hxxps://nervelin-us[.]storage[.]googleapis[.]com/7783b7ebce3a48[.]html

Analysis

user interaction
yes
max time kernel
42s
max time network
45s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nervelin-us.storage.googleapis.com/7783b7ebce3a48.html
Sample260916-19pr5afa24

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5296	firefox.exe
Token: SeDebugPrivilege	5296	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5296	firefox.exe
5296	firefox.exe
5296	firefox.exe
5296	firefox.exe
5296	firefox.exe
5296	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5296	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5464 wrote to memory of 5296	5464	firefox.exe	87
PID 5464 wrote to memory of 5296	5464	firefox.exe	87
PID 5296 wrote to memory of 3496	5296	firefox.exe	88
PID 5296 wrote to memory of 3496	5296	firefox.exe	88
PID 5296 wrote to memory of 3496	5296	firefox.exe	88
PID 5296 wrote to memory of 5408	5296	firefox.exe	89
PID 5296 wrote to memory of 5408	5296	firefox.exe	89
PID 5296 wrote to memory of 5408	5296	firefox.exe	89
PID 5296 wrote to memory of 5408	5296	firefox.exe	89
PID 5296 wrote to memory of 6132	5296	firefox.exe	90
PID 5296 wrote to memory of 6132	5296	firefox.exe	90
PID 5296 wrote to memory of 6132	5296	firefox.exe	90
PID 5296 wrote to memory of 6132	5296	firefox.exe	90
PID 5296 wrote to memory of 2440	5296	firefox.exe	91
PID 5296 wrote to memory of 2440	5296	firefox.exe	91
PID 5296 wrote to memory of 2440	5296	firefox.exe	91
PID 5296 wrote to memory of 3792	5296	firefox.exe	92
PID 5296 wrote to memory of 3792	5296	firefox.exe	92
PID 5296 wrote to memory of 3792	5296	firefox.exe	92
PID 5296 wrote to memory of 3792	5296	firefox.exe	92
PID 5296 wrote to memory of 2412	5296	firefox.exe	93
PID 5296 wrote to memory of 2412	5296	firefox.exe	93
PID 5296 wrote to memory of 2412	5296	firefox.exe	93
PID 5296 wrote to memory of 2412	5296	firefox.exe	93
PID 5296 wrote to memory of 3048	5296	firefox.exe	94
PID 5296 wrote to memory of 3048	5296	firefox.exe	94
PID 5296 wrote to memory of 3048	5296	firefox.exe	94
PID 5296 wrote to memory of 3048	5296	firefox.exe	94
PID 5296 wrote to memory of 4316	5296	firefox.exe	95
PID 5296 wrote to memory of 4316	5296	firefox.exe	95
PID 5296 wrote to memory of 4316	5296	firefox.exe	95
PID 5296 wrote to memory of 4316	5296	firefox.exe	95
PID 5296 wrote to memory of 2732	5296	firefox.exe	96
PID 5296 wrote to memory of 2732	5296	firefox.exe	96
PID 5296 wrote to memory of 2732	5296	firefox.exe	96
PID 5296 wrote to memory of 2732	5296	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://nervelin-us.storage.googleapis.com/7783b7ebce3a48.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:5464
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://nervelin-us.storage.googleapis.com/7783b7ebce3a48.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {d7282113-1c7d-44ef-810d-fe4c3e02a845} -parentPid 5296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5296" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {e5b6f87f-1553-454c-aaa6-fad190b8ae3d} -parentPid 5296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3920 -prefsLen 25213 -prefMapHandle 3924 -prefMapSize 270279 -jsInitHandle 3928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3936 -initialChannelId {1d079d36-9108-49f0-af81-d03efc3b022f} -parentPid 5296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:6132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27323 -prefMapHandle 4060 -prefMapSize 270279 -ipcHandle 4164 -initialChannelId {03487b1d-46d7-439c-be93-95538a12837c} -parentPid 5296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5296" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2724 -prefsLen 34822 -prefMapHandle 3164 -prefMapSize 270279 -jsInitHandle 3168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2784 -initialChannelId {983ffd79-3ad2-4f96-a0ac-8194c4f96170} -parentPid 5296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5148 -prefsLen 34822 -prefMapHandle 5152 -prefMapSize 270279 -ipcHandle 5160 -initialChannelId {441b47da-1ca0-484e-b580-a0bdc8481308} -parentPid 5296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32952 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5516 -initialChannelId {114632c4-b886-4e86-8189-61e9f0e83b03} -parentPid 5296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5684 -prefsLen 32952 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 5692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5700 -initialChannelId {55b35ca7-f5f9-45b9-9f55-e83523c502fb} -parentPid 5296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5872 -prefsLen 32952 -prefMapHandle 5876 -prefMapSize 270279 -jsInitHandle 5880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5888 -initialChannelId {a8302a78-a1ed-43b3-8992-1c7e51428f73} -parentPid 5296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 74d79199c5014122c2f0036bd93442f81ade9081dcad70b4b2556f12cd65400a
MD5 5510cb48422b1ec296d146337365485b
SHA1 f0959af56713aeaa175b53db855bdeac3d45b212
SHA512 1f349eda94a1736c488411d95f8ac184f5a8377d8e4d7439a225bee71f475c670e80f8d9839fa43bc99256fde03465600acc45c92745c0e5e41cb41f5cf5f39f
SSDEEP 384:HkCjiO024YUJDL84KKDL849B7SOEAd9KVRaAcP+AWRMAf:EzZYSDL8lKDL8CB7S/AmVAf+hRMs
TLSH
T18C729E3A4F003CBC15A7C0E8C5F9539A8D18B7A7CFE6806D21583D0DCA98A69A4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 d4a9780d7c2797900b09e04b5885ecc19e2f700af0d9055af775b38bbab52a47
MD5 733cb9b7d1c164bfae59c4157d3c57b3
SHA1 87515eaaa781a7dda1f56c308f99ff0497da35c9
SHA512 7916b8d339653c3b1fd852fe8457f1da44cd4f40b7b7d9ae444521dae49ae5b4cc0b8b4399c035b4cd6986da38ec2b940b06cfc9e36ddacdd1e6711758a9a4ee
SSDEEP 384:HalwSiO024YiDL84KKDL849B7SOEAd9KVRaAcP+AWRMAFL+6S+P:6l8ZYiDL8lKDL8CB7S/AmVAf+hRMCLbv
TLSH
T197728E398F013CEC15A7C0E8D4B943A98D18B797DFE6806D21583D0DCB98A6DA5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 be0c40381ac9e2505e7b34304fce901b3899628217aa04969551a65d0f978504
MD5 67eee8f21fd0a06f163c73330a93bf43
SHA1 26e2bb36c6fc43ceb61195d8f263d834d3f203d1
SHA512 7c4e18829309f7e86ee25cb3980ba55b57cfe9316e181076115edcc22c39b2bf9ac50323b9c6a5b66925ebf45501c82c8b31398acd77adf9720640e5ec57adf3
SSDEEP 192:YOv5zbo7lZK8yjR9OV1d66JoztdzgCl6mc0dz:jbo5ZK8yj2d66Joz/zgC1jd
TLSH
T11BE12FA8E628867FC018027BCDA21B440F39389A9C4E3F1975EC640C2D572DE378E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 bfde125b0be12fff1a0dcf89c19b18e65374bc54cd3ced715673d5a8a4bd4657
MD5 c4dd2e0c60c5df7a6a4806720ee49a38
SHA1 0b1be0e4f84d96b8b86609ba9b6110a4bedf76a4
SHA512 98a0515b7d6dd96bafd1fb167c814a514279b3c9356fe7a933220115e7c2ff3ad0bdab09b02fe7c034846cfe4e976a09bcd30d516fc1f273e687ac3b3dd8eed3
SSDEEP 192:i1d66JoztdzgCl6mc0djOv5zbo0ZK8yjpE:sd66Joz/zgC1jKbo0ZK8yjq
TLSH
T100D1FE58F629863FC018023BDDA61B900F35389B9C4E2F2571EC240D2C976CE7A9E57E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 bb23cdb71019bcea9c6cabb225fe29dd1359ddaaff2595da376ba2452f9cfbec
MD5 d5a447d34a1930246bca274dd001118b
SHA1 762d96df815f7926076cf568f3b6e073bc3ce39d
SHA512 4bfe6135e2b628280586eeccb8e0d27ad432371feba732a43ca602819cf0f7aacb05248b52b920ae7a762bc02101d8a0f56a6e03776d85d16269bdb0122f09db
TLSH
T1E8213E9C3AB84D6EACCBE29C7440068E53554E0B05871D535D12EF8DCE92AE9317E43D
MD5 SHA1 SHA512 TLSH

Submit Download

14c2e0f4-f4a7-49d8-9f68-6c13ccad8e68

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\14c2e0f4-f4a7-49d8-9f68-6c13ccad8e68
Size 883B
SHA256 a51edcc53d2ba72adc0764fec76ff5371915bcdda487b2a214f6d1be90a2f9ce
MD5 d848e3e2bcf74cfa2a38033ab4c441d0
SHA1 d12893a45d0738cad6cee8379097d67d0592c91f
SHA512 bb63880072722a93882cba6b4ca131463d1aeb224020416505154c382d1d8a52fd87579457838798d46dfda40249061842cd8717e904528862da437c9c5e6414
TLSH
T145110081A634B5B6DD3CD20BCA923B5647F47423C4C585243DB15E080D7BA1EA36AA0B
MD5 SHA1 SHA512 TLSH

Submit Download

6fc46ae8-c731-4cce-b66a-39ad4ee980c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\6fc46ae8-c731-4cce-b66a-39ad4ee980c9
Size 235B
SHA256 9ff52f339cec2d0050504dc417833654095e0b187d8d9f3271db276456bb9caa
MD5 f8c56e1d490a8f03d2b24b394445e68a
SHA1 aee34e2693f8791fb63d217c87a76c37a526a1fa
SHA512 8dfdd045be930dad65ab1271fa1118ee995d2213f9a313b50bfe319f2e14ea5bc64f8fc069c20e9b680daffd10ff402b7fef6bae304823dfcb2a67d1c4528377
TLSH
T143D0978138D8735D08240F07F0E029DA309D8C3318B06810C5654A7899BDAC88651C26
MD5 SHA1 SHA512 TLSH

Submit Download

70238ace-437a-495d-ba6e-c085c6804bac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\70238ace-437a-495d-ba6e-c085c6804bac
Size 2KB
SHA256 70f624953aeed2bc9f092d966e395a2a9a65dde374efa8974f45c9a90bd28145
MD5 7b9221aeb4e36f721b1c418690f0cce6
SHA1 0e71e17fec49f61543f18f47447923322154157c
SHA512 50ceb980ed72572e875373f613480c51721d285d743fde451215ca0d1c5b059bff92efed3f4db7afca69c6d673c8538877a0a74aedab9d3eb538bfdaee9b3aa4
TLSH
T19841106C75B85C779D8AE54C9482378E43A48A1A00822C836D51EF0CCDD6A9E736E53B
MD5 SHA1 SHA512 TLSH

Submit Download

89ac0808-79e2-4da6-9104-e18371a69f43

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\89ac0808-79e2-4da6-9104-e18371a69f43
Size 16KB
SHA256 e570ff8c9280f1a60514d4d86e83879ca52bb1c1dd0e29c8edd95bbd90a0dcdf
MD5 7fa96fe6d8ebb4074266b3b30d916140
SHA1 08c26e13bece48434b570fb1917f56a444d05681
SHA512 47cce93515f3c2531bdc593d448751e457c70f81b93befc3358f6882744353dfdc32337c84ce3e8663c7e9e6d676a215565b4ff76e5b8d9ac57f4034fb9015c2
SSDEEP 192:yzgXgJzuArMiao1LBSSqb2eJFHd0++FEGMeofJ2zmAapJU8rFJSCC9iXGqEAFzxr:yzgXOzuqfcSEBPprvXGDAFlR75
TLSH
T1B772E956682045BAC251E36994FCBFC3E6F538CF4C419FCA9BE47D086DDA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b2fba1a-1070-47b7-a741-aa5eba74d630

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\9b2fba1a-1070-47b7-a741-aa5eba74d630
Size 886B
SHA256 3db7651fa250f089bcd668840f1f1330e4ebdc49b205ffd278783ef98b19160e
MD5 3baacde1f98ea906c57320f127171764
SHA1 5dfda02823e96bb962b001687272d07675b19eac
SHA512 c92e733c6caae98c7156949c30c448ae3d73b287c12cbe1bb54e27b355c5413dbde02697cb7218e503e2effa07d5c76f2b3e5677217244c05e049e6b09e3b73f
TLSH
T10D1100829634B5B29838D34BCEA23B4646E47423C4C54D187DA45F184DAB91E63AEB0B
MD5 SHA1 SHA512 TLSH

Submit Download

bca14fd5-b84d-436b-b336-1949f57ff4c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\bca14fd5-b84d-436b-b336-1949f57ff4c4
Size 235B
SHA256 cab15daba77dfb6eadf0b878aa317880f6400a9ed71a7f760e080b448a7a4aed
MD5 a3aa53f26e7fb2c96579417fd7a63127
SHA1 2cbfd109c112b758e6385ce82b5ce577d82de3b9
SHA512 73d0cc6ada6929c63d3d6a2d398f49157196776aedde39337f96a4d3ce384b0686e98d3d54330ab7769a7bff687db5276337118d30833abab23b8163a5c5b19d
TLSH
T100D097CE648C632D08180F06B0A0A9EA34488C3330A09C2085620174A9BCEC8817180B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\extensions.json
Size 16KB
SHA256 090d239ff115c0efb15e9452bd7ed8fcaa6e7fa053974b75c7972b99762b197f
MD5 62db02e59449819f717b0aca736258c6
SHA1 af72160dcf6df8497fa77c9209c6a56799522a5a
SHA512 bcb6132d96fa2e0d1729e6f63aa0bde10c54ed42f08912dfbbdf59005f18e163d2eae3c7ef1f952eb8c9085027f624c633a028a8a48ccc1efbbaefcdb5abc382
SSDEEP 384:OkI4vbUmldvH8dhWI94zH96oTL4HFL4PnL4H+L4H2L4HBea4h1:hI4zRfkXF4B6I4F4T4k4c4hV4L
TLSH
T13872531545049E78298EA79BAA367E02C37D473B60845C78F4DD8FC802FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\prefs-1.js
Size 8KB
SHA256 68882b5c4c2ca4d41adfa6a22b0227fcd4a5d255bb0565803c3c38ef24101adf
MD5 7c694cb429c4449374de79f25c491564
SHA1 33c75b7059bf655c6b84435e3f647981d6ae12c1
SHA512 88e044d9575870792c0b4edc85b19a7ea7bc2b94d4cce08c8510156f5cf69e7e4f9f435ec01398b21071ec480da8333e8e9abeda00151db4294431398db948bd
SSDEEP 96:xHztTUXqGq3Yf2dKObzShgbSSlddv9jiLnT2WReHbxYwNiouAuZBw88iEm8L4cnk:djRof2dKvgbSSSvdRKFhi7AuZBw889Iv
TLSH
T154020D789144CB7F74B2366CAC244D705AB2063BB7BF68D724B95485450CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\prefs.js
Size 6KB
SHA256 1bc4630b216eb5673a924ff1291b9728951c30727d54989ba0fe7bd57535bf8d
MD5 b0aed09a8d5423d04fe450b69dd328b9
SHA1 8fbb4f247c52d67bf315c1cbafbff952c0e51962
SHA512 ee02f89f5fb770474a28f4aaf2d93d841c7f69a09a1328b51c2a228332b41552bc6f81ae0eecb943a2d7cea1ac9500455dd9d4888392ac5141b125d2eb26c2b5
SSDEEP 96:xHzUTUXqGq3YfFiA1zSkCSSlddv9j3nT2HDbxYwNiouAQBw88u8L4cnCVAU:dKRofFiAFCSSzYDFhi7AQBw88gv
TLSH
T1C6E11E789048CF7F64B6776CAC6888715AB2013BB7BF68D350B55488051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\prefs.js
Size 6KB
SHA256 a3fde72aa8640f94cdd57bb1e422e11df52bd0dd495542d9668e667538fbd79b
MD5 15539219b0e26102b7072030d5be548e
SHA1 e135deeebc2cfa85fd22be251cb7c794c9d66bc3
SHA512 3a3fc64ef5a88a2d32c75f61705db21f6eeb3d959566d107a0ce9a6e92d492688c3ed78838c055a8f6b181f93d9f6f126fd23d9a9320ce0c0eaff708e2c25c5a
SSDEEP 96:xHzUTUXqGq3YfFdKObzShgbSSlddv9jiLnT2HDbxYwNiouAQBw88u8L4cnCVAU:dKRofFdKvgbSSSvYDFhi7AQBw88gv
TLSH
T1B8E12E7895088B7F74B6776CAC684C716AB2013BBBBF68D350B65484054CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\prefs.js
Size 6KB
SHA256 189004108b5a3451739e3f00e0adc00e4ebf91c93cb47ff07ace507a94e743ef
MD5 ba23670cb9b66df5ce4c356272961912
SHA1 396b9e98c1c97cabc41479ba4b06cb3d07617991
SHA512 b755c4114125b2210ddd5965adb274e40b01259b086e139838e2f764cf1907986e0be2b87acaa5b8813506f88b54bceba89bdab853361fe48e9d37e70a567d10
SSDEEP 96:xHzUTUXqGq3YfFdK1zShgbSSlddv9jiLnT2HDbxYwNiouAQBw88u8L4cnCVAU:dKRofFdKigbSSSvYDFhi7AQBw88gv
TLSH
T16AE12D7890088B7F74B6776CAC688C716AB2013BBBBF68D350B65484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 bfcadf3cdabea8ed87ef3e059305adb24460b56ae091b6b5c02390b7db7fc0c0
MD5 44618e76a271595736d08b730aa513c8
SHA1 14e2fa710c6f9110cc05c1ad3dc97f5dad046aed
SHA512 35258d1772d8f2313031fea1ffe7c2204ca336cc3882141580ff9210e6f49b57cdf8501cbc920546eaa3a894b062be109990065c159112f44184070adf5532db
TLSH
T1A621F887562F6FFBFB22C259D4812FD25E24202345F168F0E44C8F83D59D85CB28A25E
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads