61aca6bac6b538577cf8469492a87647274c81539a833fdacd119c5f2d56560d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_50c1ed05c2eb69dc6d1d0027297d0794_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Size 383KB
Sample260528-vrjkhahs2v
SHA256 61aca6bac6b538577cf8469492a87647274c81539a833fdacd119c5f2d56560d
MD5 50c1ed05c2eb69dc6d1d0027297d0794
SHA1 27e7c52390a0023384c7abfc859c8ca40958e4a5
SHA512 a1afda4c064aea2d47082d116a56de779f831a7a76b10f2c20bf885fba982d3b1c7107038fa1d9ace7d156fd3c96dab353b38767e7aace073b5bc82766638e26
SSDEEP 6144:udhYXxt/WgyaNmbXMHupIeIaK+XDsBRHJeqD:IYXxtrmTMHupIeTzwHJeA
TLSH
T14E84AE16F3DA04F9E1A7C638C9024516EA72BC564760A6CF33A46E963F237E05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	firefox.exe
Token: SeDebugPrivilege	2204	firefox.exe
Token: SeDebugPrivilege	2204	firefox.exe
Token: SeDebugPrivilege	2204	firefox.exe
Token: SeDebugPrivilege	2204	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2204	firefox.exe
2204	firefox.exe
2204	firefox.exe
2204	firefox.exe
2204	firefox.exe
2204	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2204	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 3248	1708	2026-05-28_50c1ed05c2eb69dc6d1d0027297d0794_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe	80
PID 3248 wrote to memory of 2204	3248	firefox.exe	81
PID 3248 wrote to memory of 2204	3248	firefox.exe	81
PID 2204 wrote to memory of 5104	2204	firefox.exe	82
PID 2204 wrote to memory of 5104	2204	firefox.exe	82
PID 2204 wrote to memory of 5104	2204	firefox.exe	82
PID 2204 wrote to memory of 1960	2204	firefox.exe	83
PID 2204 wrote to memory of 1960	2204	firefox.exe	83
PID 2204 wrote to memory of 1960	2204	firefox.exe	83
PID 2204 wrote to memory of 1960	2204	firefox.exe	83
PID 2204 wrote to memory of 4588	2204	firefox.exe	84
PID 2204 wrote to memory of 4588	2204	firefox.exe	84
PID 2204 wrote to memory of 4588	2204	firefox.exe	84
PID 2204 wrote to memory of 4588	2204	firefox.exe	84
PID 2204 wrote to memory of 2868	2204	firefox.exe	85
PID 2204 wrote to memory of 2868	2204	firefox.exe	85
PID 2204 wrote to memory of 2868	2204	firefox.exe	85
PID 2204 wrote to memory of 2788	2204	firefox.exe	86
PID 2204 wrote to memory of 2788	2204	firefox.exe	86
PID 2204 wrote to memory of 2788	2204	firefox.exe	86
PID 2204 wrote to memory of 2788	2204	firefox.exe	86
PID 2204 wrote to memory of 3464	2204	firefox.exe	87
PID 2204 wrote to memory of 3464	2204	firefox.exe	87
PID 2204 wrote to memory of 3464	2204	firefox.exe	87
PID 2204 wrote to memory of 3464	2204	firefox.exe	87
PID 2204 wrote to memory of 5108	2204	firefox.exe	88
PID 2204 wrote to memory of 5108	2204	firefox.exe	88
PID 2204 wrote to memory of 5108	2204	firefox.exe	88
PID 2204 wrote to memory of 5108	2204	firefox.exe	88
PID 2204 wrote to memory of 4068	2204	firefox.exe	89
PID 2204 wrote to memory of 4068	2204	firefox.exe	89
PID 2204 wrote to memory of 4068	2204	firefox.exe	89
PID 2204 wrote to memory of 4068	2204	firefox.exe	89
PID 2204 wrote to memory of 3308	2204	firefox.exe	90
PID 2204 wrote to memory of 3308	2204	firefox.exe	90
PID 2204 wrote to memory of 3308	2204	firefox.exe	90
PID 2204 wrote to memory of 3308	2204	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-28_50c1ed05c2eb69dc6d1d0027297d0794_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_50c1ed05c2eb69dc6d1d0027297d0794_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27098 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {bccee9b7-f3b8-4c9c-9945-2911786e222e} -parentPid 2204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2204" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5104
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2396 -prefsLen 27134 -prefMapHandle 2400 -prefMapSize 270279 -ipcHandle 2412 -initialChannelId {4aaf2299-f177-4ba4-8795-ef66c13dd30a} -parentPid 2204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:1960
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27274 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {0560a39b-7249-42e8-b3e2-9ff29ec7b0d7} -parentPid 2204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4588
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3988 -prefsLen 27274 -prefMapHandle 3992 -prefMapSize 270279 -ipcHandle 4008 -initialChannelId {ac640785-9517-49fb-b34d-630b4d12e168} -parentPid 2204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2204" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4548 -prefsLen 34773 -prefMapHandle 4544 -prefMapSize 270279 -jsInitHandle 2920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2896 -initialChannelId {a6d0263a-d950-4a0f-84e4-9024021cafa0} -parentPid 2204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:2788
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4924 -prefsLen 34822 -prefMapHandle 4928 -prefMapSize 270279 -ipcHandle 4960 -initialChannelId {b27b0762-ab5f-4637-90f8-3851139a7833} -parentPid 2204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3464
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3140 -prefsLen 32952 -prefMapHandle 3144 -prefMapSize 270279 -jsInitHandle 3148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {0522d025-3202-4a1c-bea1-d2d6cd78cccb} -parentPid 2204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 32952 -prefMapHandle 5668 -prefMapSize 270279 -jsInitHandle 5672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {fc2b849b-4e8f-4e7a-b527-b129030f72f0} -parentPid 2204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 32952 -prefMapHandle 5856 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5868 -initialChannelId {7540ea5c-77d8-4a46-b6aa-c8b29f0421e3} -parentPid 2204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wvdcag27.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 1db12f69341c8198733461149cd2c4dcff4fd921a9d95e0f5feca5cea05bd041
MD5 fe6b7dcb4763fc9ef9a01705d5601ecb
SHA1 161b5930571c94a874c45a2465a35d739d2e967d
SHA512 7a13664938f0d29be533d6d6b2285533b8cfd7dbe3d2d1b52e0b07252a65d4b0002f0d30fd621d1e08993d63f31d0bba1569165286161962daefad85ec26f0d0
SSDEEP 384:HUr7iO024YUo6J+Sl1xDnZBPsac4j0lpDII+HmLWmLV:0SZYUo0+Sl7zZlsac4ID8LW
TLSH
T1D3528DB99F0238A92A27D0A1E9BE5344CD05E6BBDEE2D06705143C04CA847B9F4F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1360b6c4ac88770e9710b55f8932318a10ed77840f58d23ec54c2d785f6ad98e
MD5 847afc3dc350fea1afc4d5a98da17b72
SHA1 6b86e971ad013ffaad912731152014c81ab70de0
SHA512 a95b927398b77b5faf6f6a72d22f98d1980f295a540b423ff87d77aa91ccc30b2321bc8c55084dc037c2cbbcc1ba8c0b300572f2163d1d187c24ecf85ba9604c
SSDEEP 192:H1d66Joz0dzgCl6mc0dSOv5zbozZU3yjCI:Vd66JozQzgC1jzbozZU3yj1
TLSH
T14ED1EF68E639463BC444427BDCA21F400F39788B9C9E6F2531EC645C2D572DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 381a94b4f532911185b45ea6ecbd5e7642a8b3ab73ff0f26ea0ec787d2556eef
MD5 06a508472d48505a380dc3ba05ba46b1
SHA1 6f23aa6eb37b9585029def419219266cadaebd75
SHA512 4ac5606c0b15d25586a910ab19e090cf2c526f7fa3a83ccaf5d449549462de3f9c79795325fd68f923ddc9ea4ada024263ff868b1baba811801038096a864d1f
SSDEEP 192:H1d66Joz0dzgCl6mc0dpOv5zboHKZU3yjf8+:Vd66JozQzgC1j4boqZU3yjx
TLSH
T112E13264EA28867BC444527BDCA21B410F39388A9C5E3F19319DA45C2D572EE3B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\events\events
Size 1KB
SHA256 9fe6085f48d8bfeee922611c55a7b1d90a6245e99529a9ca7be34f1f98c184c2
MD5 19e3af88d64cb349ce6ce84ceb8ff34e
SHA1 843af6e7a0bc11c89373a58b3e8447e441b0edd5
SHA512 e3bab643512f7bd696652b6ea9ef931cb569c447e6e91032126dad4406fcc50f1f023bd6f6f707e2af2ee57e0369192540c5b58b9d92db2bfbfca4f94178fbef
TLSH
T1EA217C9D3AB84F6AA8CBE2AE7440028E93554E8615C71C438D03DF8CCDD5ADD326B839
MD5 SHA1 SHA512 TLSH

Submit Download

2c9e1b8b-ea4f-4627-b7a6-2193b597ab56

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\2c9e1b8b-ea4f-4627-b7a6-2193b597ab56
Size 886B
SHA256 2c1893b2e4f3c8a51bcec1adfa170e701d0c2d58de9eb96697b89c019c6493f3
MD5 8bfb88c1a9ed8cc713fcafecbc5d1c0c
SHA1 1c2fd7bbf23a5e8ed4c4afbcaed1092357e7152e
SHA512 2f08c62737d0466658a0ea834400aa2ed93d3c389ebc13764d1d3f0d875302f566536373628a06918ed96fdf0168617e543c17b8cbc06968f92ccc7e36281e24
TLSH
T141110451C97566B3CC64D18B95927B028BFC752380EA4D143D649A184CBA12E57AB307
MD5 SHA1 SHA512 TLSH

Submit Download

37e72fc5-8b84-447f-b044-6a33651c14ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\37e72fc5-8b84-447f-b044-6a33651c14ec
Size 235B
SHA256 c64a8412d025d1665477c208ccf7fa8a49dfd6f686b7efe8723fa931a9a4262a
MD5 9218d4102a8a81d474d3804b415e901c
SHA1 da1fc50b71221e86f1dc9f3df8185a1321fca0f3
SHA512 ebd170fa791fd6a91a59d03a6946cf8b6fc7756e536a44397f06481badb4e678192ea5639aff6d5c026c239c646acb24a60dd7e4175361ba72812d76b90379ce
TLSH
T177D0A7845898AF5D58150F1BF0A469CA3145CC3B64B5A811E6614578EBBEEC981F1816
MD5 SHA1 SHA512 TLSH

Submit Download

4c72f691-35c5-4ab9-b2a6-b1830a6f2422

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\4c72f691-35c5-4ab9-b2a6-b1830a6f2422
Size 16KB
SHA256 28f1a8448d98aacab45d18ec526c20b9f8c699c438808b2141d2a5859f4837f4
MD5 87899be1ab73639dd84e4499f81ed084
SHA1 413db15f6348c621fae77734822394bf0bbc89db
SHA512 a61942e1c95bb55183568caf24ea40b3cfe2d95372765c97ceb61b3fb1a3e2782925cdf3bbcc24506d5b828ca5c4e5d812fb4ebcd0678ef9d34bce95b2ab16f2
SSDEEP 192:fvovWfEEnD7SWzt9Wu+UxYkhqQN5eb0Q0Q0/oepzovwepN0qhZW2ZLP9qnwPwh0w:XAW847SWZ9B+UykEQUmt2FJ2mdSoe
TLSH
T1F572B9565820857AC651E3AC98FCBFC3E6F52CCB4C419FCA97E4BD0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f5ec313-8cf2-4d2d-97f9-4c5ccdc07dd3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\5f5ec313-8cf2-4d2d-97f9-4c5ccdc07dd3
Size 235B
SHA256 b58ddb0314d3587a0292a0e714c84cef8953e0c57256f2a28e6fb550a6fa9018
MD5 f839e948f4ab486d0c66acd7999fdeaa
SHA1 b43351bdd68f17868388b64a85279048b7127165
SHA512 40109c4a10d608fccef14e7654d64c80bba5f4f1ae0f384a9f4756b0defd6360111fb66f534ff73a87bddf5229bfa306d104e5eaf75a0772513a614bbe174493
TLSH
T144D09780588C771D8C190F16B0E06DC2308E4C3718755860D6900174AAFCAC8A1D1827
MD5 SHA1 SHA512 TLSH

Submit Download

60ecfbf9-2111-4490-a2f6-9630ad4debb3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\60ecfbf9-2111-4490-a2f6-9630ad4debb3
Size 883B
SHA256 0d44c6487519f37ef611cdf34c18d72e284c968c35ff7d66c3ec4b7aeccfb1c0
MD5 b832d33e797da9f571f85b92d3375ec2
SHA1 61adeae56f0032c7acdea1e5e3beeea1e924cc28
SHA512 2a94fe1866607cd7e4ce76e607f90cec0904410b7892a6eb1414c8834d10a5699395e3462ba7765804b427a93fa98f3dd89cafc7c58a61b5582bfdfb6289f80e
TLSH
T12011DC51E534B5B3CC68914B8A513B028FB8761380D548543CA48E084CBA52EA76A30A
MD5 SHA1 SHA512 TLSH

Submit Download

6636e41a-8340-4ea6-83b3-762f583647f5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\6636e41a-8340-4ea6-83b3-762f583647f5
Size 2KB
SHA256 250a0d3c0065f002319031434d9dfdc3fe6898e36f37e17280ba455bf3404b02
MD5 92672b57eb1902b8dda84bae0573733e
SHA1 b10259b5b7c7eb1db5f88e67778d3747cda0ad1b
SHA512 75f0189836c35765e8095a34e8427ab8632a6715433260a5e3cd45e9bb11515f201d06b03ec427d6c75ed263865f062b2d17c4e5b6d520e5f82023688e2df3e6
TLSH
T15841116DB6785DB74CDAF18D9091374E47B04E1300C61CC36AA1EE0CCC967AA336B62B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\extensions.json
Size 16KB
SHA256 867f95665f73f339fb7965310c37172796aa16b3a5719c6ee1f5ca203beb3f07
MD5 f5a0f4cec928da9d1206908e4c42a14a
SHA1 3acf52c72e7d882af5460bd88519de8da1165ee3
SHA512 5e8b66eb467758304edb9bf863a23caa62edaea74d8f222537fc4501c1984c060fb4ef83f18275fa944fed83790186836a0825d694f8cfbfe878882e9dd83c51
SSDEEP 384:ckI4vIUmldv18dhWx94z/96ofL4H4BL4P2L4HUL4H4L4HA14hk:zI4ARfmXY4x6k46404u46404+
TLSH
T16072432545049EB8294FA79AAA36BD01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 6KB
SHA256 3e1d12a3d4eeb4b4005513c6d3c04a4c8e190f0ba4eb0d2b7ca49cb2565c9cd1
MD5 3e2b86198ea9ca154791c716382dabd6
SHA1 404729196aaccc77513a799c7cfd7dcbb2ede133
SHA512 3724752d1d4a2348f5a958e94161bf4f7ac100380702d5ba9dce84940df0ea3e1be8515bf4a9d2c31319d8e19d3fea6c2d5c4ab9953282c1b5a5eaca62cdbae0
SSDEEP 96:xHkUTUNqGqZfxF+1zS3nuSSlqdv9jgjKnumHb4nNzw9Bw88H8L4cntev:+gRZfxF+OnuSS/pob0sBw881
TLSH
T1ECE12E7895088B7F74B676ACAC688831AAB2413BB7BF28C750B554C5050CF3446F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 8KB
SHA256 f78298b3bccd356be3e50ac69498d94c2fffbd2bb2192d515bde5cd482587d70
MD5 12e8ebfae8bff135ccca1aed97ec403a
SHA1 9ea69853293121816f47b08b1200387b90d8283e
SHA512 1a51e0f1ec32a9b6187293df734ea65c324a4bad5052caea159006891da6c88bf7d0382e8ae256b468f435ed540829df687a7d2b9895b43cc65f29db9aafa6c8
SSDEEP 192:+3vIPxZURZfBTu4TF+VnuSS/ptRT0xRIBw882zW77RYGwN:8vIPxZe5LCnARIxR+wGzW77RbwN
TLSH
T17F021D789114CB7F74B6327DAC2488745A62017BB7BF68C790BA44C5014CF3446FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads