286e67730f1101f81920f9830d85654086e6e433beb2934e152799403f73d1dd

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SteamDaddy.exe
Size 16.8MB
Sample260715-pdcxxaft21
SHA256 286e67730f1101f81920f9830d85654086e6e433beb2934e152799403f73d1dd
MD5 02f17ff04d3823c22e1f8bc64b82b9cd
SHA1 a1115bbcc78bf54a11bbdb0edcd837a035fa53a5
SHA512 b6f46a8c40a2da3cabb3913578f969b78a61f9ff22fa7f0af740ee970bf68f00bfb0dd781b913dac777e5c581398fe859e11d777c7f4112fc259c3219cf2af12
SSDEEP 196608:u6y5gjfHPQHjC4T+hQReeKL2yzaC+fptfZe1t:u6yof8wQR+RzUtxef
TLSH
T1B4078D07F26581B8C076C075C656A623FB72B84A07306AEB37EC4A353F67BE05A39715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	firefox.exe
Token: SeDebugPrivilege	3320	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1540	SteamDaddy.exe
3320	firefox.exe
3320	firefox.exe
3320	firefox.exe
3320	firefox.exe
3320	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3320	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 3320	2712	firefox.exe	86
PID 2712 wrote to memory of 3320	2712	firefox.exe	86
PID 3320 wrote to memory of 3260	3320	firefox.exe	87
PID 3320 wrote to memory of 3260	3320	firefox.exe	87
PID 3320 wrote to memory of 3260	3320	firefox.exe	87
PID 3320 wrote to memory of 4556	3320	firefox.exe	88
PID 3320 wrote to memory of 4556	3320	firefox.exe	88
PID 3320 wrote to memory of 4556	3320	firefox.exe	88
PID 3320 wrote to memory of 4556	3320	firefox.exe	88
PID 3320 wrote to memory of 728	3320	firefox.exe	91
PID 3320 wrote to memory of 728	3320	firefox.exe	91
PID 3320 wrote to memory of 728	3320	firefox.exe	91
PID 3320 wrote to memory of 728	3320	firefox.exe	91
PID 3320 wrote to memory of 2240	3320	firefox.exe	92
PID 3320 wrote to memory of 2240	3320	firefox.exe	92
PID 3320 wrote to memory of 2240	3320	firefox.exe	92
PID 3320 wrote to memory of 116	3320	firefox.exe	93
PID 3320 wrote to memory of 116	3320	firefox.exe	93
PID 3320 wrote to memory of 116	3320	firefox.exe	93
PID 3320 wrote to memory of 116	3320	firefox.exe	93
PID 3320 wrote to memory of 5452	3320	firefox.exe	95
PID 3320 wrote to memory of 5452	3320	firefox.exe	95
PID 3320 wrote to memory of 5452	3320	firefox.exe	95
PID 3320 wrote to memory of 5452	3320	firefox.exe	95
PID 3320 wrote to memory of 5516	3320	firefox.exe	96
PID 3320 wrote to memory of 5516	3320	firefox.exe	96
PID 3320 wrote to memory of 5516	3320	firefox.exe	96
PID 3320 wrote to memory of 5516	3320	firefox.exe	96
PID 3320 wrote to memory of 5524	3320	firefox.exe	97
PID 3320 wrote to memory of 5524	3320	firefox.exe	97
PID 3320 wrote to memory of 5524	3320	firefox.exe	97
PID 3320 wrote to memory of 5524	3320	firefox.exe	97
PID 3320 wrote to memory of 5580	3320	firefox.exe	98
PID 3320 wrote to memory of 5580	3320	firefox.exe	98
PID 3320 wrote to memory of 5580	3320	firefox.exe	98
PID 3320 wrote to memory of 5580	3320	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SteamDaddy.exe
"C:\Users\Admin\AppData\Local\Temp\SteamDaddy.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1540

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27100 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {60e9ed8d-987b-4822-aa90-4a309f055f7c} -parentPid 3320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3320" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27136 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {b5341aae-4ce6-453a-a79e-17b423bf3efc} -parentPid 3320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27277 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {f6377227-51fa-4333-8618-e3ce054e4d01} -parentPid 3320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27277 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {68fb67a4-35cd-438f-b5c2-3b83c367c7de} -parentPid 3320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3320" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2768 -prefsLen 34776 -prefMapHandle 3136 -prefMapSize 270279 -jsInitHandle 3180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3016 -initialChannelId {1ce1436a-53c5-4ccb-b4e2-5ce907e3849a} -parentPid 3320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2988 -prefsLen 35013 -prefMapHandle 1636 -prefMapSize 270279 -ipcHandle 2996 -initialChannelId {c2baaf60-6645-4dce-8ed4-74eb19730fbf} -parentPid 3320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 32900 -prefMapHandle 5108 -prefMapSize 270279 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5128 -initialChannelId {115b3d6c-8661-47b1-bc89-69eedd6c439d} -parentPid 3320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5232 -prefsLen 32900 -prefMapHandle 5236 -prefMapSize 270279 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {571ee74a-ca38-4268-bb7d-c71fed4f4557} -parentPid 3320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5140 -initialChannelId {5ec9a9bf-7949-414d-9326-30668d90abb9} -parentPid 3320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 e0d38935b41b39c1a9955e89252450d9b13e900380cbc8493291f302269037f3
MD5 f16273756089606898e2dec2c5703645
SHA1 66be29b2e8c3674567bb17b91abc89970a79bcda
SHA512 0d8f3c141810b1279106d8d38c01452fba6d5f8a6de8d45465f4e4554953a0ce81b5f1c3cd71318145ed004b7e66ec8d6009c2af86b142d0750b36ed2c448e47
SSDEEP 96:BLF4QFaFVFXF5/dd66Joz1zgClKtmc0d/UGSdF95/7bkW6BrcPyUR6rWI:a1d66Joz1zgCl6mc0dzOv5zboBCyjCI
TLSH
T1D9B1DC68F229863FC448423ECCA61B500E76784AA85E7F2931EC745D3D672CD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 608965039281994088604be15366401e2963c49dd704dc1412160dce8aca50a1
MD5 24a8f6ad0a9275501c75263d546df250
SHA1 d7baa2fbb066c2e62759b90c18f04f2a6b3583d4
SHA512 0427b292952c0316e7ea824ac909da851b05fe39fa8058258adc2c7ee06cc0ee69555144b2eef5f2498c88162cfbda262d42d59a27d897debc0d908a94d3aeb1
SSDEEP 96:BLFt2Fz5FVFXF5/dd66Joz1zgClKtmc0d/UUhSdF95/7bkW6BrcEHoyUR6TWI:671d66Joz1zgCl6mc0dPOv5zboBbHoyZ
TLSH
T1F3C1ED68F628463BC448423BCDA91B400F72395BAC5E7F1A31DC644D2D5B29E7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 73dfcf49ef097bf65ce402fd60e483f71856b04aecb96686052779e116800983
MD5 5ded6fd5afad01ec3cd600cbdc3e49ce
SHA1 732801e6a4113f4bead700a2a05b8410ec0cbfc0
SHA512 070e5b210d70c73500e908c1842c341beb69c4ef3fce0910b1fc469fd94a4f2134d58bf5076b70eb5767bd018c9219c61bde8534c24b35fc06872faf88ef1729
SSDEEP 192:971d66Joz1zgCl6mc0dWOv5zboAXZHoyj4m:Pd66Joz1zgC1jjbo+ZHoyj
TLSH
T127E1ECA4E628863BC408427BCDA51B410F36395B9C4E7F1A35EC64582D5B29E368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59f1dac1-27ee-48f4-8873-47c5c1ca9ae9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\59f1dac1-27ee-48f4-8873-47c5c1ca9ae9
Size 235B
SHA256 2b186aca2b8fc2e0a0dd23813e7f9ca683def8a7cff17334242e96022c2d6bd8
MD5 d007a80e2c9a53b2e2621ef6ba9fe0d5
SHA1 e6c747acce7a61232773263ba2870d276b21287e
SHA512 8283d3b036335eaf87650b232ac1f5288a563c7b9b7c561f406c790ce08dd4c15eb8a1e2baa1fa2d7e473cc7148f6f51fa4322c2ab31d470112d5b80d911ac8c
TLSH
T1BDD0978028E86B1C0C040F07F0E039C734C88C3B20B49861995106B8A9BDAC44292827
MD5 SHA1 SHA512 TLSH

Submit Download

699b1092-e415-48ec-a7e3-3f64a31ffaf3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\699b1092-e415-48ec-a7e3-3f64a31ffaf3
Size 883B
SHA256 edb95c1e7d5d7550ba033697982e4ffee1456b89efff190ac9c3033c4adf28b2
MD5 416b867c075e94967e3fc4f25b874fcd
SHA1 ad3c063cb1d6b2c897be49b061f7010a0a2fb96c
SHA512 c1cddd2b3e132d5ea321e7f6a576260874750c36f680c85bb28181bb89e97f194510197fd21dd6a5a8f18b2e8644bc2242bb9adc312da2be1a9475030091ac3e
TLSH
T1F0112381A674BAB2CD78925BCA6437034FE4742384C998043DA04F040D7FA2EA76A70B
MD5 SHA1 SHA512 TLSH

Submit Download

7aa64b27-55d0-4acd-aa76-ee85961c37ac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\7aa64b27-55d0-4acd-aa76-ee85961c37ac
Size 235B
SHA256 7e8638ddb030dbe91a9199374e247be180e0375b9181c196f5c4fb5f0f0f6baa
MD5 7ff62740337967524d0d90023a047f90
SHA1 22d42ad07f8da764e067415124de012f9ce07557
SHA512 9502e2a6dc3da90e67fd9f04a5ad8622643e6e7c10caabdfe88686de78b14776e4d3baa9457489daf6a1fa48b8ef8a81de98cb307cd17d50c3022a8d73cab9b5
TLSH
T1BBD097812CDC2B6E08242F03F1E028E230958C3320785850C97149389AFAAC841A280A
MD5 SHA1 SHA512 TLSH

Submit Download

91edd9ee-8cfc-4c9f-aa6d-08c0e676a33a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\91edd9ee-8cfc-4c9f-aa6d-08c0e676a33a
Size 886B
SHA256 d255e28c68787323ed34485fb884da9923c03d99ebdb46eb69f72f79026b7b59
MD5 c5907df673e5484d0e5221ddaf303ce1
SHA1 a7fdd5c939b668f33d98650875d4f93ea37bd08c
SHA512 2668f6494e76407d5f0b907362e9a380d8ac76986a7096ccfb1377783ac3948f11a19d5d3b0e22c49a5cc2d436da71a32f45c9ff39a9e51d64cb373595c00cbf
TLSH
T1731100808674BAF3CD78D29BD99877424FE0B42384C95C047D545E180EFE92E676AB0B
MD5 SHA1 SHA512 TLSH

Submit Download

977e6948-78b3-4157-bc25-0f8bfa6588cd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\977e6948-78b3-4157-bc25-0f8bfa6588cd
Size 2KB
SHA256 bfea6179c5fd7887183a189014f667ea5ba8550c38dd58dfdf9c80ad6bbd5944
MD5 b63fb48f3e85d70568165b1bf7b2dc68
SHA1 2241ab3bf8720d65c17dd3dfa75d4f579da929bd
SHA512 3fcebf18cb4460233f03044cc1e86f462575c4f9408350564e4cab4e1eb00c358e382c5430a4cd056299bed6df11a4b8544905c9c5ab8beca1f5416ccfb19472
TLSH
T19741136835785DBA4DD6E19DD881339E4B91890310C51C432D62DF0CCDDAB6A336B92B
MD5 SHA1 SHA512 TLSH

Submit Download

b7a40662-513d-4551-87aa-6ed3834fa144

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\b7a40662-513d-4551-87aa-6ed3834fa144
Size 16KB
SHA256 b7297a4dec205e9db5caad765ce713d9c58ff86e7cd972692f67f0c8577816cb
MD5 ea1cf25f59d22687292598faf56d16e0
SHA1 59424ef122f8b0b78dfbef97a7e4f2ed4ebc6361
SHA512 b1735eef3ab1b407a9f3b038f8e0b0d74341fb7e871779d1c47cf38ef73122bd7aa8a0350e42b539f391e9183b739499f14b3518cb8c91d8c64545ccc0501a7e
SSDEEP 192:lSRKnONVaoEqO95F6LMXWMWnXwEN/WFKHiduS1LSdb/BkN5JgQmuS2mvizx7kyTF:/i9N/WFKnTF/iJrbS2gil7kyTYk
TLSH
T1E772EA166860467A8791E39CD4E8BFC3E5F528CB4C418FCED7E4BE086ADE06D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs-1.js
Size 6KB
SHA256 a6c485c2584425c9e432aba0fe59f45bf575ef8332db4bf1ea2151c7e95b41e3
MD5 fa0bfcdc8f9e298f30842dbf8d38a048
SHA1 1339ca8a58dfa7af50db7d3161d3f3155aacd7d1
SHA512 ae55afecb7aeb0d68f9efccd33ec1d7feec464f7128efda097ab4d94c44fcb92de2319efb7179c129eb996e63c1ea405ebefb9d8c99df5d478ca5a77c860d279
SSDEEP 96:xHLkUTUiqGq2fknq1zSqSSlNdv9j4n+H/vukBw88P8L4cn+r5GS:KVR2fknqPSSnnukBw88n
TLSH
T1E2E1207895088F7F64B677ACAC6888315AB2013B7BBF68D750B65485010CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs.js
Size 6KB
SHA256 153173b9c53386eb41d1eb9a59b24cdac85788ce4aa9226a5264e1bc70b495ba
MD5 3935494d6323c5265eca1ac78b73124a
SHA1 ee0d9a8b6f6a349f9f8e42e7daa8b947f0c5ff61
SHA512 93fd1801b52da9504a60c920d662ea4fda6e5f20a3bf4d88c2e70943facb1dbadc8d65053a6fc30fc65494271c0c57a3155e1590ba81393f36695cf4176f8693
SSDEEP 96:xHLkUTUiqGq2fkIj1zS6+SSlNdv9jbn+H/vukBw88P8L4cn+rM:KVR2fkIjL+SS4nukBw88A
TLSH
T14AE1307895088F7F74B677ACAC6888315AB2013BB7BF68D750B64884010CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads