8b70a5477fd362d9bb478fecb911a02dec1f49de21c3b7b24e70cc8643e959b3

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_699b1a611e40b93bde74433c08e05a9a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Size 381KB
Sample260913-afcbtshp2w
SHA256 8b70a5477fd362d9bb478fecb911a02dec1f49de21c3b7b24e70cc8643e959b3
MD5 699b1a611e40b93bde74433c08e05a9a
SHA1 8b242c9892d3cf5ae6f872371c3d50eb503a49ef
SHA512 c65993951066a818f74203f31d770540449e601921c272a346fba7c39afa07b4b5e8ed906c1372f6fb9d2195cd13d12c1325d1d06d2a6f4dc9eee0229609302d
SSDEEP 6144:qynDUuQsII/WOtbuHRS6aiETssOGIFXDsBRHJeq0/:RD/QsIIvUxPaiETsssFzwHJeJ
TLSH
T11984AE16F3E904F9E1AB823889424516FA72BC564760A6CF33A46F963F237D05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	2026-09-12_699b1a611e40b93bde74433c08e05a9a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	firefox.exe
Token: SeDebugPrivilege	5008	firefox.exe
Token: SeDebugPrivilege	5008	firefox.exe
Token: SeDebugPrivilege	5008	firefox.exe
Token: SeDebugPrivilege	5008	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5008	firefox.exe
5008	firefox.exe
5008	firefox.exe
5008	firefox.exe
5008	firefox.exe
5008	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5008	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2984	1944	2026-09-12_699b1a611e40b93bde74433c08e05a9a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe	85
PID 2984 wrote to memory of 5008	2984	firefox.exe	87
PID 2984 wrote to memory of 5008	2984	firefox.exe	87
PID 5008 wrote to memory of 4052	5008	firefox.exe	88
PID 5008 wrote to memory of 4052	5008	firefox.exe	88
PID 5008 wrote to memory of 4052	5008	firefox.exe	88
PID 5008 wrote to memory of 3664	5008	firefox.exe	89
PID 5008 wrote to memory of 3664	5008	firefox.exe	89
PID 5008 wrote to memory of 3664	5008	firefox.exe	89
PID 5008 wrote to memory of 3664	5008	firefox.exe	89
PID 5008 wrote to memory of 4932	5008	firefox.exe	90
PID 5008 wrote to memory of 4932	5008	firefox.exe	90
PID 5008 wrote to memory of 4932	5008	firefox.exe	90
PID 5008 wrote to memory of 4932	5008	firefox.exe	90
PID 5008 wrote to memory of 1844	5008	firefox.exe	91
PID 5008 wrote to memory of 1844	5008	firefox.exe	91
PID 5008 wrote to memory of 1844	5008	firefox.exe	91
PID 5008 wrote to memory of 648	5008	firefox.exe	92
PID 5008 wrote to memory of 648	5008	firefox.exe	92
PID 5008 wrote to memory of 648	5008	firefox.exe	92
PID 5008 wrote to memory of 648	5008	firefox.exe	92
PID 5008 wrote to memory of 4836	5008	firefox.exe	93
PID 5008 wrote to memory of 4836	5008	firefox.exe	93
PID 5008 wrote to memory of 4836	5008	firefox.exe	93
PID 5008 wrote to memory of 4836	5008	firefox.exe	93
PID 5008 wrote to memory of 4912	5008	firefox.exe	94
PID 5008 wrote to memory of 4912	5008	firefox.exe	94
PID 5008 wrote to memory of 4912	5008	firefox.exe	94
PID 5008 wrote to memory of 4912	5008	firefox.exe	94
PID 5008 wrote to memory of 4996	5008	firefox.exe	95
PID 5008 wrote to memory of 4996	5008	firefox.exe	95
PID 5008 wrote to memory of 4996	5008	firefox.exe	95
PID 5008 wrote to memory of 4996	5008	firefox.exe	95
PID 5008 wrote to memory of 4248	5008	firefox.exe	96
PID 5008 wrote to memory of 4248	5008	firefox.exe	96
PID 5008 wrote to memory of 4248	5008	firefox.exe	96
PID 5008 wrote to memory of 4248	5008	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-12_699b1a611e40b93bde74433c08e05a9a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_699b1a611e40b93bde74433c08e05a9a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27100 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {aa13c9b4-1ef5-441d-9db7-e2223503eaca} -parentPid 5008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27136 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {0954b5b9-cc2d-4864-a9d5-407c14b81e41} -parentPid 5008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3664
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4012 -prefsLen 27276 -prefMapHandle 4016 -prefMapSize 270279 -jsInitHandle 4020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4028 -initialChannelId {67e3589d-dd08-4825-ae34-e498ef03762c} -parentPid 5008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4932
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4176 -prefsLen 27276 -prefMapHandle 4180 -prefMapSize 270279 -ipcHandle 4280 -initialChannelId {f543d2b4-8e2e-4ccc-9fb4-d003a2e3aaeb} -parentPid 5008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3080 -prefsLen 34775 -prefMapHandle 1636 -prefMapSize 270279 -jsInitHandle 1664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3020 -initialChannelId {1805a9fc-accd-4907-80b3-8ff45579998b} -parentPid 5008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4928 -prefsLen 35012 -prefMapHandle 4932 -prefMapSize 270279 -ipcHandle 4940 -initialChannelId {1f851b3e-3f59-4d20-bb21-febf2aa2bebf} -parentPid 5008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4836
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 32900 -prefMapHandle 5116 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {ba26f3b6-b660-4d6e-b56b-d6cad6708e5f} -parentPid 5008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5332 -prefsLen 32900 -prefMapHandle 5336 -prefMapSize 270279 -jsInitHandle 5340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {17d2873a-8a40-4229-81fb-dcb9f579dad2} -parentPid 5008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 32952 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {64bc8ebf-615d-4147-a6d6-4b25434c9f6c} -parentPid 5008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 9546200be76622b94d5fd3b2d854650dd125e5758a36164b6bbb0fc89122f08b
MD5 8e4f464c074c3dfcd83dd4366728a4ad
SHA1 1d66559d787268d3c11a3c636757a4046e91fdb7
SHA512 3c5921878af365a1d2be5b561f5ae26e6d2df5ef043cb5690680f80be0b2972637117bac3e54b00955fbf74a26f78519e79f6365f81eca4d21c4d7a7557b0346
SSDEEP 384:HkCjiO024YVDL84KKDL849B7SOEAd9KVRaAcP+AWRMAg:EzZYVDL8lKDL8CB7S/AmVAf+hRMl
TLSH
T1C6728D3D5F013CBD15A7C0E8C5F9929A8D18B7A7CFE6806D21583D0DC698A69B0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9f3e12d8dd7e79a96d25a2857e50c189fd17758c2ab04d0b91ffbbbf8e45311a
MD5 488e12221a83eca902a69e51cd504157
SHA1 da550f71c23311939cab79e4cc2a33e0ac050f66
SHA512 4618283cba6986c94d46cecfb889232b5d1d064d261a6b8ec9326bed749a65c97a32941aa9a5f98819f2ee7687523079ea7437f692803448fe5696731f906dd1
SSDEEP 192:BOv5zbog9ZHlyjsOxhVgw1d66JozGzgCl6mc0d:eboyZHlyjjd66JozGzgC1j
TLSH
T1C5E12F68EA28467FC408027BDCA61F410F79389BD84E7F1931AD641C2C5B2DD768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 c274d555351c79f905875d5453b6ea1a589c5ac4dba64815de56b654bc35797a
MD5 581c83811ebed1c649731288b7740d4f
SHA1 63ab42e3a8173b439983b4d503583a0011bd5239
SHA512 6c9304269461fd1bd6f0b642458cb5bff71c14833da32c0624e65ac5c8c1ec2b0eb8ceba0272e07e02c118ecb1455ad155f9d17fefe2f101d20b4166744c0774
TLSH
T1C661C858F228463FE444813ACC932B441F743456A8AFBF2A39AD604D1E5B2CD778D47D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3a07b34d4ff6277d94ca6a42d1d4e7a19656cf07937c6220b571bc8db1e6234c
MD5 5465b7de7adc4a424578eb2f0491f7da
SHA1 b4c9425b2fddfd2aeaa1fa0eb234d3f4e2bf990b
SHA512 baa84dc7d27563e82145874f5115d619535694d8a3e8a56fe2bf682e05353478a93e7ced5e139bdbfd3d88e30f070236865d584dc4df218a5a8265faa4c2eea9
TLSH
T18221485C39B84D2EAC87E6687451028E53554E4208871D430D52FE8CDE816D932AF43C
MD5 SHA1 SHA512 TLSH

Submit Download

037f5fde-7ff1-4784-b9dc-71471524a9ff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\037f5fde-7ff1-4784-b9dc-71471524a9ff
Size 235B
SHA256 fcda0921aa02545608026b2fe124b4acf38f18cb6b101460abfdad6b71ac9461
MD5 dada4d7e96d921450410ab41dde8ca5e
SHA1 035020f1cd23b70ed80b17f390a47672ea1a9e36
SHA512 c7cc97a6c4d377f967c291c4a60a7947d107d2acdd5d1e48d4c49e61c77250ad9d5763816d2d17f9cb15ab728a542b0a448113ae7c023a207bdc23b0ff434a02
TLSH
T1F8D097E534A8231D18040F03B0E069C631848C3324B0A8508AA040B49DB8EC80221816
MD5 SHA1 SHA512 TLSH

Submit Download

34cd0015-43ab-4136-9dc5-e31974b2ecf5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\34cd0015-43ab-4136-9dc5-e31974b2ecf5
Size 2KB
SHA256 ef47f2aaa2fa9975c98e39c104ee7abee84ffe19b840b103c77ad595995f4933
MD5 416acdca545416802cf9ae866f9bd320
SHA1 cb0a8896c76dbf8307baba86c5844e154224bbb4
SHA512 3059bba9c8d01dbaf7831cc394b7ab5dfd36af07f74fd26edf948a1b50f3fbd5f289b32001491e030fdbb69173f7cebcfd00c8853200c6bf58ded255db2f1d05
TLSH
T11E41525C75B85CB79C8AE14DA0D2334E47B48E4350C618437EA2EF4CCDE679D236692B
MD5 SHA1 SHA512 TLSH

Submit Download

3b89bfd5-1d25-4900-9728-4c7483d5a420

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\3b89bfd5-1d25-4900-9728-4c7483d5a420
Size 15KB
SHA256 717c5b30a9b4e3eb12ac9454dd8030da2ba1ae3958470e5a746f6cf74ede56a4
MD5 5f2048af62559dda636bda332ee726d5
SHA1 f8034e8da3fd6288aeece3cbad67b3cf968045fd
SHA512 a60581125bc7454db169ec231fdbc4ffc2952d2c55256866a398aa1437271172e66dfceccb5fd9d7a66f1a491e27d253807b47496e58c5ff8aba039ec6a0d28e
SSDEEP 192:aUFdjxuOtBL/2dNSzK6iSzuG8vVfIp2UszveiSRG+SzxzcRkUdcXQl5lE45BXmaY:1j380kzvPSRG+SlzcRLcXQ5Z5Y
TLSH
T1F962D9566470597E8691E3A8E4F87FC3E2F618CF4C019FCA9BE47D0869EE06E1127847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49978e1c-3b72-4cc2-8c86-79b3a4796d97

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\49978e1c-3b72-4cc2-8c86-79b3a4796d97
Size 886B
SHA256 960f156d024b662d0cbf1967be673ada5d6dd90454fa16b03c633fb8d662f144
MD5 31d757003e05ea511f3403c060da8554
SHA1 531760a4ceb4a571bca8f1580025e6b2cdca8150
SHA512 ec649c042f4e23f4e1c79dcbee111b523d6a728457453ba0261f628fc677d1eeec519eadad2edb3082140f72cc135688bddbfbf0abe9c4d08b282043d1d3ab32
TLSH
T17D110081963179F3CC68D24BD8E17B024BE83523D0C98A187E655B184CBA51DA363707
MD5 SHA1 SHA512 TLSH

Submit Download

527f2b64-9364-478b-8f84-0728288561ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\527f2b64-9364-478b-8f84-0728288561ba
Size 235B
SHA256 7fec23b0dfc8ba01caa03d25ec861e9c70c1cd04ecf7699459e89b26b126b6f0
MD5 0164579f9abfc1d817ca1d2599e0bd3e
SHA1 daa77165fa92847bf9fc5819e05529cb5a94da9b
SHA512 752a0cdeee275e52f10bd3d0fe5cc7e33af1fd9bdff0dbc22eb80830081d6919f578af33dbe16a630e77415a3ed7c48d23f1952775d1c8cc8306f306d59cc352
TLSH
T1B2D097E0A8A8A39C08344F02F0A429C630854E3320B4A810955188389ABDDC8012183A
MD5 SHA1 SHA512 TLSH

Submit Download

d9ad5b36-3df9-44b9-818b-f8f332feacbc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\d9ad5b36-3df9-44b9-818b-f8f332feacbc
Size 883B
SHA256 efb441422be85bf2879ae274b666d9d609da07e5d5347923e2cb89e6777ac5c0
MD5 805fb00d5c3b04cb1827b6a0390624cc
SHA1 e5097c493f94cc4b89dee448e005ea896466fb54
SHA512 efc5a0b2cfe635e98602a79d143b3df1c521898e69023c1a6814115d36fb449189d25a8029fdf32b4ffc1ae6d23e5dcf294eba85cd47486d40c06f41663fa6c1
TLSH
T1FE110081E67279B2CD68924BD8D63B028BF83923C0CAD5143EB55B180C7F61E9366B07
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\extensions.json
Size 16KB
SHA256 96137572d82a89b59aa6ac1107d18af6178504f7aa5c5d07c2ef4b412ac9c1ce
MD5 e0bf16c6970659af58966bd692915939
SHA1 e2820501bb2805376c6ab053c97ad7c76e4efce4
SHA512 67767d1db8e3fb55d562b7c35ff2bd1aa80ef8bed78af01f9735fe8aefed5662a01232eacb35835c082e6b0d0a4906d848fee16bb851a0ea6c8b9b610f1569f4
SSDEEP 384:XkI4vMUmldvS8dhWA94zs96oxL4Hb9L4PdL4HXL4HoL4H3F4hQ:0I4ERf3Xp486y454V474K414+
TLSH
T1B672421545448E78298FA79BAA36BE01C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs-1.js
Size 6KB
SHA256 a8e5564c7565dd74ea44ebc3d6a56590a3e867e6a9eaf7c4afcd1b06e9834407
MD5 43e1d2a4ea215e4b5afec29d70def3f0
SHA1 af588b801a4a4a8c071d9258131ef330534959a7
SHA512 24abd0e392fcc1b5a2c0b0497d8ccd1f83051d9c076a2a90bd9435f748c2eaa9c9725ddac3cf41c296816c06f7b7bdf22b3629584194abddd2b850dfc3dfee87
SSDEEP 96:xH5UTUGqGqFfQ0n1zSQSSlSdv9j5n2RHKpBw88n8L4cnEVoR:XBRFfQ0nNSSh9KpBw88ZG
TLSH
T1BEE12F7894488B6F74B677ACAC6488315AB2013BB7BF28D750B554C4015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs-1.js
Size 7KB
SHA256 95256807a22774eb4797a82d2c1b38386e641ed9f2820cb049ec171683138b09
MD5 b60556dd3d0e4cc314ba2be5c4852b2d
SHA1 0b96eda6255905dd00fa4cbe8eda39d5a92e9f8b
SHA512 f063a92a2c07a2fe99a3b0d0c3ad3c8bfe30cccdba6063a1783efde02733ff5874dc6cfc04dc6a91ac13aee1b2686d7ea6e27aad2ec59f2f38fa0a95721f7d8b
SSDEEP 96:xH51TUGqGqFfOfGObzSR8SSlSdv9jln2RWRxO7Bw88HP08L4cnEVoR:XQRFfOfGb8SSp8R47Bw88YG
TLSH
T12FF10C389544CB7F74B6366CBC644D305AA2063BBABF6CD710B95884011CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs-1.js
Size 6KB
SHA256 0426fe19ba009c7da4e3d11023191808a71a928638779e37088d6fe16986a1fe
MD5 f5bccef245fb4de3ffe353a599c5161b
SHA1 e1198e4fe83a1bff756f14af345fe01a3ee2d0ae
SHA512 ce39b19eee4a4758f5d0c3672e057a7f881b8e23aae8639f67aeabaeb385f497b87826071bbfc9929a01d8658348c1d225a991e39f8678b52bd0730507448252
SSDEEP 96:xH5UTUGqGqFfQfG1zSR8SSlSdv9jln2RHKpBw88n8L4cnEVoR:XBRFfQfGo8SSp9KpBw88ZG
TLSH
T159E11F7894488BBF74B6376CAC6889315AB2017BBBBF68D750B554C4011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js
Size 6KB
SHA256 3b1bb06e51d6f37c61c01d032b4019c814d27833e4e8f940c71f1d8a35136a5a
MD5 4537873fd861d77ba9974b6038242ebf
SHA1 24d6146afb7c995e62ee182e28595a8a7729c482
SHA512 6c755403a629da6b472fe41e2d462617f4ddd8f58a1a787b2a0c6d7a28c47eb79a0e8d0c83681e5c07a6ca3cdd5b5364ee75d115493a3b9a7b467f1663079b15
SSDEEP 96:xH5UTUGqGqFfQ0n1zSR8SSlSdv9j5n2RHKpBw88n8L4cnEVoR:XBRFfQ0no8SSh9KpBw88ZG
TLSH
T1BFE12F789448CB7F74B677ACAC6488315AB2053BBBBF68D750B55484011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 ed2934e3a90a208d548b7ae141253859741bf2b47ca7f0c1812ca3c0caa7eaee
MD5 29cf3d3ae866f61087ecd1ccee9c2cd7
SHA1 5b7fa0176b421abba55e51ef78fdb22735def7d8
SHA512 5bdf0dd0119fbad84b929adbf231ed91410d9bfc0b00f4736374bc11c782cf844937274cef0f6cf544defa8392052ab5ca0aa3eb6c0e3569c55218796540fafd
TLSH
T12F21A7C9CD2F1EE57E71C363C08D0AA9C6583422446458F5C59D5B07298A04D168BA0A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads