hxxp://6nhmgdpnyoljh5uzr5kwlatx2u3diou4ldeommfxjz3wkhalzgjqxzqd[.]onion/

Resubmissions

25/08/2026, 06:18

260825-g2p85seq8s1

24/08/2026, 22:39

260824-2lb2ssvbqb1

Analysis

user interaction
yes
max time kernel
32s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://6nhmgdpnyoljh5uzr5kwlatx2u3diou4ldeommfxjz3wkhalzgjqxzqd.onion/
Sample260825-g2p85seq8s

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	firefox.exe
Token: SeDebugPrivilege	4576	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4576	firefox.exe
4576	firefox.exe
4576	firefox.exe
4576	firefox.exe
4576	firefox.exe
4576	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4576	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 4576	344	firefox.exe	85
PID 344 wrote to memory of 4576	344	firefox.exe	85
PID 4576 wrote to memory of 3164	4576	firefox.exe	86
PID 4576 wrote to memory of 3164	4576	firefox.exe	86
PID 4576 wrote to memory of 3164	4576	firefox.exe	86
PID 4576 wrote to memory of 3332	4576	firefox.exe	87
PID 4576 wrote to memory of 3332	4576	firefox.exe	87
PID 4576 wrote to memory of 3332	4576	firefox.exe	87
PID 4576 wrote to memory of 3332	4576	firefox.exe	87
PID 4576 wrote to memory of 2992	4576	firefox.exe	88
PID 4576 wrote to memory of 2992	4576	firefox.exe	88
PID 4576 wrote to memory of 2992	4576	firefox.exe	88
PID 4576 wrote to memory of 2992	4576	firefox.exe	88
PID 4576 wrote to memory of 1808	4576	firefox.exe	89
PID 4576 wrote to memory of 1808	4576	firefox.exe	89
PID 4576 wrote to memory of 1808	4576	firefox.exe	89
PID 4576 wrote to memory of 4608	4576	firefox.exe	90
PID 4576 wrote to memory of 4608	4576	firefox.exe	90
PID 4576 wrote to memory of 4608	4576	firefox.exe	90
PID 4576 wrote to memory of 4608	4576	firefox.exe	90
PID 4576 wrote to memory of 4620	4576	firefox.exe	91
PID 4576 wrote to memory of 4620	4576	firefox.exe	91
PID 4576 wrote to memory of 4620	4576	firefox.exe	91
PID 4576 wrote to memory of 4620	4576	firefox.exe	91
PID 4576 wrote to memory of 1984	4576	firefox.exe	92
PID 4576 wrote to memory of 1984	4576	firefox.exe	92
PID 4576 wrote to memory of 1984	4576	firefox.exe	92
PID 4576 wrote to memory of 1984	4576	firefox.exe	92
PID 4576 wrote to memory of 4016	4576	firefox.exe	93
PID 4576 wrote to memory of 4016	4576	firefox.exe	93
PID 4576 wrote to memory of 4016	4576	firefox.exe	93
PID 4576 wrote to memory of 4016	4576	firefox.exe	93
PID 4576 wrote to memory of 528	4576	firefox.exe	94
PID 4576 wrote to memory of 528	4576	firefox.exe	94
PID 4576 wrote to memory of 528	4576	firefox.exe	94
PID 4576 wrote to memory of 528	4576	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://6nhmgdpnyoljh5uzr5kwlatx2u3diou4ldeommfxjz3wkhalzgjqxzqd.onion/"
1⤵
- Suspicious use of WriteProcessMemory
PID:344
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://6nhmgdpnyoljh5uzr5kwlatx2u3diou4ldeommfxjz3wkhalzgjqxzqd.onion/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {8a1a8aa8-2ef5-45c3-8db9-783a1bab5e99} -parentPid 4576 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4576" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {d78ecf68-4496-475f-94ed-3932e3915a92} -parentPid 4576 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4576" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 25164 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {e8929851-7826-4b39-8273-cdd16009dc8a} -parentPid 4576 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4576" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27276 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {b8efe25b-ddb0-4793-89ee-6ae2fb966f43} -parentPid 4576 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4576" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4228 -prefsLen 34775 -prefMapHandle 4232 -prefMapSize 270279 -jsInitHandle 4236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4244 -initialChannelId {4f590fea-39a3-4bb8-aa42-2d2ed666b51e} -parentPid 4576 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4576" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4680 -prefsLen 34905 -prefMapHandle 4724 -prefMapSize 270279 -ipcHandle 4748 -initialChannelId {239ad9b5-6891-4a7b-95d8-c468dbd646ea} -parentPid 4576 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4576" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4932 -prefsLen 32845 -prefMapHandle 4936 -prefMapSize 270279 -jsInitHandle 4940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4948 -initialChannelId {380396ac-b381-4315-b51a-b867553762eb} -parentPid 4576 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4576" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5124 -prefsLen 32845 -prefMapHandle 5128 -prefMapSize 270279 -jsInitHandle 5132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5140 -initialChannelId {55899bec-53e9-48bc-acba-280dde821224} -parentPid 4576 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4576" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5084 -prefsLen 32845 -prefMapHandle 5080 -prefMapSize 270279 -jsInitHandle 5076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4928 -initialChannelId {05070278-3ee9-4d3e-958f-314083c7de8d} -parentPid 4576 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4576" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 10KB
SHA256 a880a0da6776e8abf4a3dcd2607bba268b24dbf9b83e61db4f50632a7eda84f3
MD5 cdf32cf3776cba53863e5edbc7b3038d
SHA1 f87834c6ac22370311f8571afdb0b3215845aeff
SHA512 5211161b016e9ac237be90f718e59017afe385674572b1d791a79d53f454638ae914377e168afe1c5b2e4444627fea598a3cbb0090d579a408eed15d96e05e17
SSDEEP 192:HcypKRycXz5RqvAcdRPSHXFCPD1Oo1tssmr9M7ukNY1o:HXkRyiO024YEr9MZNYm
TLSH
T13C224DBF9E403CA81A239099D5A8911C8F08E5BBDEE7D03E20583D8DC96475A71F94DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a72a577bbc5a582a6cd627f6669f1206acea92ac905324115c5191795cecbc30
MD5 a62dabcda2a78582b061aed779ef1d3d
SHA1 27c2c43f23bfd9ab3e398673352f577d2a03ca44
SHA512 db3aa9c67f15ea38617cb77735e8715c2c38cf58c01ea1c69a6d540b02f3f94eb99777c800df3ae5efb868069a44e90def3b6a92eaf955363be4a8efaf835d64
SSDEEP 192:DOv5zboPjMRgcyj5DS1d66JozGzgCl6mc0d:Mbo7MOcyjdcd66JozGzgC1j
TLSH
T1E9D1EA68FA29863FC418423BCCA50B400F35385BA84E7F15319CA41C2D972DEBACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d925633b5c147593cd7aab9b72223a11763d6ed57152376a9dc50c2b50c29b4c
MD5 94cbd4bb0123d3a85896f94b2768a76d
SHA1 0d562ed72edf45cf0711613c2749e87f9fdaf81d
SHA512 c596f5b012d8bfa56f5b7aeb27c1a9adcbf324544eeae0bc5dacedc36c700e753ba793a8624842c1a77d625e6f4b97f352146ae3109d00ac128899da8c3b231c
SSDEEP 192:US1d66JozGzgCl6mc0dkOv5zboPjZRgcyjP2s:Ucd66JozGzgC1j1bo7ZOcyjF
TLSH
T1C3E110A8FA28863FC418427BCCA11F414F39385A984E7F19359CA51C2D572DD7ACE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 0574cdaebf7514199abb12d7b77eab46ce1393a1909ae2e27a50abdc224b4084
MD5 79cbf8fda20100efc0bb5578a16d3629
SHA1 e98ace29b124ff8e58073fa837ac2cdabeef8884
SHA512 51e76edb77e4a93e2d885b18e49c1d065c58aa0e1d19c0e70e7dd107516f3519294c1b12d8288b29bb8e53934ed685faaf032a848d416822da47d08a7902bd1a
TLSH
T1B561C858F2298A3FE445423ACD921B412F343456E8AE7F2A38AC614C1E5B2CD76CD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c1f5fe6c163afdecd8da49b354595b5a8d209d5285f1c7a9e877526ed91ccc25
MD5 bae1ada15f9f85582e3ed638a9b461c9
SHA1 5e69965d55dac92ccf35c24291bff954fec74878
SHA512 9c1545a3c0e9d2568fc32be138e7fd1d25847f6eacbbc8e3cc1801d59feb53aaf834832642ccc14a663ea3b5ab386d1d9808c93392ce53c1249bfa293bbbaf09
SSDEEP 192:US1d66JozGzgCl6mc0d6Ov5zboPjZRgcyj5I:Ucd66JozGzgC1jzbo7ZOcyju
TLSH
T132D1EC68F729863FC419023BCCA61B410F35389A984E7F15359CA41C2D972DE7ACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7a7d5cfc9987accfbddcebd35f3dd3558575087655e39076f14da10c46980b4f
MD5 263b12c43e69258cd564807eb10a0b32
SHA1 aa6de8e681670f204464849c857dce12bae4734e
SHA512 b172cbed343cbcc863ba500502aa060bf6d766a9466cf831d3b47a855184480bbb06765c2ab5363e36c9f3d9253e1ce656b125cc0d3798144a338b0bc0bf8128
TLSH
T147213D9C39B94E6A9CC7E26C748015CF67258E434D871D430D12FF8DCE81AE9326E438
MD5 SHA1 SHA512 TLSH

Submit Download

21d204e5-1b57-4696-ab26-bdf80987ed56

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\21d204e5-1b57-4696-ab26-bdf80987ed56
Size 886B
SHA256 92503f4e1c0c66c3a2cce310cf38e7a6d939150d98295caa728d66c31e46bd52
MD5 b9e40b31bb9c7a7757a30f518a870eda
SHA1 78eaedca9335ac39f625cfdc2c6c97f65a0ef516
SHA512 ac864ba2d8825f597b900c662a9085fd809a7370307f68fcb46c1ba25ae20b81988d698a7b3c8af2a32ca3c2ea7c9176ef0c78f84b1bd8bc22eb331623812849
TLSH
T1E81167409B7874B28C78D64B9AA077028FE03033C0C659083E418F280DFE11E93D7607
MD5 SHA1 SHA512 TLSH

Submit Download

463abb20-0d23-466e-9d4d-d20cd419091f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\463abb20-0d23-466e-9d4d-d20cd419091f
Size 235B
SHA256 ecf2c3c58413fc85c0e018f3c1a20c5e1aa7fad7cd15612bbbf1987a6651ad0c
MD5 6d70440ed66dc7c3e39e0e5f63f2a8d3
SHA1 641df205ce4c2b2ef37ef53b2aa67a743dc9e7ab
SHA512 0a390bfd642f786902e7d62bbd0ad7c0074e98c39e18124d1c37419fde3295564492e2ee134ac9ac712dad77e186d9ef22af1928edfb1adff661a40dc5fb1c50
TLSH
T146D0A78564986B5D08141F17F0A0A9C675A98C331875A860D97245789EF9EC8916681B
MD5 SHA1 SHA512 TLSH

Submit Download

5ab13f80-6a55-4533-98ef-d247d885ba92

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\5ab13f80-6a55-4533-98ef-d247d885ba92
Size 235B
SHA256 72282afb9a2587c210e63076c9b66ac4eb188327c51df198b551c3a258cb720b
MD5 eb11dda832de097f7b16c856d18968c7
SHA1 420a5974f50a1bfd051ae475a666f2ce98a032fa
SHA512 58c1599a579a2fbf8a0cf19f2679f6d2c7c43b2f3219a495cfd74fa0c1fa506d8e8e668a1f6b74b6eba668ddff4efae514224f620d8a1ab638a6791d6add6fbb
TLSH
T11BD097806AA8636E08100F03F0A02ACA30568C3329F4B830C5A60134CAFDFC9029182B
MD5 SHA1 SHA512 TLSH

Submit Download

9e570c9a-8453-47d7-9b1c-e945dc506562

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\9e570c9a-8453-47d7-9b1c-e945dc506562
Size 15KB
SHA256 8f317c85077dc88f94102bdb99937d6d4e3e127d5685f4e1a164ff674cb4b642
MD5 a5086beb5aa9d0c97feee6d8a68dc197
SHA1 5915d93f50cb00ab0e01f030c48547d7406ef038
SHA512 65f76726eba075775808ffc4cecf2229d5636ce694f74a1a18776bfe7550fe9ae3310d6549fa47a7dd4c4ec024d51dc12edc6f17285cdf6f7f2950355a632845
SSDEEP 192:tA2c6D1R64B5zSMRtDxcB1DaITHq2EcHPF+ipstS0jx29RCWdT/yN/t1SfmOobGK:tTZLTmMRtDxcvDrTKp0PXpy2A0O46OQ3
TLSH
T18872CA16683055BA8291E3A894ECBFC3E5F538CB4C419FC9DBE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8248c68-2669-48e0-9375-556aee8b3bbf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\d8248c68-2669-48e0-9375-556aee8b3bbf
Size 883B
SHA256 1aa50fe142f68bfaef8abd27085602086166b3974b152c8e61f265a832db1b3c
MD5 e572d0b098918e11166917697c210a90
SHA1 93adacee42f848d9e1b05d3e395b1a80d8c5cf1e
SHA512 3e0ff1b6cfad38a4fff79865a2cee673752f5b0b02795771ded4eda756828855a0d5f42915810558ec0bd4d39f61f86a003337011187b8c4ea6ee6243c740e68
TLSH
T1E711E790A639B977CC7DD24B85513B029FF43527C0C9D5043DD19E140D7E52EA3AA60F
MD5 SHA1 SHA512 TLSH

Submit Download

e6e799cf-189c-437c-9b73-22aaf9faaee3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\e6e799cf-189c-437c-9b73-22aaf9faaee3
Size 2KB
SHA256 6e7aa7118648eb8991a4748e2c0d46da18cc1f73d41cf022cb1a070c1d0ab3d2
MD5 1cc3af5907f25451b8b67879463b8a03
SHA1 ea885c8b5488ce534f56e3bc0bb6cbb096c7d9e8
SHA512 2dcabaecc4c58fcae7c29f41c8e610446b6866310f432c88e5609a095ee0000f0afa0f5af6c74f96ad2b3f05033f0a71727328a8abf1202105801e6972e7e940
TLSH
T18A41306C35788CBA5DEBE58DD481234E6B644A1300C238833E61EF4C9D9A65D736A43B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extensions.json
Size 16KB
SHA256 a0d69f31b8e26a089e7c44314626628178ade88ebb1db39d38ef051262687132
MD5 3d8f1553b15b513598df136ce93485db
SHA1 ec08f1771e3644e4c8f347c4cb2ab33b93067f82
SHA512 99a11d2dba8ada78b4a0207776974593cf790cbdcadbf1bf37f5005a685477358c5786a8905979fa5c0220ada17e8c17c547ebdb93b2a1670364675865de924d
SSDEEP 384:ghkI4vzUmldvQ8dhWo94zr96oQL4HQL4PGL4HzL4H/UL4HMRp4hw:PI4LRfJXF4F6Z4y4U4f424sT4a
TLSH
T1DF72431545049EB8298EA79BAA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 8KB
SHA256 a793ca0d791b4f0bdbf632793f3bf8f69aebc145b57c92d8ab19116721a5508d
MD5 d09a3a0cde9def97589672808742ea94
SHA1 6bc36e9a2f7f64b954331b349d19bdf5ad4d7694
SHA512 535eb6bf54f815e6ef894c07a0e153b8674da461f4948cac245cd2f2c8153e1ccd04685cf75d6c1c6452d9f660d7695ef2b20271fe6c7d25eb9f94d278a42c39
SSDEEP 96:xHiBTUMqGq/fAOtFPObzSaSSlmdv9jbnytWRbr5AsO7HjvrBw88S4eg8L4cn23U4:UuR/fAOtFPgSSZ4RGsIHzrBw8842
TLSH
T1ED020D786004CF7F64B6376CAC648C716AB2023BBBBF68D614B95484015CF3446EDAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 88b9e6d6d743991d8d25d7c9e4c6cd0a810dea95871df4e18ed8b873518f48fc
MD5 11d8489b3ff457f04085cfb302177816
SHA1 1b034b33fda50f543f8d26fc04b82609607e9eb7
SHA512 b56fbd0ce49fbcd332f6122e8193d05573e12e1fbaea94108bf602baf78b8605b8ee307f998a769a1f02ad0fe6a8e9acf2d6865512240bb208cdc7d88f63afe7
SSDEEP 96:xHiUTUMqGq/fSrO1zSnSSlmdv9jbnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrOWSSZxisIHzsBw88J
TLSH
T1D0E130789048CFAF64B677ACAC6888716AB2013B77BF28D650B594C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 306e565fc8b0ece626087bf0e96a0627bd93c6f508f0f4b0b6352b1e99e25fe0
MD5 855416866f52d476a1303c9ec12686cd
SHA1 06d2f0b8c4731391f4c0857902cf51890bc80386
SHA512 d9fda7a4aa3612a0a32527f0950f3642c3825a5f79af2224ccb374a637e87c8834077744eb0539782adfda19791d6f9405260d034917fd5de13fa6ca4352e6d6
SSDEEP 96:xHiUTUMqGq/fSFP1zSaSSlmdv9jbnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSFPHSSZxisIHzsBw88J
TLSH
T11FE13F789048CF6F64B6776CAC688C716AB2013BBBBF28D250B594C4055CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 131182bd9ddf600a27ebe96495e7593f57c563fb8f07a597fe70296deeb21a48
MD5 b803d576fdfc42642e2451014691a544
SHA1 0583e2b6e4ede29812daa68f8fbe3290d485b675
SHA512 4d778673b84c875007091d10b121cead34b2d3757f26d839a845b60cff77688054f4a83b33fc9a36a40461a231fd02b4d72932b147e34bed73027b47e7deb31c
TLSH
T196411BDB98572CF17A34AEC994850EF5CA5A31338CB19CB0CA4956172ECF181328FA98
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 409616db24d0c53e69837ce29b304527e1b8b5f593031a5c6fb2883e709b5390
MD5 a8a8b449ef622244bba9a8432f59d8c3
SHA1 c9f3c7aff5285e26629363a835edd896977b1310
SHA512 e5c7acb896f31edefc54c7510577506f44ce03e95c460f76044303abc77faa2fb8e0e283dce6fad9c864699d9df4d3ca0108a839cb6fc610908051f0ea606df5
SSDEEP 49152:qBj3QLjgCSizDGYwul+SXZaW3smH0NUuEw+G:Uj3QLjgCv+SXYW39HaUc+G
TLSH
T11C1639F824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CDFAE05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads