a0f4104801d1d248028bd51f896d752aef1f183c2d4f85a396234880dc3ce4a0

Analysis

max time kernel
329s
max time network
336s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
23/02/2024, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mindustry.exe
Size 584KB
Sample240223-rnfgwsah92
SHA256 f9afb4ade0ba4d8cd758fabdb9cd76af2c72b59130140604b29cf02295b74569
MD5 07f788dd556b612fd064a73913f82bfc
SHA1 3abe2d614dc63ca4d6b9907d36d5c35bd54cf020
SHA512 68de704e7248e647744a44c5cc46b08c97f5c80ae73e009b6c45367dd6691bb331b6d3cf7a0d4503c60be1361f59c734499c77ba1ea5b5b8448a44d5d3385e38
SSDEEP 12288:cPpWdd4P5jtbIHMavP0JLk2KgszHpaHwZMTVLzRBYkd2pA7okT1KP:cPpWdd4P5jtbIHMavP0JLk2KgszHpaQE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Control Panel\International\Geo\Nation	Mindustry.exe

Loads dropped DLL 2 IoCs

pid	Process
4568	Mindustry.exe
4568	Mindustry.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Mindustry.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Mindustry.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	428	firefox.exe
Token: SeDebugPrivilege	428	firefox.exe
Token: 33	5684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5684	AUDIODG.EXE
Token: SeDebugPrivilege	428	firefox.exe
Token: SeDebugPrivilege	428	firefox.exe
Token: SeDebugPrivilege	428	firefox.exe
Token: SeDebugPrivilege	428	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
428	firefox.exe
428	firefox.exe
428	firefox.exe
428	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
428	firefox.exe
428	firefox.exe
428	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
428	firefox.exe
428	firefox.exe
428	firefox.exe
428	firefox.exe
428	firefox.exe
428	firefox.exe
428	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 428	4828	firefox.exe	76
PID 4828 wrote to memory of 428	4828	firefox.exe	76
PID 4828 wrote to memory of 428	4828	firefox.exe	76
PID 4828 wrote to memory of 428	4828	firefox.exe	76
PID 4828 wrote to memory of 428	4828	firefox.exe	76
PID 4828 wrote to memory of 428	4828	firefox.exe	76
PID 4828 wrote to memory of 428	4828	firefox.exe	76
PID 4828 wrote to memory of 428	4828	firefox.exe	76
PID 4828 wrote to memory of 428	4828	firefox.exe	76
PID 4828 wrote to memory of 428	4828	firefox.exe	76
PID 4828 wrote to memory of 428	4828	firefox.exe	76
PID 428 wrote to memory of 204	428	firefox.exe	77
PID 428 wrote to memory of 204	428	firefox.exe	77
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 4288	428	firefox.exe	78
PID 428 wrote to memory of 3372	428	firefox.exe	79
PID 428 wrote to memory of 3372	428	firefox.exe	79
PID 428 wrote to memory of 3372	428	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Mindustry.exe
"C:\Users\Admin\AppData\Local\Temp\Mindustry.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:4568

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.0.1661777882\1900547350" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1688 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a4ae0d8-ca52-4d43-a420-651e92a9fb01} 428 "\\.\pipe\gecko-crash-server-pipe.428" 1776 25f62df5158 gpu
    3⤵
    PID:204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.1.1080728616\211052276" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22f7fc12-0a88-4567-a9f1-0fc3c0df8dd4} 428 "\\.\pipe\gecko-crash-server-pipe.428" 2132 25f62930b58 socket
    3⤵
    PID:4288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.2.1002420479\947311922" -childID 1 -isForBrowser -prefsHandle 2860 -prefMapHandle 2856 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4a58f3e-246e-4b21-aea7-866a0567f0c7} 428 "\\.\pipe\gecko-crash-server-pipe.428" 2832 25f670afb58 tab
    3⤵
    PID:3372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.3.665811950\1494431814" -childID 2 -isForBrowser -prefsHandle 3476 -prefMapHandle 3472 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc545e59-6dde-447a-8d07-b5fbaac3d76b} 428 "\\.\pipe\gecko-crash-server-pipe.428" 3488 25f57d62b58 tab
    3⤵
    PID:4492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.4.954745263\1165596545" -childID 3 -isForBrowser -prefsHandle 4216 -prefMapHandle 4212 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb8d23d2-1102-4668-a9e2-87910b9e2169} 428 "\\.\pipe\gecko-crash-server-pipe.428" 4224 25f6813eb58 tab
    3⤵
    PID:2236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.5.1147700663\1292793107" -childID 4 -isForBrowser -prefsHandle 4784 -prefMapHandle 4780 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a5254d7-8692-46be-96d7-e5d3ba05758c} 428 "\\.\pipe\gecko-crash-server-pipe.428" 4796 25f69331858 tab
    3⤵
    PID:1780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.7.2013835627\392224123" -childID 6 -isForBrowser -prefsHandle 5128 -prefMapHandle 5132 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa5eb580-328c-4c3f-a619-d8068a93485b} 428 "\\.\pipe\gecko-crash-server-pipe.428" 4824 25f695eb558 tab
    3⤵
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.6.1441859399\1934681398" -childID 5 -isForBrowser -prefsHandle 4936 -prefMapHandle 4940 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdbd0bc0-2dbb-4317-a818-c744be41215d} 428 "\\.\pipe\gecko-crash-server-pipe.428" 4928 25f69330358 tab
    3⤵
    PID:1436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.8.253934451\1432864574" -childID 7 -isForBrowser -prefsHandle 5460 -prefMapHandle 5528 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {796f521d-a007-44be-91c1-8baccfc95f37} 428 "\\.\pipe\gecko-crash-server-pipe.428" 2900 25f6a794d58 tab
    3⤵
    PID:4124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.9.1046335145\442917522" -parentBuildID 20221007134813 -prefsHandle 5364 -prefMapHandle 5732 -prefsLen 26328 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8736ac26-9ba2-4540-8082-f879700532d6} 428 "\\.\pipe\gecko-crash-server-pipe.428" 5772 25f6a819958 rdd
    3⤵
    PID:436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.10.1924981654\1679892018" -childID 8 -isForBrowser -prefsHandle 6068 -prefMapHandle 6132 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {68356187-d391-4584-8db7-9de603a036a0} 428 "\\.\pipe\gecko-crash-server-pipe.428" 6104 25f6b5e0858 tab
    3⤵
    PID:5600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.13.897329670\1269272472" -childID 11 -isForBrowser -prefsHandle 9932 -prefMapHandle 9928 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5bfd17b-422c-465b-a7e3-481f58d57b89} 428 "\\.\pipe\gecko-crash-server-pipe.428" 9940 25f6c508458 tab
    3⤵
    PID:5172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.12.1665772185\1042594116" -childID 10 -isForBrowser -prefsHandle 10120 -prefMapHandle 10116 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f742efc9-348e-4064-9e77-d0bb9a21abad} 428 "\\.\pipe\gecko-crash-server-pipe.428" 10128 25f6c507258 tab
    3⤵
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.11.1558428697\706721364" -childID 9 -isForBrowser -prefsHandle 10272 -prefMapHandle 6308 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a71ddb2d-e383-4dba-904d-a87840790111} 428 "\\.\pipe\gecko-crash-server-pipe.428" 10260 25f6c56bb58 tab
    3⤵
    PID:5160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.14.600411768\2011777149" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6268 -prefMapHandle 6272 -prefsLen 26768 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {765f7767-c3ee-4977-a4b4-ea50825f578f} 428 "\\.\pipe\gecko-crash-server-pipe.428" 6132 25f6c509058 utility
    3⤵
    PID:5240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.15.1253238559\1741458419" -childID 12 -isForBrowser -prefsHandle 10244 -prefMapHandle 9668 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2eae105a-45f1-4cb9-b306-3dd4b3fe6b02} 428 "\\.\pipe\gecko-crash-server-pipe.428" 9748 25f6c5e4b58 tab
    3⤵
    PID:5332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.16.16683047\1241558882" -childID 13 -isForBrowser -prefsHandle 9404 -prefMapHandle 9556 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b41e0ed8-5bb7-4377-bc69-2546adb987f6} 428 "\\.\pipe\gecko-crash-server-pipe.428" 9412 25f6cbcdd58 tab
    3⤵
    PID:5524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.18.2059278637\2029430973" -childID 15 -isForBrowser -prefsHandle 9116 -prefMapHandle 9112 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a858db8-b201-4326-94c7-da5f287e3e48} 428 "\\.\pipe\gecko-crash-server-pipe.428" 9124 25f6ce05658 tab
    3⤵
    PID:5544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.17.101425808\496193375" -childID 14 -isForBrowser -prefsHandle 9308 -prefMapHandle 9304 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7003a83-08a1-4dc6-b0c3-b866d522c433} 428 "\\.\pipe\gecko-crash-server-pipe.428" 9320 25f6ce03558 tab
    3⤵
    PID:5540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.20.726147963\957949129" -childID 17 -isForBrowser -prefsHandle 8792 -prefMapHandle 8800 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {842f9493-8c78-4ab6-816b-a090793af0e8} 428 "\\.\pipe\gecko-crash-server-pipe.428" 8772 25f6d624a58 tab
    3⤵
    PID:5748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.19.1523207616\691335988" -childID 16 -isForBrowser -prefsHandle 8916 -prefMapHandle 8816 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3787b6b1-c786-4313-a6aa-c9b11dc292e1} 428 "\\.\pipe\gecko-crash-server-pipe.428" 8804 25f6d527f58 tab
    3⤵
    PID:5800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.22.666929790\593882045" -childID 19 -isForBrowser -prefsHandle 8352 -prefMapHandle 8348 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {551d0e78-04ed-4403-8ee8-d615e49ad145} 428 "\\.\pipe\gecko-crash-server-pipe.428" 8360 25f6d79c558 tab
    3⤵
    PID:308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.21.736687998\815019942" -childID 18 -isForBrowser -prefsHandle 10072 -prefMapHandle 10056 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5378217-fbe2-444c-ab89-2f5a39188ffa} 428 "\\.\pipe\gecko-crash-server-pipe.428" 10068 25f6d799558 tab
    3⤵
    PID:4132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.23.284057392\320415781" -childID 20 -isForBrowser -prefsHandle 8504 -prefMapHandle 8532 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a269d9b-ce32-4dcc-b47e-0c8f63def564} 428 "\\.\pipe\gecko-crash-server-pipe.428" 8800 25f6c50ae58 tab
    3⤵
    PID:6808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.24.640026115\613022056" -childID 21 -isForBrowser -prefsHandle 9272 -prefMapHandle 9080 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {73b05128-b582-4815-897a-3df79cadb0fa} 428 "\\.\pipe\gecko-crash-server-pipe.428" 9500 25f6d47d058 tab
    3⤵
    PID:6888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.26.644803035\1041230199" -childID 23 -isForBrowser -prefsHandle 7720 -prefMapHandle 7724 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db155cb3-e944-4a1e-9e4a-4220945850dc} 428 "\\.\pipe\gecko-crash-server-pipe.428" 9500 25f6e9b7f58 tab
    3⤵
    PID:6868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.25.665547207\1613726535" -childID 22 -isForBrowser -prefsHandle 7812 -prefMapHandle 7816 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0f0354b-d10f-4142-a635-2b796c3f2c05} 428 "\\.\pipe\gecko-crash-server-pipe.428" 9752 25f6e9b5b58 tab
    3⤵
    PID:6880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.28.945791380\1055739589" -childID 25 -isForBrowser -prefsHandle 8384 -prefMapHandle 9908 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6244596-22ca-4ae8-8c29-7544a5a85213} 428 "\\.\pipe\gecko-crash-server-pipe.428" 10096 25f6f3c3b58 tab
    3⤵
    PID:7280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.27.412823858\1209248153" -childID 24 -isForBrowser -prefsHandle 10400 -prefMapHandle 8208 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bfffaa2-c529-4740-b20e-210227dcf3ed} 428 "\\.\pipe\gecko-crash-server-pipe.428" 8336 25f6bb03e58 tab
    3⤵
    PID:7288

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x404
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10766

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\10766
Size 7KB
SHA256 bf7f5a5535a87de8fa265654cf2b8d3c899c87f578b4b2a07dc5b008aee66d12
MD5 f093d97116befd6e816f10b140bdae47
SHA1 bcb05fe8707a710df298977f0cc65efa8ddb5a4e
SHA512 86f4172151c4284379dc50dfef9d633351c19ce48e0651af7aa76b97a0e23fbfc9b3dd96b1c04945c2f091f23f64361f0f916beb379393b607007b8e2a2b0137
SSDEEP 192:eXw6ilw8XJuahFXw6ilw8XJuaCnTpNFGdCda:owXljXJXVwXljXJQnTpNFGMY
MD5 SHA1 SHA512 SSDEEP

Submit Download

17094

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\17094
Size 47KB
SHA256 81cf7141a35f44a5f16e36e86bc4de43dac3205f5e2e18042e336c0448e304ee
MD5 eadcb44ad9ab202762f90d524863ac7b
SHA1 e56ed35a4ccc0f571828c023623d01e815e2d999
SHA512 8cb6817f256d745fba4891efa88cd0460cb8d0b5a49c595a797357d462f424151ac9dd6fc9ca5acb3eacb6fb4cd1302b3b60c16bfdab43167d71d3f9e685aeb2
SSDEEP 768:0Sv+XLMMyW/ZYX8BPTcLiCVU7RErqWi5Tdx3DSv0nM40AAaYeKJMBkVOMktGjlT0:0S2LPBs8BILsNErqPR3DXkAVYe/DMmuY
MD5 SHA1 SHA512 SSDEEP

Submit Download

184

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\184
Size 9KB
SHA256 4921bbef992a921636207555a05c11943e74419f15a07043af342c925e0e1b38
MD5 e39502ba22736926d74a066174a53e6f
SHA1 781fae22ee4dedc03f932402e2d3d1251bd3bf58
SHA512 4d57e27f1127f5b2fa322f6b9e13f2c8573a6ff9ec8851e23781206d298f6233f1bea05a57577fdeb7cdf1ca062ab0d8046cdd5b9b2f76713e0407feaebe2c9b
SSDEEP 192:Z51B9PzeW4EdSKmMRXPzeW4EdSKmMvC2rAl7YNCW2P8ro15j75ywpskCBY6kP:Z5V6W4EdpmMR/6W4EdpmMvCmAl7YNFUZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

19058

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\19058
Size 9KB
SHA256 d139c9e274d0982f8b640a02921e9b4c9f4496b968ae38f5781fe279ff5c1e35
MD5 e9a6d45870477ceddb76cf8a7bfde3ff
SHA1 7917be9c7349bc1d1d86c220ce21cc1d66020477
SHA512 637e47a105e2a3b5624074f667069f312c28d6dc7c6b732c7afa94c2419e385e08e11e840fee327d0f57fa10129e8a92b5edccf3350af4962b321c8b40f581e5
SSDEEP 192:W1JKa4mHk7dF7St81ebmrcmOjeiH26mmwgy+v/kRXU3OHMy+WO0RIad7wFd7w9:W1JKpmETSq1eiraje226NwX+HkJOWO0N
MD5 SHA1 SHA512 SSDEEP

Submit Download

21776

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\21776
Size 8KB
SHA256 73b7f7b530949b2f89554ea37dfa70aac6326cd0a7cd484e0f838eefef3ec833
MD5 e6cc17402fe9b340fbb491224df9f439
SHA1 3946051ddfbb4c657372dd1d7ffd7c050799d70e
SHA512 66cbba6c6b25522e9811392fb6394acdb7bd6e93faefbdec0d331937d59c5dffae44dc54d70a50998b13e901b6c2760c07d5620bdeb2fb0bcb88c43e9fff9ab6
SSDEEP 192:Jh0R2JjFJ8JJB+m0R2JjFJ8JJBHC2rAl7YNCW2P8ro15j75ywpskC0NYPh:Jh0kJxJO+m0kJxJOHCmAl7YNFU8rIVyV
MD5 SHA1 SHA512 SSDEEP

Submit Download

22614

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\22614
Size 11KB
SHA256 708c9fe9c79dad5b700c5c11b19626d74cbad8941b7b55b61d1d74cbbfbb51c0
MD5 9736df5edd3988a2a3ce47588ee51e1c
SHA1 8d4c34a14c9f344930e8ee3cb94037b4b45e8b6e
SHA512 1b2c610a03fcf32eea05f9a74d3ec695379a8cabdb2f8f70cc0156237c823e7ff42629ec86f1720ef560fe5c523c50aab38b209d537d40fe801be5d79dbab055
SSDEEP 192:DkY7HZELNzqBsPgJp33HyvGiWR2jI0LO+wt7nzyxBnYK5k+H+BsRTssg7HnjbBm3:DoLJOsPgr33HyvLM2s0LO+4Dzy3ntNHl
MD5 SHA1 SHA512 SSDEEP

Submit Download

24885

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\24885
Size 12KB
SHA256 e0db4414d092ab63be79f37cb6d200961c87495e7efa71bffef0db083730aec4
MD5 d9a279b99011f447383d113de6dab6d5
SHA1 7451e5454230c2a6f275b98501f4ec60e4247c9f
SHA512 a831e1ef173c2a4e85199fb938e43c9192941c4648fd8dd33c91f8c13bb9f025c5f677e52c03efa7a87fc3ddf1a4327738485470eb3407b786a4ce49f848dd91
SSDEEP 192:Mi1BrV34geA/ELtCREPNUOLrke1fiFBOe1p3kDtoEA1Bh1By:MqrV/ELtCREFdLrkeaFBP1p3k58xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

2699

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\2699
Size 8KB
SHA256 9f8a7ec9f3761a3ed994459f3b91d1ff319db94b00965dc5b8b8e5280f06ba4d
MD5 487cbe95fa7492f2fbcaecb00b0d7cad
SHA1 052d993a3555db73f560e3a87236e134ad2a0242
SHA512 ec214382d495e565563662cd44636f8753fb5fb58164a37bea9ede1a9f8fb3d690f278897ce28bdf09e8a154cb190939d64aebc31ffc32d5b23fc08a28cf90f8
SSDEEP 192:EmwC9pn+hxk33aqh82C3jC8e92SgbB1M8/iTQtuay+WO0RJBy:EmJ9pn+Tk33aqhtC3vSgbBRikWO0nBy
MD5 SHA1 SHA512 SSDEEP

Submit Download

30447

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\30447
Size 9KB
SHA256 be456aef15209870f27fa02564527ebf84596c673642314c74094d2e5698a008
MD5 a72c3d3493db3d5b75190fe3eab3ebf6
SHA1 b21d7b53690d2487587cd4e4af4306933385752b
SHA512 c6f56409eb61a467eaf5225cbdb4f586a2bd7f92e129e15eee906d68d3cb1f3f9a6f4e1bd7235fe88cddacb99f7ddad26a48d75f7797422ab72461b32e526dca
SSDEEP 192:r3qUf7MMJGmpOb8ohsMJGmpOb8ofC2rAl7YNCW2P8ro15j75ywpskCGd/YzddwYf:r3Qzmm8oszmm86CmAl7YNFU8rIVy8eKw
MD5 SHA1 SHA512 SSDEEP

Submit Download

30505

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\30505
Size 8KB
SHA256 6a87d9b4bdf929d6c2b2e7ec315e3cfc2293404e12289fd1c50457c4cbd61abe
MD5 5293bf03fc0d576ad31c7a6a7ca20bd8
SHA1 6f686b7a6dd4e2dba5029e8908f8ad15496b3862
SHA512 a10c1deeedf50ef1942a2689bb36f3b726346a93939363799bcd8a267905c6df0acfa64d6eefc7340c81608037681d0929f6ad5e61ca10d7ea20b12ea51fc867
SSDEEP 192:Emd9pn+hxk33aqh82C3jC8e92SgbB1M8/iTQtuay+WO0RZd0:Emd9pn+Tk33aqhtC3vSgbBRikWO0rd0
MD5 SHA1 SHA512 SSDEEP

Submit Download

31304

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\31304
Size 8KB
SHA256 44b5c641e10e506387f964a65ca507c912aad6b6697d6fa70cc5f0d5f9f6f33d
MD5 638a0b7d34a37584ae1f1388efad875e
SHA1 2c17cf56777d60da2fa0502cba5f8f033860823f
SHA512 aa431350994a4152670ddb947975a2a3dc603a862f04d50bc99e5b1a593a9a59be8e132af84217ac318b65699ecd1847f6de6abe2ad6781f20f96c66bce23f0b
SSDEEP 192:U0R2JjFJ8JJB+m0R2JjFJ8JJBHC2rAl7YNCW2P8ro15j75ywpskCpYAw:U0kJxJO+m0kJxJOHCmAl7YNFU8rIVy85
MD5 SHA1 SHA512 SSDEEP

Submit Download

4502

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\4502
Size 21KB
SHA256 881cadc8977f4d45333cdfad53792e2ef51f2a63a64aec797df0d8f4e87c94bb
MD5 f34b62878e5646e12a1882aae50dcb17
SHA1 82d78e396f560e9e94c3e17e74c66c63e46c5e15
SHA512 918bd40b4d5c46321d17a70be72bc70f709c161a2208e6003203873d57c8eaf878e97ace69df6a92b15963a19dc048caaa7142a01a13184e660dbc91747e51fd
SSDEEP 384:Fi8MqiXTjcG9B15fPpfPULBG1trCYC7AwiMVYC7Awim8eehqrufWWCt2BEQ3hZ:FiGiMkB155fMtkbCEbMqCEbm8eehq4wg
MD5 SHA1 SHA512 SSDEEP

Submit Download

6928

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\6928
Size 8KB
SHA256 85e345326b2e9c2a2124df152685440306c0abf2611270a75a0e0e0ee0e54b12
MD5 f3c476ccd920164a7e343a0c6ed2a82c
SHA1 af5ea95538031226147bc81207cfe6f8c6369c9f
SHA512 fa0f42b0392f1a6330b471ce1277578cc809f506f573736b59a7809a6a3a2d42fe5669f55ce1ad925b6b6b10202a0e6651fdd3a66dfc9c5c5fd10a2f45cc9c13
SSDEEP 192:V0R2JjFJ8JJB+m0R2JjFJ8JJBHC2rAl7YNCW2P8ro15j75ywpskC0NYiO:V0kJxJO+m0kJxJOHCmAl7YNFU8rIVy86
MD5 SHA1 SHA512 SSDEEP

Submit Download

7197

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\7197
Size 10KB
SHA256 df97e59f29a4f24c920e89a82fc7dab9356fa2852ad20c4bcf70b88b71e0ac63
MD5 051f7d9578d2ac0955dd3684d06d67c1
SHA1 d98937b1c41ef9cc8c9ea9431e2fa827d0041a10
SHA512 74f38b2f2fed79cd3be189b097607f51189d7cda142d67f387cdb35d1800b708c2f03f64a462d48457f763b0ac812471a26be564603294ce6aabf1b2f60e3827
SSDEEP 192:hM1B8Ktqyh4LR8fKittQYFNBoGoGlsNAnjbHE:68Ktqyh4LR8fPoMNroKsSHE
MD5 SHA1 SHA512 SSDEEP

Submit Download

8189

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\8189
Size 10KB
SHA256 a542113f7126bd21e40d74754bf09c84464d1f9a7b1914a6a0237f1dd279ad10
MD5 3214310190d023f14990c16a4ce7ec33
SHA1 01a237d2fbc42ced615c7d516b376f5689c97324
SHA512 31849dd92babff95b4ac02dbe9990fd2307ec5bdb3e85c2694db05b0f4e09507a66a3f6f4575b534e2997f4539847099640e82bd14cd7e4dad823ae494a6a182
SSDEEP 192:vM1B8Ktqyh4LR8fKittQYFNBoGoGlsNAnjbHY:A8Ktqyh4LR8fPoMNroKsSHY
MD5 SHA1 SHA512 SSDEEP

Submit Download

890

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\doomed\890
Size 29KB
SHA256 fb41c9856f7464f01af0f8ba699d740301bef2595ba5b1dfaba311f3d88e7808
MD5 1b620ea30ef64fa685c7c021cadbb56d
SHA1 476009939a4f9da85e78e5c8c5196d9c054978fd
SHA512 06b8094568f246ba678a27129f59f45d0d4f0fde04d2973f4ed71d2a5da8672dd30aa784912ba716076990306a8db18cce6b23722e55a5176425a50927b10e99
SSDEEP 768:DCXjfq/qUNjhxWvbvLEnymahjzuPFgM7/IJ2qUCEbMqCEbm8eehq4w2BV03:uzCS8knmincB7/yUCEvCEqaBw2Xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

003C5063C87A2BE598BC93500E8F5D1DD94A583A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\entries\003C5063C87A2BE598BC93500E8F5D1DD94A583A
Size 96KB
SHA256 e511388e494a0cad1df662926d0ca77b70b342c52d7dc07dbbaad5ed7796f436
MD5 4d02c66be7950bae215ef2c41fdeaf2c
SHA1 99b8044d31b441a34a15763f453b46f998548894
SHA512 6c3a06b638ecc4fb13011010f1f665ba34c4e6cb44d641bc334d37a219bfbc1f8e1466030c8831550c84e5dfd5f86e4bb403a885800e72b9f5a741c6823f2ac8
SSDEEP 1536:eRkgslsMHqiiPKLcM7MSVrnZV2pHOScux/CbcjhCEvCEqaBw2XW:vK1SQK2Hgux/20h5v5BBq
MD5 SHA1 SHA512 SSDEEP

Submit Download

10F172D9F83A7EBF6E8F07BC5F596C4BC000489F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\entries\10F172D9F83A7EBF6E8F07BC5F596C4BC000489F
Size 22KB
SHA256 171c95bfaff017b82ad48e44121b18b755c440356050733fa561328eaa105540
MD5 b080cebde28672d668305c7af9766852
SHA1 e63debc63da9801b94e9eafe04b2c273ef79f417
SHA512 d59f23f952fa1d84b10a8ce95854d617ce726516b0fa4f96009d85abb344b0ff8a7e2d9706848b56761166253c6622da1397ae6e1690a96f4f84eaf04922b146
SSDEEP 384:jbiWTkB5a1pVYFY+frPTSfbY5UQUXNRaYC7AwiMVYC7Awim8eehqrufWWCt2BVu:jpQBI1DgY+T+TY5Xc9CEbMqCEbm8eehi
MD5 SHA1 SHA512 SSDEEP

Submit Download

407D48726FE325CAFF19762A8C9B918D128F3C5C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\entries\407D48726FE325CAFF19762A8C9B918D128F3C5C
Size 107KB
SHA256 4c12ee2b04f0801f5cc4542bd4968f4168d4b49285dcb31657b335fe5de841d0
MD5 2514869758ad00ef3d70d881698e1ca3
SHA1 0704edacaf42d387c77ff0479a680eae686fa353
SHA512 34a3abd293b053549b60ab18124e07dbc7ba165ea6a3759a27cd3efc28ba5410b268871204abe5b4a4d8beb5adf998420fb0d52caf742f04ff2d5a21bfe1f3f0
SSDEEP 1536:gEs+gUsLlDMQdYRRYUaQOti4SpL8v8gvHBRC4vDg04Ih8m9ujlbr6/wFTr4O:gE6tMQdqRpOtiCv15M4vb4+ZMwwFTr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7164B9EADC8F86A9E243796CFC5C680C0E4FFF94

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\entries\7164B9EADC8F86A9E243796CFC5C680C0E4FFF94
Size 205KB
SHA256 a1dc99054716038e9f50ea3249453b92e8c90596973db9a5ce6b6a0542f450fe
MD5 7f17c9695ee6da9250a5402d50621841
SHA1 06ecb8eb792f2d72331241c4824b08aa94fed9b1
SHA512 c1657800d985246b1f26c19d426129de7b05520f3eea6b72a9bcc3ae2e35f985a16f1e03ac17caa961d769192ca6eb7d74863333315f06713f2a762850b50724
SSDEEP 3072:1kAcJFJZNYo7rna9Vk4AcQ9rzu0ktWn/jne5KnA3rKfRKJ8HTa2UsbW4d5v5BBW:lScana9Vk4AcQ9rzze5KdfTJUsbXFW
MD5 SHA1 SHA512 SSDEEP

Submit Download

8B2802806A446B7E1AEEF0C2C707415CE3EB1B2D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\entries\8B2802806A446B7E1AEEF0C2C707415CE3EB1B2D
Size 70KB
SHA256 90ead1282159ad01c8f819e089cf1d1041bc4aa569c81fc49a5da3cc0f43cc52
MD5 fc191c39830f2fcb298c968836bfa83b
SHA1 cd74ee2a9b02e8be6480cceb273c263258d69725
SHA512 2ec0ae98e46795a31b8d4884553ff612265776306ad5ebc482424ba94655797f3f8c8a8f50fc6fe10cfe00c2a44e960f209f5d6993930106e57e011452ceb968
SSDEEP 1536:BD8CHD3YyluRiWXHIV/uQVCtiGBBeCEvCEqaBw2XsWi:BDPEylMiW3d45v5BBoWi
MD5 SHA1 SHA512 SSDEEP

Submit Download

AA8E08AF1A7D11F1E57C0A00D4C101E6D942422E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\entries\AA8E08AF1A7D11F1E57C0A00D4C101E6D942422E
Size 138KB
SHA256 5eaaa0f2fa99c3f5abbbac2d63c11b2adaf3d12613d861b2615030a32265ca66
MD5 dd1ac004cfd962f38f026bd05b1abdee
SHA1 283551cebc6fb926d09d459c80747ec19144432e
SHA512 02a31fcac0ebee477182869f99ed5452620028ca80a21df13ae55859676a8d9ded66be225995c22ab3cdba9230eefee02d5c1fed8f5d590ec3e8ed602c2d45ab
SSDEEP 1536:D14UDfUL+l0s00ORrDuCuU4Owl8raJN2/BmK1lXaQmVe4khtgSvoxvLkBkzbI4e:Dv0tWeLcNkYSvojI4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

CFAD202F78796B44556C48715617B4AE1C4471B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cswg9rdm.default-release\cache2\entries\CFAD202F78796B44556C48715617B4AE1C4471B0
Size 11KB
SHA256 9d3083bb622760c5626f9dc57e65027c71b4181862c18c6ef8066bed1f250751
MD5 462a38b31ccbe38609a71e76eb148f36
SHA1 91f6cfbf324e8f272542508d3ade4c0fdcc77641
SHA512 531a21ddf535a64e8c8edbc89a72158411f5731ab9e164326213d05b5ef55855d99ffe4ee1da996b3d5b9549b2681f4f78fb144829da26962afeb86e4eaeb578
SSDEEP 192:BFX7WSUvit87u3KouWmrXw6ilw8XJuahFXw6ilw8XJuaCnTp/:BdF27u6ou/wXljXJXVwXljXJQnTp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 9KB
SHA256 09c0c4e1b700ec903080b27aa536fb18a4898acf3fc0553afc2981e60dd54428
MD5 279c253cf254381827fae823c1557bad
SHA1 4b5215dccb00572373b1cb99ef3d0a18828f193d
SHA512 7749f6a5a95df948433db672cbeb36d1d0d5324eac38d116cc0b92691366d386685d914f94f7abd903a8127c66b047b41867960774092cea3473a656013e2286
SSDEEP 96:m0974/z9VC/D9zOlvu969m4Bllv7Kq9cCU:m0974L9VC/D9zOZuc9tBlZ7B9cCU
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 c0c49f1f415c68817163bc8486b09f53717c6f366cdf57285c84903f8039a001
MD5 ca794aa3aff2ead0596871603556785b
SHA1 5ee76a0c719b2af854b76a22549f7676b31027a9
SHA512 6ac602e89c6842b3ee0f14d411038ab30af50fd830f0a390437e72ae06a811df5629723684872c5992ca6dc97cdfd65d0add1ee986151a35dd02006214f7cf17
MD5 SHA1 SHA512

Submit Download

065c2d51-c9dd-46d9-bf6e-72c8df393e1f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\datareporting\glean\pending_pings\065c2d51-c9dd-46d9-bf6e-72c8df393e1f
Size 10KB
SHA256 19f0c3f09152ea699085439bf71c7c8337c04270a762715019b448dd8882c536
MD5 3c17ef3627fd5ea9a000f19195ce5e22
SHA1 48bb91265cb892fe9162fb4c3a86b308c18d3b0a
SHA512 304de07ffaa0a46611a024a7d4128adb814771599227ebd6f430a471ea8389c8b659b787258b92a5f79ccf04d641960525a592afe70266d06b1601dca71ec6a4
SSDEEP 192:4Zj7xhsHxBKlPM+EO4LB9A8JpCrCVsp+7sd+Vocp7n39vdve7XjQZZ:oU+M3veIX
MD5 SHA1 SHA512 SSDEEP

Submit Download

1d0637a4-d362-4161-b5e0-3dc45f950995

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\datareporting\glean\pending_pings\1d0637a4-d362-4161-b5e0-3dc45f950995
Size 746B
SHA256 224c7ee80e2d639f805e586f9af4ea30b68140d771ca9683858fd23cb7bd919c
MD5 e9b9b2ff161724bae7b10e170726b0c7
SHA1 d4ca8071963e50455d0c5c7d97c2b993a393eb86
SHA512 e7f72becb8ddc4e88d129c3340a3399a00ffa091133bbeb88236d6ceb80fab5e77ac383ac89acc1ca241b2e4fbb29ed7b783b12aae9efcf116a0fa4e89649fc4
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\prefs-1.js
Size 6KB
SHA256 a99785b2181f62acc7f611aab7a04a0c7cfa5dee9b411bf89741ac65d6ff06a3
MD5 880e0cbfb05dc58d2fa9fd6d89d663fd
SHA1 66fff6c09ae9374338acfff745ab541e48ddd1c4
SHA512 6281cec53f56ecf35289673174ed061b4fd974ab12d75c7a6c6fa2bbbc7d03a110b4691c879d35cc826ab1b44bc947d55c2a50ddedaeb4c81cc3989b6824615c
SSDEEP 96:xHPulwnUTeqGqkdDdTeOTzSdPXAnpjoHxbge1ZnBw8HHLGS:1ulwnIRkdDdTe3PXJJtnBw8Hh
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\prefs-1.js
Size 6KB
SHA256 0bc5cd499dabc76d24fe3e649a8519bede9c88fcf4357461df30ae68ee0093eb
MD5 2f8088dae141f25ee46dde2a59d6e79d
SHA1 a389b6c1842c0dd82a096be264a79e45e543f798
SHA512 f1d11445333cd1edbd83dd8bd512976d9c170cdba2e309b42365b821e011e5d8b8705451cdb0e59d2e2a948681720092148716ae84189c757ba834c0c952106a
SSDEEP 96:xHu5nUTeqGqkdDdTeOTzSdPXAnpjoHxbge1ZbBw8HHnGS:o5nIRkdDdTe3PXJJtbBw8Hd
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\prefs-1.js
Size 6KB
SHA256 e1cd349a01c29ec2cd328ad172993ef24560cb2c29d63d695a76d8eb2ec5772a
MD5 d8333083ff122e46a152d646642383b8
SHA1 a4dd3d762a0117fd05d04c438c38dee8c8c540a8
SHA512 ecff3b8b6616ea8c536513271979763e41ba398a766a49cc1aca776a850a0faef1696760fc6d5030d6c5c829c18a3ac7e0d6cc3bcfc4e60585493ce834def40f
SSDEEP 96:xHul5nUTeqGqkdDdTeOTzSdPXAnpjoHxbge1Z0Bw8HHLGS:ol5nIRkdDdTe3PXJJt0Bw8Hh
MD5 SHA1 SHA512 SSDEEP

Submit Download

serviceworker.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\serviceworker.txt
Size 165B
SHA256 6c6afeb36e7961869de22d304ffc1255f5809299217096da857d3f04fab7a0b6
MD5 b3bdb0312f9950ba029402dda11c35ed
SHA1 281010e40cb863519ec70f93f018ed5fd1f110aa
SHA512 4f4450f7604c6f774f1e5d11fc23c5b9c014005ee942393f0745d527a77e302777db48bb52f694b96c9a03967d2749e1444ca7ce690088aaec7d03c1a5386b77
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 5f13e0796c17b324bda5cf5854659b20c6b0e1bf0bff9081a982f0b613de571f
MD5 96d0a01447197402b8c1ddd4b631b51f
SHA1 8716084481250e0b4bf8c32c0da08d7f9d242285
SHA512 a32b41cb31e1c4af7a411196f2c54b61c5d6c9bc6287995414f5a2b059e1c1553d42fc68f36657fabfe9eec149ce5e7fb879f472e29a666f0db4236821346fb4
SSDEEP 96:NVgQcaFELcPV3YM40eeVsnH1tpU2YmhpRr7ITlRmp0XP0/KR1TpDAT1Xzd8IxRYH:NVxjF0ctYc3VsVkERmlRV0/KRRWT1X5C
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 38e5f4bbe99adb57ca65bf7f8864e9ef28b2f625dd01b5e16c9dac6a9b95a712
MD5 4d8fce894cc2e25bf80086412a6d859b
SHA1 9a21d96585467973a2dc0d81878f4678c6eaee1f
SHA512 aad51626e2d3ac532e5d29c12de65c448183cc1c705a4386d3597223f525df77e6263ce6ad96606923aaa284d6c2c448d2cebb031aae010d598bfd91919872ba
SSDEEP 192:QVTqM6Pp49JBXx8f03VsVkERmlRV0/KRRWT1X5Px6vWJ2W:AT16PKHU0u2amlRVQKbWT1pP8v7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 c5575624c89388a7177c9f4c109ac92cd8a2ccd9b0f7b48a40cf4388735b5419
MD5 571897ad9871436b41f2a78343f204e1
SHA1 ed27ddc225b64147c59ee08e1d4018299b7d5436
SHA512 1a00fba4c6775a3ae915c1ea8d1f060141082c3b4c829e78b8c62f8e3e62980ce32fd01339dfd77d2d354fbc269ee0639f6cf14208c0a0e4e5e70abcbd314b95
SSDEEP 192:e1VTqM6Pp49JDcoxqlYc3VsVkERmlRV0/KRRWT1X5PxqY5O9wkShcW:efT16PKHDc/Ycu2amlRVQKbWT1pPgY5n
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 265505fc911faba651d0990084af868fd59dbdd640ccca30bebb6f062cbb06c6
MD5 e24e2af17c5ffa6020ff37ffb3d8fd3b
SHA1 bf8837737a3056d72492c9b6f0a518ef2945814d
SHA512 f3cd9ad4018302beda988025f7b446aa86ff3d702ccfa2bb8ad0c45a4833b9289c09484c79bbec0fb6c169611428409feb6ca6cc8197d7bbda8ac292f75178ac
SSDEEP 192:wVTqM6Pp49JKDncoi3VsVkERmlRV0/KRRWT1X5Px3f1pkxek:gT16PKHKz6u2amlRVQKbWT1pPdf1W0k
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 3527c2283762025540d8a3d16f6c7dcc91b900a6b93756636b5cc8850df05992
MD5 85574e661b2f10e13f61edb14dca366c
SHA1 199ee4319b0bc61779b13cbdbf56ac982f67e18d
SHA512 dbbe8858b65c401891f67bad2b38cf8b80b45d21697cb1056a841da21254ee545e0eccf8349c67e54f6a06db6bc2ff5fd81f94765e255a8fca738c02d413fa45
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 294f1acae4e63e1594809720ecf01a5435444c50a32580543ef6ec24ce890ab9
MD5 6540e17dbcbcae7a8f2ecf4b7e0bab2c
SHA1 bb1a3769ee767c42eca964af1bf2934a7067a550
SHA512 08653552d4d6c30a34b673c33550e570cf94f79f3d4d6e6c9a88e7e362491947e314ca7c38f7e4d49b7e8fc7c8fc7fae06b4ca9e95d6116c05f777c45b2aa5d8
SSDEEP 192:gVTqM6Pp49Jxrxyu3VsVkERmlRV0/KRRWT1X5Px8svMlX/:QT16PKHxbu2amlRVQKbWT1pPudt
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 0ec68e31cd94ef0ec6eb8274b82db6b4247d6d7f26dda58b374ef415baa484f6
MD5 b6cf11dfe9d64c53cf7f13c84154e563
SHA1 8804d0a558c6faf7f953641f5eaa7085730831e6
SHA512 316f506cd585a5a826db99f235de7d9efc72b60f0a0a233b7a88e82db7faf24a52c236240235b8da6ffb054c9be9372138fdaaa3e937f8f8c65cf8f67b6fc7d1
SSDEEP 192:UVTqM6Pp49JKg3R3VsVkERmlRV0/KRRWT1X5Pxrb1MSeVzNn:MT16PKHK6u2amlRVQKbWT1pPFSrNn
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 4e62971795cdd3c6bce1d27d36ebe476bea9d4e7d1309c597a5fa0244637d054
MD5 36a431e5b19b61b86fd8a1ff9e6de07a
SHA1 4f05ff9f63a18cd577fb9af3858ca4ba791a7632
SHA512 7f5644df44f45b2205dd456644821be1c47d95119b4f47b390711cd96337aa74651486814c4b734d46100e53e46d1c7d9b3227663c916cf9a7cf1f688134fa43
SSDEEP 192:QVTqM6Pp49JwXx8f03VsVkERmlRV0/KRRWT1X5Px6nWJ2a:AT16PKHH0u2amlRVQKbWT1pP8n7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 884e3acd0e31e9df76654edba71e0d380cdc930692d12ca3ccb07919a0f39381
MD5 f0d15a9b611244bfaf6456f298a00b1e
SHA1 9e94a29c9fe80322a517cb635374f8409b8cafab
SHA512 624e2095030017c288d183b9544934f5d5418d9b4c3e60404564b1c3bac5eec3781bcd745cee6825ad2c51ab1b9d66334e855b291aefd1f40bf40a87e852af47
SSDEEP 192:6VTqM6Pp49J5NCIqxkFYc3VsVkERmlRV0/KRRWT1X5PxM+AJ+xo:+T16PKHn7Ycu2amlRVQKbWT1pPydJP
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 351d703e3cf22cb5ec1725b8d2279916a22dc7c230f794714e4a11590742164d
MD5 34e9f5ee590b941f87315ca3d23c1b4f
SHA1 5a4f936104a40d76dc9d3377ec6d7fbcf2359bdc
SHA512 23d672f8d96f5d5e297a169082848820c74f8a2cda4a1ce6900ceb031251092b32a79c74a4b23d137905388a1d353d7b005968e8ee8fb957511bd55ed1a326be
SSDEEP 192:UVTqM6Pp49JKV3R3VsVkERmlRV0/KRRWT1X5Pxrb15SeVzNn:MT16PKHKHu2amlRVQKbWT1pPFnrNn
MD5 SHA1 SHA512 SSDEEP

Submit Download

{ab989c30-bb6a-4e31-99ee-0a4b6cc7f1fd}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\storage\default\https+++www.crazygames.com\cache\morgue\253\{ab989c30-bb6a-4e31-99ee-0a4b6cc7f1fd}.final
Size 668B
SHA256 4f0a23e67e481decaab1a757bcdc136452fc550a69f1783c453605214be3c97c
MD5 ab16b762af5aed186ec7e8d123f13909
SHA1 bb746203079ac94c4f41de4d7d500f089b375e1d
SHA512 6a9f93f59406fa7717b1f7133395066058860ebf71198faa730c5e58e36ff298cb4b0b8b3bc68efc618e227e577c0d614562ea97944f6ba3cf18f26befdf41e1
MD5 SHA1 SHA512

Submit Download

2926346687feisraebbaatsaed--hte.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cswg9rdm.default-release\storage\default\https+++www.crazygames.com\idb\2926346687feisraebbaatsaed--hte.sqlite
Size 48KB
SHA256 2ba72a45961eac586a26d5bc2bf25126fd18ae392d3725481b340652937c5313
MD5 fc18bdfbc4c287c2119339e2031d548e
SHA1 96f349b7c19fe04b63253881feb351a7a30bb2cd
SHA512 bcb39c71b237bc80f798a35673a1d1a97bfcfd32ad9ab2ab9363de016b966320e4caa61576db30e9ca62987cb4d72368e37cf0202f4694a508b2efbdcb44696b
SSDEEP 48:T/OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEAB:D16S6CKnqlizbxV+2xVeU7X2B0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

arc64.dll

Path \Users\Admin\AppData\Local\Temp\arc\5f24d8af\arc64.dll
Size 746KB
SHA256 d4c00d290f17de953de933552427b7ee717cd44cba20c451db8d3275241eb38b
MD5 adbf8c72d7e687eb6b21622c7edccaf8
SHA1 acbe605f81ab02240c1a3ee1dae6ec62c8df1789
SHA512 175f62fa4a6de41d1f0fd5b233ad7c65afacc0326eb9985d5e565c683a5d912b38b28cf22cdad65fa447734f2f7845ba126ad5f4a6741760e8f4c669b12b93c0
SSDEEP 12288:+0oR29hXME/JPXjMSuuzZcJlo6CGYMdFmQhXDEUxTjyesxJ4hOH+FUag:+09//lTMiy/wesx2QH+FUag
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdl-arc64.dll

Path \Users\Admin\AppData\Local\Temp\arc\d279e965\sdl-arc64.dll
Size 2.4MB
SHA256 e2b56d39567bc6085fb7e1acfb42a9550efe58ab30892bbed6e0280335ed27ec
MD5 266a50b05160ec7d3162a9b1e2dc3256
SHA1 d6dea436759164a37406333ddb3e5bc462d25e78
SHA512 6921cd2b2c977f8b1e469b6d63a010585d6454c9a5cf4049c2ec64491437d42462faad40f26cac7629c6156d9b8f3dc9381cabaef9ec4a18455cc97336da3ba1
SSDEEP 49152:KY0ilbI7NFsF3AJv9oL+Ef5c6mIMkpecncRQ+IkioW/:RbDEQ7oW/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4568-13-0x0000017F84230000-0x0000017F85230000-memory.dmp

Download

memory/4568-30-0x0000000058610000-0x000000005888C000-memory.dmp

Download

memory/4568-29-0x0000000058890000-0x0000000058958000-memory.dmp

Download

memory/4568-27-0x0000000058610000-0x000000005888C000-memory.dmp

Download

memory/4568-25-0x0000017F84230000-0x0000017F85230000-memory.dmp

Download

memory/4568-24-0x0000000058610000-0x000000005888C000-memory.dmp

Download

memory/4568-23-0x0000000058890000-0x0000000058958000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads