sheetrat | c209336b5f2488bcf4579b60322fe4dfeff3a6caec4de21ef77dac72f00bb791

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_ea6885c906ab2f05b781ff98d14ea5c6_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 998KB
Sample260930-sym56abf37
SHA256 c209336b5f2488bcf4579b60322fe4dfeff3a6caec4de21ef77dac72f00bb791
MD5 ea6885c906ab2f05b781ff98d14ea5c6
SHA1 a643cb021356b55c92bf451bc591ee4c40373f1a
SHA512 41ac675accfe4940528c2d09597dda7c67414ac1c336ff2888c8f435bfa974d490dcf26b9c7c62d0cefe1bf3f709cf5e0122946a382463d07590dde06e86c865
SSDEEP 12288:6p1W0JgkO45e7G5Yp7vRKnH8AGIa4mcZewDWNE30:O1tVc650FKcAGKmXwDWSk
TLSH
T120252A2A90546DA4CE4D12B79EFC555C116349120F22E30DBB78A3E3EF117E9BA9F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura discovery execution sheetrat packer persistence trojan

Malware Config

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x000d00000001c4fe-15.dat	family_sheetrat_v1
behavioral2/memory/5004-22-0x000001E519320000-0x000001E519364000-memory.dmp	family_sheetrat_v1

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/memory/2036-94-0x00000291A5660000-0x00000291A56D8000-memory.dmp	INDICATOR_EXE_Packed_Fody

Executes dropped EXE 1 IoCs

pid	Process
5004	GoogleUpdate.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
10	api.ipify.org
12	api.ipify.org
13	api.ipify.org

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3732	WScript.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/memory/2036-94-0x00000291A5660000-0x00000291A56D8000-memory.dmp	costura

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5788	cmd.exe
3340	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GoogleUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GoogleUpdate.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4356	schtasks.exe
3404	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	GoogleUpdate.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 5004	4688	2026-09-29_ea6885c906ab2f05b781ff98d14ea5c6_cobalt-strike_icedid_luca-stealer_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-29_ea6885c906ab2f05b781ff98d14ea5c6_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ea6885c906ab2f05b781ff98d14ea5c6_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\CEFB35C5\GoogleUpdate.exe
  C:\Users\Admin\AppData\Local\CEFB35C5\GoogleUpdate.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" 471|HScLMPsCIja2Cz1DX9dhFJhYbFxUkvo4G0Y1dm2E2dwWBM0gERpMVmdLmEMc8kS3WindowsControl472|uKmL7l1ZrhqvxfIWHh610BP4Z0Ot9PvJwuPPY2CpVxg=C:\Program Files\NtwkMonitor.exe" enable=yes & exit
    3⤵
    PID:2244
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "mprsvc" /tr "C:\Program Files\NtwkMonitor.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5788
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "mprsvc" /tr "C:\Program Files\NtwkMonitor.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4356
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "HealthCheck" /tr "C:\Windows\WUDFHST.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3340
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "HealthCheck" /tr "C:\Windows\WUDFHST.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3404
- - C:\Program Files\NtwkMonitor.exe
    "C:\Program Files\NtwkMonitor.exe"
    3⤵
    PID:2036

C:\Windows\WUDFHST.exe
C:\Windows\WUDFHST.exe
1⤵
PID:3804

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\InitializeOut.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3732

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4660
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:5436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {5a20298f-b32d-4b9b-8716-cf76b298ea4f} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2396 -prefsLen 27133 -prefMapHandle 2400 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {9943d8b0-cb15-44a5-980f-153422946af3} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27274 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {d6de4452-7bcc-4a9a-a788-e0e7459d7890} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    PID:4160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27274 -prefMapHandle 3852 -prefMapSize 270279 -ipcHandle 3840 -initialChannelId {5ada250c-33d4-47a4-8780-5813958a0036} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4432 -prefsLen 34773 -prefMapHandle 4436 -prefMapSize 270279 -jsInitHandle 4440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4444 -initialChannelId {48744309-fbec-42d7-b22b-11ae796ff41d} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4692 -prefsLen 35010 -prefMapHandle 4340 -prefMapSize 270279 -ipcHandle 4928 -initialChannelId {73354238-9e21-4e1a-8155-87e7f150f2aa} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    PID:5056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5016 -prefsLen 32900 -prefMapHandle 5116 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {69e69156-b2d9-4a12-a706-1db8698f7378} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    PID:5340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5168 -prefsLen 32900 -prefMapHandle 5172 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {4df4be0a-548e-4f6d-9d9b-d1b824c2c7bc} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    PID:5052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32979 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {99816059-f9a2-4a5c-921e-f60467b4ea08} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    PID:4644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 33071 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 6292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {c6bcb401-a2bc-4917-8a00-73209c34e0ef} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    PID:4700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1584 -prefsLen 33071 -prefMapHandle 2932 -prefMapSize 270279 -jsInitHandle 2944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2600 -initialChannelId {d41777ec-13dc-4b08-ae62-bef22c2b2dbb} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    PID:2196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 2776 -prefsLen 35198 -prefMapHandle 6496 -prefMapSize 270279 -ipcHandle 6808 -initialChannelId {4694ddda-e862-4277-8f4a-5670c89dca9c} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    PID:4876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2724 -prefsLen 33071 -prefMapHandle 2728 -prefMapSize 270279 -jsInitHandle 7428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7436 -initialChannelId {a7b6f987-80ef-4cae-b9ea-e76a4f686543} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7832 -prefsLen 33071 -prefMapHandle 7812 -prefMapSize 270279 -jsInitHandle 7816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7824 -initialChannelId {66205eb4-b5f4-47f8-b20e-b582b2487667} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7716 -prefsLen 33071 -prefMapHandle 7348 -prefMapSize 270279 -jsInitHandle 7836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7848 -initialChannelId {742c6d28-82d4-40c2-a4f6-4e160e5b308f} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    PID:2532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7352 -prefsLen 36885 -prefMapHandle 7320 -prefMapSize 270279 -jsInitHandle 5204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4968 -initialChannelId {9aa7b9ba-a4dc-412d-b7f4-81fdf472bdca} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    PID:6872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6212 -prefsLen 36885 -prefMapHandle 5812 -prefMapSize 270279 -jsInitHandle 6252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6560 -initialChannelId {229e375b-89a1-4b21-8308-dddc3e2be9fa} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    PID:4244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7376 -prefsLen 36885 -prefMapHandle 7364 -prefMapSize 270279 -jsInitHandle 8168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5316 -initialChannelId {6819637c-9b9c-434e-8d38-d46b03d9c7e0} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    PID:4752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6296 -prefsLen 40022 -prefMapHandle 5700 -prefMapSize 270279 -ipcHandle 5680 -initialChannelId {96f8a3e2-2f77-492d-a586-ea8f5a91539a} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 utility
    3⤵
    PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdate.exe

Path C:\Users\Admin\AppData\Local\CEFB35C5\GoogleUpdate.exe
Size 262KB
SHA256 8f026494ab99e1a13f2f36ae45598f55b6e2eb1a301d49e58ef7ddfae9822cd6
MD5 e4fee65332b1c03b7e62d51be0829b4e
SHA1 c59c645c4cd3e16ee06d11c4f031dbd0ad46ef4c
SHA512 2dc5d0fa3741ef8b6d17f99d4bd75fb013caa78124ce0b936ee6432a534d750e6582a9464c0ebfe20ac53d410e899bc9f1bdeb352d4ea2d099644944fb6a0a79
SSDEEP 6144:fAcLJvK3QDqfFRy34qi+9qLEupbQ4tdd8X6:fAEhK35Y3XqLEuO4tEK
TLSH
T12344AF383AE9C019F27B9F79CAD67643D63DE2736A02954A159202470F12BC1EDC397E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 e641a5a6f6d725a68a5db058fd6e83d3b2e0d9a1bbcfd751d133e13ddcc82977
MD5 2c28575840d56dc4af684aad09733e74
SHA1 d1d28dd07c98afb9b658481459fb70f09329328b
SHA512 25dc207e1885d63aa2e224dcb500b87e3bd6cc9f4cd243533d48de2ffe00bc88cece51a45a06fbdf89732f3d44d76f8b65c1960f05f59e132a3b29f126a41c10
SSDEEP 384:HalwSiO024Y8WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA3L+pS+r:6l8ZY8WTToXJWTTogB7S/AmVAf+hRM2q
TLSH
T171728E7D8F413CAC275790E8D8B943598D1CB3A7DFF5C02D26983E09C984A2A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 c29bf547ad4c3b53c1a208e57aad6a1b57c4eef165517aa2e307ae065d8c9063
MD5 17436245a4692413b2e58cac194f6226
SHA1 430adea2713cf05bb56c94aa9efdf368cbf1d998
SHA512 b3d923e2d54abc4a706089f671c5823c5bc43539356d9c6009fadfc6d5bb3cfee927cfbe9c6a33d6f415d8d65e208290645da67474595dd56d29e180e2033e84
SSDEEP 3072:j3lOQeVCKaQ+KE2KI8wNqMJ9ElA6g+A12b:ptCaQ+3ZI8Kqk2P9cE
TLSH
T15AB39FB6DBA28D7964FFC42DA792C83EF9227404F3A33009C953731466C6BB86675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.log

Path C:\Users\Admin\AppData\Local\Temp\loader.log
Size 413B
SHA256 e0c586e41a278d6e0c620926f66b3ec3ec5f9efaa73a22da857bbef83208f85e
MD5 90bab73aa67da95d79a8dcb5e3d04345
SHA1 92353ce4c001056911a957199f2b633a4296bad2
SHA512 7aecbea8faa592f3d19cd2ec95c13eef2bbc818365768e9441a479ef64e572dde68c92617d10eaa24bf17f796849af723d0b469447424e8a1ce2d1c336932b2d
TLSH
T104E02B43E480D3F50730C9FB57924ED9D57217187D2C7A2DEB48804D7005E1E35E8146
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 20KB
SHA256 0d99982b13a224c5ff77f9bddf2a8a30ad8d4e7492ccc071430db1383a4da4da
MD5 2d440547eb498047e6f58f83c6f4f132
SHA1 27146c2ef5782cd89c34621e3fce4969c6a9de2c
SHA512 db40a6b1b1b628628520166e68738d620ae2ef3d6e3b4cfd6588ed65bc8b6a5b4cf4c402eeb70854280c7471dc3b3ce73f608c836191e23623a794ca14f7d7e2
SSDEEP 96:+HBvzrLiAF/H8I56I2EIM/plSexpI61hbtGi0GjGGaGioGbG3qKJCKhZ94:y4QS
TLSH
T14B92D5F72B75F822F0928FB050A5719C9C7317295A6CA2C0CE51D0AB02957E6D0BFB78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 20KB
SHA256 ff6460f7a55790677cd827ccf13b73f3a4895451f16cb0fdfa35684028c0f94e
MD5 fcac33a4c41b6f3b6cc3ef1d681b79d8
SHA1 9cc146aeccad6b0e3d3ed623742a0733ef0effb4
SHA512 bf84d1e03fd67d445cbf5e50dbdd63e2c859ef3a639b74faf83e95018999b5a631470e78f19d0b37b40710e19abffaef3733303f71d6fa066b2457d0daaad3ae
SSDEEP 96:+HBvzrcI56I2EIM/plSexpI61hbPGi0GjGgfjfv94:BQS
TLSH
T14D92B3F76B79F822F4928FB050A9719C9C731725166C92C4CA91C0A70296BE5D0BFB78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 20KB
SHA256 3678499caac384d26657fab736ef6f72cd3f7ffaba8a12ee725aeb064fda8764
MD5 19f401c0e1b63f4e6b80b2fa1ff7b1e3
SHA1 67d361b62744c504fd8150d80e884d047b15e0ea
SHA512 2a6318358d3f2d579ce6804965e1dcfd3619ded557dd1e49e8f1812d75c437a40285f0158b6607e33da038e2e33c93e623c8cd1836b441a0bde338c19ccf2edf
SSDEEP 96:+HBvzr5bFbcI56I2EIM/plSexpI6wbabkbCb/jF4:eJMQSFmAO
TLSH
T1E29293F76BB5A822F8928FF09098749C9C731324566C91C4CB81C0A70695BE9E17EF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 20KB
SHA256 3222b64ce50b92e4380b4297754b20c55dae44a09ff75dcc9062acdf949bd8c1
MD5 bb5e492a64747cff20c81ab329b6dd41
SHA1 96acc793820f7a0bc7cf7e9eccb967f633581529
SHA512 a0acfcb7c55fd8139d1b4aab6f01b481201af93294e455b8cbcb1d54db9b4572bb96cd6e574ab6e02d41eeeb1e8e47be6a50514ecd4276bf60ee2e6558700a13
SSDEEP 96:+HBvzrBfbRbcI56I2EIM/plSexpI6nEb2bkbCb/jF4:K9MQShKAO
TLSH
T1AB9293F76BB5A822F8928FF09098749C9C731724566C91C4CB81C0A70695BE9E17EF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 20KB
SHA256 0047d133311b068a5d080b82eefe61256ddce17a1eaeb0ee06f38a7bee8874c5
MD5 72e4785fac512293cac73dce02d29e87
SHA1 f4daaebad1b55db22dd6dfd1e1b085b7f8b942ad
SHA512 61fc60700309dc75410456c2978bd53353a92e5908c3d7a81a786e7db4f119deec065c96924a44578f0307e3a0f8758e387c2141faedfa401f9365fbf5a717f6
SSDEEP 96:+HBvzrnbfbcI56I2EIM/plSexpI6qbBObkbCb/jF4:kbMQSfsAO
TLSH
T16B9293F76BB5A822F8928FF09098749C9C731324566C91C4CB81C0A70695BE9E17EF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 7KB
SHA256 30240cae9b158832bca739d5ca3e208071deda37b5197838492752a239c8fbee
MD5 df5a26d00f4bc7e61cd13111311050d1
SHA1 31c510816c881b23efb012f4dcfed3bc8badc030
SHA512 630bde90d655e8c023a603852dc7f22edb09fa84d3e7347cfacfcd6a8cb7adfe529e81fe7724ad980454f852cfaf18363826bd53a685fe5924788a0a52ac9966
SSDEEP 24:gUuhMZvUhXE9Vv0JhRMT9B2JhRY391RkVhRYh5q9F55A5EfhRcC9lswhR:6sBePGqPwXkVPcI56EfPJFP
TLSH
T1D6F160E36B76B472F0928FB09099719C9C320724166D9184CB85D0F706D6FAAD17BBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 10KB
SHA256 4ee0e21f13c4a5db8e5c0db54dcd56cbe21226a270356bdaee574bd009f90f8d
MD5 46972adfb5733bafc4d24b7bf95caf49
SHA1 bc5c84369dba7085985e5af9f6598d7d5c973cf8
SHA512 87eeb843881d4e37fa7d0081a62b903cc43ae041abdca293ee5be3044ede4dd287d0810f7f5f33b83ff1d315bc34f5c6085adfa818a5488c90adc496f3022ce7
SSDEEP 48:6sBePGqPaXYPcI56EfPJFPnM/pqVPU9MVP:XBKGOakcI56IJtnM/pqdUed
TLSH
T1C9224FE36F76A462F092CFB08099719C9C331724166CA184CA45D0B706D6FA9D17BBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 12KB
SHA256 2ad2dd92a7ca61508367469055fd477ce0d6ee17d6a1b2846419d3f77d6e37e6
MD5 49640cb37046fce927cbe0fe293f6e9e
SHA1 04ae08a6dd765fdc39fc424294983618ffb2ff6b
SHA512 b13713d2414d96e5ccf6361d866c3b23dfe695fab1a6a5cc58ee3cf63bd9f8e340997e36af10d32a135d509474ffd56390f6ebe621859dd8e64cc4b63dc8116b
SSDEEP 96:XBKGOJ7iAF/18I56IJtnM/pqdUedcuUe:AJQ
TLSH
T14742B0F36B76B462F0928FB0509971DCAC331724166DA2C4CA45D0F706D6BA6D07BBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 15KB
SHA256 d4c77d1127031ce0c77a075ebd40d351fc0e6fbc71b072b89a95203493c7115c
MD5 84bcda95be3d12a5440cbb8779221a8a
SHA1 33938f7c59311ace2ec54e0c998f9221586db4b9
SHA512 93796180e6b131cba3c921686e6d3d67e96e8fd6efc147017cb6676512ed3cfd4c4134d16c254e32aff2fc4cbd39c1516804804827591807025b6252d61747d6
SSDEEP 96:XBKGOnOiAF/K8I56IJtnM/pqdUedgOUetGi0GjGGaGioGbG3:b2Q
TLSH
T13962C5E72B75B822F0928FB050A9719C9C731724166CE2C4CB55D0E70696BE6D07FB78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 18KB
SHA256 9aa70ca4f1e35ea28987b9a668bdffd07d52574852c41346e4349a5e2fa67d08
MD5 82e557124286cd4dc97d3c2401b1ac88
SHA1 e53655c66014bf1c64a1d6e595cd142bc9ff007f
SHA512 8e1f32b0ca887c3555f019a82f5e71daafb272fdad155b86883a6598ab9484be14153b7ddde7922da914b9e506eb55681fd32b29afa2fa4b0d06e399da8a2e18
SSDEEP 96:XBKGOoiAF/M8I56IJtnM/pqdUedgOUetGi0GjGGaGioGbG3qKJCKhZ:JcQ
TLSH
T18082E8E72B75B822F0928FB050A971DC9C731728566CA2C4CE50D0EB06957E6D07FB78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 18KB
SHA256 0a28ada732d6832edd89a81140fe6d827df8c33f00c5e371b54c3171563c5049
MD5 d5ff51d9abd66477ceff72b2bad101f8
SHA1 3e809ae728cd52843d90a9527de535354bbf5a1f
SHA512 1509de636311dc7b31145ade3f8f4e6e2fd38263e26949602e89a026935a50da8ccbcd44065bec5f579b7b9a9027932e58bc18626c7a7d6fb5707b2493ec79c6
SSDEEP 96:XBKGOCiAF/e8I56IJtnM/pqdUedrzUetGi0GjGGaGioGbG3qKJCKhZ:XaQ
TLSH
T11A82E8E72B75B822F0928FB050A971DC9C731328166CA2C4CE50D0E706967E6D07FB78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 160b48279828eada3714ba91167ea4364baa0eb5903f4094e14fad078231e4b8
MD5 929058894f481e2d151e40bf6db6c373
SHA1 9367c4a7da97b326ad9e3aa4bca616ad8dfc6e5e
SHA512 965db3fde71c9982336f384a237ef11f3ce99b118379ed231419d41db4e396a59cab93187c7e64ff16031c176b8496c6041582a271fa1df807ee14d556eb2e7e
SSDEEP 192:wkuOv5zbopZ2DQyjIcOh1d66JoztdzgCl6mc0dz:wklbopZ2DQyjI/d66Joz/zgC1jd
TLSH
T1FEE12268E628867FC418027BDCA61B440F36388B985E7F1936AD740C2D572DD768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 63f0d8495fd357d8bb1635e645cff4671ad99526f0b7ca4a8e5c61df45a55757
MD5 c308dd2fc3f98a5959c14803edf037c3
SHA1 c0c9fb4564ffb9a979b7c177cb8a046ca649ef51
SHA512 49dd106dde419e45efaf525e467d340056e1490769ada6b058433b67560cf976b2ce3bd01671c6ac1a65cef3b1d4c7182adb5106d5ab0af9202f466d44d8c5f5
SSDEEP 192:N1d66JoztdzgCl6mc0dxkuOv5zbo8b2DQyjIcO+:rd66Joz/zgC1j7klbo8b2DQyjIe
TLSH
T1EAD11068E628863FC418427BCCA61B050F36358B985E7F1936ED640C2D572DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\events\events
Size 1KB
SHA256 43b5fbb21d7231a8a6bce2d5d9da2c34eda012b346d25604ff6d40943323fc76
MD5 971184310a79814166d01a2287df0972
SHA1 2e74dbc55dae83ec3a29a6047e879b874f31d9f2
SHA512 b45ad21676a00486f72b8469b0b81c038ba3a5c2eeacd35aa241493baf32099bc38cdc903d6ee93e9451738ca45e07b69c8e013c39a923f9af9202ae4876b5c5
TLSH
T1A611AA4C7AB98D2AADC7E69CB48102CD93514B0F16871C431D52DF8CCE80ADA72BE83D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\events\events
Size 5KB
SHA256 db626b26aa29a7fc76b8126b62952be2dbecbc8fd53e408053d80d754a57b450
MD5 a01932250e31b989716493d2e4235a74
SHA1 7aaf5896184b216a14321ab2c8a7f4950a0e681d
SHA512 20096915a6ed7655f58fde6c5cb285acd251364bd5efc982786ad65ef329108ced9bc443cc91335285e7e1f9c6a3f37fedd6b78cb8a34179a203ed8141c4bde1
SSDEEP 96:fVI9sC+8zIhzN34BktNd8d5wMCisViJRT:fCVlzszN1T25SiciJRT
TLSH
T1FDB12E1D66B98CBE2CC7D69CB88142CD43CD4703A1C61D871CDBDE49CC8AA8A71AF539
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07c22b3a-c009-4b3b-ab42-fe698041aad6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\07c22b3a-c009-4b3b-ab42-fe698041aad6
Size 235B
SHA256 0519c94bc4fe64b995fabc3db0feec38469f7f5e8f26d6ccd0d96f592b86d12d
MD5 38e0e3f77d36361a96a86848ba1e01e1
SHA1 ec6a9257e79241489d783408c9b9f3fda281292d
SHA512 475e4a7214325dec18e8b1a7f094718791836e4f1e59248d92ebc51df4823fefa06a53fe21d2796a5a16ae9b16be197239953badd1b692fe93418bf483200b51
TLSH
T160D0A7E868A8676D09150F26F0F0AAE771898C3714BCA8109591497C9ABDDC942A5C56
MD5 SHA1 SHA512 TLSH

Submit Download

51c9f22d-6529-402c-8808-7ab7b0363298

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\51c9f22d-6529-402c-8808-7ab7b0363298
Size 16KB
SHA256 4f0df7520966381b13a22f9ad73254778cab8456ee124451ca54ca87d0c7be79
MD5 b0cf51d1d14241ccb732f646e47b0cad
SHA1 409460269140c437eab3bd3bfa9ec16578a00c3f
SHA512 45227968e54478bd90902aaf61dd4ea7af64f93c837527b85fd54b43ae8198d390b2dc532ab26054945604d0832a7818034f3aa1e4c088b02e21883ab902c622
SSDEEP 192:zy0Kln187uTy5oWx4GS+byNcOLbNoBHTckIUegawvUSozx7tD0uRaC4tf21CiBWy:ztKln1MW+Giv3dol7tDbRaC4KguZx
TLSH
T1D172D95A686055BB8251E758D4FCBFC3E1F528CF4C419FCA9BE4BD082DDA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

551ed509-73bf-49e0-b1a1-a315aae5d9e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\551ed509-73bf-49e0-b1a1-a315aae5d9e2
Size 883B
SHA256 5e91700b6e39363f06e5ab8b5b6c59904c6c0fcba60fb8af02238a8b2a50c29a
MD5 fa74c3e6734ae981c485c1dca4725459
SHA1 bcaaefe721fb55171a108535e24008062c1cb6de
SHA512 a865d2b4619f0e977faa4f58eb9c67088702a1e8db536b23d0ceec255d88e5f84768e9b0ff681ee3a4196190b034a8e442dba8bc7cd747d7e6ad8312310bd197
TLSH
T11F114044A330B5B2CC3C924B8896370A57E4751380CED2103FB48A0809BE51DA3A220B
MD5 SHA1 SHA512 TLSH

Submit Download

86fad8c2-93af-4c49-b208-df2fab3e412d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\86fad8c2-93af-4c49-b208-df2fab3e412d
Size 2KB
SHA256 4f93fda7ac31db68edcd71780057f61102bf89a1d464b94c9dd409f1745fb600
MD5 3e5f95e5d5f554b874e52ccb74bbbe15
SHA1 8afb3103013a09695f89d4eddd871b5a3061ac17
SHA512 f95a182d10e4cd0c06ca08df79d91efd7ea0274057fcf1f1ed77edb4a21fd2187c18019d4e3f79c97cfc7df32557f3ed86a89c3c12c7474cb4ec35ac4bed1d1f
TLSH
T17141431C76F88D764CCBE24D94C2334E67B54A4340C658436E51DF0CCDA679D336A42A
MD5 SHA1 SHA512 TLSH

Submit Download

f54957e7-cbcc-4fb3-818f-5b65a6c6a2ca

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\f54957e7-cbcc-4fb3-818f-5b65a6c6a2ca
Size 235B
SHA256 f5c4997422175fbce9d3ed67c1411c8d348a61b4246ac7dc351da6cf98c1e02e
MD5 fd679d608e92aded2be325b9b9675e3f
SHA1 7fc4e0852da8a84777aa938e9c0def2828168cda
SHA512 082489f0e4a506380462e34efbf60b38bb7f7b533e28d1600f17fb851b7fd75d3a911504b988a765b3b7ab1d8077d761ad2830b29b9d3e07c32a05c8a31bdfac
TLSH
T16CD0978424986BAD9C000F12B0E2ACC231548C3328FA5820EAE280B4CABDDC55262C06
MD5 SHA1 SHA512 TLSH

Submit Download

f93d376e-6b44-4ecb-a523-84ecac942a41

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\f93d376e-6b44-4ecb-a523-84ecac942a41
Size 886B
SHA256 2e739948c59e283c5c2fe97c9f2aa0de5e43a66d23390a507cb62cd4f79ece4f
MD5 bfa79129d10969c7894fcc3b2b265b1f
SHA1 8a9541765c07e6121627603694200780be6802bc
SHA512 1be59742ca7743ee3e3b5d14e24bd998142244060694f3f65d6575dec380d315f6c933312f8cbc47966633913f597b784647db6d66903709241562624892b53b
TLSH
T1DD1100909734B5B2CC7C928B94A6770647E4B51380CE9B143FA49A180DBA11EA76620B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\extensions.json
Size 16KB
SHA256 313187c5869cc543545245d946f58ff870059572ec4555cb84b46fd57773c398
MD5 60a987a8e4703cff324a6429735a5b8b
SHA1 f327ffdbf0fd9e8891569d03be6f3ba42c5d0ab1
SHA512 7f0335fc9a79ebd5ad6c6f9f3f507c072a69d383fa36c7bf04d19024e9d85577ea1b64fd357ce4db1d55abd45fc8fb067af47647726995936d1b014a4b7ff3f3
SSDEEP 384:hkI4vkUmldvc8dhW+94zCN96oyL4HzL4PyL4HozaL4H3VL4HpUS4h1:SI4cRflXj4G6b4f444f4l4B4f
TLSH
T10372421545048EB8294EA79AAA367D01C37D473B70845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
Size 8KB
SHA256 3c4cbb943115f016ac312e50f9bd2585dc102e9283ea4da8e3524a75ebb6b41d
MD5 79b470ea201bffde098c7d240bbee170
SHA1 7b67aad0c2a8c6a60b5ec185aa7217af5e879e17
SHA512 bd6cf1dd600f0e1f3a21d44144d7e81f9e9b00059077dcccacb0da2eaa0c761f08b975231bfb5a3951b6647c81ccdcfcfd5def3753a6bb6b2ed92c934e5fe5be
SSDEEP 96:xH4NTUbqGq6foT3NbzSOc7SSl4dv9j+nXH/+FQBw889sE8L4cnYQOSGS:ujR6foT3Dc7SSj/BBw886u8
TLSH
T17A0210385504CF7F68B676ACAC6449716AA2013BBBBF68D650BA84C4015CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
Size 7KB
SHA256 02f856c3b6f44971ac8d9a9d5ffb0cfa9ca33ab4023cc3000528f83b6e907d0f
MD5 8d946a09dc084a2b10596d1ce28ae1c1
SHA1 1cb37750f6f308e91343505cc1ea866e37c1f196
SHA512 2f8f585061051845a8e38e29dcb05a8d71a3b1c191114dd4a0873c5603f303e0ca28811265aecbef35631e61bebb74160b2d4419e8290049a810ce5c654fc82f
SSDEEP 96:xH4UTUbqGq6fUT3NbzSOc7SSl4dv9j+nXH/+FFBw88u8L4cnYQOSGS:umR6fUT3Dc7SSj/4Bw88A8
TLSH
T167E1317895188B7F78B6776CAC6888316AB2013B7BBF68D750B544C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
Size 6KB
SHA256 b4def369bd22cf62b887173842417bc9ce89e48d79b256ca3a7131b3bf2bbdd6
MD5 db0102e8b554948bbf027528a6096f01
SHA1 d7f0623be8285ea2388bd4e182ebf066c5588d0e
SHA512 c08a15a1f40e86c6e9ad72e29771de308aaf8eb7cf1ce1f7fc965bbc95b9e6d394c35433c463b8fe23a18bef0a1f9fd9085c7f6be93bb90967f02dcac03abf4c
SSDEEP 96:xH4UTUbqGq6fUT3kzSOc7SSl4dv9j+nXH/+FFBw88u8L4cnYQOSGS:umR6fUT3cc7SSj/4Bw88A8
TLSH
T198E141789008CB7F78B677ACAC6888316AB2013B7BBF68D750B54484015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
Size 6KB
SHA256 511ca98f3df03fc8fc5d77c9251096e2735e2bd89f4b139616810aa47b49fa6f
MD5 bd9e4d9bedfe9d0fe043f942c3020e25
SHA1 e7f5e477ea077770df2cf35663cf8320579b5c4a
SHA512 83d799e915702ebed1ad96cba71d022f3b71433a8642af3ab5b941d3ad3524f07f2ff1158d0d0698005f7401722aa29bffc985cf242312841d4d910f6084040d
SSDEEP 96:xH4UTUbqGq6fUT31zSOc7SSl4dv9j+nXH/+FFBw88u8L4cnYQOSGS:umR6fUT33c7SSj/4Bw88A8
TLSH
T124E130789418CB7F78B677ACAC6888316AB2013B7BBF68D750B55484015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 6KB
SHA256 6d4659bb6b7d472473823a689a957623e9255aeddaa7c2f9447cbe08c9e6ebc9
MD5 7c412df7a389bd8d16b1f8e892ec43b8
SHA1 1f10bb7d31e566745a624296bda08d908c7310b2
SHA512 c529adb7ca90fe3828b330845eedc9cdda0b91b2db166053dfb96514ad35d0e019866721c35d016a12c3d978a620fa524c3a3c75a01f872f832f8b25d224ec69
SSDEEP 96:xH4UTUbqGq6fUgC1zS+OSSl4dv9jMnXH/+FFBw88u8L4cnYQO7:umR6fUgCnOSSN/4Bw88A7
TLSH
T105E1407890488B7F74B677ACAC6888316AB2017BBBBF68D750B554C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 5dd1804042cdd627d03d28fe5093d9add47f072df3d3e99f175043c21c8ac06d
MD5 c2490de4c749cb95fa6eb36c30bfe207
SHA1 275b7c14e7c225794d8310133cdfe7eec3c5cf46
SHA512 ac1fc3787e4f93601cdef3f72384afa04d61ea28acfe52cafda0c61b1329b03d0cc7c2ac2ff4a5228e8084ca4877c9c9c4e080176a4b3bcc96a4e3927ebd0720
SSDEEP 96:M2K9tjsr9JyAH5lmCtCazZxe4kNMhv4K4qqLAg8aFCqo:MXS98W1zre45hAK4q9g846
TLSH
T1DDA18E063F54BCF00A2BF9D0C5CA1FA607F1608A8DF50ECC5904A52B809C9D83FB9259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 49bb9611ee554639ec3f56b6cf60c9eddf373d3a62873d98fdfdf4b59e8a3d07
MD5 00fbc386a66ecbf66ca0bfa6c5455a92
SHA1 21e278a35f763b95ebc57a3379d6aa0711bfe7bf
SHA512 db95e6cf166b308ce0fe8b74f53477d78024e1d4cd274866777f7112c6f864b591459c06cf87935fafb55badbeeae34ba03de39a4e81b848d4cdf0521a8b08ce
TLSH
T17621D802FEBB1CF16A1AA21DA0C14F97E76420A5818CE4F0C8C8A941089C9887BFA55D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 6f568a6fd9c94c1068c79c9bca021b83a21dacf7cf0b94e869ce145040d40807
MD5 10f3c5a3f176e712bb49699a5b90b6f1
SHA1 66cda4c061406145099cb0ceb7b0f4354d6bb2f4
SHA512 f5c2a955f5d6a3c6b8b93e41e13ea47e1974e0db074a5f0af00b72a290ad8178c6abe2e36b71bf4d49bd5b6e30800b7eb135a4003af839f0a591d0eb42093862
SSDEEP 96:Q2K9tjsr9JyAH5lmCtCazZxe4kNMhvYSBOqLAg9KQn8CQ:QXS98W1zre45hgSBO9gwV
TLSH
T1D5A17E027F14B8B14A6BF9E0C5C61FE647B060CACDF90ECC5904A52A80ACDD93F79259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 e63970590171dcfd5c197bce07a71eba3130cf5c6cf235f5aa381c7c864ff16b
MD5 2a482fcac595f1707a03fe4ae8daa1bc
SHA1 802f31e548caad4ecf7b2a9efe92ad8f439ce2a5
SHA512 60216133fb0ccb90552fe2464ef2380ccf010202fc5f3da8f7265c3413af66b6a1a47babfc9d32b25fcee3ab2870819e128715d678f1d8c48d9a301f7f34604a
SSDEEP 96:M2K9tjsr9JyAH5lmCtCazZxe4kNMhvFK4qqLAg8aMCqo:MXS98W1zre45hdK4q9g8v6
TLSH
T1C0A18E063F54B8F00A2BE9E0C5C61FA617F1608A8DF50ECC5504A52B809C9D83FB8259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 280930458d10e1d0bd4805ffa19f48059edea2e11b6c90ddcc6fb395116fdea0
MD5 1b5014ab4f48cb3c125b08e0596d1a66
SHA1 a649925d2ef14595303dc1de0cd2fa01fbfdaeb2
SHA512 7c0e232e2939fe24132a0132a3eda8fc866da709c778a2c2ace1a104391411ef274915c5672109a20b4eb70797108558e019fe2582d92c876de15e2003b52c7d
SSDEEP 96:Q2K9tjsr9JyAH5lmCtCazZxe4kNMhvmVaqLAg9KQniCADl:QXS98W1zre45h+Va9gwH
TLSH
T149A18F057F14B8B0466BE5E4C5C51FE607B030CAC9F50FC85914A51AC0ACDE97FB9248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.4MB
SHA256 be7f9e797c4352a2145e7d84d16d4eb2b2d854a5c511aef31a9ffeab4e3378a7
MD5 e27f3d61be0b21a6f35b199f8ed5d537
SHA1 9cfede85e4e4bebb2c4f6546fbbdcae0191f421a
SHA512 52c580a921cedf5db784874a786f4261a483806c4fb64adfd9c050f9a8f9a889ceb99a3b31d6c84a13a60d3062d519960f7370d4e6a7e7167f6589d4e42c7a45
SSDEEP 49152:LeCBWkSKV265OgD2D3/YEjmd4k7JPU+QPoDa5vpz0evpQAWS++qbNmXJoCGVgzUo:M+3figpZ6y6mN+n
TLSH
T1E2765CE420E19253F38640B3719993FB21EFC01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.4MB
SHA256 fe5f8182c730c594e940fd153f2ffef27129da253c189990cb87861913bfd1b2
MD5 e1e5c113813345557d3c681194c6e57c
SHA1 ded510eaf6d1845feb3b7fb877bc08c446409a98
SHA512 011d25199bab355b985a872b11d9ab45be69192d4a6e2e20c6a5973c52a91f9e8b45fcc136280327492b7f69707e1b575209c182ccbb926c691da20107d161ee
SSDEEP 49152:i9yWktn/X1YeNy2D3/YSqjmd4lNPU+QPoVa5vpz0eXBQAWS++q1NmXJoCGVgzUf:1k3figpZ6y6mN+n
TLSH
T163765CE420E19253F38640B3719993FB21EFC01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.1MB
SHA256 0c910dd68203f7bd8377d18656729cf2611d0ca4a9d86a1a16c1652ca35562d8
MD5 807232d2efaf14882ca34f06edde65c6
SHA1 d7e13ae5ebe194d817bf746e28590e4682cb7b8d
SHA512 d9a0a954a5a61b81124e83929da87583abdc369968acff65ed9fbd396a80334b038968385c68b414942cda2cf03f5f4b37152c50da539081cc12f0c0cc97ab1d
SSDEEP 24576:/WEHr7hwZ1QZj7BEY5OI293BwQA+POFbK/1gMnyP+xmD57d5soYViQA2:/WCWkPaY3qOpgRxmD573soYViQr
TLSH
T1154629F820D1A257F3414033764593EF21EFD00C6027DA085BA95AE9A5B8CEF9E16B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2036-94-0x00000291A5660000-0x00000291A56D8000-memory.dmp

Download

memory/2036-95-0x00000291A54F0000-0x00000291A553C000-memory.dmp

Download

memory/2036-96-0x00000291BF130000-0x00000291BF15A000-memory.dmp

Download

memory/2036-97-0x00000291BF160000-0x00000291BF1AA000-memory.dmp

Download

memory/5004-68-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-25-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-30-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-29-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-32-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-28-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-27-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-26-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-33-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-31-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-34-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-24-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-22-0x000001E519320000-0x000001E519364000-memory.dmp

Download

memory/5004-50-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-23-0x00007FFA1614F000-0x00007FFA16150000-memory.dmp

Download

memory/5004-88-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

memory/5004-93-0x00007FFA15FC0000-0x00007FFA16964000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads