kinsing | hxxps://forms[.]gle/3UBZQhSbDJUsDd8MA

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://forms.gle/3UBZQhSbDJUsDd8MA
Sample240125-weabqscag2

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4208	firefox.exe
Token: SeDebugPrivilege	4208	firefox.exe
Token: SeDebugPrivilege	4208	firefox.exe
Token: SeDebugPrivilege	4208	firefox.exe
Token: SeDebugPrivilege	4208	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4208	firefox.exe
4208	firefox.exe
4208	firefox.exe
4208	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4208	firefox.exe
4208	firefox.exe
4208	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4208	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 4208	1568	firefox.exe	85
PID 1568 wrote to memory of 4208	1568	firefox.exe	85
PID 1568 wrote to memory of 4208	1568	firefox.exe	85
PID 1568 wrote to memory of 4208	1568	firefox.exe	85
PID 1568 wrote to memory of 4208	1568	firefox.exe	85
PID 1568 wrote to memory of 4208	1568	firefox.exe	85
PID 1568 wrote to memory of 4208	1568	firefox.exe	85
PID 1568 wrote to memory of 4208	1568	firefox.exe	85
PID 1568 wrote to memory of 4208	1568	firefox.exe	85
PID 1568 wrote to memory of 4208	1568	firefox.exe	85
PID 1568 wrote to memory of 4208	1568	firefox.exe	85
PID 4208 wrote to memory of 1492	4208	firefox.exe	86
PID 4208 wrote to memory of 1492	4208	firefox.exe	86
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 5012	4208	firefox.exe	87
PID 4208 wrote to memory of 2412	4208	firefox.exe	88
PID 4208 wrote to memory of 2412	4208	firefox.exe	88
PID 4208 wrote to memory of 2412	4208	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://forms.gle/3UBZQhSbDJUsDd8MA"
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://forms.gle/3UBZQhSbDJUsDd8MA
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4208.0.605499704\1864882776" -parentBuildID 20221007134813 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d96aa63-bad7-4030-b5a6-d28d29f6bec8} 4208 "\\.\pipe\gecko-crash-server-pipe.4208" 1944 279d39d6058 gpu
    3⤵
    PID:1492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4208.1.1146238273\239372074" -parentBuildID 20221007134813 -prefsHandle 2360 -prefMapHandle 2348 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6a33881-fda2-4f5f-b429-57b84808a1f6} 4208 "\\.\pipe\gecko-crash-server-pipe.4208" 2372 279d38fa858 socket
    3⤵
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4208.2.427376932\834023308" -childID 1 -isForBrowser -prefsHandle 3132 -prefMapHandle 3128 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96830419-7b67-4c03-a60c-ece6a28ea342} 4208 "\\.\pipe\gecko-crash-server-pipe.4208" 3144 279d7bd5a58 tab
    3⤵
    PID:2412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4208.3.910986947\263556722" -childID 2 -isForBrowser -prefsHandle 3628 -prefMapHandle 3624 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2abdd748-cae4-4b6e-8ac1-49b9c316c87a} 4208 "\\.\pipe\gecko-crash-server-pipe.4208" 3640 279d8c63258 tab
    3⤵
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4208.5.868763921\989184684" -childID 4 -isForBrowser -prefsHandle 5028 -prefMapHandle 5032 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89aeb2e5-772c-4fca-976a-f68834a7d8f5} 4208 "\\.\pipe\gecko-crash-server-pipe.4208" 5020 279d9937e58 tab
    3⤵
    PID:1868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4208.6.607777501\787813480" -childID 5 -isForBrowser -prefsHandle 5232 -prefMapHandle 5236 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0046b186-e7ec-4a95-bb75-0a76bd5df34f} 4208 "\\.\pipe\gecko-crash-server-pipe.4208" 5220 279d9938a58 tab
    3⤵
    PID:3312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4208.4.1915449950\517081510" -childID 3 -isForBrowser -prefsHandle 4896 -prefMapHandle 2892 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {188b8210-7ea2-4744-a4c5-716624ea72a8} 4208 "\\.\pipe\gecko-crash-server-pipe.4208" 4916 279d9a26e58 tab
    3⤵
    PID:3972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4208.7.755496569\2075984499" -childID 6 -isForBrowser -prefsHandle 3204 -prefMapHandle 3240 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c0b707b-3912-4a3c-a2c7-b0eb04bee8a1} 4208 "\\.\pipe\gecko-crash-server-pipe.4208" 5564 279dad7b958 tab
    3⤵
    PID:3984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4208.8.927068816\640890550" -childID 7 -isForBrowser -prefsHandle 5688 -prefMapHandle 5812 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89b1a549-14e3-4e40-8ecc-f82d335a8b5a} 4208 "\\.\pipe\gecko-crash-server-pipe.4208" 5840 279db524e58 tab
    3⤵
    PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 2.5MB
SHA256 1f71554a97f0e9d411917439e5a2cb2d966596e2ff1315e87610f1d11267502a
MD5 fa3a04c767056033fd3cc050f06ecce3
SHA1 37fb9aa9a2c99270bce2f339202af4d791eb99b2
SHA512 c49dd358082bce4b030cc16565d140c3f7aa58c2bd5e9b647a35b78dad975ed507965bcde640b4a2f823e4a638ba62ac04bd6d32de73cf810e59d8f39c61b968
SSDEEP 49152:wXQ1cJvEZR7+56mfLrZqNvniDpd1c/GA5pLPXiN6csCflASd/votRVH0LA:H1U8Z456mfLrmvnit0n7G6cvflASpot7
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 86434115654bf0c95d51cd690d3da04a90654dc79c32d9b75eafa5ff2e0700f5
MD5 b0b38c3a20993fe2698ef9b08d58a8ee
SHA1 d9d0efcd358c0337bb7ec6ca00ac0759ba4cd0a5
SHA512 d59f1e157e31b2e6507fbaa6fe6cc7f017609887b319151782dfe4e271a01b2add12927a6b87c98b21d5356e50abf27b4b3ff947583bfdc16a1e4580dc0b1b6f
MD5 SHA1 SHA512

Submit Download

2001766c-b126-43f1-98e1-2b5bed5a0ab0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\datareporting\glean\pending_pings\2001766c-b126-43f1-98e1-2b5bed5a0ab0
Size 746B
SHA256 735d0a7a58881cf15cbfdb5b934d447ceaa4b0fc152117ee5ee625de11964aee
MD5 a3e153eb5d82457d75a7b75e5a6c05a3
SHA1 364413b985433f892a647d3cd7046bfb89d89832
SHA512 80562affec3650cc2a986c91db7dd66bbe911a686d6ec86631afeb0b0e0bc95e28e561bddd4debf92e648ed00bea528729d27f05a31129abbb12c91057adc96e
MD5 SHA1 SHA512

Submit Download

2855f2b1-b1fa-43fd-845c-bdf34e5f3408

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\datareporting\glean\pending_pings\2855f2b1-b1fa-43fd-845c-bdf34e5f3408
Size 11KB
SHA256 37d6180b149c20106bfd459f262f085117993ee4620b732187f0f7896443704b
MD5 8462507deb7e1093513375d72bd6c11e
SHA1 9e7f72079253f08d93b0740efc096ae6025a5a51
SHA512 8ec548cdfe97b8824c82287b510da118965cd5440f9bf0b6d4c11f6ad44304ca6a45a6beb814e93a271ab8c61df6908ab9eefcf44a11da2f48a7f5701e5b4a79
SSDEEP 192:GqwMfgEYqv40jtAwleogierY8fJJRBp5Q/xg7cn+/nDN/oTvbxNMbU+eIbDbFN2S:4FDmS
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 2.1MB
SHA256 50d54077b16057801ea62f0b2c2634569bb73a151d4ec52838dd8de7c280f0d9
MD5 4e11a8c521739b55a3192f4e9177fb77
SHA1 c97b6cb75058b053d06dce54e6a5d9479fd9542e
SHA512 5e27366e79ecea9eeb0b9212b44cfd4ccbf0a79a1899de51ba23763cc75fd3ca4b0eb38701fca17095be9faf9c08333a5e9891207325127e9161532ac3074a64
SSDEEP 49152:5Xs+8h2DPalVFeauwvez+Wgo5xRY/+Ca1CxPkAgMwBkM:lP4WQvez+WLvb1CKAFwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\prefs-1.js
Size 6KB
SHA256 444ea6e085ae40ed691e58e43a48f9221154505ed1c4ae7868edeea71c6fd053
MD5 9d509bb0319c417aedcee147eca72f86
SHA1 7c836c2fd3e52c90377c757d0f3c92a9a7ec74c3
SHA512 4fa927df5999c72f09e7782aba67b118e50fee76b229d2bad53533e9f76836c9a256bddbfc8aa9bcf0a88d09f91a0e4dd8338ce36163b3141dfeaf0f13f939a2
SSDEEP 96:xHnQ5nUTeqGqBd7kxeOTzSrPXAnpjGHUTZfMBw8Hdc:dQ5nIRBd7kxeRPX7aEBw8HG
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\prefs-1.js
Size 7KB
SHA256 3406c3744b0042a12136eca47a689f00ddb41ef942a3da50834f00457dff0c41
MD5 b4ae0f31a966eced61de322889652d92
SHA1 4f49d38f89c5020293996eaf650755ae9810e5a7
SHA512 73b27734f28a4b696bfba051c467645f2a221d854e6dbf72a9ae9be1a53d96fa6ff3308934738b223110654a4e460b614d44b8a1fe65768f2524118a42cfa8af
SSDEEP 96:xHnQJ5nUTeqGqBd7kxeOTzSrPXAnpjGHUTZfhRBw8Hdm:dQJ5nIRBd7kxeRPX7a5RBw8HY
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\prefs-1.js
Size 6KB
SHA256 6cf70d03505cd6b76391eed9a16e6ad2d07f33f660109386fd47132062551689
MD5 cba3adc1f80b16771036882308be8d70
SHA1 77b7c4e5f46f190582b9fe371cb91698bd967057
SHA512 dc5b5662cc4ae76625a5b6afd3e033179eba0ec158995d461901340c650b73ac63bd1e4ebf5b92b9c04105c91b9d76dbff928e1e375975fdc07335ffdf578655
SSDEEP 96:xHdQ5nUTeqGqBd7kxeOTzSrPXAnpjGHUTZf/Bw8Hdc:/Q5nIRBd7kxeRPX7a3Bw8HG
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 e11a2f5b8b339acf4d674bbd138524612e183f5639ad1b2fdc3c88b0a34b6939
MD5 cf1358371af8dcc2340a65e315e3c6a8
SHA1 bc1e666933b609db3ed42f50313170a91470d4e4
SHA512 4db0111cd5ecd5e4b77f46392653f9208600a0a93d7427a252b278ee1b5f62088fa3ddca4552ac89d30561e4bc9e724cf4d6fde3f45cf2b754eb7f913bcab016
SSDEEP 96:fzwbyJ6C6HUwNuiVF47BeGT3fHTE1rJF7lzMZk0zf8W8Qge3ZwS29wb+6AcCS:LwsmUE1VF4IkHo19FxMZkcuemBwqjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 3ca9df0be3194a84962559002df127ea8557d237fdb2981c7ab22cc89ee5111b
MD5 1537db6ef9e3f2a2300defbdee670a2d
SHA1 23adbabd48dd0aa6b058a69a403bde32acdf35e3
SHA512 2343a37be03c0f28e9cdac37c8ac365a05922454b0f1ac292d3c5ccaa5d28afb04e204ff83f471ba789eb731a29ad2113a80eceb9186c69019dd74d2f26ce346
SSDEEP 96:fzwbyJ6C6HUwNuiVF47BeGT3yHTE1rJF7lzMZk0zf8W8Qge3ZwS29wb+KAcCS:LwsmUE1VF4IFHo19FxMZkcuemBwqzS
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 733500fb77dc2c398e5221ca3e11356c2a78f6946f99bbb0bd18acc34dfbe0f5
MD5 5bb3fdab6d7f2e30870579da570e87f4
SHA1 9e153b9bcff492ef1285d250397b38534e1f63c7
SHA512 c6be0200cccd3c98275e48f49e46544455eb22970e54631dba871f44594b9594e7d973525aeab04ec4458633bcfe1eb5a76da685b1ee175404033ec29bdd2a01
SSDEEP 3072:wGcHzPRuFPF3y3O6g39636uacM1eHHx7N7:wGcHzPR093y3O636uacM1eHj7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads