Overview
overview
8Static
static
3Blitz-1.15.35.exe
windows7-x64
7Blitz-1.15.35.exe
windows10-2004-x64
8$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3Blitz.exe
windows7-x64
7Blitz.exe
windows10-2004-x64
8LICENSES.c...m.html
windows7-x64
6LICENSES.c...m.html
windows10-2004-x64
6d3dcompiler_47.dll
windows10-2004-x64
3ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
3libGLESv2.dll
windows10-2004-x64
3resources/...pi.dll
windows7-x64
3resources/...pi.dll
windows10-2004-x64
3resources/...pi.dll
windows7-x64
1resources/...pi.dll
windows10-2004-x64
1resources/...er.exe
windows7-x64
1resources/...er.exe
windows10-2004-x64
1resources/...ay.dll
windows7-x64
3resources/...ay.dll
windows10-2004-x64
1resources/...re.dll
windows7-x64
3resources/...re.dll
windows10-2004-x64
3resources/...ay.dll
windows7-x64
3Analysis
- max time kernel
300s - max time network
227s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
26/02/2024, 15:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Blitz-1.15.35.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
Blitz-1.15.35.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
19 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral11
Sample
Blitz.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral12
Sample
Blitz.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
17 signatures
300 seconds
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral14
Sample
LICENSES.chromium.html
Resource
win10v2004-20240221-en
windows10-2004-x64
9 signatures
300 seconds
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/leveldown/prebuilds/win32-ia32/node.napi.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/leveldown/prebuilds/win32-ia32/node.napi.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/leveldown/prebuilds/win32-x64/node.napi.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/leveldown/prebuilds/win32-x64/node.napi.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
resources/binaries/PinManager.exe
Resource
win7-20240215-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
resources/binaries/PinManager.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
resources/binaries/blitz-overlay.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral29
Sample
resources/binaries/blitz-overlay.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral30
Sample
resources/binaries/blitz_core.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral31
Sample
resources/binaries/blitz_core.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral32
Sample
resources/binaries/electron_overlay.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
300 seconds
General
- Target LICENSES.chromium.html
- Size 5.2MB
- Sample240226-sn7rtahc33
- SHA256 fcbf6d29363d798b931f4fb0dc95b09c1a44c3ccaf79a9651ab280a8562e82b6
- MD5 02ca1f89c7e4815b82bc8974bffcd183
- SHA1 45bf8a20bad7953b7e16a74348fa034ff5844475
- SHA512 024794b3303ff4ea5f3852c505e39e140113264d24e5dc14a365e8a1fb6f9a0683e72098f1923cca187c666b39a904fc18ac53645b8a25bd8a235cf01b661a60
- SSDEEP 12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZs:sFEc5FeWSPPza8yUAmfQRkHmBa7pO
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 16 raw.githubusercontent.com 18 raw.githubusercontent.com 214 bitbucket.org 215 bitbucket.org 216 bitbucket.org 12 raw.githubusercontent.com - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3016 firefox.exe Token: SeDebugPrivilege 3016 firefox.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3016 firefox.exe 3016 firefox.exe 3016 firefox.exe 3016 firefox.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3016 firefox.exe 3016 firefox.exe 3016 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 3016 2904 firefox.exe 28 PID 2904 wrote to memory of 3016 2904 firefox.exe 28 PID 2904 wrote to memory of 3016 2904 firefox.exe 28 PID 2904 wrote to memory of 3016 2904 firefox.exe 28 PID 2904 wrote to memory of 3016 2904 firefox.exe 28 PID 2904 wrote to memory of 3016 2904 firefox.exe 28 PID 2904 wrote to memory of 3016 2904 firefox.exe 28 PID 2904 wrote to memory of 3016 2904 firefox.exe 28 PID 2904 wrote to memory of 3016 2904 firefox.exe 28 PID 2904 wrote to memory of 3016 2904 firefox.exe 28 PID 2904 wrote to memory of 3016 2904 firefox.exe 28 PID 2904 wrote to memory of 3016 2904 firefox.exe 28 PID 3016 wrote to memory of 2720 3016 firefox.exe 29 PID 3016 wrote to memory of 2720 3016 firefox.exe 29 PID 3016 wrote to memory of 2720 3016 firefox.exe 29 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2540 3016 firefox.exe 30 PID 3016 wrote to memory of 2816 3016 firefox.exe 31 PID 3016 wrote to memory of 2816 3016 firefox.exe 31 PID 3016 wrote to memory of 2816 3016 firefox.exe 31 PID 3016 wrote to memory of 2816 3016 firefox.exe 31 PID 3016 wrote to memory of 2816 3016 firefox.exe 31 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html"1⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3016.0.1970511239\1641945700" -parentBuildID 20221007134813 -prefsHandle 1268 -prefMapHandle 1204 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f1d0729-5bd7-44c9-bb4b-a50b80d1efaf} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" 1368 108d9e58 gpu3⤵PID:2720
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3016.1.845878485\1772371281" -parentBuildID 20221007134813 -prefsHandle 1540 -prefMapHandle 1536 -prefsLen 21610 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aff4ac33-c666-4f7c-b801-b3502d242c3a} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" 1552 f5eb558 socket3⤵PID:2540
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3016.2.1257688863\2146956774" -childID 1 -isForBrowser -prefsHandle 2008 -prefMapHandle 1884 -prefsLen 21648 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b59eadc1-e725-43c0-bd62-f6f2b4d74cc7} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" 1864 1a77eb58 tab3⤵PID:2816
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3016.3.1793996945\533896132" -childID 2 -isForBrowser -prefsHandle 2424 -prefMapHandle 2416 -prefsLen 26046 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1745ef31-e705-4ccc-933c-60f9ed14ef71} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" 2444 e61958 tab3⤵PID:2160
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3016.4.1416125401\1188581681" -childID 3 -isForBrowser -prefsHandle 3792 -prefMapHandle 3496 -prefsLen 26345 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77a013cc-e3c4-49f4-93f1-ca4b5cfd7977} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" 3804 108dc558 tab3⤵PID:1392
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3016.5.27030895\1146806449" -childID 4 -isForBrowser -prefsHandle 3912 -prefMapHandle 3916 -prefsLen 26345 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfc382c6-ce30-4abf-b5b2-659204db1a6d} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" 3900 20339e58 tab3⤵PID:760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3016.6.412261382\1062902900" -childID 5 -isForBrowser -prefsHandle 4072 -prefMapHandle 4076 -prefsLen 26345 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {593bf9b0-32c6-4d77-974a-516535b941fb} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" 4060 2033a758 tab3⤵PID:768
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0rowjuc9.default-release\cache2\entries\4832D199584363B876D3E7D57CA02A9B0F4D91CD
- Size 13KB
- SHA256 d2fc45d0c2d835fea6fe030bbbb048f41929cb48de1e2e2052f3dc50859dbc02
- MD5 eac6a0dcad774e8cf24901b47c29c4c6
- SHA1 038e62ec35a73c48ce5fd1f8146fd7e75af13c90
- SHA512 df5447c1bd64bc3cc3368755a2cda31c4595d882e7c8e89e1feea5d1d6f79e391de550daa092bf5ae6b893d2a65c6c241668b3bb6b64e1afcf18c36cfe4dfc72
- SSDEEP 384:Hhyu9fiGLm4pUB0DuDyS4uWg938+iLO4O0lpDIIx5x54:FBi8mCUB0DkyS4ub9gLOwD8l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0rowjuc9.default-release\cache2\entries\E66F5AA5E3C285C270CF84BD11111C74D38F245C
- Size 13KB
- SHA256 bfebac9fd85693005de21bc1f239c85b1f46dbdc416710306659ea5a770a7b72
- MD5 c6c0a9dea34fd6c898d98aa3d69c89a6
- SHA1 fb652e1b8216c984cc54a714af15b50947fada38
- SHA512 2c96f1df0e632e8444dc0278abf8ddf74fda4fc134e56c1be5bd46e822e39ae9fe5616553c6988bc5614198e39ed5832767ae090b3e3dffe4d4f696208c1f8e0
- SSDEEP 384:H3vPu9fiGLm4pUw0DuDyS4uWg938+iLO4O0lpDIIOHb:OBi8mCUw0DkyS4ub9gLOwD8n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 442KB
- SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
- MD5 85430baed3398695717b0263807cf97c
- SHA1 fffbee923cea216f50fce5d54219a188a5100f41
- SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
- SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 8.0MB
- SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
- MD5 a01c5ecd6108350ae23d2cddf0e77c17
- SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
- SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
- SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 7KB
- SHA256 5dfa4ca5af9fa5cc9a9047d57857c109982900d9ea34aa7b3f2b4db6b9fa1275
- MD5 fd193f4a39542685f3f506a4c2001e94
- SHA1 da9e04f63ec05e4d93bbbc75c4367636391fcca6
- SHA512 2eae2c427b586ffeeada6e3256da3cb36fcc9b82d0efa2832dfc7066a4275db0ae0dc64c7ac8a4ebd6974d3c733d9d728e64fdef9175d54931d138a3418d44f6
- SSDEEP 48:2+9dx6W2J5Ugdwr3NMzTt9dx6W2J/6Bdwr3NN0RP9dx6W2J/adwr3N9Njl69dx6G:X65iNu65/7NuX65/LN3l065xsNR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\bookmarkbackups\bookmarks-2024-02-26_11_JGLvmXDEq1qP6i79-t3V1w==.jsonlz4
- Size 944B
- SHA256 c5ff6fb521712de73bfa401e03d5c95b2914e43c01c35fa20cae473deeb76da3
- MD5 7c927a55e7c41e2df325c633126a926d
- SHA1 d8f6735382901d3859d33bd5a46d20412a6b764e
- SHA512 5ade76050b6ac4993038c46ca5ac80b0ebaee29d5d1e4e0811b990429442413d50810a37f6e4c526779265aefc30561ea0b979ec0c3056fff9b2d86e9459a0fa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\broadcast-listeners.json
- Size 216B
- SHA256 57c230fa012c11e8c3e565dbaa8662f4d5116385daef5a3a3b9da44db3d2aabb
- MD5 4b8a8a7a619223c79e26fa39e12d752e
- SHA1 49b54a8a8cf49fdaf795b46a9107a976d3b6417b
- SHA512 3901be78a9077f45681ffb364c0060deec0abe34648c2823780639e7548e3b899625c68fff3e5065426dc21b980680612a05539da9f5e27f2319d2c58c6276b3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\datareporting\glean\db\data.safe.bin
- Size 2KB
- SHA256 ddc6deb3eb7b7e833abd1ce2f55975524231916b7acc7f0ffef33b9307f40ab4
- MD5 e8e5c85d07bea7f6f047acb20aa8dfdd
- SHA1 16cdc7e57634351e4988271e6161d4d85729120c
- SHA512 fc086a06b58fdb5ccaec9c3acaf156634b1cde22ba22e3694aecfafbe1db601535aaf19cc906d06a000938cc6e0a0d695ed90fb72b05afb3d1b65b67b6e79471
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\datareporting\glean\pending_pings\6b93956c-d970-4259-98e2-30549dd79446
- Size 745B
- SHA256 514e8f38a0eeceb3967910365b20884b794c8e4078b429c5fae6058e5816e22f
- MD5 407502f3c1cd67c32e288dfa11396ae1
- SHA1 cc9503e2f296034155ff5e55d241d1da6054954b
- SHA512 aad6cb2f7563bcef0da33b84cc4c3555c582a226dce20e2532363950f9b7b502e12d0e6867a0eed151cabc7873c1a1c388996e55e596c7123a60851c86660ecc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\datareporting\glean\pending_pings\daa95325-4d3b-4445-b4e7-12b65ef51a7d
- Size 12KB
- SHA256 6e84ffc9bf79cc44073dd3cdf6b98728e0097b46b77e6dbcda715be05d8ef333
- MD5 e254d30442cdb546c26f16113201bc17
- SHA1 0a1c7ee3da3581811782030b49ee98b503b12d08
- SHA512 07a1d5821d35c7f5cc6512a33dbf6471796dc000fcf650e78adf20b84014e166702839eb43dfae7fe25f97c6a374ce1f016bc47ab58406a36416ebbf13ccc10c
- SSDEEP 192:0aKzfgOskUMqhB+k7o50xf4dSyjRwqwBvD0MJjMUvXyfMRCIgQyicK7mLP2AJdQP:0MRmLPbJEjbr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
- Size 997KB
- SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
- MD5 fe3355639648c417e8307c6d051e3e37
- SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
- SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
- SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
- Size 116B
- SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
- MD5 3d33cdc0b3d281e67dd52e14435dd04f
- SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
- SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
- Size 479B
- SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
- MD5 49ddb419d96dceb9069018535fb2e2fc
- SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
- SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
- Size 372B
- SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
- MD5 8be33af717bb1b67fbd61c3f4b807e9e
- SHA1 7cf17656d174d951957ff36810e874a134dd49e0
- SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
- Size 11.8MB
- SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
- MD5 33bf7b0439480effb9fb212efce87b13
- SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
- SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
- SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
- Size 1KB
- SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
- MD5 688bed3676d2104e7f17ae1cd2c59404
- SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
- SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
- Size 1KB
- SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
- MD5 937326fead5fd401f6cca9118bd9ade9
- SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
- SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\prefs-1.js
- Size 9KB
- SHA256 ee109e959af9da42c91334d419df8b8254df4f066e946b0d6c7eeb7814a1b7a3
- MD5 42a59cf023a8630ce37a8896cebc5231
- SHA1 30848d035f8546205e87ea8a6f15b62d60f95822
- SHA512 571fbc0b674eb17eefaabbc7d406c84da8a223aa1234ad833e4863faa146dd9d1ac45b215bb5916500ef080ab7a6b6f5df6d2179b7d2a2473e98655204813b23
- SSDEEP 96:xHPZqinUTeqGqOdhVDHyQeOTzSnsPXAnpjBHP52YSfVbtSwZRBw8H/qJzFIswEY3:1ZVnIROdhVzyQemPX6P5mRBw8H5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\prefs-1.js
- Size 7KB
- SHA256 b72349a560d45ea7611814cd658249c19d5f0efb8b157c16fcdb5a032ab585d6
- MD5 8c339d1e2cf0750b08cee5766f4b87ec
- SHA1 6665da51e3f69ebd749732d153cd621fb6809046
- SHA512 a0aecaf3dbe403a0a37d247190428a629432889702b4624581c524b0c69bb91eea08816efbf5decc52ea664fc91edadf2233df562303c226b24fc568bc364dc0
- SSDEEP 96:xHPZ5nUTeqGqOdhVDHyQeOTzSnsPXAnpjBHP52YXBw8H/QzVFAwDvvX3e:1Z5nIROdhVzyQemPX6P5BBw8H7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\prefs-1.js
- Size 10KB
- SHA256 552fd75dbe4e1ad05011a126ba55e4a6a579c1fe1123bd96c2efdda0beb35624
- MD5 4cd8fd8472abd989fbeda2c40e7305b1
- SHA1 bddcc516cdd20620e898557d999239be827aa815
- SHA512 6af7126784bf4acb197165721d7fcb2cd1583dc17d33f24164a3386d5908a18cead41a6fdd5e98bcc2bbec79874d1ab78508705520a4efa6a05c0f6fdb1c2813
- SSDEEP 96:xHPZqZnUTeqGqOdhVDHyQeOTzSnsPXAnpjBHP52YAfVbtSwZRBw8b0q/qJzFIswT:1ZInIROdhVzyQemPX6P5cRBw8b0q/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionCheckpoints.json
- Size 90B
- SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
- MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
- SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
- SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 b3cb76d3135ff00abc251c735806203715c4ffe466ba710e886c7fb2b3b1ec11
- MD5 94080847693eb2d67d8b8c4968323c5d
- SHA1 abf776ed21cefc57242138217a9efc11fe8c2545
- SHA512 f9b4b3c1d221d35d0a12623002fba376c2d388dd4d6992efcd129182c833d9b8b8367f286e717ac265d07109a61a4fa912e3c92c12a66be3c8279b2e42ff92fe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.7MB
- SHA256 2c033549d92f2529b2a5c743b477964291894f2ba4c5acf6ad7912ca5377c1b8
- MD5 4988b1805ba821d96ab5b26c06502389
- SHA1 56aa4ef228b8176d193c2dd86f23cebcb3597693
- SHA512 de1f3b5fc5da591e5bb6b6779d066b8782e92e2b3e9febcd12cdb7f99de18433f2bc17b0e27ca6acf9f9833e9409fe9af1de040dac3807d88c2ea61f9b081475
- SSDEEP 24576:ZMSOjUb7uDjZmciV0iwPtx8RCYbTnBF/V/CtZZv5OHGfZJHbBYS1cp+lObnrpWFQ:AqICuHxuACV3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\targeting.snapshot.json
- Size 3KB
- SHA256 5810bcab839e45291ffd4c0cf2415d2f672f40c4f57711d2236cdf695c912ca1
- MD5 d950801c7ba8931ea873f074c31f64ee
- SHA1 a79637c72e527b1e2d647db0819b54f606e67d50
- SHA512 82d2b8e651fe8b1b3a99ff05f75aa467fae297e96d5ded4fbb44fbcc6af1dc79695acbe6425c8139a2ae7896c333e4aac69f0f20bb89940e2899beab13142c62
- MD5 SHA1 SHA512