d06a9ce3aca0107c4d66b0c6ab9398b9747f2720609ceae0d30f6ac610eb31a8

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_2bcb729e9b4aa8b663b2eb91065de020_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Size 381KB
Sample260730-2kwptaydra
SHA256 d06a9ce3aca0107c4d66b0c6ab9398b9747f2720609ceae0d30f6ac610eb31a8
MD5 2bcb729e9b4aa8b663b2eb91065de020
SHA1 25bec2fad0265b0c820ea7643e064d39ce96f71e
SHA512 302f5d934dfd9745324c2b8201fe3a464913f004dbb6e46a43df99c0dc7ae1061b59e87b743f7e3e91978c2bacfb9f9e83817550d694dd82e66721468ab9a872
SSDEEP 6144:dzCV1Q8XX/WXsR6+DyPUT6aW7zVWpYFXDsBRHJeqt:oQ8XXT6+WPUT6aWUCFzwHJey
TLSH
T16C84AE52F7A514FAE16BC2388A424516FA72BC164760A2CF33A46E963F237D05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2444	firefox.exe
Token: SeDebugPrivilege	2444	firefox.exe
Token: SeDebugPrivilege	2444	firefox.exe
Token: SeDebugPrivilege	2444	firefox.exe
Token: SeDebugPrivilege	2444	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2444	firefox.exe
2444	firefox.exe
2444	firefox.exe
2444	firefox.exe
2444	firefox.exe
2444	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2444	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 4872	2696	2026-07-30_2bcb729e9b4aa8b663b2eb91065de020_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe	89
PID 4872 wrote to memory of 2444	4872	firefox.exe	90
PID 4872 wrote to memory of 2444	4872	firefox.exe	90
PID 2444 wrote to memory of 948	2444	firefox.exe	91
PID 2444 wrote to memory of 948	2444	firefox.exe	91
PID 2444 wrote to memory of 948	2444	firefox.exe	91
PID 2444 wrote to memory of 4272	2444	firefox.exe	92
PID 2444 wrote to memory of 4272	2444	firefox.exe	92
PID 2444 wrote to memory of 4272	2444	firefox.exe	92
PID 2444 wrote to memory of 4272	2444	firefox.exe	92
PID 2444 wrote to memory of 2376	2444	firefox.exe	93
PID 2444 wrote to memory of 2376	2444	firefox.exe	93
PID 2444 wrote to memory of 2376	2444	firefox.exe	93
PID 2444 wrote to memory of 2376	2444	firefox.exe	93
PID 2444 wrote to memory of 3400	2444	firefox.exe	94
PID 2444 wrote to memory of 3400	2444	firefox.exe	94
PID 2444 wrote to memory of 3400	2444	firefox.exe	94
PID 2444 wrote to memory of 5276	2444	firefox.exe	95
PID 2444 wrote to memory of 5276	2444	firefox.exe	95
PID 2444 wrote to memory of 5276	2444	firefox.exe	95
PID 2444 wrote to memory of 5276	2444	firefox.exe	95
PID 2444 wrote to memory of 5800	2444	firefox.exe	96
PID 2444 wrote to memory of 5800	2444	firefox.exe	96
PID 2444 wrote to memory of 5800	2444	firefox.exe	96
PID 2444 wrote to memory of 5800	2444	firefox.exe	96
PID 2444 wrote to memory of 5732	2444	firefox.exe	97
PID 2444 wrote to memory of 5732	2444	firefox.exe	97
PID 2444 wrote to memory of 5732	2444	firefox.exe	97
PID 2444 wrote to memory of 5732	2444	firefox.exe	97
PID 2444 wrote to memory of 5608	2444	firefox.exe	98
PID 2444 wrote to memory of 5608	2444	firefox.exe	98
PID 2444 wrote to memory of 5608	2444	firefox.exe	98
PID 2444 wrote to memory of 5608	2444	firefox.exe	98
PID 2444 wrote to memory of 4636	2444	firefox.exe	99
PID 2444 wrote to memory of 4636	2444	firefox.exe	99
PID 2444 wrote to memory of 4636	2444	firefox.exe	99
PID 2444 wrote to memory of 4636	2444	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-30_2bcb729e9b4aa8b663b2eb91065de020_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_2bcb729e9b4aa8b663b2eb91065de020_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {86026a8e-64f5-4574-b023-28cedb2ba16c} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {188693d6-0d76-48e4-9ecd-7da9f45f7e8f} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4272
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3812 -prefsLen 27274 -prefMapHandle 3816 -prefMapSize 270279 -jsInitHandle 3820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3828 -initialChannelId {f273b287-73fe-4f8d-b213-3e9d149e5e9b} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27274 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4012 -initialChannelId {fb39b314-cdf3-4b60-9db4-8a5d8b7b8b5e} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1632 -prefsLen 34773 -prefMapHandle 4304 -prefMapSize 270279 -jsInitHandle 4308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3160 -initialChannelId {c4b3528e-ccbb-477d-bf05-46cbd6c1fcb1} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5276
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4968 -prefsLen 34929 -prefMapHandle 4972 -prefMapSize 270279 -ipcHandle 4980 -initialChannelId {f1ab9e12-22b4-4814-9d47-7e4ebbffb293} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1624 -prefsLen 32952 -prefMapHandle 1620 -prefMapSize 270279 -jsInitHandle 1628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4804 -initialChannelId {a340dbb8-b3ee-468d-9ebd-4f40cc0a944d} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 32952 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4788 -initialChannelId {7c8d7c40-ee1b-481d-a48c-19c886fb7e40} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5816 -prefsLen 32952 -prefMapHandle 5820 -prefMapSize 270279 -jsInitHandle 5824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5832 -initialChannelId {8e42ff36-d74b-4b21-a5d8-8146328a94e8} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 353ae08915972887a1b8895fbac328d9f37a8d3d96c3ebba610def7e63c30a4f
MD5 d5262159b1a0cf5d07f77ebab5bf67aa
SHA1 e8159e2285233c9be4680c96623f1eb7a34fef15
SHA512 dc01a9b913c1b2c1c314859ea20d6c17a804a252230f71e8bd36eafed4737da6deba86055b8ca15cb780c5883656742e10a3d62fe0360026cbee6e40be38b47a
SSDEEP 384:HwCe7iO024YlDL84KKDL849B7SOEAd9KVRaAcP+AWRMAkEvp3:QqZYlDL8lKDL8CB7S/AmVAf+hRMMR3
TLSH
T121729E3E9F413CAC1597C0E8C4F992DA8C18B6A7CFE6806D21683D0DC798969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a21518c31ab19827c824dbbebbb7eeb1d8af0dc83041ea74908236315fb44927
MD5 46599c7c576d591bfffcb2d8da5ddefe
SHA1 934d3ad5fa9d4c7b83bcdfa0ea22457c13d2f533
SHA512 edebd3e55bcbb53fe421a75535317dafe9f902fe2dc20500e09c1e5d56ab82e6f29eac31ecdeaa0f47dcf94e6f48f5aa7611af2d37ee19a51a7fd7c91a9efd0c
SSDEEP 192:iSOv5zbo7KZC9yjHs3PDH1d66JoztdzgCl6mc0dz:iRbouZC9yjH+xd66Joz/zgC1jd
TLSH
T1B2E11E64E628823FC448427BDCA61B854F39388AD84E7F1936ED640C2D572DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 41e473c56391eb76b884e6b26d69087c0c217a7c5a609e68f748e65089d3420b
MD5 d7f9307e8d130425868fc7a6f5ff75cd
SHA1 1daebadd6b3ef159261e8a835a1ab395f004f637
SHA512 bbdfb9fa532892a6dedcb39a7c4bea6987d8ed2162a1272cece38f44a629418d10b836b01dd90cb287e3365af446ed1ee2cd72b28fb52a0bda540f355d6c23a9
SSDEEP 192:vSOv5zbo7KZC9yjHYx0H1d66JoztdzgCl6mc0d:vRbouZC9yjHfd66Joz/zgC1j
TLSH
T1F3D1ED28E629863FD455023BDCB61B800F75384AE88E7F1536EC640D2D562DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7fb5ff0636048430613825dc3fa6e7669acac1e91de3596f77309425630c54e9
MD5 65472b12f827d4deccb6007f07aad8b1
SHA1 60a4c2af151aabf62cc3fe137b504f39647ac6d4
SHA512 39f956d8fae2d538ae2087de51026294d0b7b2c89863f6cac182404f468bbea95bcc64ac4ae8a1061929c37cc37a6a58804a009f9594a8dbb4258e032d724a27
TLSH
T1DC21455C39B94D2AAACAF79C744002CE53954A4B44871E4B0D82FF8CCE96ED9316A43C
MD5 SHA1 SHA512 TLSH

Submit Download

13d7b565-f04d-4bae-86e6-9a48a0ae5115

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\13d7b565-f04d-4bae-86e6-9a48a0ae5115
Size 235B
SHA256 8593eeae61b169afda9b17a01c6e633899b6c2d1b9aa807cc1ae28349869cd92
MD5 70c8365e8616c7e34794599ced513073
SHA1 a9b52cc330493ccd15e0454e9ad3377182644230
SHA512 daf97f5c4f0f0ccd8b8dc674cf50417107bf21b7fa1c5b1b150187ced598e19cbcf71fd6836e110c8dd090ae763c750a8949dcaf7106f59de29407fd2bf1ebe3
TLSH
T172D097C81898636D09048F06B0E279C330A48C3B2868A824899001B88ABDEC44121C0A
MD5 SHA1 SHA512 TLSH

Submit Download

67484a27-547d-4093-b1e0-780a1eb19753

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\67484a27-547d-4093-b1e0-780a1eb19753
Size 16KB
SHA256 7c33a9e5c61fcb746aa6ee1f793876d5479807805ec9bd60214acf75a5e9fcca
MD5 e34220c32ecdb67856da6b5d531d70d7
SHA1 5351bb0f56e89da8c47535a881b5a3990f6c6103
SHA512 4acc7bc58215ae15ef48062a311fab25173f5dcfa5e64bb44130122c3068b521bba02dbb0de363cc183cf232ed8df518dd10241946937e07d25ae7ff0a1bd1a5
SSDEEP 192:5H19+RGBcJK+PdhqVrq136Uw1dB+QJhHkszxUURqnKSGpmsgJrNzQ+LyOewhs8AJ:L9GdwV9Uwf9JZzlUURqnK/pzv
TLSH
T12E72EA16686045BAC691E368D4FC7FC3E6F528CF4C419FCA9BE4BD086DDA0AD112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

746ab02e-375a-4b95-944a-93bece106b80

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\746ab02e-375a-4b95-944a-93bece106b80
Size 883B
SHA256 7725e5a45a0c6200f6c53c50ff868ff538bb2fdc0edd6dcb3d8c6fa970af5add
MD5 302e15b1dddeeb77724c259426c49629
SHA1 762e5a8c188e19fe7809192b626b05748f027708
SHA512 2976d8b4456418e889b41881616598352cdfd05741df1a9f7f38136c15b6e2febb01c1067c2bdf72a788baef2571320142885d6f6d1fa7af120a59b4ee8c68c2
TLSH
T1331104818634B6B2CC78D24F89A5374587E87813C0C654043FA45A040E7E51FD75A64B
MD5 SHA1 SHA512 TLSH

Submit Download

99865d88-ac8e-498c-b93e-1944fb54d0fb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\99865d88-ac8e-498c-b93e-1944fb54d0fb
Size 235B
SHA256 ec96efd1641707ad5e0503ba8b8f4dfdf41731858c6a94cd4697b8c14b5c7524
MD5 3c0e58947280bb7b9f5919008bd56e9f
SHA1 38238d7dfdfd3b07ceb0532147b14088bed10b0b
SHA512 34cd7a2562e31eb3d6f6d6e648a9e68b03049e94062c2d5f3ac405f7b2c69f757169db7e2c398d859db9e95f8586a0e454f2778492ff2ded2804199dc0055640
TLSH
T10FD09780249877AD08101F0EF0A029E230544C3320B09890DA9045F4C9FEAC54292816
MD5 SHA1 SHA512 TLSH

Submit Download

b752bed2-ce77-41f4-bc37-50a5731faf8d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\b752bed2-ce77-41f4-bc37-50a5731faf8d
Size 886B
SHA256 401fc6c60343a4cdc8e737797e14336b69d5f8bfb0d1cfeaae548adfa8fe4980
MD5 44f40fb128b00d4d59469c91aff3e1ac
SHA1 d73d7678c4091197401261de99ec6e4802028577
SHA512 a79ac2cc299e9d49f30a7a445835c6234b87ddcff215f1d3e3eedeebdb91cc52746a1a12e4921332fbf0e59f0c085f19866acb0800b9e1762eaa30ff15cfa2c5
TLSH
T1AC1104518634F9B2CC68929B9DE0774687E47413D0C658147DA15A084A7A50F976B30B
MD5 SHA1 SHA512 TLSH

Submit Download

f2fb9f20-18e7-44b4-9370-43b66476cdc8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\f2fb9f20-18e7-44b4-9370-43b66476cdc8
Size 2KB
SHA256 2204eec1b935e77bf4d7fef9744253b99ba9b84b1efec5c329321476e26bc429
MD5 f5acf7ec06585caa467e59cba204ff84
SHA1 d3a6d7edcd362298f3633abda49b49f71818aad8
SHA512 86cd29eb302ccc8a03e63d3dac3ecfe12e7012f89a41ed5cbf5d0844f907960aad86c746bfc4b16f2c3904e9652ef52749be56f91d981333ae81f356567ab8f8
TLSH
T15941336C36789D779CCAE65D949133CE93A1990340C62C432E51DF0C8E9529E63AA52E
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\extensions.json
Size 16KB
SHA256 fd8139e7907e4e7826ddba5ce32c392abcd82bbb803675751dfb44b649e205d2
MD5 9245201ba31bf5c643bf9af76fb16d32
SHA1 2300bad3b276d03b08c901f97129cf66e5bb69ce
SHA512 351cd16acb34b294b26698bc6b69d85b22eb4f3abdcd81af144fe78e4ddecfd196802348f65e0852e21234f2c189a55772ad1921c79d19d802cc2bf4cb25b17e
SSDEEP 384:UkI4v2UmldvR8dhWZk94zP96ohL4H8L4PtL4H2L4HxL4H/aI4hTn:7I4eRfiXi+4Z6C424l4c4J4fH4B
TLSH
T1DC72531545048EB8294FA79BAA367E02C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 7KB
SHA256 679e5574d4ebfd886ead063aa31586159bea5f051a3182ad23b69be3a35d40a0
MD5 6bedc66bc011be0d39bfd140054e5d03
SHA1 ecddc66c4c5d4487ce179d74bda4d0e4600f3ce3
SHA512 133b655fb1b4245b714dc16c93151e943986636e7332c7504cb6b0a273e0d826354d4cd2cd30244435eed3729911e8046272045a3fd7a56a67224701045e9b90
SSDEEP 96:xHTGpTUEqGqSvfIKiObzSESSlvdv9jbZnNWRNem93Bw88OwW8L4cn5VPB:oORYfIKiqSS9uRBNBw88RT
TLSH
T10EF10E78A144CB7F75B277ACAC6449705A72023BB7BF68CA14B99485011CF3442FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 7eb96b0323fd580667fcbe9ee0abba95b89bf125d3b87527ebb4c7c5fef95aef
MD5 2d842fbea2bbd44f8e29df35bfcdbc98
SHA1 59e219cc51080656a0a9bb59ecb3c519e61553cd
SHA512 e30312bbec728fb1f0431cd579607d5b26dad8fbf62553115d4f6c11ba4a18ef468db4884116e9f4ac988b8bc9b8f40698351c9262508b793c3b1b2d62f2ba49
SSDEEP 96:xHTGUTUEqGqSvfklN1zS2mSSlvdv9jq5nNHKm9fBw88u8L4cn5VPB:oHRYfklNbmSS8v35Bw88vT
TLSH
T157E1207855088B7F74B677ACAC688C316AB2413B7BBF28C610B554C4014CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 ffdd357bd94df8f6636735da2d1594647fcfc5b5af62f30a47b6e39e9e50e175
MD5 0213a6ee2a63adf65701e6dd3245addb
SHA1 924ac1737f19d4d8c866347ddd3f0b8805d88cf7
SHA512 a90f56a045a61f29b1b169cb65cf59b6b77bb7ed85cba484de2ac5e29b02ef049868a334bf39fcecd202b135df85663413bf01a446f6dcfbaaf0f92d5fee93a6
SSDEEP 96:xHTGUTUEqGqSvfkKi1zSESSlvdv9jbZnNHKm9fBw88u8L4cn5VPB:oHRYfkKi5SS9P35Bw88vT
TLSH
T150E130785548CB7F74B677ACAC688C316AB2413BB7BF68C650BA5484010CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 f0e64763174196193f0dd02e306e9f0cb6b92d7a82829a9bc69e37ed09ef2ec2
MD5 2322f9701833d7165fb66585c53c232b
SHA1 7755e6037ed18189f3c59155301420ba7ba0a85d
SHA512 a29e175953432809385a6fe711175da85660a0b09f186e6286ca22b662b6e3808880447b4346816f97446ef4f21b6e936cf5a38556668274adcab68e5b7a1c38
TLSH
T12C21CA92D87A1EF57A61914DE0CE8BE3C748243344B668F051AC4E02459D10DF385209
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2696-2-0x0000024ADE050000-0x0000024ADE0CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads