8b70a5477fd362d9bb478fecb911a02dec1f49de21c3b7b24e70cc8643e959b3

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_699b1a611e40b93bde74433c08e05a9a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Size 381KB
Sample260913-afcbtshp2w
SHA256 8b70a5477fd362d9bb478fecb911a02dec1f49de21c3b7b24e70cc8643e959b3
MD5 699b1a611e40b93bde74433c08e05a9a
SHA1 8b242c9892d3cf5ae6f872371c3d50eb503a49ef
SHA512 c65993951066a818f74203f31d770540449e601921c272a346fba7c39afa07b4b5e8ed906c1372f6fb9d2195cd13d12c1325d1d06d2a6f4dc9eee0229609302d
SSDEEP 6144:qynDUuQsII/WOtbuHRS6aiETssOGIFXDsBRHJeq0/:RD/QsIIvUxPaiETsssFzwHJeJ
TLSH
T11984AE16F3E904F9E1AB823889424516FA72BC564760A6CF33A46F963F237D05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	firefox.exe
Token: SeDebugPrivilege	3520	firefox.exe
Token: SeDebugPrivilege	3520	firefox.exe
Token: SeDebugPrivilege	3520	firefox.exe
Token: SeDebugPrivilege	3520	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3520	firefox.exe
3520	firefox.exe
3520	firefox.exe
3520	firefox.exe
3520	firefox.exe
3520	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3520	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 4608	2824	2026-09-12_699b1a611e40b93bde74433c08e05a9a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe	87
PID 4608 wrote to memory of 3520	4608	firefox.exe	88
PID 4608 wrote to memory of 3520	4608	firefox.exe	88
PID 3520 wrote to memory of 4180	3520	firefox.exe	89
PID 3520 wrote to memory of 4180	3520	firefox.exe	89
PID 3520 wrote to memory of 4180	3520	firefox.exe	89
PID 3520 wrote to memory of 5056	3520	firefox.exe	90
PID 3520 wrote to memory of 5056	3520	firefox.exe	90
PID 3520 wrote to memory of 5056	3520	firefox.exe	90
PID 3520 wrote to memory of 5056	3520	firefox.exe	90
PID 3520 wrote to memory of 1216	3520	firefox.exe	91
PID 3520 wrote to memory of 1216	3520	firefox.exe	91
PID 3520 wrote to memory of 1216	3520	firefox.exe	91
PID 3520 wrote to memory of 1216	3520	firefox.exe	91
PID 3520 wrote to memory of 1700	3520	firefox.exe	92
PID 3520 wrote to memory of 1700	3520	firefox.exe	92
PID 3520 wrote to memory of 1700	3520	firefox.exe	92
PID 3520 wrote to memory of 1096	3520	firefox.exe	93
PID 3520 wrote to memory of 1096	3520	firefox.exe	93
PID 3520 wrote to memory of 1096	3520	firefox.exe	93
PID 3520 wrote to memory of 1096	3520	firefox.exe	93
PID 3520 wrote to memory of 4728	3520	firefox.exe	94
PID 3520 wrote to memory of 4728	3520	firefox.exe	94
PID 3520 wrote to memory of 4728	3520	firefox.exe	94
PID 3520 wrote to memory of 4728	3520	firefox.exe	94
PID 3520 wrote to memory of 5856	3520	firefox.exe	95
PID 3520 wrote to memory of 5856	3520	firefox.exe	95
PID 3520 wrote to memory of 5856	3520	firefox.exe	95
PID 3520 wrote to memory of 5856	3520	firefox.exe	95
PID 3520 wrote to memory of 5268	3520	firefox.exe	96
PID 3520 wrote to memory of 5268	3520	firefox.exe	96
PID 3520 wrote to memory of 5268	3520	firefox.exe	96
PID 3520 wrote to memory of 5268	3520	firefox.exe	96
PID 3520 wrote to memory of 4116	3520	firefox.exe	97
PID 3520 wrote to memory of 4116	3520	firefox.exe	97
PID 3520 wrote to memory of 4116	3520	firefox.exe	97
PID 3520 wrote to memory of 4116	3520	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-12_699b1a611e40b93bde74433c08e05a9a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_699b1a611e40b93bde74433c08e05a9a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1916 -prefsLen 27097 -prefMapHandle 1920 -prefMapSize 270279 -ipcHandle 2004 -initialChannelId {854192d7-ce27-490b-907c-9508f9651bd5} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4180
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2388 -prefsLen 27133 -prefMapHandle 2392 -prefMapSize 270279 -ipcHandle 2396 -initialChannelId {66aaee5b-6f46-45a5-89fb-91a892414484} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:5056
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 27274 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {ec981c3d-aecc-465c-91cf-df1be2252e4c} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27274 -prefMapHandle 3980 -prefMapSize 270279 -ipcHandle 4064 -initialChannelId {ace1e978-7cf3-4207-b4a1-dc52b0de32e4} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2988 -prefsLen 34773 -prefMapHandle 3088 -prefMapSize 270279 -jsInitHandle 2736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4440 -initialChannelId {c47d7dd1-ba6f-42f7-9f1a-0ac460a2395c} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:1096
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4964 -prefsLen 34929 -prefMapHandle 4968 -prefMapSize 270279 -ipcHandle 4980 -initialChannelId {df48b74a-c013-46bb-be5c-b6ba0c1fabb4} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4728
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {24484eca-a06d-4afa-9960-223b73893490} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 32952 -prefMapHandle 5648 -prefMapSize 270279 -jsInitHandle 5652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5660 -initialChannelId {0cbf503f-c519-43ee-b6f0-544221efaebd} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5268
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5828 -prefsLen 32952 -prefMapHandle 5832 -prefMapSize 270279 -jsInitHandle 5836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5844 -initialChannelId {24100ff1-16cf-437d-9a76-6c5caeb0c333} -parentPid 3520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 44840a88748f848906d8a9f89529dfd2a4d56600b7de5bf86e047090a87ecebe
MD5 7997101a3ad91f5acdda9726f042c80b
SHA1 df30b46a33949a761aadcd93e7a4ceda4126f06d
SHA512 0777bbdfda327a882572021512144a2c48e5abf2722d7d3791913e38ea1e918c308bf7b7e40a69090c35e4d7459c7371fd703c105351943cf6a5f76702ba1c77
SSDEEP 384:HkCjiO024YxDL84KKDL849B7SOEAd9KVRaAcP+AWRMAM:EzZYxDL8lKDL8CB7S/AmVAf+hRMT
TLSH
T1A2729E3E5F003CBC1597C0E8C5F9929A8D18B7A7CFE6806D21583D0DCA98A69B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 f2bf1ce4db55847962b7ba835b95e77f75699c56762d5f62b5a10c796d4075c3
MD5 58dfac018cc7a009b0c4712e986dc9ac
SHA1 d80655453f0a1fa1030cfc05e99beb105957bb30
SHA512 61f7acd971321fd6e97888f1ff6fe69edf135aabfbbbd1c3968de3741f21ae392df155a9e94a2b2edd225d76e2fa5ba326fbb8f344731017ea9b63af8fd46723
SSDEEP 768:WvpHKvJT9Gcm+ux/BnRsQsfGOblbCbTbeH1lBp:WvpHKvZG/Bnin
TLSH
T193D20144EB1A953FD42902BBDDA50B001F79B88998092FA73A5C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 a5442c49c7652dea6f92c2508a0d52c624253462f9e769e2e89ce1ce636f4c55
MD5 ca3365177fa617694eb0eef61ed42563
SHA1 3f661296a7049fef0b5cdafa351d5d8ec778c6a4
SHA512 e201dcf6e1da8a49e9409a9990a6d1da99beda0a677b0f37590bf45b4fc173941d518a91f31921de73676f6f6114ad013149c5ca5e495cd9810ff3868b04eb7e
SSDEEP 768:ui11lvpHKvJT9Gcm+ux/BnRsQsfGOblbCbTbe:5vpHKvZG/Bni
TLSH
T168D21284EB1E953FD42912BBDDA50B001F79B88958092FA73A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 546aa03d4de8635b7d7afcfd377d078851a4be2b15819251255ebf9e28d47015
MD5 8c120c8b80e85f22ed82ed3750f8b32d
SHA1 d21f91e76f65046258172e894b1ab5a38beb38a3
SHA512 50f378d37a818914d2499df52b8d1e7693c5e4538990d8c2290e7af95ecac28b667cde04542883664e1e5a33bfb1404ba958cbb7da044bdd2ac5e496f12c1480
TLSH
T10D21375C3AF94D3AACCBE29C7441128E93558E0605871C430D03EE8CCE9AADA326A53D
MD5 SHA1 SHA512 TLSH

Submit Download

11217800-058f-475e-99d7-adda44c77584

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\11217800-058f-475e-99d7-adda44c77584
Size 235B
SHA256 4885e2bce2bf6f8a98cee645050c4596e972323305617f14fc6e2f015563e3cd
MD5 60fd955a7970386a015d8c2b448af87e
SHA1 75d57530c532fbcb3df71bd6aa233e5ea8136657
SHA512 1282a9e8fc0b7217c2ee4afdd2df75041b7f0425c37a13579c9c6b943d6380ef3d72369be7f9b4eb5ab6d74f92f69f05509e5dadfa2f7cf0276b7cba01a1aa95
TLSH
T141D097C0188C2B5D8D204F02B0E028D230888C3710B07830D6F205B489FDAC60222C16
MD5 SHA1 SHA512 TLSH

Submit Download

1aff0069-1f91-41d8-aa8f-e8c8da666373

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\1aff0069-1f91-41d8-aa8f-e8c8da666373
Size 871B
SHA256 a7e4dc50134058b0aef7f0fe29e47eb713ae02720bf184a5ef51415b71e4e311
MD5 b4159989eb2fb3480bea35a363c1d1e3
SHA1 8b541dbaa8c7b8900d80e80811d2ee7524da0cec
SHA512 ff19f51f0e9402babc2cd702468b75b9f2ad33d60f0534a12508e64bfd21a21703c3bf66f7480e4c756d84ad311d9633cdbfc499750dd89bc4943bb631d6a433
TLSH
T18B110081962576B6CD3C930AC9A33B5687F4351380C589047DF51E180D7F91E936A70B
MD5 SHA1 SHA512 TLSH

Submit Download

78cefe92-fbf5-4382-921d-3d3db47837bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\78cefe92-fbf5-4382-921d-3d3db47837bd
Size 235B
SHA256 4c8700ae8fa19b57f8be7d5fe7c0fb297bb85cd17a64487a6f5569ccf63a0dfc
MD5 0a9b0f9798900fee8db6f1ec3af6a3f2
SHA1 820ba9e1f8764878fe23a5b3a9f64c4df829fb1c
SHA512 d7ac4aacfc406a6438755baa067a70811351b1bade5bb462d388fae97d24cd41a8e907deb7b11687ed5d2676fd272c6f1bae79374fdfe414fdf6e5cc53ba6941
TLSH
T19ED0A794249C6B5D4D255F07B0F069EB30998C3314B49850EA6145B8DEBE9C852B291A
MD5 SHA1 SHA512 TLSH

Submit Download

e2e7d011-07a5-49c5-b296-81d8dbd17b44

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\e2e7d011-07a5-49c5-b296-81d8dbd17b44
Size 886B
SHA256 c594202009f7ebe38e9fe5b0954446d0f61ff44ee93f66f80af7c78e90561497
MD5 009f1f31da94adc926bfaa78d4e20523
SHA1 f8a9500ed6cfd162fc7b9c5e047ae63a022cf9bc
SHA512 56f6396d75a76a0c77cdba0ad3a922def03aa95435747d6a8d0d47dd95caa364e8b28430058d3aef6b6af57d5ad57a41aea2b2d55dab4deaeffee6bc22e3e789
TLSH
T14A1140829628B5B288388387C9A2378747E47023C0C60A187DA15F1C0DBB91E636B30B
MD5 SHA1 SHA512 TLSH

Submit Download

fa459c03-f318-4bf6-8562-ba0ad1e29e75

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\fa459c03-f318-4bf6-8562-ba0ad1e29e75
Size 2KB
SHA256 5fac3e94021cbb6f08126439970f4048b6fdfa11159c656bf9bb6253b33fedcd
MD5 6d523bebde8bfa4a9388d5cbcc16d0d3
SHA1 14524e6ccd83bac219ef76b448cdd1028d95a959
SHA512 7d8665be764c6c3ad5bb0e5a2284836869c3b70102fc82277683ce06cb1c9ce1968a6ff0a93e8c642b0ec4dc066897e39bed91110ec6d7785595ca4f2c48998d
TLSH
T1DB41345C74B88D7A9C9AF25D98D2338E53604E0340C62C476D52EF0CCD96A9D637E52A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\extensions.json
Size 16KB
SHA256 dcee11fb5e36f326bc71f55f5ba8f69553d7003ab198446b87f05e4e97e6c5b2
MD5 880002cfd26f72f3ca103e062696edf8
SHA1 90cc0d4137ed1bf8376b4ba75e72a9efedda1fc8
SHA512 e949f2f591de0f83277d3cde25ba0652b7cd78e8b2ef0a404e9c4c10e1e6520aeb495e2fdb2c037483d8aa317d45b1b97fd4b72d54a4852c67524f1cae5303e1
SSDEEP 384:OkI4vbUmldvH8dhWI94zH96oTL4HFL4PnL4H+L4H2L4HWO4hp:hI4zRfkXF4B6I4F4T4k4c4h4X
TLSH
T16172531545049E78298FA79BAA367E02C37D473B60845C78F4DD8FC802FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\prefs-1.js
Size 8KB
SHA256 b0b775ab4103ccdbce2ed380259786071ca5a997ad2794e1ea45450888ad2cd7
MD5 e06a100a04d875488b8dd69d410d73eb
SHA1 403080e5f4270f290cb98269e3499ed591295327
SHA512 965e5e5edc4478c23e9577d71f7d43a51588d7cfb337ec15bdcf619850118e90f98aaeda9c9a07c558261650bb06c19bc7092fb5ba393961b86bb6d7a4e14973
SSDEEP 96:xHzRTUXqGq3YfF6UObzSrSSlddv9jlnT2WRaHbxYwNiouAVyBw88B9kC08L4cnCv:dnRofF6UJSSJdRmFhi7AsBw88BN2v
TLSH
T12902FE789044CB7F64B2367CAC6549715A62063BB7BF68D310BA5885051CF3842EA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\prefs.js
Size 6KB
SHA256 7e8fe00d0e18ca78b915070a8be9ee03b98cdfb89eb77eac486ae19610a6e5f1
MD5 f3b6a40c504564e6649667439ce7cf67
SHA1 8e954831af3deea50b62b2d94dffdcb2b080f6c3
SHA512 6a3c7ed26677c0181e33f106f991f8a11d0615b54d1b90033dcfca69061a3ab637df5e6864537024128e75090ae3f0e3190dee2b093551d88842d43330ce5339
SSDEEP 96:xHzUTUXqGq3YfFiA1zS9SSlddv9jFnT2HDbxYwNiouAQBw88u8L4cnCVAU:dKRofFiAISSJYDFhi7AQBw88gv
TLSH
T1B6E12F789048CB7F64B6777CAC6888715AB2013BBBBF68D750B55484051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\prefs.js
Size 6KB
SHA256 2716e3baae0ce6d5c7976146b5972d59eb1c7e7c9fbe8106694747e842b2fa96
MD5 d50b2725cb2d38b8115979119748043c
SHA1 5d2ef152a2d055faa4a02fa0237e9c2f12019cb8
SHA512 dbabb6863307f938fe2da19281d38d81990781d54edd4d55b7d396b11ac7ead275bb00e29cbdf8af68ba586ea50c1fd099c5e032ae9cf70b7f1775f150013802
SSDEEP 96:xHzUTUXqGq3YfF6U1zSrSSlddv9jlnT2HDbxYwNiouAQBw88u8L4cnCVAU:dKRofF6U6SSJYDFhi7AQBw88gv
TLSH
T167E11E7891488B7F64B6777C6C688C715AB2013BB7BF68D350B65884051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads