hxxp://clopofffr7tth6hsvxx3cys4qkshrbbiitnxfwts6hj64mtnaovjieyd[.]onion

Analysis

user interaction
yes
max time kernel
138s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/09/2026, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://clopofffr7tth6hsvxx3cys4qkshrbbiitnxfwts6hj64mtnaovjieyd.onion
Sample260923-xrt3caad29

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	888	firefox.exe
Token: SeDebugPrivilege	888	firefox.exe
Token: SeDebugPrivilege	888	firefox.exe
Token: SeDebugPrivilege	888	firefox.exe
Token: SeDebugPrivilege	888	firefox.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe
888	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 888	2740	firefox.exe	87
PID 2740 wrote to memory of 888	2740	firefox.exe	87
PID 888 wrote to memory of 1836	888	firefox.exe	88
PID 888 wrote to memory of 1836	888	firefox.exe	88
PID 888 wrote to memory of 1836	888	firefox.exe	88
PID 888 wrote to memory of 4452	888	firefox.exe	89
PID 888 wrote to memory of 4452	888	firefox.exe	89
PID 888 wrote to memory of 4452	888	firefox.exe	89
PID 888 wrote to memory of 4452	888	firefox.exe	89
PID 888 wrote to memory of 3832	888	firefox.exe	91
PID 888 wrote to memory of 3832	888	firefox.exe	91
PID 888 wrote to memory of 3832	888	firefox.exe	91
PID 888 wrote to memory of 3832	888	firefox.exe	91
PID 888 wrote to memory of 4960	888	firefox.exe	92
PID 888 wrote to memory of 4960	888	firefox.exe	92
PID 888 wrote to memory of 4960	888	firefox.exe	92
PID 888 wrote to memory of 2044	888	firefox.exe	93
PID 888 wrote to memory of 2044	888	firefox.exe	93
PID 888 wrote to memory of 2044	888	firefox.exe	93
PID 888 wrote to memory of 2044	888	firefox.exe	93
PID 888 wrote to memory of 5332	888	firefox.exe	94
PID 888 wrote to memory of 5332	888	firefox.exe	94
PID 888 wrote to memory of 5332	888	firefox.exe	94
PID 888 wrote to memory of 5332	888	firefox.exe	94
PID 888 wrote to memory of 5372	888	firefox.exe	96
PID 888 wrote to memory of 5372	888	firefox.exe	96
PID 888 wrote to memory of 5372	888	firefox.exe	96
PID 888 wrote to memory of 5372	888	firefox.exe	96
PID 888 wrote to memory of 5380	888	firefox.exe	97
PID 888 wrote to memory of 5380	888	firefox.exe	97
PID 888 wrote to memory of 5380	888	firefox.exe	97
PID 888 wrote to memory of 5380	888	firefox.exe	97
PID 888 wrote to memory of 5392	888	firefox.exe	98
PID 888 wrote to memory of 5392	888	firefox.exe	98
PID 888 wrote to memory of 5392	888	firefox.exe	98
PID 888 wrote to memory of 5392	888	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://clopofffr7tth6hsvxx3cys4qkshrbbiitnxfwts6hj64mtnaovjieyd.onion"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://clopofffr7tth6hsvxx3cys4qkshrbbiitnxfwts6hj64mtnaovjieyd.onion
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2024 -prefsLen 27099 -prefMapHandle 2028 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {b277c3d3-768d-4d24-a0ae-cad06a24b932} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {be5919af-33d2-45d2-b0d2-bb7244e3ad18} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 25164 -prefMapHandle 3784 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {cd9ca3fe-3d25-48e8-ad4c-e148caf808f7} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3944 -prefsLen 27276 -prefMapHandle 3948 -prefMapSize 270279 -ipcHandle 4016 -initialChannelId {a9bc3a4a-c199-4887-a7c8-fcdf2976bd0c} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3248 -prefsLen 34775 -prefMapHandle 3236 -prefMapSize 270279 -jsInitHandle 3160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2728 -initialChannelId {42caa374-200e-4026-b9ff-3cda6751549b} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4740 -prefsLen 35012 -prefMapHandle 4736 -prefMapSize 270279 -ipcHandle 4716 -initialChannelId {25fb3d1d-4cb7-4cc9-ba76-a78bd666c1fa} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4996 -prefsLen 32952 -prefMapHandle 5000 -prefMapSize 270279 -jsInitHandle 5004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5012 -initialChannelId {0c739fec-290a-44e6-b21d-4880d0d4ce9b} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5036 -prefsLen 32952 -prefMapHandle 5040 -prefMapSize 270279 -jsInitHandle 5044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5048 -initialChannelId {a8dab418-c596-4c39-8cc4-7fb25b9ffbd1} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 32952 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5412 -initialChannelId {e7959073-90e7-4341-b654-fbe99217bedd} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 10KB
SHA256 871c532363d230d636e5df09acb55d72164012c66a8ba127becb393ad1efa919
MD5 40630fc3f7e9577e90bb991e40f7f29c
SHA1 744387fc6161c29587c585c4ce44aa699805c7aa
SHA512 b5c46aa1a10b0c58a5b4f637e3dd74391d4c563ec736959a2f669cf9ea30a1f1b84651aa79c98919aa0ae994c2d916f731f24e0bba60e043152468294f940110
SSDEEP 192:HcZlpmScXz5RqvAcdRPSHXFCPD1Oo1kIfKKf5pRy3iABxZa8mNjKKf5pRpKz1q0u:HalwSiO024YJxy33BxvSxWg0+Az+/
TLSH
T141227CBE9F402CF81E27E098E97582188F5D95B7DAA3903F711C3809C94476928FE0AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 52KB
SHA256 5fc6a14a7b6f43e2c2a153b439709132d9ba1e8accaa2157277c7b07c81ba6c9
MD5 42c10123495124b29a1a68ad10930920
SHA1 26917954e8d3b053f4ec41c0ea1adcdb9f7bbbfe
SHA512 632bf58f7fff534c96e0ab18524265af18219ffb969b3f9e62793e58a153c91dd477650fe62464e8f8bd2baad95d7450e601cf679ec1cc02b1358483fd835d6c
SSDEEP 1536:3dBoqpvOmL4cNjO1z64P2iH/Nvp3PT0BL1:3dBjmm8wi1ulctpr21
TLSH
T17D33F044EB1A953FD42802BADC960B003F79F8895A1A1F67375C64786C873DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 52KB
SHA256 805a8ad265e15e7012ee2c8e0e72b3f5e00a24702aab6fd8c8c2e75dcc6ccdf7
MD5 b63e5a3f551516aa82ff09d895c1849f
SHA1 cb690684460f2730bcc30ddc48397b7b5d3a45f8
SHA512 2b7f802f6aa8b83f331cb8047ba502453828a1a1379e3c0babb90ca98fdb4944741624ccf5f64fc2e3af3e1c741d1bf4cd9f82f70f327999a567d63eb0c86fe7
SSDEEP 1536:fdBoqpvOmL4cNjO1z64P2iH/Nvp3PT0BL1:fdBjmm8wi1ulctpr21
TLSH
T1F833F044EB1A953FD42802BADC960B003F79F8895A1A1F67375C64786C873DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 a29b61089e82022786b77645a8f548b1852c2424a37b66af13a7653d809827e0
MD5 b502294b6680704f146a90edf3c0e608
SHA1 1320b7a94df20c37923a2ff014bcf307e898737b
SHA512 8448422130a79c039c9853b89ad180049bc76717ef4d467ee6c461ff025465580a71ae1924ff8be713a57bb1459c949f1fe344011ed6bc9df7269230ed91aa53
TLSH
T10A61C758F229863FE045823ADC965B412F307496A8AF7F2A35AC604D1E1B2CD77CD43E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a12a9f6dbf2c02fa077b370deafc2fb430935181697cf6bd9b98543effbb0baa
MD5 6ba5cab199b1f2f279c89c945fce70d5
SHA1 755f69ff6c4e63972f708a429a2938aecdabce0f
SHA512 afbebbb814d9010a75bfa08ce5f7026e13ba7398f375328a64e5b2e8c84730b4ae74b743ddf1f9e0e97b3c7e5eabc59f1f3b034869048e921460b2f7fcea0d85
SSDEEP 192:r1d66JozGzgCl6mc0dwOv5zbovZCoyjblM:pd66JozGzgC1jpbovZCoyj
TLSH
T179E11E64E728867FC418027BDCA60B454F39388A9C4E3F1935AD640C2D576DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6e3dc1819c2ec75ac582231cfa7cc9d57614e5fa00e0fb48525bc82a6ffddaff
MD5 306a4c4fff5ca31a7dbb9adf659f264c
SHA1 273f5efc7621d74db3ae047418fe557ffdfe283d
SHA512 c16f18b6e1b003f562fa312d2df0181c48d54fe27f25b116ab3b37c8fe11011cf48827ee18ac1cb7fac0b03c0310408a0a080726fb9e3e1ea76fabc8bf2940b9
TLSH
T149216A9D3EB84D2EA8C7E69C745112CE53A24E1B04471C871D13DF8DED916A932AA439
MD5 SHA1 SHA512 TLSH

Submit Download

087341a6-e115-4418-a58a-7ab28bf07eb8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\087341a6-e115-4418-a58a-7ab28bf07eb8
Size 2KB
SHA256 7222b264326d27ca601fafac1882049635ddfffbb16bf48a654a0ad281286a9e
MD5 bea2afaf3d43012c1564591ef49a45fd
SHA1 d1a5ec879a74e15bb90f24026885c7a21377834f
SHA512 f8e6c9a46083f58b19856dee9aaee0fe39a3695b7fb9de1123432964bbd7ce654e8bd09859a73c2ab2bdc209f787ba7868f6219a2fbfb313326daf714b21c450
TLSH
T1204111987AB54D779CDAF54DD442238E53744A4700C218833E52DE0D8DA679D336A92B
MD5 SHA1 SHA512 TLSH

Submit Download

6d401346-fc8a-4856-853b-91500bb68592

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\6d401346-fc8a-4856-853b-91500bb68592
Size 235B
SHA256 15e8050f84b3e088ef3417191af62ebfd3c1f7a6225e72ebd625156f9d2679f4
MD5 59f7eb0420669a0c3f4c1b05e86cf9f8
SHA1 433440d86913dd76d76d11be24dec40d29de3666
SHA512 cb8a52c51d5e40503159068b8bbceea22549e7f79765348051432d1200236980bd69638246dde5faed70150dcc82838775cd6c23424c48f3317d449fd63c0c69
TLSH
T12CD097C02888672E48144F46F0E078C630844C33A4A4AC2096A2873489FDEC941A181B
MD5 SHA1 SHA512 TLSH

Submit Download

870eb89a-de20-4a9c-a5e6-8be2a4bcdc10

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\870eb89a-de20-4a9c-a5e6-8be2a4bcdc10
Size 886B
SHA256 5ba2fe8de153b0a0a835b764de1f282ebd90d4a7eabddccb72a4c7a016f8a157
MD5 7108bfdf2aff9330982fc96505bb015a
SHA1 675d0ba0cab45be133da07bbae396a5589061924
SHA512 e9ffc442482992054b8c76fa1d6ae0d2a05303e950f3245dfbdcbf1ff0e2d95e0f9795687a8e4edc77b6c363c10e57d37cdfc65f00a1a1b801ac7d99bc0bf3c8
TLSH
T1B4110040DA7079B68C78C287A5A6B746CBA4B12380C64A043F691A180DEE54E9766607
MD5 SHA1 SHA512 TLSH

Submit Download

90be8f0e-c2ce-42e6-9e22-713085c0e699

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\90be8f0e-c2ce-42e6-9e22-713085c0e699
Size 15KB
SHA256 57d1829475eef0e3e96d279df8da18d74a6c0425cbaf0bfb9b1b66a4b5751723
MD5 c24ba67df1dfb3bd4a074349138b4c13
SHA1 bf58e66f84b7d2d05a68efa61021d83d18ac33dd
SHA512 b0a9fc8409ecff33ca95de333ac32e24047b265012e17ac5df8deb574577496183e50186a9cc7c188c5ad9f76c8225968d1b2fc1b20663ceca7ab708f7bccec9
SSDEEP 192:ILo7LNgF59b0BMRz+7KR5jEb5mYBp7Awg1tDrmdTxZ0kSzhcxK6DBCdHm/5:n7xgF5l0BMRS7KRBEbJnADDyVf0dEh
TLSH
T14F62E85568205A7E8291E368D8FD7F83E2F518CF4C019FCEABE4BD4859EA0AD1127C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a36cde14-48af-4d4f-b4cf-391530769f8c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\a36cde14-48af-4d4f-b4cf-391530769f8c
Size 235B
SHA256 5425bba019168fa15ab3057031a2203121fb3a64a050ca21ebc93bab3ec9f11f
MD5 9afce2b1d8cbea24b48c7617b7fda04e
SHA1 4b12d2800f7e65dfcf0ddee66e86ef3313f31b7d
SHA512 df3204ad81d0fc0699f41730547d3f91931cf9fc9e1ed733abcdbe92db89e22190fa32d5fb02dfe16ae4a24fdfac47997f77a30057e639c913a51a82c6656cf4
TLSH
T101D0A7C498986BAE48151F06F0E17ECA34898C3354B5F820DD6165B499BE9C84166C1B
MD5 SHA1 SHA512 TLSH

Submit Download

b70e5d33-b97f-494c-9356-e025cb012fc2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\b70e5d33-b97f-494c-9356-e025cb012fc2
Size 883B
SHA256 d5525612be75d2a9aa76541771c80c3fe96b03726f7fe2aa4d555a5b3d8f2b59
MD5 c012798e16f51604535ed74ff81ab26c
SHA1 1910fd01318fca4b62f13f0f641a30ff2088769a
SHA512 13380a341ec5fb4045734cf67297344375fde14b4d43035d958b632c3e3e5b473a582736d594b2d1ac6d1758b2a3ed4ab8d4c44f605280da0d801c1938bd19d6
TLSH
T132110080E77179F6CC7C924BC565B70AC7A4765380C685083EB519180DBE91D936A707
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\extensions.json
Size 16KB
SHA256 48d9934e737c9b238ba74cdea4458b0356369c813a9cbc236d5df31ce348d9c3
MD5 33f61b0eb4f5b8407a26512100ab762d
SHA1 fae17aa9d55e733f7c91ac11ed24a22bdc1eacd6
SHA512 1c62b0419f2d48e6a3bac17217a50af450f10d946945b819d043add8ce3372e29250751d2e8aa578aba6dd5f230b09e0812cab43b8c5f48052988268e37e7445
SSDEEP 384:qkI4vLUmldv68dhWt94zW96oVL4HvL4PvL4HqL4H1L4Hki4hR:NI4zRffXM4m664T4L444V4r4D
TLSH
T18672411545448EB8298EA79BAA367E01C37D473B60845C78F4DD8FC802FB5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs-1.js
Size 6KB
SHA256 7ca5880ad5f9bc6ee579387c0eb402c1428885bd5bc3c61d4b6290eddd325a25
MD5 f18ff08969528401d381c864f121825b
SHA1 f9d9a936f866813e8f6b4d72c6a415420c2f2ea6
SHA512 6d05a844f5edb9d68724892792201f724449e1709ba66d7d38aa09456d91f3bba63fa2b9a98b8ca15da9d973886545b247334b8b1e76a9362e71a48df42c202d
SSDEEP 96:xH2UTU7qGqEvfnPO1zSwSSlSdv9jcWnPHEBDBw88n8L4cnlu88:EmRafnPO9SSKEBDBw88J
TLSH
T167E12E789548CB7F64B6776CAC6888315AB2013BBBBF28C750B954C5011CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 6KB
SHA256 d10f22a8deb5e5a8ac2e4b00d61f40a26a0e0a91184d1d3d1430cb464c5b4cce
MD5 69d9eb1bceaede5d803f21cf16370e33
SHA1 76524231fb25ad8090b84f23630ce5c28bc0f7d6
SHA512 9112673684fce924eb5f5ba286957e935b2f9cf0b7eda8c735f5ece21d1ec52221a114a0da4037cb726e3028613cf7e47eb50331c10dc8cb3269e147303a52cf
SSDEEP 96:xH2UTU7qGqEvfnY81zS+SSlSdv9jcWnPHEBDBw88n8L4cnlu88:EmRafnY8bSSKEBDBw88J
TLSH
T14BE12D789548CB7F64B6776C6C6888315AB2013BBBBF28C750B554C5011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 7KB
SHA256 e06698847f98c4f3425f1e355d3792050a00bc8d0ea6b92337f42542c7963614
MD5 b5a711bf94c0ce749e173d694a3e1d82
SHA1 e3067590b4f2a064a34a14dcd3d15699292dcabd
SHA512 1e9d9fa71d4f98f8cff280bbb8e63b3304c1d31d764039d9cbc85b280abe572b369f74fde7e6cb95c340bf91d9d3789a6dc2793374884aad5d2ddc8ae914cfe6
SSDEEP 96:xH2tTU7qGqEvfnPOObzSwSSlSdv9jcWnPHEBDBw88m8L4cnlu88:E3RafnPOGSSKEBDBw88s
TLSH
T1DEF12D789548CB7F64B6776CAC2888305AB2013BBBBF68C750BA54C5011CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 8KB
SHA256 f218768ae84a82d49a08007a3f160a617ce7fcf88e9a0d8e38c4bf015a492962
MD5 4dd6690720791df570ca7e00b1b2ec73
SHA1 68194478590df605a96bb9ddf957029a50231296
SHA512 a1514acb5ce956b66ca3336965458d2ae687f2b094a59c0c8d6114b46e0daf40e4cd5976eab0d918f4b4674e92c1ff67af38110ada8fecff976783a72b4fbba4
SSDEEP 96:xH2tTU7qGqEvfmlDPOObzSwSSlSdv9jcWnPWR2IBbBw88QC48L4cnlu88:E3RafmlDPOGSSfR3BbBw88c
TLSH
T14C021C789508CB7F64B2367CAC2488705AB2013BBBBF68D750BA54C5111CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 00d27a29ab62356784346765d2610c4fd6772044c7d97ff7f668e97e321d875e
MD5 33808eafa8bb9414251766038481d955
SHA1 6fccab602169988b90392290a28fb6506b0ffd67
SHA512 778cfb1f1227f9210047a21b2443e88c3f2bd0ab7387333f9e14f36d3ba25c38af892292bc1935666d3785a2d05fde10e6d1e954a0bf74955a20d86dba344583
TLSH
T1B721B84720473DF2B6E7511BA84CCF53D7EA353241B15CB0948E8DC265CA04B6689318
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 3919c98a231b7d53d8fb8417a7804cfc0b8f5a2d6e6a246b6a97eb065922a7f5
MD5 3266b84571404f371b7033d4f604c079
SHA1 47f7cfa6e177546bf7da2e6857da9560956f3882
SHA512 a5a9c1de9af5cf93f1ca774ff2741926a6b6d641385a0ae823a5d7560ad533a7ff460c0befe43aea92516ca9419f9056d95bfcaa26c2b160f90fae79b22b2811
TLSH
T15121B84320473DE2B6E7910B948CCF53D7EA353145B15CB0909F8D8256CA04B668A318
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 28e07f9442b8852f4b2d39f3caa352a8257972d35d6d6b2beaa528323356e728
MD5 35c749ae971efe552c8360b19a42bc72
SHA1 c898c46b0704bbc2a7314aa5998958484fdff24a
SHA512 1164d7b7e3e6059ad6dace62a8df58017145bb9af261410ae83d88d872167c24677edccae49af6d1e77171c4455499ceb0fb7ad940d7383edb6e8996b033396d
TLSH
T17E21B88720973DF1F9E7910B9849CF92DBDA342544750CB0815F8D82A5DB48B7789318
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 e106287b869264b7a3b056094caca8a50b9cf31703806e23009084c19e85efc9
MD5 fb2a30df27c8625c35e250985a9c7889
SHA1 742fd3d2ade45ba58db695d0ca9590a18d64e5bc
SHA512 0153a09d77146d810845f9ddfc77d1f02fe3a3e925fc97d6b2fc260cbc08884abb7584d95533864517dbb9ff4c20698a5a47ab28c54ab2676904cad197d01457
TLSH
T16F21B68320473DF2B6E7911BA888CF93D7EA353245B55CB0908F8EC265DA04B768A318
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads