hxxp://xkon7ufvszh6y3p6eha7xfmoo6uryzhp5zprahnii2px7ucikzkpemqd[.]onion/

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://xkon7ufvszh6y3p6eha7xfmoo6uryzhp5zprahnii2px7ucikzkpemqd.onion/
Sample260925-wm6d5sshjc

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	firefox.exe
Token: SeDebugPrivilege	4156	firefox.exe
Token: SeDebugPrivilege	4156	firefox.exe
Token: SeDebugPrivilege	4156	firefox.exe
Token: SeDebugPrivilege	4156	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4156	firefox.exe
4156	firefox.exe
4156	firefox.exe
4156	firefox.exe
4156	firefox.exe
4156	firefox.exe
4156	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4156	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 4156	1480	firefox.exe	86
PID 1480 wrote to memory of 4156	1480	firefox.exe	86
PID 4156 wrote to memory of 864	4156	firefox.exe	88
PID 4156 wrote to memory of 864	4156	firefox.exe	88
PID 4156 wrote to memory of 864	4156	firefox.exe	88
PID 4156 wrote to memory of 5664	4156	firefox.exe	89
PID 4156 wrote to memory of 5664	4156	firefox.exe	89
PID 4156 wrote to memory of 5664	4156	firefox.exe	89
PID 4156 wrote to memory of 5664	4156	firefox.exe	89
PID 4156 wrote to memory of 2380	4156	firefox.exe	90
PID 4156 wrote to memory of 2380	4156	firefox.exe	90
PID 4156 wrote to memory of 2380	4156	firefox.exe	90
PID 4156 wrote to memory of 2380	4156	firefox.exe	90
PID 4156 wrote to memory of 2956	4156	firefox.exe	91
PID 4156 wrote to memory of 2956	4156	firefox.exe	91
PID 4156 wrote to memory of 2956	4156	firefox.exe	91
PID 4156 wrote to memory of 2612	4156	firefox.exe	92
PID 4156 wrote to memory of 2612	4156	firefox.exe	92
PID 4156 wrote to memory of 2612	4156	firefox.exe	92
PID 4156 wrote to memory of 2612	4156	firefox.exe	92
PID 4156 wrote to memory of 5344	4156	firefox.exe	94
PID 4156 wrote to memory of 5344	4156	firefox.exe	94
PID 4156 wrote to memory of 5344	4156	firefox.exe	94
PID 4156 wrote to memory of 5344	4156	firefox.exe	94
PID 4156 wrote to memory of 3952	4156	firefox.exe	95
PID 4156 wrote to memory of 3952	4156	firefox.exe	95
PID 4156 wrote to memory of 3952	4156	firefox.exe	95
PID 4156 wrote to memory of 3952	4156	firefox.exe	95
PID 4156 wrote to memory of 5716	4156	firefox.exe	96
PID 4156 wrote to memory of 5716	4156	firefox.exe	96
PID 4156 wrote to memory of 5716	4156	firefox.exe	96
PID 4156 wrote to memory of 5716	4156	firefox.exe	96
PID 4156 wrote to memory of 5852	4156	firefox.exe	97
PID 4156 wrote to memory of 5852	4156	firefox.exe	97
PID 4156 wrote to memory of 5852	4156	firefox.exe	97
PID 4156 wrote to memory of 5852	4156	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://xkon7ufvszh6y3p6eha7xfmoo6uryzhp5zprahnii2px7ucikzkpemqd.onion/"
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://xkon7ufvszh6y3p6eha7xfmoo6uryzhp5zprahnii2px7ucikzkpemqd.onion/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2036 -prefsLen 27099 -prefMapHandle 2040 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {1b5bcb27-707d-4a6d-b768-f689d32ad66c} -parentPid 4156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4156" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2508 -prefsLen 27135 -prefMapHandle 2512 -prefMapSize 270279 -ipcHandle 2520 -initialChannelId {a1e077dc-2192-4fb6-938e-028618e1da22} -parentPid 4156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 25164 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {601faf0c-87ea-4531-a899-500f60a06b31} -parentPid 4156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27276 -prefMapHandle 3980 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {a70de839-3a22-40f2-9d5f-25782f6ec3d5} -parentPid 4156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4156" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3044 -prefsLen 34775 -prefMapHandle 2884 -prefMapSize 270279 -jsInitHandle 2980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3028 -initialChannelId {f7a1cde2-d16a-49a4-8a94-086ec9c30a91} -parentPid 4156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4764 -prefsLen 35012 -prefMapHandle 4768 -prefMapSize 270279 -ipcHandle 4724 -initialChannelId {9aedbaf4-806a-4614-a154-5f7cf9729ede} -parentPid 4156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4928 -prefsLen 32900 -prefMapHandle 4932 -prefMapSize 270279 -jsInitHandle 4936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4764 -initialChannelId {c6007743-5861-4463-847c-b3ea8a35cbd0} -parentPid 4156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4956 -prefsLen 32900 -prefMapHandle 4964 -prefMapSize 270279 -jsInitHandle 4968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4976 -initialChannelId {6396d1f2-86c5-4330-9d99-a7b03fe4c2dd} -parentPid 4156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5332 -prefsLen 32952 -prefMapHandle 5336 -prefMapSize 270279 -jsInitHandle 5340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {500a5810-3437-411a-a3e7-89e57891e4f0} -parentPid 4156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 10KB
SHA256 eaccce992299245091768dfc9e927467302fd4f4e95ea0160744c97d6e8f71fe
MD5 e4b465fa29ef072f1fc4b9b88f7b14d4
SHA1 714b92514aa9113bbde054a3d6a9cb30b5b4a323
SHA512 50a89efdb7947c1f99022c5973377de3ad6756461f074f1b8f50ac3e64a1c60483304b8a3f7e9cd0898f23c97debb2b19fc8dbd92feae1bd257b626a07c61bfd
SSDEEP 192:HcZlpmScXz5RqvAcdRPSHXFCPD1Oo17sWbO0kQegsUgg61M0+xz+S:HalwSiO024YDPknu6q0+xz+S
TLSH
T1EA225DBE8F807CF81E5380D4E46952198F19E6BFDAF7906E111C3C488FC472565EA89D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2386633b9c61425a3b608ec1d48c63919bea1a008958e7e8c6f5bc906bab2cb0
MD5 14a8f3e41d22c5f76807101f9e3a5219
SHA1 044d0abf2dae10ec47ccb14ceedf73ab39a62afd
SHA512 653f1edf46786d569e83a2f3524cbf62147191515ab724013af6a54dba2cc0bd7b851b70d0c440cc4c9f945cab3a3f0549cead6a9015288d6c671f96b674e8c0
SSDEEP 192:Q1d66JozGzgCl6mc0djoPOv5zboPeGv8yjvBvl:Kd66JozGzgC1jxogboWGv8yjvH
TLSH
T148E121A8EA29563FC408027BCCA61B414F39384B984E7F19319D64182C972DD7ACE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a3a5ea605d13450789a955aaeb2cb1482de5356bebbd51f2b5e2735731f79a41
MD5 049d9a53955c69e260f9256aa90f223c
SHA1 e0a4f82d8e31173bbb529c7fcc32a3eb854cf90d
SHA512 66921067f84188c7e1cf949769347aa4fba44f2676e3bb7c3083a94ac0a8289b3a66f0360827d89fdbe4fba32814a658034869a752a3db5d3077273ac745f7a9
SSDEEP 192:HoPOv5zboPJZGv8yjvBvL1d66JozGzgCl6mc0dz:HogboBZGv8yjv3d66JozGzgC1jd
TLSH
T186E120A8EA29563FC408027BCCA61B410F39394B984E7F19719D64182D972DD7ACE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 23d9ce0f51995324ba37583ea94a353909580e71112dc61bac5ac0d53f121c6e
MD5 7814eff5815a15cdc758d78a1f4599ef
SHA1 19019b5f6122738a4cc72a9d1743dccddeea5ab0
SHA512 dc376314cc6509445f25509c49ada8dac4172c88ef938d4b52972279ef32e81aa45ece161ac21c37e3cf58119a774633d3931fffbd2a045b1c4c324556f2ab09
SSDEEP 192:Q1d66JozGzgCl6mc0dVoPOv5zbowMGv8yjvBv:Kd66JozGzgC1jzogbowMGv8yjv
TLSH
T13AD10FA8FA29563FC408427BCCE51B414F39394B988E7F19319D64082D972DE7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\events\events
Size 1KB
SHA256 a5a02919dbc1609fbab9023b801d14621895b2109c7658ae67e734c2f0780c28
MD5 afbaf6e10c9b41fae094f0c36ec3538c
SHA1 31435b362a6b60e4e8f219c0d2a78b9bbb76845f
SHA512 bef5cfff2870c2744d628e67b62004a727cb66c24380556dd722d5c0b124a63868afc5e3de1fdf5eb01949fcfea92e3a776c4109c35b1c6f5c0d1de619781c42
TLSH
T161217F8C3AB88D2B5D87F69EB481128E97954E0704871C43AD42DF8CDC81AD971BF43C
MD5 SHA1 SHA512 TLSH

Submit Download

3b50c67f-4261-4575-be34-9aff986117d3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\3b50c67f-4261-4575-be34-9aff986117d3
Size 886B
SHA256 5fd5ff4efec5d629e9a0e927b08dba563a3d013561d0f8adf9cdf0bb20f9bfae
MD5 3bd2c83e1c37afeee233fae900e2e58c
SHA1 c03daae7291dcea26ec7f999ef42bae55fe48a3a
SHA512 476a3755c885675891c358642fba8a6d69050722e0adbc991a482eef30e246a124aeb68819605c9f446a4bff10c9b3989160c0075e5e6616d967d74c8504c87f
TLSH
T192110091A9327872CC29D14BC4E0775287F43513D0C64E187E905E1C0DFB50E53A630B
MD5 SHA1 SHA512 TLSH

Submit Download

7cfd8b17-1a62-4801-bc33-84485e0f4b89

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\7cfd8b17-1a62-4801-bc33-84485e0f4b89
Size 235B
SHA256 11ce1f8b14f47e1bed5cf85941363e20d38fa510f855b5551fa55789ec6e6526
MD5 44fb8a6fe968290c95d80f3cdba43953
SHA1 e673b0d85730c5c89456bd874fb9eadeaa7e4a36
SHA512 19ef79fb0c0681ec9e017c47db4621bb23222412498ee3275ff6dcf696047b54a880c862890d7cf0477b0509c244815427080658c26898f373d131269676e451
TLSH
T1D4D097C028882B2C08101F9BF0B029D631944C332874A860A5628574DEB9ECA0221816
MD5 SHA1 SHA512 TLSH

Submit Download

8c12d0d8-e5f1-4d38-8b97-17a8578cfbfb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\8c12d0d8-e5f1-4d38-8b97-17a8578cfbfb
Size 15KB
SHA256 6f9f8b79c163853b6f1024b62586c1371dca86306b7cf4bfc4f015e421802adc
MD5 652d3bc5be2852974cfc42035a32c49d
SHA1 5f1d26224439effdd54873af7bf2a6656b113bab
SHA512 90d2adacbb2207f304c28c2ee59545c1c773fd84bb1702953c15697106c3cbbe8d7178fb9edf20960fcaca3f8c779273b9c17e9b6db915fed1978af6defa89db
SSDEEP 192:/zawfdULCuqmRrrturrLqBJYESe+k64BaS1LPEKihAv5KSj6DSKRzLBzjCIEP:7aud58J7h64Qbgbj6DSKRXBzjjEP
TLSH
T16072D8562420597A8251E399D4FCBFC3E6F528CF4C418FCA9BE47D085DEE0AE012794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e93fe93f-bdcf-4f25-b047-997627d8aec0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\e93fe93f-bdcf-4f25-b047-997627d8aec0
Size 235B
SHA256 3610abf5f4ccca890dfdff69186e4c68777c16123c144704759d1586533c67da
MD5 a1432e0e82c0165e73664d7bc172ac70
SHA1 167df5a6f8050273b3024b5b2c3699a2a22e16e7
SHA512 21cd32e2cfc3505e20c87469b4ff009a3ca724e71dd4af21963e8cd051ea98e48724de78a8d7720a3d46716c15319fd23795cce8f194dfae3ae46e015320d675
TLSH
T195D0A7C124A8675D48140F16F1A169D630A94C3768B4A860D671497899FDACD4162957
MD5 SHA1 SHA512 TLSH

Submit Download

efce89c5-0f4f-41d0-b240-3d538f17612f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\efce89c5-0f4f-41d0-b240-3d538f17612f
Size 2KB
SHA256 e6596fab9fd050f59f4c04dd7a6e8b56cee982999087b3dcb3faa7a6ebe2d83d
MD5 8bbf142e9206016a46b8339f611afaf7
SHA1 89429b61ab224ed8b5e78d44916cdb07b2c0afe3
SHA512 86467191a84941ee1f28512bf3982132d58bc7c8f512f066c06e5f6c09a037ad5218e9662fa0642e92fd1da8263f82f4ffa3c814f874cbcecb51c6a223b681d7
TLSH
T1EE413E6C35B85C369CCEE14ED18223CE53748E4300C31C832E92EE4C8DE669A237A52B
MD5 SHA1 SHA512 TLSH

Submit Download

f2724cf0-7b96-43fc-b250-26b905100de2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\f2724cf0-7b96-43fc-b250-26b905100de2
Size 883B
SHA256 6abd7bfb5798f96931e3320b54de5e54375b382094a629fef8768f24e601fc4f
MD5 756e4e8ee9e64578fc37759e633c6a92
SHA1 1e60f99a64af0d373f54555ac91c5fd37b40dcb7
SHA512 3944d97eba77db8367d350bcae63233599cd9ff3ddbe7a2536475893b6a2764e8a66731b3df75e9cbdc4b09c0d7545d1cadbc5c699abf047b9828477b00d7798
TLSH
T12F110091A9767972CC68914BC8A537014BB8761380CA95183EA10E140CFF50E93A6307
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\extensions.json
Size 16KB
SHA256 ad470ea110cd4314b1ebf97df64051c969a23c99d93dc9546dd1c6606bfa69f4
MD5 4a9108e03331594111abbe7f4e505ea5
SHA1 e2601c1eee109c5db3bea4b00b64dfe7b0501f1b
SHA512 4d559583194d10f7f73aca3e1eaefe5f30ffb62a237d2b94c5766c162af49905fb354d579c03e334d6feac3b2f223d72d6975d9a3ad596e99e85f583778b12db
SSDEEP 384:xkI4vDUmldvmC8dhW294zK96oSL4HgL4PYL4HtL4H7L4Hv54hc:CI4bRfuXP4C6v4i4i4N4H4B4+
TLSH
T17272531545049EB8298EA79AAA367E01C37D473B60845C78F4DD8FC842FB5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs-1.js
Size 7KB
SHA256 352169ca13904c072f26252028956f7a374499ca1ddc3aea1aebf6cac1156515
MD5 6a5ccb82d6d9bc254c36a8991a2c086e
SHA1 ba5c839b3b31c5708facffe6d82b672671a4d75f
SHA512 f4cdb69ae4319accb40fa19fca74c7ca77a24158a70e007403445fc8a4de43994e08e1fdc3abcbb40bc062e71154d0079f983728f08b95fc7999be80cd21bcee
SSDEEP 96:xHrJlTUdGLqGq8fbaKObzSqwSSlSdv9j2nWWRMHQWEqBw88/YE8L4cnuVCLM:RJOGGR8fbaKkwSSDReQEBw88rUo
TLSH
T11DF12F785104CB6F64B6777DAC6489705AB2013BB6BF68C7A0B984C4014CF3482FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs-1.js
Size 6KB
SHA256 3077b60bb5529c6a7b925eb81bc7e9f18ba91151ec12049c28cf47fae9705880
MD5 218f487fdc24796ea8feff3aece681d1
SHA1 b2bbb584b78cf1e207bc868aa7b9ed9cdfbb6c49
SHA512 1161a99af79cba26dc7a6b2dfdea40cce6960a43360e933e7e9cd835cb244df59b1513fab7ec5e64c568a77f9ccbe6828017f2ad3b3e63a09b6433a5b47398cc
SSDEEP 96:xHrJUTUdGLqGq8f3aK1zSqwSSlSdv9j2nWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3aKfwSSmbQuBw88jUo
TLSH
T1D2E130789008CB6F74B6776C6C6888715AB2013BB7BF68C750BA54C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 6KB
SHA256 cdcc6c630d3cf7896afc2fab4686e9bccc0eef0ac984b6620169f8316fca281b
MD5 043a4085a87c81856639e096e43230fd
SHA1 eae7e7a3ae1407d16d870f81b8244b8853fd6b86
SHA512 b4c13d428766b3d0d2c3fbc043768f836c38113147b22fe2ea4ab3def31c625a2710e6eea7b5e8785e4a1822c635d1aeb57c2b8bb7531bef6af4cd90f0904b58
SSDEEP 96:xHrJUTUdGLqGq8f3hY1zSPSSlSdv9j2nWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3hY+SSmbQuBw88jUo
TLSH
T12BE13F7890088F6F74B6776CAC6888715AB2013B77BF68C750BA54C4015CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 59aa17f5792234b6469fdd79332255344b217e9760403f9c7794ca167f699797
MD5 415f79a3dad1057d10e6a4a5a99b4e5f
SHA1 8dd5fc9d8335fce8bb84ac597a9fbac522eff06c
SHA512 04b9f665853b001808663b2a7e9a3015d85e6ef807d56f8c24d7e95bcd7f345583ab8b30bac36e48c181563a2215505ebe34cdfa4af606f778d529446742f9a2
TLSH
T1A5210BD3591A3EF47F17E219A4858FB19799307105741CB0858F991315CE44D764A12D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads