salatstealer | 2b9b83e660a8217dad59a2698615f9278161fbc21c2db21a0ef1946c340651a0

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_300b80499a2274756c87bdcd47d86fb6_cobalt-strike_icedid_satacom_stealc.exe
Size 4.1MB
Sample261024-v7v88sfd72
SHA256 2b9b83e660a8217dad59a2698615f9278161fbc21c2db21a0ef1946c340651a0
MD5 300b80499a2274756c87bdcd47d86fb6
SHA1 6c727cbeb27d515a81473f1b692e489e62e58d9a
SHA512 bc006d4d11a6554d6ec9cb22b51ca15a06176f59ab00a15408f676fc720c0f560b3cf135540670662224b71c4f6935d9714f57c74e6ffd4d02ee843fcf856386
SSDEEP 98304:1Ugk0TTffj8lTbq/Susd/hQbaOJI3JdZe7UntlfTnNyqh5X:1UKTD7OSdsRhIapdyUvjv
TLSH
T11D1623A669B5549BE7B58938C641BD05DE623DE367E0F6C74340ACC70B13AE85A3F320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery salatstealer persistence spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 14 IoCs

resource	yara_rule
behavioral2/memory/4088-352-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-380-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-391-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-738-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-741-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-746-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-752-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-753-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-754-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-756-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-757-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-758-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-765-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer
behavioral2/memory/4088-766-0x0000000000500000-0x0000000001155000-memory.dmp	family_salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 14 IoCs

resource	yara_rule
behavioral2/memory/4088-352-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-380-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-391-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-738-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-741-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-746-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-752-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-753-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-754-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-756-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-757-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-758-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-765-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4088-766-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 14 IoCs

resource	yara_rule
behavioral2/memory/4088-352-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-380-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-391-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-738-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-741-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-746-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-752-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-753-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-754-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-756-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-757-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-758-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-765-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4088-766-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 14 IoCs

resource	yara_rule
behavioral2/memory/4088-352-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-380-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-391-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-738-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-741-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-746-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-752-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-753-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-754-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-756-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-757-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-758-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-765-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4088-766-0x0000000000500000-0x0000000001155000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 16 IoCs

resource	yara_rule
behavioral2/files/0x0006000000016b49-13.dat	UPX
behavioral2/memory/4088-15-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-352-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-380-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-391-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-738-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-741-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-746-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-752-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-753-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-754-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-756-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-757-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-758-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-765-0x0000000000500000-0x0000000001155000-memory.dmp	UPX
behavioral2/memory/4088-766-0x0000000000500000-0x0000000001155000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

pid	Process
2436	N7LCndtf.exe
4088	P8NJ6MDJ.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000016b49-13.dat	upx
behavioral2/memory/4088-15-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-352-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-380-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-391-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-738-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-741-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-746-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-752-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-753-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-754-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-756-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-757-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-758-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-765-0x0000000000500000-0x0000000001155000-memory.dmp	upx
behavioral2/memory/4088-766-0x0000000000500000-0x0000000001155000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	P8NJ6MDJ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	P8NJ6MDJ.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P8NJ6MDJ.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF717EAA4AD94EC9558499602D48DE5FBCF03A25\Blob = 1900000001000000100000002e43cb5682e3a1756f80fc53cfbff8250f00000001000000200000007a9bc7ffecf427111c5a2e5bf589ffff1ee95fef12b3cc42764d7c907a3f6959530000000100000081000000307f3020060a6086480186f92f00060930123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c03021060b6086480186f92f00060e0130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b000000010000003e0000004900640065006e0054007200750073007400200043006f006d006d00650072006300690061006c00200052006f006f0074002000430041002000310000006200000001000000200000005d56499be4d2e08bcfcad08a3e38723d50503bde706948e42f55603019e528ae140000000100000014000000ed4419c0d3f0068beea47bbe42e72654c88e36761d000000010000001000000066908ed134572466070299553e6e2b99030000000100000014000000df717eaa4ad94ec9558499602d48de5fbcf03a252000000001000000640500003082056030820348a00302010202100a0142800000014523c844b500000002300d06092a864886f70d01010b0500304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f742043412031301e170d3134303131363138313232335a170d3334303131363138313232335a304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100a75019de3f993dd43346f16f516182b2a94f8f67895d84d953dd0c28d9d7f0ffae95437299f9b55d7c8ac142e1315074d1810d7ccd9b21ab43e2acad5e866ef3098a1f5a32bda2eb94f9e85c0aecff98d2af71b3b4539f4e87ef92bcbdec4f3230884b175e57c453c2f602978dd9622bbf241f628ddfc3b8294b49783c93608822fc99da36c8c2a2d42c540067356e73bf0258f0a4dde5b0a2267acae036a51916f5fdb7efae3f40f56d5a04fdce34ca24dc74231b5d3313125dc40125f630dd025d9fe0d547bdb4eb1ba1bb4949d89f5b02f38ae42490e4624f4fc1af8b0e7417a8d172886a7a0149ccb44679c617b1da981e0759fa75218565dd9056cefbaba5609dc49df952b08bbd87f98f2b230a23763bf733e1c900f369f94ba2e04ebc7e93398407f744707efe075ae5b1acd118ccf235e5494908ca56c93dfb0f187d8b3bc113c24d8fc94f0e37e91fa10e6adf622ecb350651792cc82538f4fa4ba7895c9cd2e30d39864a747cd55987c23f4e0c5c52f43df75282f1eaa3acfd49341a28f341883a13eee8deff991d5fbacbe81ef2b95060c031d373e5efbea0ed330b74be2020c4676cf008037a55807f464e96a7f41e3ee1f6d809e133642b63d7325e9ff9c07b0f786f97bc939af99c1290787a808715d772749c557478b1bae16e7004ba4fa0ba68c37bff31f0733d3d942ab10b410ea0fe4d88656b7933b4d70203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ed4419c0d3f0068beea47bbe42e72654c88e3676300d06092a864886f70d01010b050003820201000dae9032f6a64b7c447619611e2728cd5e54ef25bce30890f929d7ae6808e1940058ef2e2e7e53528cb65c07ea88ba998b5094d78280df61090093ad0d14e6cec1f2379478b05f9cb3a273b88f059338cd8d3eb0b8fbc0cfb1f2ec2d2d1bccecaa9ab3aa60821b2d3bc3843d578a961e9c75b8d330cd60088390d38e54f14d66c05d740340a3ee857ec21f779c06e8c1a7185d5295edc9dd259e6dfaa9eda33a34d0597bdaed50f335bfedeb144d31c760f4daf1879ce248e2c6c537fb0610fa755966314729da769a1ce982aeef9ab951f788239a6995623ce5558036d75402fff1b95dced4236fd845844a5b65ef890cdd14a720cb18a525b40df901f0a2d2f400c8748ea12a488e65db13c4e225177debbe875b17205451934a53030bec5dca33ed62fd45c72f5bdc58a08039e6fad7fe1314a6ed3d944a4274d4c3775973cd8f46be5538effae89132ea97580422de38c3ccbc6dc9333a6a0a693fa0c8ea728f8c638623bd6d3c969e95e0494caaa2b92a1b9c368178edc3e846e2265944751ed9758951cd10849d6160cb5df997224d8e98e6e37ff65bbbaecdca4a816b5e0bf351e1742be97e27a7d999494ef8a580db250f1c63628ac933676b3c1083c6addea8cd168e8df00737719ff2abfc41f5c18bec00375d09e54e80effab15c3806a51b4ae1dc382d3cdcab1f901ad54a9ceed1706ccceef457f818ba846e87	P8NJ6MDJ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF717EAA4AD94EC9558499602D48DE5FBCF03A25	P8NJ6MDJ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF717EAA4AD94EC9558499602D48DE5FBCF03A25\Blob = 0f00000001000000200000007a9bc7ffecf427111c5a2e5bf589ffff1ee95fef12b3cc42764d7c907a3f6959530000000100000081000000307f3020060a6086480186f92f00060930123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c03021060b6086480186f92f00060e0130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b000000010000003e0000004900640065006e0054007200750073007400200043006f006d006d00650072006300690061006c00200052006f006f0074002000430041002000310000006200000001000000200000005d56499be4d2e08bcfcad08a3e38723d50503bde706948e42f55603019e528ae140000000100000014000000ed4419c0d3f0068beea47bbe42e72654c88e36761d000000010000001000000066908ed134572466070299553e6e2b99030000000100000014000000df717eaa4ad94ec9558499602d48de5fbcf03a252000000001000000640500003082056030820348a00302010202100a0142800000014523c844b500000002300d06092a864886f70d01010b0500304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f742043412031301e170d3134303131363138313232335a170d3334303131363138313232335a304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100a75019de3f993dd43346f16f516182b2a94f8f67895d84d953dd0c28d9d7f0ffae95437299f9b55d7c8ac142e1315074d1810d7ccd9b21ab43e2acad5e866ef3098a1f5a32bda2eb94f9e85c0aecff98d2af71b3b4539f4e87ef92bcbdec4f3230884b175e57c453c2f602978dd9622bbf241f628ddfc3b8294b49783c93608822fc99da36c8c2a2d42c540067356e73bf0258f0a4dde5b0a2267acae036a51916f5fdb7efae3f40f56d5a04fdce34ca24dc74231b5d3313125dc40125f630dd025d9fe0d547bdb4eb1ba1bb4949d89f5b02f38ae42490e4624f4fc1af8b0e7417a8d172886a7a0149ccb44679c617b1da981e0759fa75218565dd9056cefbaba5609dc49df952b08bbd87f98f2b230a23763bf733e1c900f369f94ba2e04ebc7e93398407f744707efe075ae5b1acd118ccf235e5494908ca56c93dfb0f187d8b3bc113c24d8fc94f0e37e91fa10e6adf622ecb350651792cc82538f4fa4ba7895c9cd2e30d39864a747cd55987c23f4e0c5c52f43df75282f1eaa3acfd49341a28f341883a13eee8deff991d5fbacbe81ef2b95060c031d373e5efbea0ed330b74be2020c4676cf008037a55807f464e96a7f41e3ee1f6d809e133642b63d7325e9ff9c07b0f786f97bc939af99c1290787a808715d772749c557478b1bae16e7004ba4fa0ba68c37bff31f0733d3d942ab10b410ea0fe4d88656b7933b4d70203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ed4419c0d3f0068beea47bbe42e72654c88e3676300d06092a864886f70d01010b050003820201000dae9032f6a64b7c447619611e2728cd5e54ef25bce30890f929d7ae6808e1940058ef2e2e7e53528cb65c07ea88ba998b5094d78280df61090093ad0d14e6cec1f2379478b05f9cb3a273b88f059338cd8d3eb0b8fbc0cfb1f2ec2d2d1bccecaa9ab3aa60821b2d3bc3843d578a961e9c75b8d330cd60088390d38e54f14d66c05d740340a3ee857ec21f779c06e8c1a7185d5295edc9dd259e6dfaa9eda33a34d0597bdaed50f335bfedeb144d31c760f4daf1879ce248e2c6c537fb0610fa755966314729da769a1ce982aeef9ab951f788239a6995623ce5558036d75402fff1b95dced4236fd845844a5b65ef890cdd14a720cb18a525b40df901f0a2d2f400c8748ea12a488e65db13c4e225177debbe875b17205451934a53030bec5dca33ed62fd45c72f5bdc58a08039e6fad7fe1314a6ed3d944a4274d4c3775973cd8f46be5538effae89132ea97580422de38c3ccbc6dc9333a6a0a693fa0c8ea728f8c638623bd6d3c969e95e0494caaa2b92a1b9c368178edc3e846e2265944751ed9758951cd10849d6160cb5df997224d8e98e6e37ff65bbbaecdca4a816b5e0bf351e1742be97e27a7d999494ef8a580db250f1c63628ac933676b3c1083c6addea8cd168e8df00737719ff2abfc41f5c18bec00375d09e54e80effab15c3806a51b4ae1dc382d3cdcab1f901ad54a9ceed1706ccceef457f818ba846e87	P8NJ6MDJ.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4088	P8NJ6MDJ.exe
4088	P8NJ6MDJ.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	firefox.exe
Token: SeDebugPrivilege	900	firefox.exe
Token: SeDebugPrivilege	900	firefox.exe
Token: SeDebugPrivilege	900	firefox.exe
Token: SeDebugPrivilege	900	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
900	firefox.exe
900	firefox.exe
900	firefox.exe
900	firefox.exe
900	firefox.exe
900	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
900	firefox.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2436	4852	2026-10-22_300b80499a2274756c87bdcd47d86fb6_cobalt-strike_icedid_satacom_stealc.exe	89
PID 2436 wrote to memory of 2896	2436	N7LCndtf.exe	90
PID 2896 wrote to memory of 900	2896	firefox.exe	91
PID 2896 wrote to memory of 900	2896	firefox.exe	91
PID 900 wrote to memory of 3048	900	firefox.exe	92
PID 900 wrote to memory of 3048	900	firefox.exe	92
PID 900 wrote to memory of 3048	900	firefox.exe	92
PID 4852 wrote to memory of 4088	4852	2026-10-22_300b80499a2274756c87bdcd47d86fb6_cobalt-strike_icedid_satacom_stealc.exe	93
PID 900 wrote to memory of 4684	900	firefox.exe	94
PID 900 wrote to memory of 4684	900	firefox.exe	94
PID 900 wrote to memory of 4684	900	firefox.exe	94
PID 900 wrote to memory of 4684	900	firefox.exe	94
PID 900 wrote to memory of 2472	900	firefox.exe	95
PID 900 wrote to memory of 2472	900	firefox.exe	95
PID 900 wrote to memory of 2472	900	firefox.exe	95
PID 900 wrote to memory of 2472	900	firefox.exe	95
PID 900 wrote to memory of 2872	900	firefox.exe	96
PID 900 wrote to memory of 2872	900	firefox.exe	96
PID 900 wrote to memory of 2872	900	firefox.exe	96
PID 900 wrote to memory of 1412	900	firefox.exe	97
PID 900 wrote to memory of 1412	900	firefox.exe	97
PID 900 wrote to memory of 1412	900	firefox.exe	97
PID 900 wrote to memory of 1412	900	firefox.exe	97
PID 900 wrote to memory of 1620	900	firefox.exe	98
PID 900 wrote to memory of 1620	900	firefox.exe	98
PID 900 wrote to memory of 1620	900	firefox.exe	98
PID 900 wrote to memory of 1620	900	firefox.exe	98
PID 900 wrote to memory of 5824	900	firefox.exe	99
PID 900 wrote to memory of 5824	900	firefox.exe	99
PID 900 wrote to memory of 5824	900	firefox.exe	99
PID 900 wrote to memory of 5824	900	firefox.exe	99
PID 900 wrote to memory of 4844	900	firefox.exe	100
PID 900 wrote to memory of 4844	900	firefox.exe	100
PID 900 wrote to memory of 4844	900	firefox.exe	100
PID 900 wrote to memory of 4844	900	firefox.exe	100
PID 900 wrote to memory of 5116	900	firefox.exe	101
PID 900 wrote to memory of 5116	900	firefox.exe	101
PID 900 wrote to memory of 5116	900	firefox.exe	101
PID 900 wrote to memory of 5116	900	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-22_300b80499a2274756c87bdcd47d86fb6_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_300b80499a2274756c87bdcd47d86fb6_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\N7LCndtf.exe
  "C:\Users\Admin\AppData\Local\Temp\N7LCndtf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:900
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {34bb3547-0faa-4a96-8add-81c01cf66515} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:3048
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 27133 -prefMapHandle 2404 -prefMapSize 270279 -ipcHandle 2412 -initialChannelId {f3296c71-fc95-4d87-8f00-0df05bfc2618} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4684
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3664 -prefsLen 27274 -prefMapHandle 3668 -prefMapSize 270279 -jsInitHandle 3672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3680 -initialChannelId {034fb407-1c6f-4330-8353-305eb4266e89} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        5⤵
        Checks processor information in registry
        
        PID:2472
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3828 -prefsLen 27274 -prefMapHandle 3832 -prefMapSize 270279 -ipcHandle 3908 -initialChannelId {2fffb24b-126d-4813-9d9c-219226ce6a4e} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        5⤵
        
        PID:2872
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4280 -prefsLen 34773 -prefMapHandle 4284 -prefMapSize 270279 -jsInitHandle 4288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4292 -initialChannelId {bcaff5fc-d8d9-4792-a297-8436e20c4295} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:1412
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4924 -prefsLen 35010 -prefMapHandle 4928 -prefMapSize 270279 -ipcHandle 4932 -initialChannelId {7a8fffae-8921-4e30-bdee-e0ff2bbb5d6d} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        5⤵
        Checks processor information in registry
        
        PID:1620
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 32952 -prefMapHandle 4536 -prefMapSize 270279 -jsInitHandle 1628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5484 -initialChannelId {2288ada6-fd1c-431b-a650-4d30a5a93b60} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:5824
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5628 -prefsLen 32952 -prefMapHandle 5632 -prefMapSize 270279 -jsInitHandle 5636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5644 -initialChannelId {ae28f6de-26d1-41c6-9ba5-e45a7edb1ffb} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:4844
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5784 -prefsLen 32952 -prefMapHandle 5788 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5800 -initialChannelId {ad099f8c-b2ee-4249-98ff-452440ea2324} -parentPid 900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:5116
- C:\Users\Admin\AppData\Local\Temp\P8NJ6MDJ.exe
  "C:\Users\Admin\AppData\Local\Temp\P8NJ6MDJ.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7wx55ht6.default-release\activity-stream.contile.json
Size 4KB
SHA256 222963b1448d39428fc1cf4cf08fa3aee7deb9483e9642e975025aec818659c3
MD5 0c51cd1026be5fd3231045f5e9c761d8
SHA1 8fa98f3d0cf22e71e920effa1cf76415b5fb1016
SHA512 030d43617f85aa6e147ace6aa2600b183ae1ee6f40113f4764bfc2b3a9c2b953f46b080c9d49e9045c66c74a76dec13ffac29146dbbabcabdbcd729343ec0260
SSDEEP 48:YdbAIreDZlywWMZwpqQHioPQamqp4JyreDZ7ywN1d3QPGjy6T+jiR1QnnqbtreDu:TvaMigamPx7jT+mRmnnNyJW0Uolz
TLSH
T15F91C76F846445221A78F7E97C1B27A8F007B0059EE5DFAC716B8C11857CBEDC0DE984
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7wx55ht6.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 139bdacbf4fd3807094ebf644bf28550f0f60c573ad89d7875c173c69fc009d6
MD5 e7ec745a9406c5dbf02844853fa1784b
SHA1 f12326d704005d28e3dc54e3c623a033315fe545
SHA512 dc40a5926639b5eb61e71e1b841696acc0fe50038c43e9f079d03d335b738f9d2f7789d0f04520a26e3bce4d095d3b4db2bd33487a19deb199b932bd8902958d
SSDEEP 768:CyRh/3Ip+nbachaFymLJFrK+RPHJ6iO84JbZ9/LrPxl4uOcbFQvjV4:5Rx3Q8acGymLJZBdHcP84JPHPL7OcB
TLSH
T17B7307A397E8B1BB1B9237CB1C0FB95B26D2015AE34601CDEDEAC91CA0CD654117E5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7wx55ht6.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 72e96451813bdb4d5e6e06dabf27d508876d929dc2ef20c1042682633397f5e1
MD5 56e478e9af18a6e8b04ea72cd91130d2
SHA1 1e5f7b175c293b0b217a07099ed855280bed8ad5
SHA512 032412030b7ddad9c46aa2346fb5d93b576d498f5b8c98915c762d2bff2a3624414ee1142cdfa000ab2ecb850ce8329a59072ee13ea971b2e2fadb1dd77954eb
SSDEEP 768:CyCbcvd6l7+qRRAUnqOQEtd12oL+wqLZvP8bozQ7/tXFVCTu1e51L8oOQWafkNBr:5baVtmvHakqZISOyWTYuGDLa7Vb+
TLSH
T14C730AA3A6EDB2BF1B9037CB1C0F759B61D20145E78505CDFCEDCA1C818D698423B6A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10931

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7wx55ht6.default-release\cache2\doomed\10931
Size 256KB
SHA256 2cf852783f1c12fe037acf42604e5758cac42672f5126d668537814bc9153c7d
MD5 de359036f55bb3c40d92eb9e935fc223
SHA1 94eb364823b7d496e1a680ddf17cbdf7f0e0f8a6
SHA512 3c98afc1fbd9bd88516ed6861a8955ff9bb36b973aa4c760110c425ea7f437412b1c094fed9f25c71f602e21b8dc3d5c2cdc4acad892dbcfec6d6ba6ca1d5f25
SSDEEP 1536:BYCYPsuWeZBgXESPrzuQvkcI8npOm8ccsoltFlj9SziavTnTPugWICK8Ct92ZFZV:0TZBgXRulcRnpOGcsohuTnTPFb2Zj3l
TLSH
T1D94407F3D69C30FB075296DC6C0E72CF72AF4139DB1209DAF868C148D2C9A65107AB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15553

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7wx55ht6.default-release\cache2\doomed\15553
Size 52B
SHA256 ed87b9121c5f39d969f56c426bd98588117242f33a5992ab452f8209a2550cfe
MD5 250e7ba1922a890dff7385ab429e8929
SHA1 721533dcdecf799a078dbbef306773f4ab342533
SHA512 dc6b4c1f7c0c8042ef0d5e3af08577543ea862b98e07f2dfd1eb94562e1d44532c9958e85a43ba693428fd8725cc4f44712b8954a9e4dc24419a5efeb4d9bd33
TLSH
T14E90026942A18944D51890B11800C0B804203D505E88B623B9910B5205524D20100300
MD5 SHA1 SHA512 TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7wx55ht6.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 05d971bba0c03b0658adcedebc45fd1e789a417e5c4185bb11e320f1994c7f73
MD5 573424a3b12b289df575e76f0b572432
SHA1 e011210f73a90cd2b8db15595da1927edec871b0
SHA512 6a76aa1c82c9663e58d951ba123fee47972c37a7ca6b91eef78dc1b1c047a2a946b0929f9dc8ad53e0fcafa1ea0fd44538ee65ae09670d4c10fe69fd249a119d
SSDEEP 384:HGNQiO024YbWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAg:mDZYbWTToXJWTTogB7S/AmVAf+hRMt
TLSH
T105729E7D8F013CBC1B5790E9C8B583588D18B7ABDFB5C06D21883D09C988A6AB1F945E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7wx55ht6.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 5ce3865f1557cb64e5e4d24bbf8a488674fc074e77be4b53b1cee16f092980cb
MD5 841831e1afe2864ee0a6f416ea76b1ef
SHA1 88793e924b5c47e2a16128bdecda66825c228183
SHA512 469b832b71f849e7b7bd494b25fd5fba81d45c10e91212d676ebbd86a022a53e68c9ecde22f229943da89e96e3260bdb654f97ba0bcf2df901061875ab378ee7
SSDEEP 1536:jTrliyAmB+DzNb7xHNhv3BsFT0vx+u1B773/TJhprarYpKzmLl6hOgKwk5ezjo3A:j3lytb7xHNfWsxXfvTDKjggwU4pKPse
TLSH
T1A5B3AFF6DBA2CD3955FFD41D5A82893EFD362440B3A33019C8636710A2C6FB87679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7wx55ht6.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 a161b60e19be0a61aae63e324bcdbb5313a27f42772d4b1a3ab276b6c0e43e65
MD5 84a23c3e257e94a5aa7d0a30dec54992
SHA1 877d2265fe321ca60b98accca6404518eeb08312
SHA512 5800b62d3f5f4ffa18df9226ebdfe8eca6d8d3a1bc3764b733b0a7b5b1109d494852b18fe0f095e6c9df7ed4327d397b12d786eb6d50fd744afa86aaa1a516f3
SSDEEP 1536:XTrliyAmB+DzNb7xHNs4Xk3DKfua+Nea7c2DZMhprarYpKzmLl6hOgKwk5ezjo3U:X3lytb7xHNQKWaS0GZuKjggwU4pKPsW
TLSH
T1D8B3AFF6DBA2CE2955FFD41D5A82893EFD362414B3A33019D823631061C6FB876B9748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N7LCndtf.exe

Path C:\Users\Admin\AppData\Local\Temp\N7LCndtf.exe
Size 392KB
SHA256 8a4ab120a0c917eba0e2ee76502e4cf07eca6534cfaf5af90cb4699e283291cb
MD5 e15e3f7a30ce3cf4dcb87913d4875d3c
SHA1 5f8588cadbbf834df4c1c22e82db2debbf8ce59b
SHA512 b7aec3b34440d0ac0d8cc9ac9158da99f21fddee274c6e537353a8948d1bb72e14cad273388ce2b53ac7d3b919678d2c72d653715cb8387a41c352c1b3f971dd
SSDEEP 6144:YwdU+jQ2/y8MUnT2jiN1Z9m0E9ofJMZ5PvOXDsBRHJeqjv:Ywh3y8MU42Tm0E9of0ZmzwHJew
TLSH
T19884AF55F3D500FAE16BC1788A424516FA72BC164B60A6CF37A42E9A3F23BD05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

P8NJ6MDJ.exe

Path C:\Users\Admin\AppData\Local\Temp\P8NJ6MDJ.exe
Size 3.4MB
SHA256 db64e5edfcc151597f666859d105d341fcc4822d5bc100c5e786e4f49b5561ee
MD5 65090c3f7918a135bfc06c2db12576a5
SHA1 cc8c49cbcd779c6b1b383947de49f7f8de1210d3
SHA512 664ae5ab8666e5d20c512fc102dc97f6205c63f55896cb658e14c9bcce6a845c1baf6b4d9a9a81c13aca8602c4acaac1c437d5558ca1778be651d0c478a98042
SSDEEP 98304:kQPTC9xa4Eg6t/Lxti+BYhPguZ4+gkbRb:kQxptW914+
TLSH
T17BF533B6F9877607DA5BEAFF98C5D9370ADF7024E24883E0041E7404E866D09FF4661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40371339ad31a7e6.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms
Size 5KB
SHA256 1f43525639f39a0ab2c53f50fc9ebe230fb2e787d51e5cad0669ec5a458e98e8
MD5 5ef86800d291747fb492e724cc0fc92a
SHA1 d065cd00ddc57414d642591b3a26a1585ce2b5c0
SHA512 10ba07a6676207ed81dfd5743ef471e16f9543860cbe4a21bbeb87ac6f19d187bb19c831f4416b4a620612dc4c9e38cf86a067b799bb042e6c3a39d33702ff41
SSDEEP 48:Tnb6dmJ5UgdwnzOqb6dmJ/6BdwBOYb6dmJ/adwD7:Rw/l/P
TLSH
T15AB1CA010BFB0955F5F392723A727B069773FD01661F079ED181A2840932BA496AEFE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\addonStartup.json.lz4
Size 4KB
SHA256 50a8d1099e5d3b42be61488c6ec6e8363dc612193391cdb3bde6b2772bce1c00
MD5 2a0b0e25d2aa0ebce5c0b26fac90e725
SHA1 4bc4cda93e148628f526388d4613069aba32baf9
SHA512 de86d4dc201c8b070ddd2f1345ae7b937c5dccd291c97b9d7f7492f037c441a675731374e5b7ba9af7b7c588f0fe6898eefdcef11669972023cf1712922f8501
SSDEEP 96:NAKV4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NzE52xxhD8rGvm6ApwnHUuhN
TLSH
T10CA17DB6D541EFA5FE32C04398D97FB2EAA6AB7414A9C4D0F16B71294C64E735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 88f266683cf51f8b022103496111293d1febea7ade2ec9eea178e49adfe6c6a0
MD5 11c80adcd888a286ae2834cf9c40245e
SHA1 fd7cdb8ac5ff1692f4ab53209883c65cf1e3e0a9
SHA512 6b68b16bf530f84a56b35f67e9ab5cd64e8580c06993321f0c1904c7a191f66dba6822416a949f49ea66207c95692a17e50f614d46521a989ea63c9367f437a7
SSDEEP 192:Q1d66JoztdzgCl6mc0dcOv5zbo8ZT9yjPvl:Kd66Joz/zgC1jlbo8ZT9yj1
TLSH
T105E12F64E628863FC409427BCCA61B410F39389A9C4E7F19319CB5582D472DE7ADE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 674d24635aed4f4234e8bd2ccd73b2cc17d1ebe1ff9e83e0b2500837709ced77
MD5 143e53f311014b388f22a2e29098427c
SHA1 b5af6b3af63e2166456da3eea37f055a76e01768
SHA512 adc7969c120550cc1850aff7bd6d090a4da02fde7cb2e73eee2ecf5446f0e4d968dbef801bf8e74f682025bb759556e07b722b4ccec2fba6292aea505426067b
SSDEEP 192:6Ov5zbo77T9yjPvq1d66JoztdzgCl6mc0d:5boXT9yjEd66Joz/zgC1j
TLSH
T1ACE12F64E628863FC409027BCCA61B410F39389A9C4E7F19319CB0582D472DE7ADE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5910eef287245cd401b578b37629e0aef2a3daf79c2cafd8c9d1db80f7dabfa2
MD5 a1bdc5b343090947628f815db03359e1
SHA1 f63e470bf45ee3f024ab00b53615483b08f706e2
SHA512 4aa4e222ba37fe69d27b0d5c798c158541456002979f3a6e3fd972bcc4dc5e45f1a2439aa6ce747bf203de4fb1e81c88b49116b72cf5e80eb2cc1c64cbe25221
SSDEEP 192:Q1d66JoztdzgCl6mc0dTOv5zbo77T9yjPvl:Kd66Joz/zgC1j6boXT9yj1
TLSH
T1EDE13F64E628823FC409027BCCA61B410F39389ADC4E7F19319CB1582D472DE7ADE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3f0d4c2f7e1d02f1cd8d6de2c2b727bc613cb520c0cdff4c6ce2d0998fbe7c33
MD5 0528223f08d8733df5fcfe88a944924f
SHA1 b93da966a42bb719e2c81fbf504bb76e9d42e9f5
SHA512 342867c740619d553fb85440f213200e3bfbe8cd4fdd96294c9bbe1e986c59ce8a5e948401401967a4073c34833e0999d5217fad42b9168761b297c075ddcf1c
TLSH
T11821285C3DBD8D6A598BF6587885028E97558E0E44871C434E42DECCCDC2AE932AA42C
MD5 SHA1 SHA512 TLSH

Submit Download

0bf2bae4-14d4-4af6-9636-72bb725a1687

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\pending_pings\0bf2bae4-14d4-4af6-9636-72bb725a1687
Size 2KB
SHA256 2ea97c63b00bcb599d6e61a49506aa89d487e6f6df69dd71df82a5e4f182d06c
MD5 ef94c56493aa9b2d1a94ba00619c423f
SHA1 4184de036e0fb5d3afaca94d9e6d2062a53b8afb
SHA512 c9e0238cf45c9e8af5325f0c186240f3ff1532d39c4155f30f877b8533c293cc5945a8ec2ae8916f0c2f44a26cfc104517bd5af48b95ca07394456b50c9dd77d
TLSH
T15141535C78B88E7ACCCBF15D9482338E53208E1340C26D836D51EF0C8D87A9D736A66B
MD5 SHA1 SHA512 TLSH

Submit Download

2b23c53e-3a6f-4459-a060-e471a22c839c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\pending_pings\2b23c53e-3a6f-4459-a060-e471a22c839c
Size 235B
SHA256 a63a3bfef76f5b0d6067e24b383dc184de9317fa16e044fccc00845e72214cdc
MD5 7f1b76975a56a1ed218ff76c52fd7fd9
SHA1 8f8c92c2af92f9caa24a9213bdccfd3ecaf54293
SHA512 bb2e9865d6360d968f8746bb87e940cfd5fbb564d78e7f6edc16a3392c0b6235777bd5af1db0e12d1eafef40e6fe0edf51977b8a06ccf94349638f01edb343a7
TLSH
T101D0A7841898AB6E2D541F07B1A479D630598C3354745820D5E145F49DBE9CD4251917
MD5 SHA1 SHA512 TLSH

Submit Download

546101d6-8c0f-4d19-93d1-038e8520b9e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\pending_pings\546101d6-8c0f-4d19-93d1-038e8520b9e0
Size 16KB
SHA256 3419b80716e9ae8fcf41039013304786fc4f4c9bb882c7067807d0e7f235f7fe
MD5 55a57e03fe9a8875afa11fcf9d60cca3
SHA1 533064483855285937ae8c09833154f053d70d8c
SHA512 7c8f72f9405147d2733a091456668b38b7f923cc665e60257c35f5dfff66e3454cd346cb1058411c906efbe07aa06bd8973be8566243372663f7ba4f9e12498d
SSDEEP 192:gjqDxa7luu8FKkelg7U53Z0Irv7c6KFpJ9i1FeBwzTdjrzx5Sm/9shROAtLaW90H:gjK6hXZwdCf1l5Sm/9MROAtLaWqSgdT
TLSH
T1ED72E816286059BA8691E358D4FC7FC3E2F528CF4C419FCE9BE4BD0869DE06E102784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82306eea-679b-40e6-ba0e-c3f90d6b23ed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\pending_pings\82306eea-679b-40e6-ba0e-c3f90d6b23ed
Size 883B
SHA256 40f211062a69845737cee0ccc600228351a94406b111ef0e445c855dcdaf475a
MD5 18064475b43cab4f279d26f53af1ad06
SHA1 5dd69bc699c9b3a7f9e999d55017c59ed2271267
SHA512 8d3d39ecad22aa189d67e65e82591f5e973bd57571191af5f1b99d230b1eafb6b4a7b2329fa8e74eda8652cb9bb03043ef85dc6189597a44b739ae9e5cd67f41
TLSH
T10F110040D635F9A1DC6CD21F89653B424BE8752380CAD6043CA99E140D6B91E937BA4B
MD5 SHA1 SHA512 TLSH

Submit Download

a0651195-052c-40db-a781-ec020d35ce84

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\pending_pings\a0651195-052c-40db-a781-ec020d35ce84
Size 235B
SHA256 b01f0262d2859b2b51d584421ac47be21bf1a1c4a9b022ff5e530221acc6089a
MD5 fafd4bf19a18ab31fb660b4fffcaf094
SHA1 86f83e079455aea2255788c217d674e62175b4df
SHA512 efa67356c65379c3bd9e57d2ff6bcc60efaccbef3c38bcebcf897ffe60d85ad7137f23403b185c14328257df015f08ddfa8244e811c9877834e20b0df48a98d5
TLSH
T1FAD0978068886B7D08200F27B0A0AAD231588C3B24A4ACA4E5A101748EFAAC80151C1B
MD5 SHA1 SHA512 TLSH

Submit Download

e9ddb697-47c3-4f4f-8ba5-90b7194f3572

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\pending_pings\e9ddb697-47c3-4f4f-8ba5-90b7194f3572
Size 886B
SHA256 010bba770da6997c05752edc1779f4e4e0c58e7cfcdf7643b685adcdf6991994
MD5 667c69eafd174a172dbbffeef8301077
SHA1 6abd5a951035035988a578c96562e10f5e920f58
SHA512 0c003ef57a6250d63fa231083a608354ebb5b63e108d392715f08f70e5b6a87e0b3e88197aa3e19f6fb8d85acbed22db040829dd0f8d083c44f9b2e7f75ef72f
TLSH
T1E41140408635F5B1CC6CD25F89A13B0247F8342380C69A187DE49B280DAF91A93ABB0B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\extensions.json
Size 14KB
SHA256 638cf7289b7df91c9e667916f7ddb357b7f047ec611e9a992fb6fbb20e13deab
MD5 128cc53e3718f791579eb1ec1c72437d
SHA1 a8d390e3543341613c8217db9cddb0b39d5737cc
SHA512 f1470001b56ab071ddf9cc2a8294113336ef023049a38cc59dd61923038ce65743800914bffbd0645b5ea942651235409bf702d3fd6f4e9bbb350e80b15b4b35
SSDEEP 384:6kI4vFUmldvP8dhWj94zI96ooL4HPL4PJL4HTL4HaL4HC:9I4dRfcX24A6N4z454/4I4i
TLSH
T1FD62321545149EB8298FA78BAA367E01C37D473B60445C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\prefs.js
Size 6KB
SHA256 a5d429e82dce3fa8ee6d9391af8010cf9f13eff5811f6fc366b61256531a99ba
MD5 fbb25b3a962a81ecaf03622a6df7f5cd
SHA1 82d84e07d84a96c89c768931433f8e049cce4bc3
SHA512 39ad4ce993543ea6bce713a765cc1acd4c4b560fbb898047f59f82465bf2810fae9961469c840c596ba02caefa3a26ef83797d50fc8da4027c57759fdf1daa60
SSDEEP 96:xHLUTUwyqGqEfsZb1zS0SSlXdv9jSnbHutdBw88u8L4cnrjp:1oREfsZbFSSMurBw88P
TLSH
T11AE12F789048CB7F74B677ACAC6448316AB2013BBBBF68D750B54484050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\prefs.js
Size 6KB
SHA256 40715c8b467a064cd99c34b622c455d51f988f60291a5a44c02af08f7d3b4192
MD5 791fef2e5f8a6a31eb484c9e47268838
SHA1 6a1572802bd7643762dc013542dcb864a5a7fd4d
SHA512 0f9aefc65769cffb8eaa62c5c938875a89f5e58c2cd14281b0458648201440eef0ddfbe1c66b12b78e92dabd68e9b6526a533075d2e954b9568243dc1644f8cd
SSDEEP 96:xHLUTUwyqGqEfs18ObzS9SSlXdv9j+nbHutdBw88u8L4cnrjp:1oREfs18TSSsurBw88P
TLSH
T107E11F789448CF7F64B676ACAC6488316AB2013BBBBF68D750B544C4050CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\prefs.js
Size 7KB
SHA256 c752454a8ede81a923eee3f1a9be58eaf435c6e9462f77b0c4fc3c4314c9b867
MD5 f9259f9179b90838620acf251e2bbec5
SHA1 fb0ad52fe988512e04db7be4bbff7134f5e38170
SHA512 8cfe633c5bbab8aafde1eee3f1d65c7be20850ae7aa07cd5fdcded1db23092c768fd076853d98b1daf0c4b79f3a0ef7ab0a739abd95d8d8deaba6fc5e77f1d44
SSDEEP 96:xHLJTUwyqGqEfA18ObzS9SSlXdv9j+nbWRICytBw88B88L4cnrjp:1xREfA18TSSZRVytBw88D
TLSH
T1F1F1FD389408CF7F74B6767CAC6488315AB2013BBABF68D650B944D4055CF3845FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\prefs.js
Size 6KB
SHA256 e06a5a99f737b685bfd7eca7f73ce352cb556fdca2b90a63c9966f6f0bcaa930
MD5 20a627d5f15b76e83c52121ba13cdd9b
SHA1 07b51f52b67d48389f8675e7c73b30efe86e76c6
SHA512 7a6c65058cc0328b99cc3f0dad2a2d1d5a8f1935c6c90c59606776f1de3d14e939e0adfe10687b703746c4af440c9ab105c1b2e98a405a9703b2eba498e0b8a5
SSDEEP 96:xHLUTUwyqGqEfs181zS9SSlXdv9j+nbHutdBw88u8L4cnrjp:1oREfs188SSsurBw88P
TLSH
T1C5E10F789448CF7F64B676ACAC6488316AB2013B7BBF68D750B544C4050CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 061b7e304e0d2187ad3bdff41991756d4f0c8800074159e911d6d4dcb1ebc225
MD5 ca00b0395ef25885d3ca7b22bc3c3519
SHA1 f34a5862b6923f576a77e10a4326725619c9cae7
SHA512 1f8188d0e73f7ca678bd13999512eaa04be4274e23c19c5461c1cd53944cd617c2b61bb8cce8292c046b4cac5f1d82ac7a3739b784d19abfd80d64dd7f8b4751
TLSH
T1FC218486FFAF69B333A8830990CC2FF5A6A4A0524168A8F0995956126A98D1733DD709
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 af80d53aefefa8ab744ee6b9b57ccf33e20cd1ea6d31d5ff87f405b85e8eaa17
MD5 ab39cefaafb4f7930e5f23a24f3be91d
SHA1 385b03055b8a430507e9b3cfbea4b0d97d6c1022
SHA512 3fce3659df94b74558cde837442898d018eabb5bc5697d9e7cdce249bbe590245f4a91dd11f67259e2731deeb96bb163e886132d439769ca5e46b692d79df65d
TLSH
T10221A793ED7A0EF237F44315E0CC4FB28698203248B454F0415D4B62E9DE90E338A519
MD5 SHA1 SHA512 TLSH

Submit Download