hxxp://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid[.]onion

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Sample260831-ecltbacr6y

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	firefox.exe
Token: SeDebugPrivilege	2916	firefox.exe
Token: SeDebugPrivilege	2916	firefox.exe
Token: SeDebugPrivilege	2916	firefox.exe
Token: SeDebugPrivilege	2916	firefox.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2916	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 2916	3220	firefox.exe	84
PID 3220 wrote to memory of 2916	3220	firefox.exe	84
PID 2916 wrote to memory of 4380	2916	firefox.exe	85
PID 2916 wrote to memory of 4380	2916	firefox.exe	85
PID 2916 wrote to memory of 4380	2916	firefox.exe	85
PID 2916 wrote to memory of 4036	2916	firefox.exe	86
PID 2916 wrote to memory of 4036	2916	firefox.exe	86
PID 2916 wrote to memory of 4036	2916	firefox.exe	86
PID 2916 wrote to memory of 4036	2916	firefox.exe	86
PID 2916 wrote to memory of 3916	2916	firefox.exe	87
PID 2916 wrote to memory of 3916	2916	firefox.exe	87
PID 2916 wrote to memory of 3916	2916	firefox.exe	87
PID 2916 wrote to memory of 3916	2916	firefox.exe	87
PID 2916 wrote to memory of 4872	2916	firefox.exe	88
PID 2916 wrote to memory of 4872	2916	firefox.exe	88
PID 2916 wrote to memory of 4872	2916	firefox.exe	88
PID 2916 wrote to memory of 3840	2916	firefox.exe	89
PID 2916 wrote to memory of 3840	2916	firefox.exe	89
PID 2916 wrote to memory of 3840	2916	firefox.exe	89
PID 2916 wrote to memory of 3840	2916	firefox.exe	89
PID 2916 wrote to memory of 2968	2916	firefox.exe	91
PID 2916 wrote to memory of 2968	2916	firefox.exe	91
PID 2916 wrote to memory of 2968	2916	firefox.exe	91
PID 2916 wrote to memory of 2968	2916	firefox.exe	91
PID 2916 wrote to memory of 4644	2916	firefox.exe	92
PID 2916 wrote to memory of 4644	2916	firefox.exe	92
PID 2916 wrote to memory of 4644	2916	firefox.exe	92
PID 2916 wrote to memory of 4644	2916	firefox.exe	92
PID 2916 wrote to memory of 5068	2916	firefox.exe	93
PID 2916 wrote to memory of 5068	2916	firefox.exe	93
PID 2916 wrote to memory of 5068	2916	firefox.exe	93
PID 2916 wrote to memory of 5068	2916	firefox.exe	93
PID 2916 wrote to memory of 1628	2916	firefox.exe	94
PID 2916 wrote to memory of 1628	2916	firefox.exe	94
PID 2916 wrote to memory of 1628	2916	firefox.exe	94
PID 2916 wrote to memory of 1628	2916	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion"
1⤵
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {a82b391b-2c54-4250-b493-c333a8f09f8a} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {3f5748a0-9124-4a65-958f-9b583d269b2f} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3776 -prefsLen 25164 -prefMapHandle 3780 -prefMapSize 270279 -jsInitHandle 3784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3792 -initialChannelId {85cbdec3-6449-43dc-853b-661f56de0f00} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3940 -prefsLen 27276 -prefMapHandle 3944 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {27b1f2c2-792c-4ec8-a80f-060ef805ccdb} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2956 -prefsLen 34775 -prefMapHandle 3104 -prefMapSize 270279 -jsInitHandle 3712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4300 -initialChannelId {9d57e2a3-2476-4dfc-a36e-373d3b92cbed} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4648 -prefsLen 35012 -prefMapHandle 4564 -prefMapSize 270279 -ipcHandle 4724 -initialChannelId {be339d8b-4701-44ae-9d36-3f0a1195d80b} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4948 -prefsLen 32952 -prefMapHandle 4952 -prefMapSize 270279 -jsInitHandle 4956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4964 -initialChannelId {a3efff1b-b720-4f14-a7b5-167622d6d8bf} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4980 -prefsLen 32952 -prefMapHandle 4984 -prefMapSize 270279 -jsInitHandle 4988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4996 -initialChannelId {bdba7001-fe16-4508-9d3f-d4b85f1259d9} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32952 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5364 -initialChannelId {5ddea4d0-2344-4d51-a4af-6a0c92b08e8f} -parentPid 2916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 10KB
SHA256 92829d51108b715bd62aa0af31e41fe209802e97435aab5f2749b0432b492d4b
MD5 6f1db9af77c5bf4bac7839a18cfa2440
SHA1 6b4ad43e2444b4151b03d87d2922f44c82495f7f
SHA512 a76ffb205ed52435219e34c5ed029eca07728c6480948963faded585b5fed92c245a2f32f128319b4fbfd4bc7de9e47bc1508033ea085f9cf7310e9e43d618f3
SSDEEP 192:HcFpojcXz5RqvAcdRPSHXFCPD1Oo1qYhVpSOVmqMFcEoaczS1gQPd0:HkCjiO024YDV0OV/MFczSo
TLSH
T1A4226DBF9F003CF81A57D188D9B4924E8F19E5F7DEA3902A511C3808C9C8756A1FA49D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 10KB
SHA256 6e49f46eceb1ab38af0e9c30d9173ec618b195aba9c09a17034c8ec840a2721e
MD5 6d5de196bc10b8392e6976f1316615a7
SHA1 94e0dfa11e197498207f2def922153d2526768be
SHA512 497227d9359133cc8c621f3d8d36fcbb4344b523b48401ac009bd55fe39954fea7e3f2c6605bee82cdab076a40c569acc29f4c13b036efda70dd9410071ce89a
SSDEEP 192:HcypKRycXz5RqvAcdRPSHXFCPD1Oo1bYhVpSOVmqMFcEoaczS1CD7:HXkRyiO024YWV0OV/MFczScD7
TLSH
T131225CBE9F403CFC1B23909DD9A5821D8F18E5ABDEE7D02A111C3814C9C8756B5FA49D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 e81a161d0048f49f91828d9237f640e493facc0157da11dcea23f34fd90df39f
MD5 73b4638d9b57c5a06116291d1b442760
SHA1 4c0345dd32940440f8c111325d07009b23f0cb5e
SHA512 a295b0f3c6fa3e846ffd34b031ade1b35a272df21b1d2b3fb59764d4d559c0d9698026a9017a1621c49e324f92c7b0c38ec2c64dbefddd16e40bf06d50abf767
TLSH
T19C61965CF228863FE445913ACC965B411F347456A8AF7F2A39ACA04D1E5B2CD768E03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 ee55bb78f6d2ee9246de155811bfaa976bfdfc64d8b23531150524785f1070c5
MD5 e3464fb01d65b7177b3bd8b5bf461ecb
SHA1 4d40ffe5747caf1d903d0e7f57f979af896a7641
SHA512 57592a75f9415ab636e1b5e46414dfb61d62fa18df495a703a3d5c5ae18491d55fe0420a959a8b3281534816c1ab27d169554bd3d499d2171a952add57fd0a93
SSDEEP 768:PEMRSoS5uh13GGcmhu9XCKiHaHVtm8UmhbbCbebHbLbWbYbzbFb3RiuU4Qtj3But:KoS5uhlyCGRhU4Qtj3BuQQ
TLSH
T1E3031144EB1E953FD42812BADCA11B002F39F88959092FA73A5C65786C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 4e9d5e4abba5c4ceb557059bcad372760e56beaf8b97612dcc0578c860920a4e
MD5 01330fe8c44916509f756171efdc3f31
SHA1 cab1fde7aeb35bd084591a9975f8575333ee32ba
SHA512 073909ab685ad1c653a9cf07978d17dc041f226c6bfaaf1a8e767516e8a2445e1333b120048dfdeaefa076b425244086703f460e624545ae578a0dbde3b02a93
SSDEEP 768:boS5uh13GGcmhu9XCKiHaHVtm8UmhbbCbebHbLbWbYbzbFb3RiuU4Qtj3BuQkwEs:boS5uhlyCGRhU4Qtj3BuQD
TLSH
T104031144EB1E953FD42812BADCA11B002F39F88959092FA73A5C65786C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 13ce2bd8c0b569e388bde642e51781e93fb06d16d658aec9a9ee5a228e8ed067
MD5 337fa393b4a3349319b9daeb5f8e6f21
SHA1 cceecadeeaefab641c108cd7f058b7c3c42af8d7
SHA512 14d4e36b5dbce7f76cd1d56f85be27c77b394aa0a7473aaf1f5a820b2628f3a831e17be12150e174632ef3153cf3b3b6e537c3ed82d4748c6f8bff0ff66ad14f
SSDEEP 768:RRSoS5uh13GGcmhu9XCKiHaHVtm8UmhbbCbebHbLbWbYbzbFb3RiuU4Qtj3BuQk5:aoS5uhlyCGRhU4Qtj3BuQg
TLSH
T119031144EB1E953FD42812BADCA11B002F39F88959092FA73A5C65786C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 25674202733ae53bcec864655dae1062c8117f857aaf3fd77f875c4a7f641d91
MD5 4847745c90034951041b288ac366344c
SHA1 1b55e7b9160db061c027a7cf844b455d4ef86767
SHA512 4a75ea412ff1b45341a973ecf2091505540ff7179e27be7578b9c8c82cc21b3ce31105434a5b867f69e804bda9e93afff45d222d573b1f57279d1ed48ec76c5e
SSDEEP 96:OnFw2FaDFymFOF9/dd66JozGzgClKtmc0d/URHSdF95/7bkW60rcECWyUR6IWI:5+1d66JozGzgCl6mc0d6Ov5zbowbCWyo
TLSH
T107C1FF28F628863FC405423BCCE52B510F763997988E3F2935DC65192D9B2CE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 53494aa2ad0fb0cba49e2e24bec882778518469eeaf8bee5f0124a18ec1f82d7
MD5 33c47f9a5cd1702364742bfd21e712cc
SHA1 0abcee910e82ba496e2ec4d9abd0a15925c7693d
SHA512 2fc4d8afb3d5d86579ea0a0583c6c441e286f9291522c0ce49ce34dc0019108c1eee1a882932a5d6f17d894063ebb436359e1d0ffcbdd28a92e641ea2c877e57
SSDEEP 192:0Ov5zboZTZCWyj10L+1d66JozGzgCl6mc0dz:Xbo1ZCWyjbd66JozGzgC1jd
TLSH
T150E12264E628867FC405027BCDA12F450F3A399B9C4E3F1935DC65182D9B2CE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0ab7186c4c77cf53df1bbb8ce0b59bc64dbde961cecdd3163a07a8d7faf023ad
MD5 69d330f5547f06d01a4b4038bd3cb77d
SHA1 48c88294b0f1c87721e2a4320ec40c277ea76884
SHA512 b91947f0b62b7d6556e4bf1e89c14a205e7b457576c2e84967297070a9a6ee5f13d349d3f2aa09edab7f14dc18cae8124642b94e01e265703b702f8f34993634
TLSH
T1D411685C7BB84DAA9F87E39C745001CE53298E0204C65D434D22EF8CCFA5AD9322A52C
MD5 SHA1 SHA512 TLSH

Submit Download

2004e8ff-7ed4-40d2-a467-070cc9cc4576

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\2004e8ff-7ed4-40d2-a467-070cc9cc4576
Size 235B
SHA256 ecd10606ed635e46d6801f715109cd2cc0f05d349f355a63b50991e31964477e
MD5 267dd20a6b96339a589516aa1a5a20a0
SHA1 917d456f49beb0252b7886d42a854e9e4326a3ef
SHA512 3fa86846bab7f518eb032d2776dafd4965b59c086cbde03a8b47d25137f8e24d89e9def056b71cb4c0f68b063829b0b2007206d7aa414c22f0b47a4dc6a8780d
TLSH
T1D5D097801488236D5C006F02B9E078CA30488C3320B45C20D5A14674EABCAC48256C1A
MD5 SHA1 SHA512 TLSH

Submit Download

4204992f-66dc-4d04-adc1-a1af79cc444f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\4204992f-66dc-4d04-adc1-a1af79cc444f
Size 235B
SHA256 d0cdc89a0fa46ae1ef8d318885067cd4fe0ee29a7b07d33649492f4b112ac408
MD5 d877e2e6eea6ea7b3852b0c376262622
SHA1 eb041f113283b2ff7da443e2569f211154bdd17b
SHA512 d66a86d6bd83920dc80bad2e4d75b8cc79d53b183cb011c9d429f558b3e1b3eaf1375f047ed47dde6c01b3e77ea6b4c156a1e217d2091805f1975a0df5c37ff5
TLSH
T164D097C02888776D48180F06F0E028CA72844C3718A4983095A20439A9B8EC9632181B
MD5 SHA1 SHA512 TLSH

Submit Download

68c07770-b293-4b51-a401-82de9534880a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\68c07770-b293-4b51-a401-82de9534880a
Size 883B
SHA256 bf77c29c1e1d2927240bd14ec15ba377682a7eac61a4b0fb89c6de8bff46759c
MD5 4b86b7f908b21c1679a8e21ff57fb44a
SHA1 9ecd1047e6395c661db3a2181e96fb44cb7c089c
SHA512 2b8ffbc75c257d950b05629b610e35167b3853bfcfad9fc00699155a35bcafaba89c5ad3ec43d32339e7a8961aad341fde079149d9d2abb2baa8a0d654ff7159
TLSH
T1E6110041E630F9B2CD69D24BCA9077128FF8252380C550183EA15A140DAE61EA36B20B
MD5 SHA1 SHA512 TLSH

Submit Download

725eb678-8963-4cb8-9afd-c077059b79e5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\725eb678-8963-4cb8-9afd-c077059b79e5
Size 886B
SHA256 85a00e92b7857ad5f30153e34e1f86e3f1358e1147a40321ec3fd59889cb895d
MD5 e695a9d30a5a6a16301d8288b4fff21f
SHA1 f3afd8eb78856b5c262d8375bc8bb4956ccb3d96
SHA512 7ca03f4622a4299a21ba293f56d0211915af39eda3bfe2259263af2cceb07673353e19bce3faf3aa295cb1d0f0754716a3e791f8e092ba8e14acc06ac2be298a
TLSH
T131110041D674B9B2CC299287D990B7538EE4252380C659147E905B184DEA60EA367307
MD5 SHA1 SHA512 TLSH

Submit Download

9f76642b-b973-4598-8869-af3633e8a308

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\9f76642b-b973-4598-8869-af3633e8a308
Size 2KB
SHA256 723528b7e4d474e04c9317d8fa6fcbefbf3671035fbe299d707d7bfc32dd77fd
MD5 17d419a6f0a4a19185e94259907b7000
SHA1 c9491d8bafeb0a80d883c20b2d1cbb8f1c6fa528
SHA512 70617ccc55c55809bfdd26418d71e17c2756332bbe2cfe2e8ffafd1f2f4b3996c7899f608d9213cf535c0af595ff2e5d0202d7c03d4163575af1e97f7219857e
TLSH
T10E41306875785CB78DDAF28DD482238E57A04E0300C618832D91DF4C8CDA6AE376A53B
MD5 SHA1 SHA512 TLSH

Submit Download

b1d5f51c-74a8-4fcd-a5ec-03b9c333431f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\b1d5f51c-74a8-4fcd-a5ec-03b9c333431f
Size 15KB
SHA256 6c250f3f1c1744a5e485da507732ebe454ddb57effe82a31da2ebdcf7a2073e8
MD5 023d17e943fc1250acadbd36b6b51f93
SHA1 e311ea2faf8427a44a60b6ba47dabc1be1ddb7fc
SHA512 e4e91cf6ca87fdc071a376ba3758c07c9ba765cc0d2010ceb16c2f1ecd8b2f0744d2c20c011df7c7f6f12b908dc040f8814fb9202454e9da2263eb5970a779c2
SSDEEP 192:Xk/Pg3UR19BCQeSjhU91Vm5ns/qdyTj+7cSRzyu+skBmsCQqb27LMaEbetnZDPvD:XKMUtDg+7cSRJ+skBmsEmMpbcZDPv8Ot
TLSH
T18872C85A5820457A8251E36898FCBFC3E6F638CF4C019FCA9BE47E086DDE06D112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\extensions.json
Size 16KB
SHA256 02deafdefe7cdd1b4bc3bc354829165118d3bc11067ae3355e61c2d64fbfbff2
MD5 57d20d5ce23a4d16a102eead6cda8f65
SHA1 f7aa9824d9923dee868644a5b455246f63b532a5
SHA512 cfba0fd5d5c02c038b2b607737aae9ae26dd538744b6f02bc6f4b57b459461babafb6d04f50aca78cb6c176cc844a6f6744d3bcedfdba3b0df9c0bf9ed7fd1d1
SSDEEP 384:qkI4v3Umldvc8dhWA94z196o3tL4HzlL4PTL4HeL4HCL4Hmw4hD:NI4PRflXV4H6Ct4p4H4E4Q4T45
TLSH
T18D72421545048EB8298FA79AAA367E01C37D473B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 12KB
SHA256 4d6602c04173cff79e4797641956784e623b3c4095dcf2848623ddf7ead0dcf7
MD5 76e3c3c3b75639eecc0c0f5251017477
SHA1 5bfdb0a5a7b5aafcc38b243413f191e29444d316
SHA512 c0c28413d1c8ef3c53817cd58c83039a58ec93a6cdb3b0ca7f47e2bd6a037c3075f64b6a8ab5ee2fa8b92d8ff7fd9c5059295e4f22bbb3fe21f837ce47f81b31
SSDEEP 96:xH7VTUPDqGqnfIoZcGObzSPSSladv9j3n3pwoDR2gRnEyE/F/+OBw88d/9++sN6B:xiORnfIoZcGpSS0LR3ZOBw88ZNsN6rN
TLSH
T16F42BD3891408A3F61F2377DAC61497019B1022BB6BFFCD755F9A491056CF2441EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 6KB
SHA256 b495b541253d2156ee4ad60420b6cb15e64c48fae37848da943823d10fef6e06
MD5 0b3bc81e08ed61f5ae39f054c042d2a3
SHA1 8755aabcc8dac67620d45ce2fc0be18366d0b50d
SHA512 432a875da4601f84c6e264db50ff035940b2c60d000dce902f260b78022c66fa7581b8113cfc265a69a4e9c65cfac94f3e0c7cc4f151175de0e028caa76a5220
SSDEEP 96:xHgUTUPDqGqnfLcG1zSPSSladv9j3n3H8RNBw88n8L4cnFpC:yfORnfLcGWSSw8HBw885
TLSH
T181E11F789508CFBF64B6776CAC6888715AB2013BB7BF68C650B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 68d5d08296dce4391050999b940fdea6b0b875935cd32775ced76a8495804237
MD5 6d06a88cd8a98ba60ed7d1e1912d08a7
SHA1 aa5be303d9dc083c9a940b8c51f3776dd4d2f9d0
SHA512 d69bae1a1f9fbf0e55a8a679d17352cc7ec89fc038edfcfc827b1faa5a1c46ee2bd32f4e378d0ddcdf9c5ebdb1cf66e1b7d2c61c91681ac86d6b801c5e80843d
SSDEEP 96:xHgUTUPDqGqnfLLy1zSeoOSSladv9j3n3H8RNBw88n8L4cnFpC:yfORnfLLyLoOSSw8HBw885
TLSH
T1A3E12F789508CBBF64B6776CAC6888716AB2013B77BF68C750B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 7KB
SHA256 a29aa79e34cdbc0afbcb51d8fc6fc4cae4eaa9e9cba2bcd8dde2cee8013c511d
MD5 f65d351ffdec1f26e1e624bb6effbbab
SHA1 641a7c3f1aa3c9470b5539f4ff697bcdbdbd7bf5
SHA512 6a6cc4a307c69bab40e13c777c3b76e83fa9692427d8ee5a24f5cebc0b080b83410fd9b65f5da0b772c545eb1cf028d829e182eb68ff14ab40c9b5b26e72b750
SSDEEP 96:xHgVTUPDqGqnfLcGObzSPSSladv9j3n3H8RNBw8818L4cnFpC:yiORnfLcGpSSw8HBw88P
TLSH
T1C3F10D789108CF7FA4B6776CAC6488715AB2023BB7BF68C650B554C4015CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 7KB
SHA256 7aad2bfd5d9c632656994fa3a7b4af1c6c9027dabc46ed7711e97d0d52b0f283
MD5 dd80cf981ce9225949170770631b6740
SHA1 594a5ef766fae3e50776b7e10c6e3670d4af6ad0
SHA512 142e3ed56a3abf847a690dc253916d6493bb750f5517271b82931d5dff658639ad9ebef144a6e08fd7b1fa35a0d83cb819accc48c138c457c07145f5a5eb485d
SSDEEP 96:xHgVTUPDqGqnfIoZcGObzSPSSladv9j3n3WR2gRncBw88o8L4cnFhC:yiORnfIoZcGpSSFR3iBw88u
TLSH
T18DF1FC789104CF7FA5B6776CAC6488315AB2023BB6BF68C650B954C4011CF3845F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 9210888b47d75106b0c98bc16d8981207129e38c833281cdf2519ff88310bc53
MD5 314f3cd6d3de8cef212bfa24f1bca852
SHA1 8729dd0fc8e421c358138a5bb3197e513f22d493
SHA512 fd87b91aeff23fab0d8ca674f8e748ab5721557c0d19d31d5a5f24d2b65c945ae52ef9c4546ca1b222b290308d61db82ba090b525895f58af148a165b35225d2
SSDEEP 96:3FfRNX24wdPLCLpmYV5cAssfM5EW3c3sstmhF3i/kwv1agCrfET:1R04ALCLp15cAsxc3s2mnik41ag8G
TLSH
T15AA17F0310B95CA8EB7345CDD0804B187B98297388FE58325C9E6548129DAC3ED7E434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 ac1b1638f118a0f44a9fd505803461bd7ce9804126f1174095ba640148cc6f64
MD5 65075b95fefa6485128514297ed0031f
SHA1 e2ea75cd57b71355262af7c1d0a38e2117bc76f8
SHA512 56088d3d921ceb4e8852ec4394c6d777292c6ac4e3aa9c31a7b6e67a02297348596ae88c28896a50838705f279d79e4c69b7927fbcd76c29de662e16dc3cd394
SSDEEP 96:3FfRNX24wQPLCLpmYV5cAssfM5EW3c3sstmhF3i/kwv1agCrfEL:1R04nLCLp15cAsxc3s2mnik41ag8s
TLSH
T102A18F0314F99CA4EB7345CDD0804B147FA4297388FE58325C9E7649129EDC6EDBE834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 c1ceb29679a35c63feadd5c8436faba4558860b8a32d16402a7a4bfb8319f749
MD5 2e6f59346f3578b4c134094d17707dc2
SHA1 ee17a69ad0e8ae3ba390e3079deef6ee581368dd
SHA512 b14b3d06612a7ced7278b0264e44c4d0bc66997e79aa53d59bc7ea58cb0882998b262bde9c7c48e226ab79cd8374b711d77554c5eebe75bf0f197d2fa7966e34
SSDEEP 49152:oDmghuVjA5lU525XIcNeaKvgmRBbFOYyg/:wmQuV85652JVeaKvgm3/
TLSH
T10A1639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads