a867021feeac8b95583b9588c7363a9a382be20cd318c564ab
MD5 43c285c78512211a1ece55b38667adef
SHA1 6fb61878c66fe8663923acb7622c4798b2a26561
SHA512 9a6cefb19b30bc40a35361f0a23940b9e0164836de0054fffa451272c0f1365d23a30695e550d93f472d06fe32c4b9bd8645df2f58f336c258bf3dc6175bdfe3
SSDEEP 96:xHHUTUZfvqGqqkf+1R1ObzSZPmSSlDdv9jEnLHH4/39Bw88n8L4cn/MVzW:9QRFf+v1WSSaH4/39Bw889g
TLSH
T116E13E7895088F7F64B6776CAC688D31AAB2013BBBBF28D710B55484054CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 efff9925030788100111876b27fa619ebad3b3aab74789805455578c66ac721d
MD5 1c57e9af819d22b372990094bcb39079
SHA1 8517a7b86fe634ab0c614ac42251585259c862bd
SHA512 9b054af7a199c5decb95eec35c7418f23353c8d9d5b286560d7bc90e99586479862e6c6cf39ab69da4e67c2a685c52374a386c5708c2a08f9d670d52003e9b27
TLSH
T156413BE7A8972CF2763169C9A4C50DF1CA1831328CB0CC70DA492E2627CE695A34FA5C
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads