hxxps://giminion[.]cc/new/gm/

Analysis

user interaction
yes
max time kernel
20s
max time network
14s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://giminion.cc/new/gm/
Sample261024-pc9v9atzet

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3604	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3604	4584	firefox.exe	81
PID 4584 wrote to memory of 3604	4584	firefox.exe	81
PID 3604 wrote to memory of 4528	3604	firefox.exe	83
PID 3604 wrote to memory of 4528	3604	firefox.exe	83
PID 3604 wrote to memory of 4528	3604	firefox.exe	83
PID 3604 wrote to memory of 4380	3604	firefox.exe	84
PID 3604 wrote to memory of 4380	3604	firefox.exe	84
PID 3604 wrote to memory of 4380	3604	firefox.exe	84
PID 3604 wrote to memory of 4380	3604	firefox.exe	84
PID 3604 wrote to memory of 2940	3604	firefox.exe	85
PID 3604 wrote to memory of 2940	3604	firefox.exe	85
PID 3604 wrote to memory of 2940	3604	firefox.exe	85
PID 3604 wrote to memory of 2940	3604	firefox.exe	85
PID 3604 wrote to memory of 4264	3604	firefox.exe	86
PID 3604 wrote to memory of 4264	3604	firefox.exe	86
PID 3604 wrote to memory of 4264	3604	firefox.exe	86
PID 3604 wrote to memory of 2916	3604	firefox.exe	87
PID 3604 wrote to memory of 2916	3604	firefox.exe	87
PID 3604 wrote to memory of 2916	3604	firefox.exe	87
PID 3604 wrote to memory of 2916	3604	firefox.exe	87
PID 3604 wrote to memory of 5360	3604	firefox.exe	88
PID 3604 wrote to memory of 5360	3604	firefox.exe	88
PID 3604 wrote to memory of 5360	3604	firefox.exe	88
PID 3604 wrote to memory of 5360	3604	firefox.exe	88
PID 3604 wrote to memory of 5384	3604	firefox.exe	89
PID 3604 wrote to memory of 5384	3604	firefox.exe	89
PID 3604 wrote to memory of 5384	3604	firefox.exe	89
PID 3604 wrote to memory of 5384	3604	firefox.exe	89
PID 3604 wrote to memory of 5444	3604	firefox.exe	90
PID 3604 wrote to memory of 5444	3604	firefox.exe	90
PID 3604 wrote to memory of 5444	3604	firefox.exe	90
PID 3604 wrote to memory of 5444	3604	firefox.exe	90
PID 3604 wrote to memory of 5456	3604	firefox.exe	91
PID 3604 wrote to memory of 5456	3604	firefox.exe	91
PID 3604 wrote to memory of 5456	3604	firefox.exe	91
PID 3604 wrote to memory of 5456	3604	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://giminion.cc/new/gm/"
1⤵
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://giminion.cc/new/gm/
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27097 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {044bf290-0165-488b-8d20-896ce5c33a03} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {9c421555-7f48-453c-b165-c4d8138dbf4a} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3804 -prefsLen 25164 -prefMapHandle 3808 -prefMapSize 270279 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {99c8fe5f-96e2-43da-9196-c4a9ff7486b4} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3968 -prefsLen 27274 -prefMapHandle 3972 -prefMapSize 270279 -ipcHandle 4040 -initialChannelId {a5fe6071-d9dd-4947-b517-10b160cb6bc4} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2732 -prefsLen 34773 -prefMapHandle 2988 -prefMapSize 270279 -jsInitHandle 2780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2904 -initialChannelId {9fe17cd5-1cf7-4878-9566-a412d6213f62} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5088 -prefsLen 35010 -prefMapHandle 5092 -prefMapSize 270279 -ipcHandle 4996 -initialChannelId {46c62cdb-fc4f-45f0-8af8-28842b1d2f5b} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5268 -prefsLen 32900 -prefMapHandle 5272 -prefMapSize 270279 -jsInitHandle 5276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {2fba63f7-7030-4f0c-bd35-c6182351a882} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 32900 -prefMapHandle 5460 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5516 -initialChannelId {2f9a39c4-1107-4b01-a06c-c02108018027} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 32952 -prefMapHandle 5712 -prefMapSize 270279 -jsInitHandle 5716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {2edfdcbd-1981-40f1-971c-edbb3c71363e} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\activity-stream.contile.json
Size 4KB
SHA256 eda81aa14ad6e86b7d244b4737a54f944af5dd46b6ac12cd18190c6d7509b0dc
MD5 0d3aec3c540df4ee80b27dd2ae532e5e
SHA1 eb42d8c24c1d9d2bd8e9fb9ae7ce4b16482a963d
SHA512 cc35b0dbcc0e1bc027ca9d4693430bc728c0d8bf04cf40364248a309061fc7f5c8a80c26a651b0ecf9cecbede349c1e39b68d5a15c38c6e45230c82154557b45
SSDEEP 96:TD3iMz7SEjm5Z57fYLXT+mR/2nyWMyazYL4Mgolz:XyMz/jYH7fYWmR/2yWMPzYMMgoF
TLSH
T108A1EA6B95B485521721BAE60C0B13DCF013700AD9F1DE78B1BAE965A5E83EF80DE944
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 3970730dd69c75ebf9d5134029ceb0f2b15a4d185826bf6cb11279f285b73eda
MD5 6f4a25bf5193f815f763ed92760a5098
SHA1 a454894140d767f6179adde5d95e0169ac5af356
SHA512 596774248527d2dfdc8ba2b44b70232681990effefa69141ddb4dcc6918b60e0f810115442dcac3ceb61c4c50e9fbd4fd0a77c71c6a4400c46c95344a25d3927
SSDEEP 768:hKy/XB6V0gl0v51Yu/i/FLsVXROI9mOgOsr9SOOr9Rt8q+G6:hx/RAiRiu/UF8ROI9ynrWtUG6
TLSH
T12773FAA3A6E871FB1BA137CB1C0FB95B62D20246F3450AC8FCE9CD1C91CD754523A5A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 bb2389eb02d2a595db720a6fa174c147afbb9861df9f4411fdf3e957c8a27abe
MD5 10864838c1e6d5cb26577d055145a662
SHA1 3daecd3f36d6ff56db4f1f65f41f9e430027e64c
SHA512 66dc724dc5711522622e9181fc920f4b3e9c20bfd3817755cf6fc9cb6af6687a7289cdea34d49c464195038c861bc88c098f90edf64de89822d2c5a4d1521d78
SSDEEP 1536:jTrliZW3bId7NJQnyP6sLKs0Btr3VWxuYjh12jKAiEWUyEtwLF0YTi+bxaeu1OrW:j3lQNJQnPNzrlkiKCyOV+bxII0cu
TLSH
T1C1A3B0F6DBA2C83C65FFD42DA782853EFD272414B3A72009C923635452C6BB87679748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\SiteSecurityServiceState.bin
Size 1KB
SHA256 9843da47e3d14fdaf568425cab50cae3190c7e21cdaaebc614baaae45416a170
MD5 d1e7a0735e2c2fdcf53ba2c264065b28
SHA1 c426ca7d30306a4a393f566e083566695408bee8
SHA512 a13429ea7641ff7fab54a9b5a03d486e5dd7979f64b55305f52e1d545a52086f6a933b7afab89f7cdaab2c18dc4d41af18822fc724e3eb8550a68eac05fb17f5
TLSH
T15021123948CBC175F0924735749E88600C16339A41A7F4A83FA156D030A4FE829EE291
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f9a2f298f07b94035d4500d5740f455903e9ddf74b48aec4aeb55ed1acc84cc6
MD5 b85c30cac1be5676df2214fc968c0645
SHA1 ff0126a9b26bac14e711cd403a77cb2fe4e75fc1
SHA512 da45325c37152af9b2374a48387b00ecb840b70856b6c4ee7b7c686aefce9912454da0d185f0f4e6562c0c66078b8d42dcbc6a2c79f2a54c7a9bc4662edfaa8e
SSDEEP 192:QM1d66Joz0dzgCl6mc0diOv5zboHfZ6PyjacD:Zd66JozQzgC1jHbo/Z6PyjD
TLSH
T16AE111A5EA28463FC404037BDDA61B400F35399ADC4E3F19369C651C2C5B2DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\events\events
Size 1KB
SHA256 21585f3fe2fe3a7c9c313ad0de5bbb978a03a62e2b56bb3151386c7762b35d8b
MD5 4ba2f824d66fee3731f8cb8299aacc6d
SHA1 24f3f5deb9a123fb8cfa1b8533878f3abf0f8b79
SHA512 c8cfa102897704dc7f4f6757101a84f4dfeb4e67458887b9b94fe36756e67d6062120f562c7046bdd128f80382c10688a45809adcdb72e5934b323dec7d1f3fe
TLSH
T17B21255C3EF94D6F68CBF69CB481028EA3554B0A45871C434E42DFCDCD91AE932AA938
MD5 SHA1 SHA512 TLSH

Submit Download

37468dd4-35f2-4fed-93d6-c964dc4cd1f8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\pending_pings\37468dd4-35f2-4fed-93d6-c964dc4cd1f8
Size 883B
SHA256 3047e2183dc51507a932bcf4912e1b4849b5b5d263b970d2f10fae8a3c59f301
MD5 cf075a89d71fa738455166a5e3f68a18
SHA1 d84e6718a29f2c195e260554c489dbbbae5daa26
SHA512 70ec618073e208cf56a337f0f5210b21df60aac349abd0c49b0cb9034b5001c44d95b0ee98192b6fbb76bac38151a6084816eb900df886160c8a20035860998e
TLSH
T18C110481A77475B2DD78924A8955370247B47533C0CA89043EB45D080CBE60EA75A75B
MD5 SHA1 SHA512 TLSH

Submit Download

3acf2960-f48f-464f-8c17-03cd8cf6f9fc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\pending_pings\3acf2960-f48f-464f-8c17-03cd8cf6f9fc
Size 235B
SHA256 7887f55f1aa2991666c9087a7692913ad9cf1bfc0df15ef53f10fabfea0ac32f
MD5 df0fcf0376486d2a8b7b9f99f97bc710
SHA1 86fcf12f4eb7625ce4609e054548cca2d8c167d6
SHA512 b9970da1d83546ec0bc389a7c901a6794d563052cc1a035792ef017c5da341ea69c3cd3af462bd46877f7f72f6f85106995f1d6715aa35cafee4077eee26d696
TLSH
T1BCD0978A2898235F08100F13B0E06AD231468D331074A814CDA005389AFCFC88162807
MD5 SHA1 SHA512 TLSH

Submit Download

8c3371d5-f12f-4755-9afc-f9e2b77c71b1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\pending_pings\8c3371d5-f12f-4755-9afc-f9e2b77c71b1
Size 235B
SHA256 b4e135c034f8f9afc372f24d53d0cdb6726da0f91201ab5f0f43d2f6156a3338
MD5 82a6c37fbd966df6053e0caf5d2b2ab2
SHA1 7dcd76cd047e4e2a9edaa589727743db940797e4
SHA512 c41734a7d83818bdcb91a5e617410a841fcada23618269b8fdf7ea2b925c136e621e92d9bbec517526607cf9896730e1b694f288440cf74f81f07cca0a66194d
TLSH
T1C5D097C464E82B9D08140F13F0A028D271884C3314B458A0D660C6B89DBEDC84152C46
MD5 SHA1 SHA512 TLSH

Submit Download

b529a270-3197-4f22-b36c-f6c640857e73

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\pending_pings\b529a270-3197-4f22-b36c-f6c640857e73
Size 16KB
SHA256 59f1733cbd284823633a11e2839c9069ebaaad4eb3357d837b47cf4026f4897b
MD5 ac65cf48e9808b78663d42fbc2faec4b
SHA1 08f795550032d79536ecad899be3ddddfd9d7e73
SHA512 26aa459f9d81919cee7354c905d8d598419d68f9cc874461c063400d8fdfe53cad9f4dbe8e7a6fa7a996e0730bf1ee9a0925f6700189f8cc3be1eac08a7c39aa
SSDEEP 192:9pJKlESP0x3DvLC1880K3kSzo21YuyY4BzPFYU4lZ0ias3s+m2o8OP/Kmo8c2ROC:PJKlqzvLs880K3kSFyY4gLfqdm5I
TLSH
T15072CA56282045BA8691E36994F87FC3E6F538CF4C415FCA97E4BD082DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c99d685c-b16d-45e2-b5af-e9c0a1827d70

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\pending_pings\c99d685c-b16d-45e2-b5af-e9c0a1827d70
Size 2KB
SHA256 861220608c7ab468326ec727f75127e01f54eb1b1bb570f48b5a3fddb7f6b387
MD5 e2fe10f83430424070cc496246f7ed2d
SHA1 22771e8cae53acffb42a31d2abbbb3db804d2060
SHA512 e6dd59115e22c844b7cca58efef0987e9ed6015b02e1f58e4e83ece317959d9f4202f4500599eb8dba3bc5971b0efb29d3d7f85f3eb2c2989bd87b1b2a03d717
TLSH
T10241315875B84C769CDFF28D89D2338D53648A0380C62C832E55EE0CCD9679F23AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

d96377de-2047-477b-b26f-57e016eb0a1c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\pending_pings\d96377de-2047-477b-b26f-57e016eb0a1c
Size 886B
SHA256 e08a5cd802338c7b06db6f68083065872c0ba81dd375be80b1793cdb0909651a
MD5 13c593b0d9880bd4a74cafe3e7cfd017
SHA1 9dd6dadf486f46285ceb071b5108624c083a8080
SHA512 c9c26440ba39348e87dfd8f3ca4c80b46bae00e6945be65d6835adabbee71117c5017e7822ebdfe4c24077bdcac2e5b41867d2a41577824ea9b452546735f9b1
TLSH
T1D91144C09730B5B2CC68824746A137428BB07023C0CA4D083E644F180CEE11E53AA30B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\prefs-1.js
Size 6KB
SHA256 3db6f78bc36f7bd10fcba40ef2c842fa51da53b5a0ffbb1dd5492142c3b43697
MD5 58437a5c0c12c04501bb9849abda0d1b
SHA1 29ff58d003774480cde4cda2afb68f6f9c12ccb9
SHA512 1075766038502c87f5c44fdda8caadb8cea0e0a6b8251725d76ca877fbe3b4d9114b4c74865ca46bdf073596b16462789dda15e21c5f6dfce39991951cb5b361
SSDEEP 96:xHjeUTU5QqGqnfNH61zS4SSlldv9jbn3RHyrBw88H8L4cnwb3:VelRnfNH6xSSj94Bw881
TLSH
T17DE12F7895088F7F64B677AC6C688C316AB2013BBBBF28D650B954C4054CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\prefs.js
Size 6KB
SHA256 8f74d2bf7a4cdbda9ddb0efb2328b4e616a172b2e23634bc714542080d1cdc5f
MD5 c86610b460816fc0c436592375f81353
SHA1 e1a9584fd2b12d40516e9396b72f9cfaec90e5f0
SHA512 60ea1380a25932c8ccf03b5029ce7f84b4c22600f547605e7d9797417ab45851c70e7d847e12fd6132fc6233be094838318d616541b515c7853c5a4bb2b0bb0c
SSDEEP 96:xHjeUTU5QqGqnfNfC1zS+SSlldv9jndn3RHyrBw88H8L4cnwb3:VelRnfNfCHSSd94Bw881
TLSH
T12BE11F7895088B7F64B677AC6C688C316AB2013BBBBF68C750B954C4054CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\prefs.js
Size 6KB
SHA256 5252cec4e33551689a888396c1acca90ff73b2979d005eeca693a117ff247126
MD5 99839a7c064b93b894e54c6418411109
SHA1 ad7864cd81ad5b120fc8c3682a943e99491fa124
SHA512 2332a507e94feafed698fc3e6a25ade5e14f8caf459d20c476ae61d3ab6a3bfa94f492f94042b150cc1fcf85c989c2b26edb718b6966b474ce2be14a18dba464
SSDEEP 96:xHjeUTU5QqGqnfNfC1zSnSSlldv9jndn3RHyrBw88H8L4cnwb3:VelRnfNfCGSSd94Bw881
TLSH
T174E11F7894088B7F64B677AC6C688C316AB2013BBBBF68C750B954C4054CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 5b178edfd5afe5b297b81e707c4bfcbef60c9af1ec0cd1fb93e85416e88ababd
MD5 42551e8b26bde9bfc970b7974edad83a
SHA1 2bfb5cdc3fa1ec3f7191e1f7d0e28ae8725c2c7c
SHA512 e3d01e421a8aacc9bb6e7bff8cf2fe6e93cb007cd44d0ec2bfca6ed0da5e5bc8e99c69fba851c34d135644662f4e1ab01287662da08f95f09e6d1d74a1d5863f
TLSH
T13F21C663A8272EF17B12B259C8451FF4E7993031093454F0838EED0221AE1453286748
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 e6821d6d152316083bc91aac6487fd24cb870d3289d2068ff1690dd44606ab5a
MD5 dafb7859777b5d9719dd936abce04df0
SHA1 efa6698e0f10cd7de613ae62c4b793c84396a881
SHA512 5eb155cb17e89da2ffaf9d16f576de5c5069b6bda436a0c05a37cb7bf5620b55fefc2ef9fadc1590749cf53edba62964bbd3b5110c1676df9f544c6649298af6
SSDEEP 24576:fNJwu7DmsTOPjPh5YoMkhlthBDNDWEhoQHhTJxK9Z15P7UNqstAhe3QNoB25Co:fNx/kDbYQhe4JxmT5P7xHhsqoST
TLSH
T13A4629E820D1A297F3814073724593EB21EFD00D5037DA085BA99AE9A574CEF8E17B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 c45db5efcab92044ebb6baa9d542bc4697d33f9b4e2bd6382ffe0966426233d0
MD5 6ffcd767cf2bbb5bfa39b17fbcf2aee0
SHA1 37b592c4f56b434f2bdcbb1c53bbf3c1a6f24c6a
SHA512 551f39c37d3c985073ef74c9ba869aa39be059d92a8d417ec9a388a29bc5b7e25bf4e5fe5b326903a63f1ed0667f3a75dc206fac53ec33e7f9e2ff0736b6c2a6
SSDEEP 24576:HNJKq7imi+fOPjPt5YoEVhptOBDNDWEbJQHhTixK9Z15P7UNqstAhe3QNo9m5CP:HN3akkD/Ylhe4ixmT5P7xHhsqoKM
TLSH
T11F4629E820D1A297F3814033724593EB21EFD00D5037DA085BA99AE9A575CEF8E17B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\targeting.snapshot.json
Size 3KB
SHA256 50ce918dda0b5bf6fe1514b98b695a472277b1dca02ac7ea306e3e0fcc8d2c0d
MD5 c114e0fb077c7a440d189edb7852bd89
SHA1 a3bcdaac4011b42278617eaf6b30f1a9a9f01a99
SHA512 fb1ef0c8186de711d3c3b157a52687338608a011381973b93dfca4a3510e5a8b6aac387078eb0b029f4d5766ccbbe3af205e5c8f813789296ffb22fb782fbb0f
TLSH
T18C71820C961CA4BEA66BC3C0D6447FA78BBD053370447458DAFE460C95FB5FB162621B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads