Analysis
- max time kernel
137s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
25/01/2024, 17:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.miazs.org/amlaz-program
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
General
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2072 firefox.exe Token: SeDebugPrivilege 2072 firefox.exe Token: SeDebugPrivilege 2072 firefox.exe Token: SeDebugPrivilege 2072 firefox.exe Token: SeDebugPrivilege 2072 firefox.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2072 firefox.exe 2072 firefox.exe 2072 firefox.exe 2072 firefox.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2072 firefox.exe 2072 firefox.exe 2072 firefox.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2072 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2072 2096 firefox.exe 86 PID 2096 wrote to memory of 2072 2096 firefox.exe 86 PID 2096 wrote to memory of 2072 2096 firefox.exe 86 PID 2096 wrote to memory of 2072 2096 firefox.exe 86 PID 2096 wrote to memory of 2072 2096 firefox.exe 86 PID 2096 wrote to memory of 2072 2096 firefox.exe 86 PID 2096 wrote to memory of 2072 2096 firefox.exe 86 PID 2096 wrote to memory of 2072 2096 firefox.exe 86 PID 2096 wrote to memory of 2072 2096 firefox.exe 86 PID 2096 wrote to memory of 2072 2096 firefox.exe 86 PID 2096 wrote to memory of 2072 2096 firefox.exe 86 PID 2072 wrote to memory of 1472 2072 firefox.exe 88 PID 2072 wrote to memory of 1472 2072 firefox.exe 88 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 3056 2072 firefox.exe 90 PID 2072 wrote to memory of 1320 2072 firefox.exe 91 PID 2072 wrote to memory of 1320 2072 firefox.exe 91 PID 2072 wrote to memory of 1320 2072 firefox.exe 91 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.miazs.org/amlaz-program"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.miazs.org/amlaz-program2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.0.2074943375\489737542" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9018f9cf-9ac6-4d9c-814a-2c206165ffde} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 1808 29ac14dae58 gpu3⤵PID:1472
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.1.1248643722\475793648" -parentBuildID 20221007134813 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c0b73b5-adeb-4d7c-89e7-cd08758d56ea} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 2396 29ac13fa258 socket3⤵PID:3056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.2.1584756036\349054909" -childID 1 -isForBrowser -prefsHandle 3084 -prefMapHandle 3080 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21b63e63-ad6a-4f09-8445-83b95223bfeb} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 3096 29ac54bd358 tab3⤵PID:1320
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.3.1245505097\442177033" -childID 2 -isForBrowser -prefsHandle 3888 -prefMapHandle 3884 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {560361fe-71a8-4d0f-adde-7c2b0040d1c3} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 3896 29ab4c61058 tab3⤵PID:632
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.4.439306762\746931543" -childID 3 -isForBrowser -prefsHandle 4524 -prefMapHandle 4276 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76e5b95a-c5b4-4d64-a2e2-b6abed8ea732} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 4608 29ac6a50758 tab3⤵PID:1492
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.5.1701476820\2007399927" -childID 4 -isForBrowser -prefsHandle 4740 -prefMapHandle 4620 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c8cb48d-fea8-4588-a8f8-e8bb4a994755} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 4640 29ac6afba58 tab3⤵PID:4092
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.6.1768984563\1739913724" -childID 5 -isForBrowser -prefsHandle 5020 -prefMapHandle 5016 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03df261b-7da1-4272-bf13-9492d8f0b279} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 5028 29ac546a558 tab3⤵PID:1460
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.7.1055158517\894985892" -parentBuildID 20221007134813 -prefsHandle 5524 -prefMapHandle 5544 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c63a51f5-e2cc-45a5-9497-d79e8dbb79cd} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 5556 29ac7e2ed58 rdd3⤵PID:1652
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 442KB
- SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
- MD5 85430baed3398695717b0263807cf97c
- SHA1 fffbee923cea216f50fce5d54219a188a5100f41
- SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
- SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 2.0MB
- SHA256 fed42ba7d1387d0366b89d9d6a8dc57e95bff5b59f786734cd49db01623b1c08
- MD5 6017ef488afc86f0e954c7a742e8048f
- SHA1 957aaf893870ffef78d039a7b535c2824bd907d0
- SHA512 8817f593651ee7658ba0ff41d4cbf760d3c4bc5b76a3654680fd4fde06b5c572a02930bc7d4a1e50fd064c557354e68f9325d5b1368984a1885dd46cf771d895
- SSDEEP 49152:wXQ1cJvEZR7+56mfLrZqNvniDpd1c/GA5pLPXiN6csCflASdW:H1U8Z456mfLrmvnit0n7G6cvflAS8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\db\data.safe.bin
- Size 3KB
- SHA256 f773095f0eeeee92f18a7e67be2010cbeb5f02bf1b6e412096ab4dbb08d2bb2a
- MD5 17da298bc75ba83cecf282a3c0cf9d6b
- SHA1 241424034b7f2066a62446ff06d2bb5cac547cb9
- SHA512 6906784103e0b4c69117365df10164dea05c3f18e20de9d487ce84e5431e1476d7546d2d55c4a5dffec4b05996a0bbd05ce03b767b4fe6e55371c2812681637e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\db\data.safe.bin
- Size 2KB
- SHA256 d3abccebb4f14d531fa3f390c46706dde08f6a8835c1dc2b18f24c72308ac5ae
- MD5 25bd0530c5f0dbb3d82b16a57f75cea7
- SHA1 ec4d0b65d1a42b6d2719ed4d07c4a8ee6bf8e969
- SHA512 75cc344af9c4077da4274681c425784e057e8065713c3aa2578b1f971107eb5035f6958ae5968d35e7ee22cb46f55560d69f910a84e25fd765c0a02964bde780
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\ab720630-5c46-4c00-a63f-b06813d73f3a
- Size 746B
- SHA256 2ac531d0d0c7523d2af8355636ccd3d87b46ea61de086c5184acb9fdb4f0f199
- MD5 98cb3c45b0fec2dca26ef726c049f9b4
- SHA1 37c2a5edcf3ee116f79967f52b79bf60642ca9c9
- SHA512 d33e7888bc37fa7424875a8b3928089e66b02e972293cd648761afa8479ebc6087259880ecc9f97447f9663c1bdcd0925d2c9e255ed74b98bbb33207d270364a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\edd32c91-e605-4f11-a53c-42a606738edf
- Size 12KB
- SHA256 a562e445563015c8f341f2a1eea57eed3fc1dad9e5c6367e6e249f379b3f00de
- MD5 49487eebcc609ea323b40438cd48ded2
- SHA1 e05db508ada9f43d41e9a025a438ae6e831526a9
- SHA512 4c4e977b9200b1be6430824773f160d401f92739af6a83363b50663494dbad54b5f31d12d39cad682a162309e322e9986b7ce0c619ebef60f1318818d50a58d9
- SSDEEP 192:AXe8P4YGO55/4Mq/U8Kgg+6nUiAJ+s2VVjO1PU5OrAK12wu1igqxyJqs4NeUm6/s:AXe0LB20
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
- Size 997KB
- SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
- MD5 fe3355639648c417e8307c6d051e3e37
- SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
- SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
- SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
- Size 116B
- SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
- MD5 3d33cdc0b3d281e67dd52e14435dd04f
- SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
- SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
- Size 479B
- SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
- MD5 49ddb419d96dceb9069018535fb2e2fc
- SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
- SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
- Size 372B
- SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
- MD5 8be33af717bb1b67fbd61c3f4b807e9e
- SHA1 7cf17656d174d951957ff36810e874a134dd49e0
- SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
- Size 1.8MB
- SHA256 5e9879a29460687c4fb85e03461caded40283811da01ee9c108d2647e66034a5
- MD5 438ac3fa093c69ab03fa7e47f0f9c9af
- SHA1 804907149397a99180a57d4fe445b679fb2c5525
- SHA512 25fb9a3c4239a902b73d21de1358e2c6e57cdd4184be74a21f86d3c1c149c70b7347c75db93568647acad5f5e3b8ea492017a12a380b48b7a9139f6cfbb42a10
- SSDEEP 49152:5Xs+8h2DPalVFeauwvez+Wgo5xRY/+Ca1CxPkAgM5:lP4WQvez+WLvb1CKAF5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
- Size 1KB
- SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
- MD5 688bed3676d2104e7f17ae1cd2c59404
- SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
- SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
- Size 1KB
- SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
- MD5 937326fead5fd401f6cca9118bd9ade9
- SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
- SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js
- Size 6KB
- SHA256 7a5f64ef87c15cb343df65e55274628e8fd61ab32302aaf09b0b3392cb0bfbe4
- MD5 596650f3da627acf09265b0f5be35dda
- SHA1 5fca73e5e817ca41a5e573c14a9baae28a331069
- SHA512 d39ba3b8ea6750df32dcf297c345f149ff474c7b66efc12acd0fb9bb0fd5802da2059f7c4331e1da39837a920b0e8e71896e96f15c030015a05f104000886224
- SSDEEP 96:xHu5nUTeqGqKdY6eeOTzSEPXAnpjzHxva2zH4C8Bw8HVmcF:w5nIRKdY6eeKPXUxy2zHsBw8HVP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js
- Size 6KB
- SHA256 aef178356aa3e79684668e32768f2eaa365dd4b77599f3462218df8702c20dd9
- MD5 a8acdd70327773f1752d032dc3de57d7
- SHA1 475c3d7792908abfa3294f4b8b47febd0d0131f3
- SHA512 6601e5228d83b248797612b2c42d516d33d07ba8a60bd233e874d20e5a72d655b69c48ae44b9bafa9d416d453b511a75c5535872dd2a56445689c227f51027bd
- SSDEEP 96:xHQ5nUTeqGqKdY6eeOTzSEPXAnpjzHxva2zH4CfBw8HVmcF:a5nIRKdY6eeKPXUxy2zHPBw8HVP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js
- Size 7KB
- SHA256 21e653bfa43d3d1d8c7bedc37bb25aa0c00ede438a170605876a7adfecaa0b33
- MD5 b4b7d0e214d1a9462af99aa5ef2719e2
- SHA1 13ae09bc103727f09adaf29faba26a50ece33b7b
- SHA512 dbcdf1c90291a118b5229b7a925a09ed6ec302c06688adc9d5c6558058fa700e550d48ac9b3004272f29610954892d266e1a0a131b90f412e4b1acf571072a8c
- SSDEEP 96:xHQ+nUTeqGqKdY6eeOTzSEPXAnpjzHxva2zH4CzRBw8HVmcL:a+nIRKdY6eeKPXUxy2zHjRBw8HVV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4
- Size 2KB
- SHA256 1f808d22767e3746861fa15e25c46668a6562cd3decaadb99d5b9a312f079936
- MD5 5dd7eedc02a4de01e226e446d3c932a7
- SHA1 55f0dad2bfff008d666983d4c4a28d787078d59f
- SHA512 b21634a583525b2c069996091c9ce541647ac2a3f426694261cf53e2a36fe80a19311ee93bb936ee7fc13614191e635dfb2c16c550e5e0f9a31be27a6641afce
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4
- Size 2KB
- SHA256 6930d12c7b5e3d4bba3ba7fa24ec786678404d28c52fd2ff3d79a44d30663369
- MD5 b9bc41a0b8f6f282a9b2009cff8280b1
- SHA1 e1d0fe4e01b10b20a514bf84016ea0d271e44002
- SHA512 68ffe9f0f370577a757755e16afd1e2426f215e6ad4fba076adf153225174ed22a66020a508c465d99366ac3d345272abac27a2af01ac470555fe2e067f8517e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4
- Size 2KB
- SHA256 c3b0d7988f1667e6bffb46470aa639760c84c7eda3907232fc7796d119a59d7e
- MD5 a6cc04017569634461c3cb3031445ba7
- SHA1 c03725029316c3315da3e40a3afc9cd87b87487e
- SHA512 e5c7114f499499cae8f210f3aa90e15aa996a9a89150dfca44f4bfe5732682225b05092c666e1e9936b1ae395348d800f7127cf3c4ce4845db0daca933980629
- MD5 SHA1 SHA512