hxxps://getexescutor[.]com/cosmics

Analysis

user interaction
yes
max time kernel
133s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getexescutor.com/cosmics
Sample260731-xpcehseq4y

Score

5^/10

persistence

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4976	Cosmic_v1.3.12564.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 29 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Cosmic_v1.3.12564.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4976	Cosmic_v1.3.12564.exe
4976	Cosmic_v1.3.12564.exe
4976	Cosmic_v1.3.12564.exe
4976	Cosmic_v1.3.12564.exe
4976	Cosmic_v1.3.12564.exe
4976	Cosmic_v1.3.12564.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5680	firefox.exe
Token: SeDebugPrivilege	5680	firefox.exe
Token: SeDebugPrivilege	5680	firefox.exe
Token: SeDebugPrivilege	1816	taskmgr.exe
Token: SeSystemProfilePrivilege	1816	taskmgr.exe
Token: SeCreateGlobalPrivilege	1816	taskmgr.exe
Token: 33	1816	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1816	taskmgr.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe
1816	taskmgr.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
1816	taskmgr.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 5680	3184	firefox.exe	88
PID 3184 wrote to memory of 5680	3184	firefox.exe	88
PID 5680 wrote to memory of 3220	5680	firefox.exe	90
PID 5680 wrote to memory of 3220	5680	firefox.exe	90
PID 5680 wrote to memory of 3220	5680	firefox.exe	90
PID 5680 wrote to memory of 1548	5680	firefox.exe	91
PID 5680 wrote to memory of 1548	5680	firefox.exe	91
PID 5680 wrote to memory of 1548	5680	firefox.exe	91
PID 5680 wrote to memory of 1548	5680	firefox.exe	91
PID 5680 wrote to memory of 2304	5680	firefox.exe	92
PID 5680 wrote to memory of 2304	5680	firefox.exe	92
PID 5680 wrote to memory of 2304	5680	firefox.exe	92
PID 5680 wrote to memory of 2304	5680	firefox.exe	92
PID 5680 wrote to memory of 2688	5680	firefox.exe	93
PID 5680 wrote to memory of 2688	5680	firefox.exe	93
PID 5680 wrote to memory of 2688	5680	firefox.exe	93
PID 5680 wrote to memory of 4648	5680	firefox.exe	94
PID 5680 wrote to memory of 4648	5680	firefox.exe	94
PID 5680 wrote to memory of 4648	5680	firefox.exe	94
PID 5680 wrote to memory of 4648	5680	firefox.exe	94
PID 5680 wrote to memory of 620	5680	firefox.exe	95
PID 5680 wrote to memory of 620	5680	firefox.exe	95
PID 5680 wrote to memory of 620	5680	firefox.exe	95
PID 5680 wrote to memory of 620	5680	firefox.exe	95
PID 5680 wrote to memory of 3148	5680	firefox.exe	96
PID 5680 wrote to memory of 3148	5680	firefox.exe	96
PID 5680 wrote to memory of 3148	5680	firefox.exe	96
PID 5680 wrote to memory of 3148	5680	firefox.exe	96
PID 5680 wrote to memory of 4984	5680	firefox.exe	97
PID 5680 wrote to memory of 4984	5680	firefox.exe	97
PID 5680 wrote to memory of 4984	5680	firefox.exe	97
PID 5680 wrote to memory of 4984	5680	firefox.exe	97
PID 5680 wrote to memory of 2160	5680	firefox.exe	98
PID 5680 wrote to memory of 2160	5680	firefox.exe	98
PID 5680 wrote to memory of 2160	5680	firefox.exe	98
PID 5680 wrote to memory of 2160	5680	firefox.exe	98
PID 5680 wrote to memory of 5472	5680	firefox.exe	99
PID 5680 wrote to memory of 5472	5680	firefox.exe	99
PID 5680 wrote to memory of 5472	5680	firefox.exe	99
PID 5680 wrote to memory of 5472	5680	firefox.exe	99
PID 5680 wrote to memory of 1648	5680	firefox.exe	100
PID 5680 wrote to memory of 1648	5680	firefox.exe	100
PID 5680 wrote to memory of 1648	5680	firefox.exe	100
PID 5680 wrote to memory of 1648	5680	firefox.exe	100
PID 5680 wrote to memory of 1420	5680	firefox.exe	101
PID 5680 wrote to memory of 1420	5680	firefox.exe	101
PID 5680 wrote to memory of 1420	5680	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://getexescutor.com/cosmics"
1⤵
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://getexescutor.com/cosmics
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1928 -prefsLen 27097 -prefMapHandle 1932 -prefMapSize 270279 -ipcHandle 2016 -initialChannelId {11fdc783-23b4-4655-a03e-5eaca5bc7442} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {0cf4ab30-a22a-490d-8d4a-07d9987f31aa} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 25213 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {af5b7ac3-7e46-4430-9773-2c2553d931c2} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27323 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {816c1ffa-2682-4f48-960e-01d4f4097f9b} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2604 -prefsLen 34822 -prefMapHandle 2728 -prefMapSize 270279 -jsInitHandle 2596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2896 -initialChannelId {03f045eb-5053-421d-95a9-bcfdcb6e121e} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3276 -prefsLen 35010 -prefMapHandle 3280 -prefMapSize 270279 -ipcHandle 2600 -initialChannelId {6c3d9cf6-6a97-4241-b431-c0666b474109} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5196 -prefsLen 32952 -prefMapHandle 5176 -prefMapSize 270279 -jsInitHandle 5180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5188 -initialChannelId {ef096172-137f-4db4-8aff-b0fc7f4ee547} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5904 -prefsLen 32952 -prefMapHandle 5908 -prefMapSize 270279 -jsInitHandle 5912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5924 -initialChannelId {7108a645-b803-4696-a4ca-2390dfcbab1f} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2564 -prefsLen 32952 -prefMapHandle 2568 -prefMapSize 270279 -jsInitHandle 1116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 924 -initialChannelId {c335588d-39c7-452b-af51-a5196709757c} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3268 -prefsLen 32952 -prefMapHandle 3028 -prefMapSize 270279 -jsInitHandle 6272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5180 -initialChannelId {59eca425-a51b-487b-a437-60fd06cf0082} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6744 -prefsLen 35062 -prefMapHandle 6768 -prefMapSize 270279 -ipcHandle 6740 -initialChannelId {8ffcafc9-d75a-431e-b2e5-edc3e4f7fc05} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:1648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6784 -prefsLen 35062 -prefMapHandle 6804 -prefMapSize 270279 -ipcHandle 6788 -initialChannelId {f9c3f687-e907-4afa-8f55-5fe3278220c5} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    PID:1420

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1388

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:4576

C:\Users\Admin\Desktop\Cosmic_v1.3.12564\Cosmic_v1.3.12564.exe
"C:\Users\Admin\Desktop\Cosmic_v1.3.12564\Cosmic_v1.3.12564.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4976

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 85b74c9bb4b802b6396897d80164a7c06bc67f93bbd19db01292759e928af70f
MD5 166815c8017c836dd1f35afb86571622
SHA1 d82ff646abb25ed7d6908529e74504404d73ab12
SHA512 f994b3b50aed629611d99f085951515b07dd138412e83a54e6bcb05e24327b4dc7cbd357ae18765abbf4503e47a60de564109f487b9c290059d2e0e556bd29dc
SSDEEP 384:HwCe7iO024YHDL84KKDL849B7SOEAd9KVRaAcP+AWRMAktv+p:QqZYHDL8lKDL8CB7S/AmVAf+hRMVmp
TLSH
T1A5728D3E9F013CAC1597C0E8C5F8529A8C18B6A7CFE6806D21683D0DC79496AB1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 7f7d9b80f36ef8cf6db1771eb7aab577c39fa145c116d23e68027819b9492c77
MD5 48d9c0de923e2822005cdc77b691e4ae
SHA1 13a35c5eb5da22ff646597c918d8d1f14b88b9a3
SHA512 351899aacad48e19501f56bcb987e16146a391a8913d17c298981307189ba0b550d4aa6a9719d127b2e9ed9afd9aed4dba4406e99120faac706aba6d7ab8eb94
SSDEEP 3072:j3la6TsRNZHJ3Od1iF6TvPNY8wmgc/YuTHC:p7qZHtOviF6zPNY8pg+YuC
TLSH
T17EA3BFF6DBE28D7D59FFC42CAA81C53EF9222400B3A73009C953235466CAFB86775649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 59KB
SHA256 2f271eb3403843fc0b9877dc4a05c687ef246ef327ce92e57388696c04e806ec
MD5 482c791766d9ca4757fccdcfd46189a0
SHA1 502e21bb4e3f3f4e348d217e88fe4025e8c79522
SHA512 6c48d20fe9cd55d0bbd3ffe2b19a86cc12757f7fe5d72f71e45b9da19147f3fc5b481fc3698126b83a8b450e9089c2ba5901918e58c1c715360a9c1dd2074df8
SSDEEP 1536:4/3wMCXBMpq1QC2mXr1GYlRQz9HF15sgcG1mw:4vu+Wt2kT49lvf
TLSH
T162531244EB1A953FD46802BA9CD61B003F79F8899A0A2FA7371C54786D872DC3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 843950b08c6ee4c185271c6267f4f494837a3ed4d986573c4f768aef267a7c6f
MD5 4381c0f823f9cd2ef9d7de9c7c18ebfd
SHA1 5c5a326fa4fd1bf8f488b82b802ede88761bf048
SHA512 2ece868cb55dfb9e724fa1e0cf6269ed91d892cd268cad6a343a2491b8ca32419b53d1d9ea0e5f879a2eb9fbc7cefd6305776bd6bbbe3a5ef28f0b92f335105c
SSDEEP 768:ZG1ghMyMh/r4cr4CGcm+ucvA9K+VM7FsbDbOFS:Zb1Mh/r4qpA9uU
TLSH
T19BE21140EB2E913FC41513BBDCA51B042F79B885591A2F9B3A4C64686C872DC7E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 00d4bafd58e982d178fd996c003f286d46bf5ee2226679189cdd2e97f2beddc8
MD5 67d7ecf9221b317f021546bb4b76d7d8
SHA1 001cb38312eef4f1c6820679b01b193749cd7033
SHA512 c685f6d4d12b1b4baf456423cc8677f05fc7b14c7aed116c71e554b15f07cf3e3e0f1f7cdb69e69ee4d39bed3fa8ac17794c13b1fd693d778416c606cd9c10a3
SSDEEP 192:K8r1d66JoztdzgCl6mc0dXSOv5zboIbC9yjHYxI:Zpd66Joz/zgC1jNRboIbC9yjHn
TLSH
T141D1DB28E729863FC445023BCCA61F400E75384BD88E7F1536EC64092D572DEBA8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ee9fe86379beed2e1ca3cb6a37f3f3d274a1aa69a053c88fa862536e3f751b95
MD5 545ca74f33751a24535bbc7cb5c966a1
SHA1 e600c6f562b5ffad94140e582ae1649e8cf90001
SHA512 93e4d4bef95feb4f021c9117845677f4a91298623e9857bb4b3d9b3598af58db1c49a5fac0c99876483949ea414f593a06486786b79fe56624eb610ee6905584
SSDEEP 192:DSOv5zbo7pZC9yjHs6X8r1d66JoztdzgCl6mc0dz:DRboVZC9yjHApd66Joz/zgC1jd
TLSH
T1FBE10D64E629863FC404027BDCA62F414F39388AD84E7F1935ED640C2D572DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8b5d13196dfad9b3bf53404cd7270fc57244491c003aafbd959f2034a327b8f7
MD5 2d1004328d490f592e2703204623227e
SHA1 91ff965334eebc3f22164ad0a72c7b0b37782e6a
SHA512 c55d3d68dd7a4744e5026fd1f0cd803a20413e6e006c8251113b687949ecec7714e2178d852df75d0068fc98aeb429a11d2a0a817a5fd87e1efb93feb1015f4d
TLSH
T17A217C7C39B84D6AA8CBE39CB49102CF63A14E0704871C470D52EF8DCEA1AD9326B57C
MD5 SHA1 SHA512 TLSH

Submit Download

5b448d22-c0d8-4e83-91f6-84bf89a47e80

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\5b448d22-c0d8-4e83-91f6-84bf89a47e80
Size 16KB
SHA256 254190d227fad945cca3a0ef3bd72b4b9632ba7d6809f76d289e8f9bae232fb2
MD5 312db08c0e628814e08f5fa5d81494e5
SHA1 03387b8ba9cd50d2efaca14f1204fa58414fbd44
SHA512 ec6f3db1663b995e9a9b92b7513c776cff57a2821f59e8be2182690eddb101ffbec345924abcdb125cbc71d991640707e09e5726778506b2350441026e9c86e5
SSDEEP 192:DHZbJRs57+UVcwwH7SZhsxftfyB+qA9E1Jvs2R76BSKRRzAO54a8kbsgW1YG7BSw:Ng57rp7+SKRR8Oj8kQ97kab
TLSH
T10772EA56686045BAC191E368D4F87FC3E2F528CF4C419FCA9BE4BD086DDE06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5eef224d-5a09-4695-84ac-2a454388406e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\5eef224d-5a09-4695-84ac-2a454388406e
Size 5KB
SHA256 672a0a2790606cf0b324c7c2d36ec67f39b2b01197036d469936270144d212c1
MD5 e61f03b8b60ce61e90a429c0c4588523
SHA1 94c606dc03a6a2cf769c1b6b6084d995dfd56c6b
SHA512 a43a76d7552494c2ec7a1d390ba1c48aad459e28d2f5cd18e053e50c9a12eeb4fbbf4e74ace48ea2ffeb5daad8ec5ada707a65a52e80508e1f2d977f70645983
SSDEEP 96:9vpNQ6Uqc3WNmhHJbjD/E8w6REIUg0TBMMHSEvB95w0Tp/iUGZ91YNwafSnhKQ9K:9vQm4VgSr2PDp/7
TLSH
T131C129ED8C4300433E66E22CF1A5BEAB1556293149DCC38D2BFC083A36E78BB4213359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a782ac8a-8ae8-4344-b971-6e3013fe9ffe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\a782ac8a-8ae8-4344-b971-6e3013fe9ffe
Size 2KB
SHA256 4b1fcecc8ae761e3f5068f9816da0d80e9f535533f6cbae85fd6c6329d631c7e
MD5 478ad8384b788165fa044c6a23fcfda9
SHA1 895a3ba490b16247bb15d58ef9d9ae0c6d9e4a8f
SHA512 86978a3014a48e9814b9d7824e17233e5b379ad287ade5fb15c2cdd3b44da15291d460f86c05f0c52fbd2decf051848bc8234335806c88f368f9fa02dea1a5fc
TLSH
T19141255C35784C769CD6E19DA48233CED3648A0340822C836E61DF0C8EE669E336F52F
MD5 SHA1 SHA512 TLSH

Submit Download

b87cc9f0-ed71-4881-8a32-85aeef528776

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\b87cc9f0-ed71-4881-8a32-85aeef528776
Size 235B
SHA256 84657726c2cdbfc617bd1ab8180aa4b019a0c3790826ba090f94c5df9f981512
MD5 51b19a3af667c53bad45bca49656a0fd
SHA1 b651ed0106d7d7ad04c11ba41e9992d37cd8efb1
SHA512 373826b5d44af8917d19e2e546424729c17083bd95303a49848d49d25f9626e60006155cfd4c047315fe373c494baf1c7b1cb6659cbbb42989fbcc2affec9735
TLSH
T1DAD095801C48532C04110F17B0E069C730C84C335060E4209590857859FCBC94251866
MD5 SHA1 SHA512 TLSH

Submit Download

cf2f43dc-c941-4d4e-bd66-93c5a4f5ae26

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\cf2f43dc-c941-4d4e-bd66-93c5a4f5ae26
Size 235B
SHA256 bf92a12fdf0bb8bb21bb82e9eb006c51ac37929d43a8976a420740e1deae2042
MD5 926228a191157aac3ae84188d0732ef1
SHA1 220e8d4d058ae3d4f115e4243e7465b42f159881
SHA512 cf8b4bd359b92798b7bfe354a26237e246707abbda11284f6744cd38cd5b55e1b095c57fb66decb602fb0a7b991fe6db5b38a59bbbb9fd96a1782d606caea3f8
TLSH
T17AD0978468A8676C4C240F07B0A0A8C273884C3318A76820D6A440388AFCDC94192A1E
MD5 SHA1 SHA512 TLSH

Submit Download

d3a5a282-15f3-4b1e-9d6f-47c5e0b18e94

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\d3a5a282-15f3-4b1e-9d6f-47c5e0b18e94
Size 883B
SHA256 2ff671d7566e1dd7215541fb4e69d58b57f8a637dc245c9634d2e67dc2bf3c5e
MD5 637e9ee7a633573eacbba9e9c1934293
SHA1 bcbbb6ea323a73d0add4adcfd6400b3c67e82995
SHA512 ed74f9a9b55f3e57d0144d2103a768785bd53b217f2bbd7056739eeb115a8535235c1dcc61ece05ca93e6d13a3dbe8d483d0c19f6b167013ea10a50454f22c80
TLSH
T14F1104818739B5B1CD78D24B89D53B4587F87813C0C694143DE44A040E7E51FEBBB64B
MD5 SHA1 SHA512 TLSH

Submit Download

f5221974-850a-4432-8b75-fbf8b7132a65

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\f5221974-850a-4432-8b75-fbf8b7132a65
Size 886B
SHA256 196ec176ff4819312734a787366ce1c4f46c9c4a47e53d399eced3967e15cbc3
MD5 bd2381dbde72777b8345867bbf44a688
SHA1 a36ef2894235ae86428f397f3ff1d7d72bd37496
SHA512 7f103e4e27d6bf3ce05dde3fc3312dbb9701d5a9f78de694830e7848be1b01aa0145c5b83524cf05451d6c825bba3a5f8d82e5c5f8e094d58ab89ac6ee6c511e
TLSH
T1AE1100408629F5B2CD78E24B98E47B4787E4B413D0C658043EA49B084ABB52FE76B70B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\extensions.json
Size 16KB
SHA256 f07bba27eb3ec332dbf94d3cd8d861ad788f8225819b980fd2565c70fd992751
MD5 7b38890c853a236473e8a1c7ce7e808a
SHA1 1cd4c82e58a668b6a318930c460956aa5a01a7c0
SHA512 3b07c48add892b3c46ca1d66ace0186529b3166c46713aa4e836c18bb7e86f7fbbdad9f06b2245998f4fd7bf174fbbe28da620ff9884b5d2dbd8eea79221e229
SSDEEP 384:UkI4v2UmldvR8dhWZk94zP96ohL4H8L4PtL4H2L4HxL4HgI4hTD:7I4eRfiXi+4Z6C424l4c4J454B
TLSH
T18272641545048EB8294F979BAA367E02C37D433B60845C38F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 7KB
SHA256 f862f9f56200b04747116ec172738909407d42fa73bddbc148274bd4fd0d2970
MD5 c7aea16cb5dd22b78dc19d14becca0ab
SHA1 41ea5d4095da8fcb31f3922a76bc16df44c4ebdc
SHA512 8e80f17c01da07397698964919caee1b2408a47d1a846d4470bc78f1b6d1ac574474cbfb5575d0daf90f2d5e4b14621972bd8c0958e6a84e8654b3478ef4c128
SSDEEP 96:xHTGVTUEqGqSvfkwfObzSWFSSlvdv9jZnNHKm9SBw88x1d8L4cn5VtB:oSRYfkwf4SSl34Bw88el
TLSH
T1D5F11E3C5504CB7F75B677ACAC6449315972023BB7BF68C610B98885011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 12KB
SHA256 47f342b0f9d62a4608047c4439f902150c2806df980b2d567e86ae19922e89b5
MD5 5b779ff6b4da5fa635d9f7eea4cc3615
SHA1 ec28dae282fcc3db8df580407721d88b99271e9e
SHA512 df728446cd304ecdb1190fd249da9e7bb4d24967458efecfe5eee899446e71821dd8636a1b3f7b4aad324dfdfd840180804de23b3008b92cbab3c2af3dad8b28
SSDEEP 96:xHTGVTUPPqGqSvfkwfObzSWFSSlvdv9jZnNpwoDRmYem9mV0GOBw88P7TayavIL6:oyCRYfkwf4SS/LRt8OBw88PSyavILOl
TLSH
T12442CB3C62408B7F66B7367DAC2549B019A14227B6BFBCD245FD8C82045CF2441EAAF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 7d6b11fbd387391b75593736d1c0f170fe4bd8059c5009aae65632063be8f9d1
MD5 fafafd955bdb6623ef9d50acd86fa2ac
SHA1 8eca6372f04350d871f8341dda18a2525fa83360
SHA512 64c901bb3ef0abc0f1538a4ab4f705c3e0c06fe9e575940b13c9eade3f95b8efbd37b8ad1fc795664142bf46fceebba21963c9c19afd8b43c371cf62dc2c1f9f
SSDEEP 96:xHTGUTUEqGqSvfklN1zSxZSSlvdv9jYfnNHKm9fBw88u8L4cn5VPB:oHRYfklNIZSSY35Bw88vT
TLSH
T17EE121789548CB7F75B677ACAC688C315AB2413B7BBF28C610B95485011CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 471a5cf6dd1bb163c325e3a06f6438870dab1458641c5814a7c1930ca58df492
MD5 d7baaeb9675a5432efd6683769450910
SHA1 52c4a350d1c631cdee76a14a4c4722bb7df38bcb
SHA512 5ec7b7e1708587438482964aeba37f8f930c7d7b4512e03fc76e9a8038e786f1082e6cb0158228265ec08bacca0d591bda34dab650c12b5de2981d33e3a8cdfd
SSDEEP 96:xHTGUTUEqGqSvfkwf1zSWFSSlvdv9jZnNHKm9fBw88u8L4cn5VPB:oHRYfkwf7SSl35Bw88vT
TLSH
T199E120789508CB7F75B677ACAC688C315AB2413B77BF28C610B55484011CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 7080641242dd6b6866f8de437e5c5757eb975634410558b670e2075f104a92a7
MD5 86bc5e532baa523a3a869a0f160cf4a8
SHA1 6cf7b735a04572bfbb872ce398dadcd880b0d007
SHA512 5e39e6765b12f7995d14a1d1331bf70be10dff7bfb391f10f4f83faf998d1f31857b9ea54c4ffd1e3a42503def7e5c69d1a07e83680ad00e45ec0c47bbba4eff
SSDEEP 96:xHTGUTUEqGqSvfkwfObzSWFSSlvdv9jZnNHKm9fBw88u8L4cn5VPB:oHRYfkwf4SSl35Bw88vT
TLSH
T16CE1107895088B7F75B677ACAC688C316AB2413BB7BF68C610B554C4011CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 8a1004b9df39aad7b10de663cb250148772a5c24e31e1ecd359dee989836a4ba
MD5 76eeabd5dbd424f34cc4b10d0c9b1fd6
SHA1 f0cd30612862b21ead581b14570448c41b730521
SHA512 00f544d2f813d5a21ece5f8abfeba4ccb5c2f27149f71b99d60ae5cd4a5e57b3ba9fc6fd4167c72db02c478f0a5084cd524d4c758166a0263da86bd8207bff70
TLSH
T16731074BD1A92DB57B75C0E9E1C446F9CB59343742B608F0C1DC8F0289DD14C728918E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 ed4e55e2240f52a94a4d3858079850f1724656b62f3900119a0c7dbf4c5bf009
MD5 828de71f45a846c7f5f4eb8dfc671f93
SHA1 0a72b5e5edd0f6bd341238a6c5f75cf7f849e735
SHA512 657c96be6b0d84bd7e6157cea2fa82ff318b25330e9235b58f07842737b87cc92e5e871849cd49498fd40574a370b72584898f8e8d3902c35d12edf57026a36d
TLSH
T19331074BC1A92DB53B79C0E9E0C44AF9CB59343742B608F0C1DC4F0289DD24C738919E
MD5 SHA1 SHA512 TLSH

Submit Download

Cosmic_v1.JG59bRze.3.12564.zip.part

Path C:\Users\Admin\Downloads\Cosmic_v1.JG59bRze.3.12564.zip.part
Size 2.4MB
SHA256 24c38cdd0be01720f11201844d186eb3e9be3bd92c7f8fb615311e1d8d758862
MD5 9bcde6f239e60e3845bf13fe0cb48b31
SHA1 a5d3b470e3807cb9914f150a2a0d16c5b0da4b9b
SHA512 c4b341625ef3745ee495d8d9568a33eec72da2b661dc170a928b97fa5952adae0325641cc3e7fed1c05cb5abccf5bcb0cbddc1cb7538226f30a773dfda95aa86
SSDEEP 49152:THVzRCOzdIJcpX2Er03tpk8i96f+Glw5sQ8Aux7bXniPe1JhJ4VOdFnQEigC:RkOzGJcpbr09y8iIWG8NgtDlyYX4
TLSH
T1ECC53393C18EDD17A6BBB011B4E0403781F58996927A24F676F970421F2ECD4DBBAF90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1816-857-0x0000020374210000-0x0000020374211000-memory.dmp

Download

memory/1816-850-0x0000020374210000-0x0000020374211000-memory.dmp

Download

memory/1816-848-0x0000020374210000-0x0000020374211000-memory.dmp

Download

memory/1816-859-0x0000020374210000-0x0000020374211000-memory.dmp

Download

memory/1816-858-0x0000020374210000-0x0000020374211000-memory.dmp

Download

memory/1816-856-0x0000020374210000-0x0000020374211000-memory.dmp

Download

memory/1816-855-0x0000020374210000-0x0000020374211000-memory.dmp

Download

memory/1816-854-0x0000020374210000-0x0000020374211000-memory.dmp

Download

memory/4976-843-0x00000001E0000000-0x00000001E021F000-memory.dmp

Download

memory/4976-846-0x00000001E0000000-0x00000001E021F000-memory.dmp

Download

memory/4976-847-0x00007FF900010000-0x00007FF9004A5000-memory.dmp

Download

memory/4976-842-0x00000001E0000000-0x00000001E021F000-memory.dmp

Download