hxxp://gandcrabmfe6mnef[.]onion/8b9c14fe8b0c1d15

Analysis

user interaction
yes
max time kernel
24s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gandcrabmfe6mnef.onion/8b9c14fe8b0c1d15
Sample260925-v5mt3ssdkf

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	firefox.exe
Token: SeDebugPrivilege	4088	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4088	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4088	4104	firefox.exe	88
PID 4104 wrote to memory of 4088	4104	firefox.exe	88
PID 4088 wrote to memory of 4952	4088	firefox.exe	89
PID 4088 wrote to memory of 4952	4088	firefox.exe	89
PID 4088 wrote to memory of 4952	4088	firefox.exe	89
PID 4088 wrote to memory of 3464	4088	firefox.exe	91
PID 4088 wrote to memory of 3464	4088	firefox.exe	91
PID 4088 wrote to memory of 3464	4088	firefox.exe	91
PID 4088 wrote to memory of 3464	4088	firefox.exe	91
PID 4088 wrote to memory of 1044	4088	firefox.exe	92
PID 4088 wrote to memory of 1044	4088	firefox.exe	92
PID 4088 wrote to memory of 1044	4088	firefox.exe	92
PID 4088 wrote to memory of 1044	4088	firefox.exe	92
PID 4088 wrote to memory of 640	4088	firefox.exe	93
PID 4088 wrote to memory of 640	4088	firefox.exe	93
PID 4088 wrote to memory of 640	4088	firefox.exe	93
PID 4088 wrote to memory of 4072	4088	firefox.exe	94
PID 4088 wrote to memory of 4072	4088	firefox.exe	94
PID 4088 wrote to memory of 4072	4088	firefox.exe	94
PID 4088 wrote to memory of 4072	4088	firefox.exe	94
PID 4088 wrote to memory of 5440	4088	firefox.exe	96
PID 4088 wrote to memory of 5440	4088	firefox.exe	96
PID 4088 wrote to memory of 5440	4088	firefox.exe	96
PID 4088 wrote to memory of 5440	4088	firefox.exe	96
PID 4088 wrote to memory of 5656	4088	firefox.exe	97
PID 4088 wrote to memory of 5656	4088	firefox.exe	97
PID 4088 wrote to memory of 5656	4088	firefox.exe	97
PID 4088 wrote to memory of 5656	4088	firefox.exe	97
PID 4088 wrote to memory of 5664	4088	firefox.exe	98
PID 4088 wrote to memory of 5664	4088	firefox.exe	98
PID 4088 wrote to memory of 5664	4088	firefox.exe	98
PID 4088 wrote to memory of 5664	4088	firefox.exe	98
PID 4088 wrote to memory of 5680	4088	firefox.exe	99
PID 4088 wrote to memory of 5680	4088	firefox.exe	99
PID 4088 wrote to memory of 5680	4088	firefox.exe	99
PID 4088 wrote to memory of 5680	4088	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://gandcrabmfe6mnef.onion/8b9c14fe8b0c1d15"
1⤵
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://gandcrabmfe6mnef.onion/8b9c14fe8b0c1d15
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2028 -prefsLen 27021 -prefMapHandle 2032 -prefMapSize 270249 -ipcHandle 2100 -initialChannelId {c30c615e-f577-4edd-b45a-ea58165df10d} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27057 -prefMapHandle 2504 -prefMapSize 270249 -ipcHandle 2512 -initialChannelId {d07483c2-4842-48bb-94b3-1029dfc3bcf0} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 25102 -prefMapHandle 3796 -prefMapSize 270249 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {dbe9ad8c-c725-4a15-b53f-40efdc08c41e} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3960 -prefsLen 27198 -prefMapHandle 3964 -prefMapSize 270249 -ipcHandle 4068 -initialChannelId {bb41b6cd-4d72-48f5-aa97-4b21a717d810} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4316 -prefsLen 34697 -prefMapHandle 4320 -prefMapSize 270249 -jsInitHandle 4324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2804 -initialChannelId {a9152c65-c47f-4f84-b403-97ebd73c1621} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4700 -prefsLen 34905 -prefMapHandle 3136 -prefMapSize 270249 -ipcHandle 2744 -initialChannelId {d26ccfbd-69e5-48bc-b19e-1d69c6790c3f} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4976 -prefsLen 32952 -prefMapHandle 4980 -prefMapSize 270249 -jsInitHandle 4984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4940 -initialChannelId {f7eb4c00-6625-4e73-86d4-9e9f39b0d758} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5016 -prefsLen 32952 -prefMapHandle 5020 -prefMapSize 270249 -jsInitHandle 5024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5032 -initialChannelId {547811bf-6f16-4dcd-a468-96ed8f906b87} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5388 -prefsLen 32952 -prefMapHandle 5392 -prefMapSize 270249 -jsInitHandle 5396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5404 -initialChannelId {5df91f58-a65b-471b-b58e-f90af00abd07} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 2f049c0cd9ad70c890d5d32e72e96bd0a73751c16309b28486a0917745757a8c
MD5 39b95beb015b3f250c5e3a41cd5f300b
SHA1 d0f516a9e7f8100022d3bc0a1a5f8a92cfb29378
SHA512 dd85f7dd37dc06cf37a48128ceeeccc618f69657dc8747aec2b974373784b2c2d1c4078a7bad43fe05c487088708c81ecd87542d40fd291e0f56810064ec863e
TLSH
T19861B758F2298A3EE445413ACC965B415F303446A8AFBF2A35AC608D1E5B2CD778D43E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 99315872b572d8f2448c786f545ad379d90e06edffe3eb750547a71cc9b31409
MD5 49e61044f30e4f4e0e40a970b8b058f3
SHA1 a975fb075895cc045a75e1dcc31cb9119ba0ef8e
SHA512 27734fa284d1b26500907a60aafcb33d8d7a37351f5ad291d0bdf42df881bff2e739500681031a0781590525089d1bdbdeca2363f0feb2faaafd1e819554554d
SSDEEP 192:i1d66JozGzgCl6mc0dzOv5zboPKZCoyjbdqj:sd66JozGzgC1jeboSZCoyjBK
TLSH
T1ECE12158E728867FC418027BCCA61B454F3A388A9C4E3F19359C740D2D572DE7A9D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7bf4d118f7929b6ccb9e43afa6614d722cb813561eede285cd986763d247d362
MD5 ecca4e9a24068717a13bae5978b1fcf3
SHA1 5771592d1976c3b4c89b71aad9608c9e0dfdd306
SHA512 06647c07d8b10baa973abae5f3ab5dfcaa63af57ba1566045a5f15b19b808bdf168e3aa736af4d2700147199656bd65a91a1ed30e28bebeb1c8d9b1077337d24
SSDEEP 192:TOv5zboPKZCoyjFk1d66JozGzgCl6mc0d:8boSZCoyjsd66JozGzgC1j
TLSH
T1F9D1DC58F729863FC418023BDCB61B400F36398A988E6F19319C345D2DA76DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c10085da9cc3e53f5ea414a3b71d6493344ae65c03cc7496a01b19c239a52478
MD5 c96bf049fd60bac27a4d3b719c9b43d4
SHA1 449d9606419cceb90f8ae70481baad5c90d8f83d
SHA512 99a454d0aa70c1eb109d56623c625072c0e4adb9d74c326cf1676e4b525cbdb6d9b76bfa179237525554004ca150557729d5517b8d718bd46e5e4b6ba9f2b1c2
SSDEEP 192:UOv5zboPbCoyjFk1d66JozGzgCl6mc0dz:3boPbCoyjsd66JozGzgC1jd
TLSH
T100D1BB18F729863FC418023BCCA65B400F36354BA88E7F1931AC244D2DA76DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e4c1722c0f878dc4b352ed91958a37046fabb9fa73b5b938cec1ca7e9aaa3e5a
MD5 2debfdf4c96092477c7393284ded6018
SHA1 232f5240cb8a566f1aa61a3510280a96d4df432f
SHA512 973eba7c51baf78235beec3694dabfa1119f23ea766398f8c2420c5c2f55cb2e38de017db84577e08fbd6b75faf617fb8bb9e6db054e64663db1124697dff7f4
TLSH
T144217C5C3ABE4D2A9CC7EA9CB440068E97D14E0B15871C435D13DF8DEDC1ADA36AA43C
MD5 SHA1 SHA512 TLSH

Submit Download

18b038e1-afcc-4ea1-8488-3c524e96006f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\18b038e1-afcc-4ea1-8488-3c524e96006f
Size 2KB
SHA256 2543c09650dd8b38dab959af8845893bcdbde3895625104ad44e9c4f1dee794f
MD5 34c61d616eff9a218f8873a600deb360
SHA1 b4db8d66652b90e57e10637f9840116e5b8eb522
SHA512 94b1e02594b0725769e9b75e729b5be1a6bb7bfc9ff0addfcc293667b9d56bd6df06ba096e687fd3e2e02214f3724a1030e22be2e24d5dc8236e90ccd8507254
TLSH
T11F41245C76F48C7AACCAE55D9482338E97748A4700C218436E51FE0CCDE669E236B52B
MD5 SHA1 SHA512 TLSH

Submit Download

2a742db7-589e-4881-96d2-c5a469dd4209

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\2a742db7-589e-4881-96d2-c5a469dd4209
Size 931B
SHA256 75f6a853b3ceba8ad647e61204dd8918aaf72089ffbf7908fb1fe8f99793712a
MD5 a78b5c5f2a455556168513c54e8b4960
SHA1 e8df6cade36ff2ec956c85951cbae40f19e5db09
SHA512 a59ec3be79611fe90938c315f00ebbcc1dd485671c3bc42ebded21fabf6974ca3bb31ddaa8ce9c2e1bace9ba2fceac9185f0f23482f87f44250078e22bab5bc2
TLSH
T102111041EA61B9B28D7CD24BE5A1B75387A53213C0C64E087EA11A180DEE91E5366707
MD5 SHA1 SHA512 TLSH

Submit Download

3b6aecc3-e50e-460b-a511-a351fba68108

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\3b6aecc3-e50e-460b-a511-a351fba68108
Size 15KB
SHA256 a87826b54966a3b6bf9788700fea98244a8c485a407f292def951d3fdcaddcee
MD5 8bf4bd2d9f6047e9e91e902cedb61dd8
SHA1 99bead970eaabdc47b68284cdfc23f73e1f3cabe
SHA512 9ff796304b48a684964f9e4999fcc0314b579b9ef562be32ae12f6b586e2ed027595cfcb221060a97842bfeee2575ec3325bae8de70358729efd364eb205d290
SSDEEP 192:Z4xIWnYlLcht8kaY11BS7KGM0IDt0l4zbx76jDsQzyvD5cXqvzbS7SeYDbic:COWQL6t8k7c74DtM+BAX+3S7SJDbic
TLSH
T12562D7566820597E8691E368D8FD7F83E2F118CF4C019FCE9BE4BD4859EA0AD112BC47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94ec437e-9120-4c7f-abeb-814f4892f13e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\94ec437e-9120-4c7f-abeb-814f4892f13e
Size 235B
SHA256 c305f0811eb193953b70ff6fa06669ebfc8b112aee5e55416eb4db9c4b6e177c
MD5 c6192d6ac4bb8363b5fc150c93bf8b08
SHA1 e2c63b3915fa0af8f95ab823ed911120f58918c1
SHA512 c037af2853d3e588c09f023fae40106a6a7bc1096c06e5a3827d47a777d59962239f5ee9bf29fad7ca92bc758480ed1cde7e4cb9c7f9e69071d22fdd5af2cfc5
TLSH
T14FD097C434983B9C88240F03B1E02AC230498C331474B820CAA680759FB9DC88152817
MD5 SHA1 SHA512 TLSH

Submit Download

b11630a4-06b8-4ef3-8e83-f91e20cd3d55

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\b11630a4-06b8-4ef3-8e83-f91e20cd3d55
Size 883B
SHA256 044fae6fc7ca0f919c1182a7cdd96a33958734696ed10e3b39b16b47df06c540
MD5 ea00821000c51c062612ce6eb17b9c01
SHA1 d05ebf256fd2fad0a9aa9b06da55de8fb4d80de9
SHA512 555e0c34a06fe70ce7b7122b195d686292293dc2baff8416d960c84b874b60b575f91449b801175a04a9ad2e93a5a7774cfe082b13aa75cc5ce8dcd863893176
TLSH
T1C6110081E771F9B3DC7CC24BC891B74A87A57213C0C585143EA15E180DBE61D536624B
MD5 SHA1 SHA512 TLSH

Submit Download

b96b04c9-201a-4356-b228-ecbdf893ff73

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\b96b04c9-201a-4356-b228-ecbdf893ff73
Size 280B
SHA256 bb19a6cf1236ad14b27fa527c9bcf2e273841c4d9745d134aa90e094c7b25ef0
MD5 5c8166cbf37da6df2d84c4e00d103556
SHA1 1a637f8686afd29a89f6de4c1b490b731ed2a0ea
SHA512 a6ca7416a995fd401378b49e8c1008b390aaaa1dbba3d5d70a11c74dbbb5e0535601e86a1674d409d61966dafe1b33cbaaee58c810ecae174e3078955f13319b
TLSH
T12DD02B903C9837AD0C6C5F26F1F065D631A64C3250F4581A95920A34A6FFED9C116C1A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs-1.js
Size 6KB
SHA256 e31102875a1b53d98d2e8d82b5a89ce07d3c506bd8c09878f737e7ef12cea934
MD5 c0c968643dfb8acc479507b03b14cf08
SHA1 5b9afcdfa1185f400f8b87856f43eb018befbaf9
SHA512 129892e3b7e260ff178226c570e2ce787218055942e9e943547004751ab7ff0f07dfdedcc4900c29addc5ef06a00f1c3ef8b88b1be28ab27e1965193fee4a142
SSDEEP 96:xH2UTU7qGqEvfnQj1zS/KSSlSdv9jOnPHEBDBw88n8L4cnlu88:EmRafnQjqKSSFEBDBw88J
TLSH
T113E12C789508CB6F64B676ACAC688C316AB2013BBBBF28C750B554C5011CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 6KB
SHA256 e1d8d375079d22929e94303d5b98c5b41cac309f9003c51774b99d2ffe606c83
MD5 942df094a03bb5f61f8b11db3d357141
SHA1 2732586c4b8a1afb2c99548e22554a800654c581
SHA512 94be67989d937424ca048f236207f284449d3953c9c0b959f43b539e1ea6dec4b6ab46952d24890abae6a9ababfc1a00e9167c383997ce7803b117b460dfef5e
SSDEEP 96:xH2UTU7qGqEvfD1zSc8SSlSdv9jOnPHEBDBw88n8L4cnlu88:EmRafDJ8SSFEBDBw88J
TLSH
T1D9E11D789548CB7F74B6766CAC6888315AB2017BB7BF28C750B954C5011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 6KB
SHA256 0652021634d51be46effd5611705e1dbb2902c3e9676d81dc6661c5efac7d92b
MD5 598ab479f0b3c1dabd4098678c4584cd
SHA1 5c06f61805c0a0902c46f2433bfc29c5f435a475
SHA512 7d63fd26c907326c602292c64cc65deb042ad2547fc838493981b3d7773d39c26d36698d2fa9980eaa6edac6f65130b860f00a234e9279e52dda8145db95c15e
SSDEEP 96:xH2UTU7qGqEvfD1zSL8SSlSdv9jOnPHEBDBw88n8L4cnlu88:EmRafD+8SSFEBDBw88J
TLSH
T1E0E11E789548CB7F64B6766CAC688C315AB2013BB7BF28C750B954C5011CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads