dracula_stealer | c377d3185edddefb26b052e1d2d6a2df7bc17106afb387452b06f4b9a41de7f1

Analysis

user interaction
yes
max time kernel
63s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
jre-8u501-windows-x64.exe
Size 547KB
Sample260804-db288sbh56
SHA256 c377d3185edddefb26b052e1d2d6a2df7bc17106afb387452b06f4b9a41de7f1
MD5 561b4f89322864f223c779f083a3fb3d
SHA1 d3c1c64bad463ed176cf026fd5ae8acda8d1ade3
SHA512 af66958586768cd94781bc7a7175f69e15f9921419a99ae45ba034e964e688e8c15f8acdadb012c9a17064e88051e3ec38c338b67ab9214265b2118a0c4460ee
SSDEEP 6144:+nH7TAu3kNfkQixy2Zm2FR8fe83NZfhkfqgIS7ocisF2oO5Ic1fAZpKUmpL8bb7R:IIMQwZzF6e83m1oD1fK0pL8cPB372
TLSH
T17EC43B157FA98A08E480257E455E1619DBAED1F222327303770AEF620D45DDEEE2C3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer

Malware Config

Signatures

Family: Dracula, Samurai
Dracula aka Samurai is a stealer written in C#.
stealer dracula_stealer

Detects Dracula aka Samurai Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/4660-116-0x0000028EC8F10000-0x0000028EC8F3A000-memory.dmp	family_dracula_stealer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSystem32\\Defender.exe"	jre-8u501-windows-x64.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	jre-8u501-windows-x64.exe

Executes dropped EXE 4 IoCs

pid	Process
4660	Defender.exe
1548	Defender.exe
2228	MalwareDef.exe
3412	Defender.exe

Loads dropped DLL 23 IoCs

pid	Process
1360	Process not Found
1512	Process not Found
4660	Defender.exe
1548	Defender.exe
2228	MalwareDef.exe
4416	Process not Found
1544	findstr.exe
4548	netsh.exe
3852	Process not Found
992	private_browsing.exe
4624	private_browsing.exe
2956	firefox.exe
976	firefox.exe
904	firefox.exe
3248	firefox.exe
4052	Process not Found
5228	Process not Found
5344	Process not Found
5404	Process not Found
5636	Process not Found
5692	Process not Found
5756	NOTEPAD.EXE
3412	Defender.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Defender.exe
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Defender.exe
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Defender.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
12	api.ipify.org
13	api.ipify.org
14	api.ipify.org
19	icanhazip.com
89	api.ipify.org
90	api.ipify.org
10	api.ipify.org
11	api.ipify.org

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Web\MalwareDef.exe	jre-8u501-windows-x64.exe
File opened for modification	C:\Windows\Web\MalwareDef.exe	jre-8u501-windows-x64.exe
File opened for modification	C:\Windows\xdwd.dll	jre-8u501-windows-x64.exe
File opened for modification	C:\Windows\xdwdSystem32\Defender.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSystem32\Defender.exe	Defender.exe
File opened for modification	C:\Windows\Web\MalwareDef.exe	Defender.exe
File opened for modification	C:\Windows\Web\MalwareDef.exe	Defender.exe
File created	C:\Windows\xdwdSystem32\Defender.exe	jre-8u501-windows-x64.exe
File opened for modification	C:\Windows\xdwdSystem32\Defender.exe	jre-8u501-windows-x64.exe
File created	C:\Windows\xdwd.dll	jre-8u501-windows-x64.exe
File opened for modification	C:\Windows\xdwdSystem32\Defender.exe	Defender.exe
File opened for modification	C:\Windows\Web\MalwareDef.exe	MalwareDef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1484	cmd.exe
4192	cmd.exe
3404	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3404	cmd.exe
4548	netsh.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Defender.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Defender.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	jre-8u501-windows-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3136	schtasks.exe
1124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2228	MalwareDef.exe
2228	MalwareDef.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
4660	Defender.exe
1544	findstr.exe
1544	findstr.exe
4548	netsh.exe
4548	netsh.exe
992	private_browsing.exe
992	private_browsing.exe
4624	private_browsing.exe
4624	private_browsing.exe
2956	firefox.exe
2956	firefox.exe
976	firefox.exe
976	firefox.exe
904	firefox.exe
904	firefox.exe
3248	firefox.exe
5756	NOTEPAD.EXE
5756	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	jre-8u501-windows-x64.exe
Token: SeDebugPrivilege	4660	Defender.exe
Token: SeDebugPrivilege	1548	Defender.exe
Token: SeDebugPrivilege	2228	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	4660	Defender.exe
Token: SeDebugPrivilege	904	firefox.exe
Token: SeDebugPrivilege	904	firefox.exe
Token: SeDebugPrivilege	3412	Defender.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
904	firefox.exe
904	firefox.exe
904	firefox.exe
904	firefox.exe
904	firefox.exe
904	firefox.exe
904	firefox.exe
904	firefox.exe
904	firefox.exe
904	firefox.exe
904	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
904	firefox.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2544	2652	jre-8u501-windows-x64.exe	87
PID 2652 wrote to memory of 1484	2652	jre-8u501-windows-x64.exe	89
PID 1484 wrote to memory of 3136	1484	cmd.exe	91
PID 2652 wrote to memory of 4192	2652	jre-8u501-windows-x64.exe	92
PID 4192 wrote to memory of 1124	4192	cmd.exe	94
PID 2652 wrote to memory of 4660	2652	jre-8u501-windows-x64.exe	97
PID 4660 wrote to memory of 3404	4660	Defender.exe	100
PID 3404 wrote to memory of 2200	3404	cmd.exe	102
PID 3404 wrote to memory of 4548	3404	cmd.exe	103
PID 3404 wrote to memory of 1544	3404	cmd.exe	104
PID 992 wrote to memory of 2956	992	private_browsing.exe	112
PID 4624 wrote to memory of 976	4624	private_browsing.exe	113
PID 2956 wrote to memory of 904	2956	firefox.exe	114
PID 2956 wrote to memory of 904	2956	firefox.exe	114
PID 904 wrote to memory of 3248	904	firefox.exe	115
PID 904 wrote to memory of 3248	904	firefox.exe	115
PID 904 wrote to memory of 3248	904	firefox.exe	115
PID 904 wrote to memory of 1872	904	firefox.exe	116
PID 904 wrote to memory of 1872	904	firefox.exe	116
PID 904 wrote to memory of 1872	904	firefox.exe	116
PID 904 wrote to memory of 1872	904	firefox.exe	116
PID 904 wrote to memory of 3504	904	firefox.exe	117
PID 904 wrote to memory of 3504	904	firefox.exe	117
PID 904 wrote to memory of 3504	904	firefox.exe	117
PID 904 wrote to memory of 3504	904	firefox.exe	117
PID 904 wrote to memory of 4416	904	firefox.exe	118
PID 904 wrote to memory of 4416	904	firefox.exe	118
PID 904 wrote to memory of 4416	904	firefox.exe	118
PID 904 wrote to memory of 3836	904	firefox.exe	119
PID 904 wrote to memory of 3836	904	firefox.exe	119
PID 904 wrote to memory of 3836	904	firefox.exe	119
PID 904 wrote to memory of 3836	904	firefox.exe	119
PID 904 wrote to memory of 5800	904	firefox.exe	120
PID 904 wrote to memory of 5800	904	firefox.exe	120
PID 904 wrote to memory of 5800	904	firefox.exe	120
PID 904 wrote to memory of 5800	904	firefox.exe	120
PID 904 wrote to memory of 5872	904	firefox.exe	121
PID 904 wrote to memory of 5872	904	firefox.exe	121
PID 904 wrote to memory of 5872	904	firefox.exe	121
PID 904 wrote to memory of 5872	904	firefox.exe	121
PID 904 wrote to memory of 5888	904	firefox.exe	122
PID 904 wrote to memory of 5888	904	firefox.exe	122
PID 904 wrote to memory of 5888	904	firefox.exe	122
PID 904 wrote to memory of 5888	904	firefox.exe	122
PID 904 wrote to memory of 4776	904	firefox.exe	123
PID 904 wrote to memory of 4776	904	firefox.exe	123
PID 904 wrote to memory of 4776	904	firefox.exe	123
PID 904 wrote to memory of 4776	904	firefox.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Defender.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Defender.exe

C:\Users\Admin\AppData\Local\Temp\jre-8u501-windows-x64.exe
"C:\Users\Admin\AppData\Local\Temp\jre-8u501-windows-x64.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="8-b<@\]`@bZ @5" dir=in action=allow program="C:\Windows\xdwdSystem32\Defender.exe" enable=yes & exit
  2⤵
  PID:2544
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\xdwdSystem32\Defender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\xdwdSystem32\Defender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3136
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1124
- C:\Windows\xdwdSystem32\Defender.exe
  "C:\Windows\xdwdSystem32\Defender.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Drops file in Windows directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4660
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C chcp 65001 && netsh wlan show profiles | findstr All
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2200
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Loads dropped DLL
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4548
  - - C:\Windows\system32\findstr.exe
      findstr All
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1544

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\Web\MalwareDef.exe
C:\Windows\Web\MalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Program Files\Mozilla Firefox\private_browsing.exe
"C:\Program Files\Mozilla Firefox\private_browsing.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:976

C:\Program Files\Mozilla Firefox\private_browsing.exe
"C:\Program Files\Mozilla Firefox\private_browsing.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:992
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
    3⤵
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {2e471dd3-2386-4e84-8588-f669548b5511} -parentPid 904 -crashReporter "\\.\pipe\gecko-crash-server-pipe.904" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {f6d4d71c-1085-4433-b105-f59b041fa99e} -parentPid 904 -crashReporter "\\.\pipe\gecko-crash-server-pipe.904" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:1872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3812 -prefsLen 27200 -prefMapHandle 3804 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {054916aa-efbf-4c19-a65d-ca19d3e96f02} -parentPid 904 -crashReporter "\\.\pipe\gecko-crash-server-pipe.904" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3980 -prefsLen 27200 -prefMapHandle 3984 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {1a495907-8511-481a-98e2-b091dafdd0c9} -parentPid 904 -crashReporter "\\.\pipe\gecko-crash-server-pipe.904" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4416
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4396 -prefsLen 34755 -prefMapHandle 4400 -prefMapSize 270279 -jsInitHandle 4404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4412 -initialChannelId {1349b7e8-c74a-4bc1-94d9-b31fadd4d267} -parentPid 904 -crashReporter "\\.\pipe\gecko-crash-server-pipe.904" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3836
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4608 -prefsLen 34992 -prefMapHandle 4728 -prefMapSize 270279 -ipcHandle 4932 -initialChannelId {c6d523d7-9ebc-4ae0-8739-e07573a34b5f} -parentPid 904 -crashReporter "\\.\pipe\gecko-crash-server-pipe.904" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4856 -prefsLen 32872 -prefMapHandle 2788 -prefMapSize 270279 -jsInitHandle 2792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2800 -initialChannelId {11679781-4072-499d-9ef9-9a3eea991e30} -parentPid 904 -crashReporter "\\.\pipe\gecko-crash-server-pipe.904" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4808 -prefsLen 32872 -prefMapHandle 4852 -prefMapSize 270279 -jsInitHandle 4756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4792 -initialChannelId {18e5bf30-4a52-4b09-b871-56da0a05f088} -parentPid 904 -crashReporter "\\.\pipe\gecko-crash-server-pipe.904" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5680 -prefsLen 32872 -prefMapHandle 5684 -prefMapSize 270279 -jsInitHandle 5688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {7d213477-70dd-43db-8831-768a1ee59d64} -parentPid 904 -crashReporter "\\.\pipe\gecko-crash-server-pipe.904" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4776

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5756

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Defender.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Defender.exe.log
Size 1KB
SHA256 d049789c187b2f58c900eab10205bc037740dca8640ab40c314790fefaab66ff
MD5 f26118d675c61402c218ac6794d90a63
SHA1 ffc8d592f3ca8255ca5119eff5b576eb16ac7fac
SHA512 6f14b71dae095131053a1b590e60ccec4e14c47c745bf9d52de48988d7b93b1f50bbb6bac0222dc49e3e45def052b20be2d34e116991027718da2e0fb8eb45d0
TLSH
T17411CE723371F1D889163F072C68268417BF4724BA90EE0CB5A8626ED9364275F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 b61542eeff7be7f2d283c731cc63ccb63ecd97d8f843b861337f0be072a060c1
MD5 fe63b5e787034ff3d845b3730ea943d2
SHA1 97ba40773bcdeaf9a3902de60f185628bec8865d
SHA512 b6acc1c5afe10e7bb9adfd91f5e4ab961739c01aea994cfb4629decbadc90df001ce50240103f8eea061e309a5cc736ec27ee6bc42df6e98b310742920d7773b
SSDEEP 384:HwCe7iO024YxDL84KKDL849B7SOEAd9KVRaAcP+AWRMAyef:QqZYxDL8lKDL8CB7S/AmVAf+hRMJef
TLSH
T130728D3E9F013CAC1997D0E8C5F992D94C19B6A3CFE6806D21683D0DCB98969B0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 2f0a63b7637ebab5e078e37b6fa075ab47929e77294b7e4682d7f4a8de2719e1
MD5 d39ee0946df099ccac2b73ea0d134066
SHA1 41301fefe0d344f66971a1d40a7d12c9ba00f8de
SHA512 1e16d70768348b5f96dd3e1a8526310d9da32d7a70a7dacdb118125d2ab24fb8e9d386703a639cd7037f0a45dc42d859374058ca29c788375743d13f595a5e42
SSDEEP 1536:jTrliakdGx5DM9v5UmODIfLh1sZpXBl7bYMZpMz1cm38oStog1gNk7tGmmeVVRUM:j3lqdrv5UQqVwMmz8oStoegNQGhQR3r3
TLSH
T175B3AEF6DBA2C97D64FFD4199BC2C83EFD262414B3A33019C953235062C6BB87676648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6853.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp6853.tmp.dat
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6855.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp6855.tmp.dat
Size 138KB
SHA256 a24e360a8913c9dcd9dc0e6039f1e34ff59b7bb333ea52f862898c3f5607cdfd
MD5 355ab351ef5aaef63f09525af6dcf8e4
SHA1 67005c572432287b86cc756aac78176e3d19bf39
SHA512 287bf6596a2d433bc7c0836e3aadb7778e8e35292dd766260846ff9d583a66c26f611f8c4c4251a3aab26e3092b430b066d49310c0c001a0cff035d89755ae00
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OCpX6lqwRVumkwk4OQ1:zeuvBnhJsueMEGvIW1DcP2OKERVumknW
TLSH
T175D3A84B3A747102EDE59A725CE050BB5E3CB16D4F55A1D428B620688EF2963B23D0FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 87b74d6361178ffb06225d417f9bbbc5e880a89a7da4f931ba4cbdc785dc6f72
MD5 5c08dec433dc7cd57581abf2128be32e
SHA1 303d5b0cd33b3793f652944a6f3dfd14caf88bad
SHA512 a873e62c858c1b7897bd7ba40afe3e7d6ea876a30ff2648bce2ec0e53f72186ae366fc9d2b035686351da8df321fe7439874ac1c76c1bc332fc794d370ac8c52
SSDEEP 384:e5d66JozGzgC1jzbowZOcyj2FCksE1rHSBGcmhuV5X5+RptLiuFbybTbEb3b:jE15XFpoGcmhuTsRptLiuFbybTbEbr
TLSH
T1A4D2F184EB1E953FD41912BBDCA50B001F79BC8A99192F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d0447ba2c9a48fbcd7a7804ea5986b060bbbec8c4e2e7ac51354f87b3587de41
MD5 bc2cf9723de927048f5417b0ceb00031
SHA1 71933ddcf0c4e57d6411a2e988d810cff9d24647
SHA512 0d56377ac046cce0297da250b8f8c28b0948e6e51edd288cc8f573cb7eb28a02767c5e81aa22bbdeaf550d438ea23b132fb3ff5cd655e5d5b8aa91d158ab6f6c
TLSH
T1E6214F9C3EB94D2A9DC7E39C7482018D53158E4698471D475D02EE8DCE86ADD316E538
MD5 SHA1 SHA512 TLSH

Submit Download

0e772b71-0a30-4eaf-acae-59fb7ef5ba26

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\0e772b71-0a30-4eaf-acae-59fb7ef5ba26
Size 886B
SHA256 095ed2cde285daa9395e5b751ecad04a5898eb6a1747ecd80e82389f778e9bae
MD5 21674c564d68f2990f9dd0f9dea16afc
SHA1 ccee36d3b2450896c65f56701a7473d928322a8a
SHA512 cf3cb856d6d75fc8baf964e8665a3419e7b2b122fe78fdfd6a6d009f3e079e1a1bc1aaed0437bf258d138708fc758bd2d69e571010551138bd36a078a2dc4bc1
TLSH
T1FA11C451A679B4B38C79D28BD59577028BD47423C0C599047D909A180DAB62EB3EA60B
MD5 SHA1 SHA512 TLSH

Submit Download

2eabb07f-4d22-44f4-959b-ebcb5ee3f4b5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\2eabb07f-4d22-44f4-959b-ebcb5ee3f4b5
Size 2KB
SHA256 d1000c50383b34725ec72998ad349c6170e8f40fb1233b0766c70b0e8faa95e1
MD5 18e861b58384166d48282761f89e3094
SHA1 96ce1dccb9d92f204f5692ea52f9b1a3f9eae332
SHA512 80eced0ac1969384444df8aa51ddf15a2346050f335fc11c52a44cfc2c3c0565a5eddd35938b5b9989ab46f520fa1e185b28cd7be3eaf7aceeafe8b041e77c6a
TLSH
T1C741535C367C4CB79CABF19DD481378E57644A0300C62D832D95EE4C8C9A6AE336A43F
MD5 SHA1 SHA512 TLSH

Submit Download

6742eb29-db38-4329-a763-96344217e1db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\6742eb29-db38-4329-a763-96344217e1db
Size 235B
SHA256 5ffef1fa53f9f2e8b86a8f42616e43615959127a8be996d3c1b91992cf09e2b2
MD5 273c142b6dc04debb1ca8f92790c38f7
SHA1 cf6db99aca2527bf184b3b81dfb2c6ff80613173
SHA512 56ab2a1fb56e5c784f0a0dbde95a5215cb8424ab927f900ada9f09b49a53420f8e8e50fad02a391f917b24e69e320de52f4a70a65614364b9294ecb9bd1d80c9
TLSH
T1B2D097C02488632C0C080F13B0A0A9CE708A8C3320AA5810D5D28A38CAFDEC8425A817
MD5 SHA1 SHA512 TLSH

Submit Download

94679865-4ab9-493d-8d74-1e5850d6d01c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\94679865-4ab9-493d-8d74-1e5850d6d01c
Size 235B
SHA256 ab8be1f1040a4900b473a01f467eb8b219f44b06904631ad10728b7289cb7720
MD5 eb6754687dd0ce0bd5e969b9bb4c96d1
SHA1 a05d5463b40e34257dc8d3c541c9741c3d51c357
SHA512 379b296614bb45af421df1315fad7aa6b7ab0900c3200a306427ca77689de5989c811e62e8f3667f3c3b203c852f3ce46c608b1c6040b97c369a5c41d71a4346
TLSH
T123D097D024E877DD08004F07F0B029C2308B8C33A868582099B240749AFADC981A1C06
MD5 SHA1 SHA512 TLSH

Submit Download

de824aca-ad23-47c5-8423-e577e8daebba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\de824aca-ad23-47c5-8423-e577e8daebba
Size 871B
SHA256 4ec33f83667764d181cc3925211a7f0ff1afa4fe206b6fb810fcfa1ac857976c
MD5 d0d2f9f5e22b1381cfccdc6d57915454
SHA1 16f81e450d2f737f14d23ca5ad579b24db96c5cf
SHA512 d37c5deae11310b03548af6dcba5ee4b98cf93c445d0de853ddd02157172d894638b08ef1d1d35f22868d804c7288703df88fcda59c7a2ed4974811bc0c1e4ec
TLSH
T19711E351973DB5B78C78D38BC55537068FE4352380C994047DA19D280D7F52EE7AA60B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extensions.json
Size 16KB
SHA256 e39ba70eb747f676e08b50ad4419fb1378edd86579a25e05fce3b55d4a06ffdd
MD5 aabc72ba8ec2f94e47139118e114e8d7
SHA1 4d2c1063c407f17db7dbc750872f240ee38ef1ae
SHA512 9a7f8e9e6e1fb1ae60de92232e4ecdf73d9d5ccdd788d979abdfcfdda633a0b704b00b1b00418c1a0b604fdf7ddab85b459a74df61d1615c7522426b4d84bcb1
SSDEEP 384:ghkI4vzUmldvQ8dhWo94zr96oQL4HQL4PGL4HzL4H/UL4Hek4hb:PI4LRfJXF4F6Z4y4U4f424r49
TLSH
T18972531545049EB8294EA78BAA36BE01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 6KB
SHA256 f1b3466f8e13934fb1ecddfc691830d95130a5eb4621c64800f5eeec16acfd01
MD5 1e316c16504b442676d7a6ff5735b535
SHA1 abe22d11ebb514f9a71e148fd89f272941d04802
SHA512 4bda588763cd106ec963485f8ed4b501c8bd40db8d7a7c58e771083d823e1b29ec8ed86409010b0909e3e23ed931310b75761e866c08dfb429128f36b27e06bf
SSDEEP 96:xHiUTUMqGq/fSOVObzSdPSSl4dv9jBnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSOV7PSSFxisIHzsBw88J
TLSH
T184E13F7895088F6F64B677ACAC288C316AB2013BBBBF68D350B594C4015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 7KB
SHA256 3824639a1254c6dbfb0c6f41b1e761e0c4cceacbf96bf873a34ceb2a02177264
MD5 63faf6e605bf65713b07a2497aa02d89
SHA1 9cb3bb2989c070bb95930ff3a9107c90e3a2374e
SHA512 3009092d72503e082a8fe7294ab489860ae144e27567c95a483fc89f46dd09082a682ded06fa35e9a4f25d11fc04b92eabe297b058827da387f667644d4918fd
SSDEEP 96:xHi9TUMqGq/fkOVObzSdPSSl4dv9jBnytWRgn5AsO7HjvIBw88XS8L4cn23U1K:U6R/fkOV7PSSF4RvsIHzIBw88w
TLSH
T115F10D389504CF6F74B677ACAC2489315AA2023BB7BF68D720B99484055CF3445F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 25c040c2377d1948b55495f1a271f7da880280ae9358051525430cd93082c360
MD5 a9e5bd52889793e4c9977e2b8663192d
SHA1 987f83d61498bb7561fbb7b67fb5271cc699e911
SHA512 16f590969496bcb709e891914765e0fdb69cf20a76398164602f3f4eca4f7659d9cb11514cf67c5593de8edaaa05e2c70e2719b1d5ba1b525fc9978bb136ea31
SSDEEP 96:xHiUTUMqGq/fSrO1zS3rFSSlmdv9j6nytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrO0SSsxisIHzsBw88J
TLSH
T11EE130789048CFAF64B677ACAC688C716AB2013B77BF68D650B594C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 288e6cc316cbb958a650e644d961043b18011766daf9c1112e6508060aba7b2b
MD5 fe2ee2aa171c7b2b527851a92a049f25
SHA1 0761821fb35fe3e5b280fcc97834bdab594ed10f
SHA512 7a98d74b264ec794097d940793044719ccb24e7d4312a93e8ca2cbea1b5ab39a9c8676e21a4b4e408c4d3fe224997e16c51665b5d573cb0febc70bf2f5806481
SSDEEP 49152:RBl3Q9jg9SieDQY1ut0BXZaW3sNl0T/uEwkH:Dl3Q9jg950BXYW3Wl0/ckH
TLSH
T1D81639F824D1A257F3808037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Defender.exe

Path C:\Windows\xdwdSystem32\Defender.exe
Size 547KB
SHA256 c377d3185edddefb26b052e1d2d6a2df7bc17106afb387452b06f4b9a41de7f1
MD5 561b4f89322864f223c779f083a3fb3d
SHA1 d3c1c64bad463ed176cf026fd5ae8acda8d1ade3
SHA512 af66958586768cd94781bc7a7175f69e15f9921419a99ae45ba034e964e688e8c15f8acdadb012c9a17064e88051e3ec38c338b67ab9214265b2118a0c4460ee
SSDEEP 6144:+nH7TAu3kNfkQixy2Zm2FR8fe83NZfhkfqgIS7ocisF2oO5Ic1fAZpKUmpL8bb7R:IIMQwZzF6e83m1oD1fK0pL8cPB372
TLSH
T17EC43B157FA98A08E480257E455E1619DBAED1F222327303770AEF620D45DDEEE2C3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2652-0-0x000001CD806B0000-0x000001CD80740000-memory.dmp

Download

memory/2652-1-0x000001CD9AEA0000-0x000001CD9AEB0000-memory.dmp

Download

memory/4660-610-0x0000028EC7470000-0x0000028EC7480000-memory.dmp

Download

memory/4660-117-0x0000028EE19F0000-0x0000028EE1A40000-memory.dmp

Download

memory/4660-153-0x0000028EE3030000-0x0000028EE30FA000-memory.dmp

Download

memory/4660-116-0x0000028EC8F10000-0x0000028EC8F3A000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads