ed6566cd8828d0d9a7bd2bd7731df7703977d9b18fa7ede31bb8b1835b12da78

Analysis

max time kernel
123s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2024, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fagality.dll
Size 36.1MB
Sample240317-yl7a6aed66
SHA256 ed6566cd8828d0d9a7bd2bd7731df7703977d9b18fa7ede31bb8b1835b12da78
MD5 38bf550f8d73ea9791d7778d9b6b44a8
SHA1 67bf70a4d78f9f18b1af30cd9c85c632b52188c1
SHA512 cfff6d55b90a42be22d09aaf30eed718b71fff8bfddab2404e968359a18ab8aec679a4ca85e144d3527602fd515a03724e897addd68865e796b0a387f582fd7f
SSDEEP 393216:g4S82OrtN+zJkGsF20dH5ZXtpKjzw1QxgvLqmNAmjpy:7OOrtN+zJkGsF2OZZXuv4GcLjp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3368	4872	WerFault.exe	88
3488	4872	WerFault.exe	88

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	firefox.exe
Token: SeDebugPrivilege	5112	firefox.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5112	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 4872	3044	rundll32.exe	88
PID 3044 wrote to memory of 4872	3044	rundll32.exe	88
PID 3044 wrote to memory of 4872	3044	rundll32.exe	88
PID 2280 wrote to memory of 5112	2280	firefox.exe	113
PID 2280 wrote to memory of 5112	2280	firefox.exe	113
PID 2280 wrote to memory of 5112	2280	firefox.exe	113
PID 2280 wrote to memory of 5112	2280	firefox.exe	113
PID 2280 wrote to memory of 5112	2280	firefox.exe	113
PID 2280 wrote to memory of 5112	2280	firefox.exe	113
PID 2280 wrote to memory of 5112	2280	firefox.exe	113
PID 2280 wrote to memory of 5112	2280	firefox.exe	113
PID 2280 wrote to memory of 5112	2280	firefox.exe	113
PID 2280 wrote to memory of 5112	2280	firefox.exe	113
PID 2280 wrote to memory of 5112	2280	firefox.exe	113
PID 5112 wrote to memory of 4276	5112	firefox.exe	114
PID 5112 wrote to memory of 4276	5112	firefox.exe	114
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115
PID 5112 wrote to memory of 1920	5112	firefox.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fagality.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fagality.dll,#1
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 552
    3⤵
    - Program crash
    PID:3368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 836
    3⤵
    - Program crash
    PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4872 -ip 4872
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4872 -ip 4872
1⤵
PID:4756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5112.0.1594010616\1995592023" -parentBuildID 20221007134813 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82d02e56-47a0-47bf-9ace-cde3fbc6ce94} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" 2012 2a97bdce458 gpu
    3⤵
    PID:4276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5112.1.696790320\1968853219" -parentBuildID 20221007134813 -prefsHandle 2400 -prefMapHandle 2388 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a8bde26-e1e7-4896-b2ca-84d194e94425} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" 2412 2a97b93d158 socket
    3⤵
    - Checks processor information in registry
    PID:1920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5112.2.786893390\653330926" -childID 1 -isForBrowser -prefsHandle 3428 -prefMapHandle 3424 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {616c6ac5-6103-4ed8-8676-d2e30c9129e1} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" 3436 2a9022a3158 tab
    3⤵
    PID:5164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5112.3.1793299548\1696737680" -childID 2 -isForBrowser -prefsHandle 3264 -prefMapHandle 1092 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d790594-aa85-4688-a94d-44bd7eb9ea1f} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" 3124 2a96f662258 tab
    3⤵
    PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5112.4.1139293209\1716864698" -childID 3 -isForBrowser -prefsHandle 4460 -prefMapHandle 4456 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0aae6867-9203-4acc-8cd9-218441a1b267} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" 4472 2a904219b58 tab
    3⤵
    PID:5680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5112.5.702789083\349327902" -childID 4 -isForBrowser -prefsHandle 4472 -prefMapHandle 5012 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {061d747f-f410-4102-938a-651be5b017de} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" 5020 2a9043fa858 tab
    3⤵
    PID:6064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5112.6.1253935539\394106098" -childID 5 -isForBrowser -prefsHandle 5148 -prefMapHandle 5152 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92be3135-0ff1-409b-9046-8ea16efc69de} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" 5140 2a9043fc658 tab
    3⤵
    PID:6072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5112.7.1068528488\1787163638" -childID 6 -isForBrowser -prefsHandle 5340 -prefMapHandle 5344 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3975d18-bd4d-4e00-9cfb-62bb83d3ca83} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" 5424 2a9043fb158 tab
    3⤵
    PID:6080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5112.8.679690864\266100650" -childID 7 -isForBrowser -prefsHandle 5952 -prefMapHandle 5948 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10b1c55e-d5fc-4137-bea8-a9be8fb685c7} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" 5960 2a90676ef58 tab
    3⤵
    PID:5860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5112.9.123071532\1456412753" -childID 8 -isForBrowser -prefsHandle 5336 -prefMapHandle 5424 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15e28a6a-6934-4578-ad87-5accf21ade83} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" 4456 2a9043fae58 tab
    3⤵
    PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75618D4814E59EE271AAA434B222669E870291B3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\cache2\entries\75618D4814E59EE271AAA434B222669E870291B3
Size 59KB
SHA256 f3387e8edc2b8f90fe716ecf4da63be6f108a7ea6a15cf5402ecbad77edb7f3d
MD5 fa8fa3031cf06a014a3d22ac3e3919c8
SHA1 9ae76feb6b0145b8bb8a84a79f45b967afb78b5b
SHA512 503b9840579e8a5da584da25f59ed199cdaf1f49cbe9a7cbf21891580306db82cbbce4691796965e8afcd16891703bc7431fcc6ac62e11303fae10d8d497b2ed
SSDEEP 768:sC7xpIgnCUCWAw91oEaev5ygUQwnCUCWAw91oEaev5ygURkDP1Ad2EyudO7pwPoj:skVXtAOlU3XtAOlURCL7SQj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 ddafb91bcde356268856ccc35e71544be7a67881f46570793f36e378023d572c
MD5 ea287b9fb2ea9dc5287af17451ee1071
SHA1 edeee6cd0475546f51e308b78fec49fc1f77faa2
SHA512 bced6c9b42f117a04d1c780ee7db52d7e86a659ea3930e68970214be1610e08233ebaaf63a0e61f7bb03cc009232adb1e659fc26dfd67da789cee4a2ae560aa3
MD5 SHA1 SHA512

Submit Download

1d63c5d4-7d1c-474d-9f66-967ee74498d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\datareporting\glean\pending_pings\1d63c5d4-7d1c-474d-9f66-967ee74498d7
Size 11KB
SHA256 8d269fbcea221acf76397556431202eb9ac42d96bb29aeb6fdf6ebe80e7db4d7
MD5 9a5e58d067f167e336d85454676fe597
SHA1 3aefb0ecc5f98703b2589152dff03a499be7e096
SHA512 a98f70bd2117615c8c24ca879d747946f54dbd8b5b68028792eb12a7863091661bd03780e02dc1b8c24853540fdb54b1d455ef1efe240b173e514b39184eeb04
SSDEEP 192:RCTHMaiF2UEWOokpDCp9bfjTCDMNeJUKWlhI52yrayChxW/uCCSmj5+tN1eY9Fe:Rfttc85i1de
MD5 SHA1 SHA512 SSDEEP

Submit Download

c198a8c9-dbe6-4312-a077-8e22ebe89312

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\datareporting\glean\pending_pings\c198a8c9-dbe6-4312-a077-8e22ebe89312
Size 746B
SHA256 c42047e3d689708b33a36f28e72673cffa726d3fafe058b8c19bbddd4ada670f
MD5 a6aaef2f50c211b82ef371391dbf9cc9
SHA1 0b781400a5bb9418c9b0d64dc8c2643e013db4d5
SHA512 7fa8e7756afc75a166b433be1d2343130e0f050d21dd91b6db8a204736c6ea4217f93ecfc231d1abcd5bcecce3b330f7610730151267b6e5ee25216b38e904e4
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\prefs-1.js
Size 6KB
SHA256 e519cc5b964c6b60c0ed58515b9ce214a89a56782b3bc3b315b1e0d6e9fda181
MD5 6c5f4c2955d563b805a5092342a3c6d3
SHA1 b77f633ecaf43480cc98b124ff7ae0adbcbd199a
SHA512 b7ee9681a6d08d6db914d55013f7fe3e4c9f1e45be2c17288a21d99403744a22ccf7ee6ac391a99c0074ab0d069aae2d59e08412ecbdcc3e48e6c5cb634ca138
SSDEEP 96:xHgynUTeqGqGdL0+XeOTzSpPXAnpj/HXxFVd7LC9Bw8HEeGS:SynIRGd4+Xe3PXsBFr7LaBw8Hl
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\prefs-1.js
Size 6KB
SHA256 b5f2533669f6a9182d05647545e91476f382349014fd48cdad20b1b025b58522
MD5 25a8d1ebe7665e6be7030bae2cdd5ef2
SHA1 c6833d8015e0b43f362e0a4ebab074ddd400651f
SHA512 ff15d87ad15682d732af6af8cdb9296ce6b15c037da5f6d9bf983eef5de775eb6be304364e1688bf0ec074db27b2e5c8e1072bd0aeece4cd5af87faf6f29e80b
SSDEEP 96:xHg5nUTeqGqGdL0+XeOTzSpPXAnpj/HXxFVd7LC9Bw8HEvGS:S5nIRGd4+Xe3PXsBFr7LaBw8HY
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\prefs-1.js
Size 6KB
SHA256 9bfe4cc6d0157c50f73eea79fa6cf9ff0f2b3e031790c6b64882a0374614253f
MD5 065447c8e5916ccf682331bfae3876c6
SHA1 0ba6d435186181339ac0fc898be569c0d8dcb6c5
SHA512 494322be6c4decee127a28f6fe1ec8fd106a1303ef7039f1a3c90f7dc3924a48c50442f908735265d0e10163f5005c65b98c60af48734fb300946aeacdc3a2fe
SSDEEP 96:xHg5nUTeqGqGdL0EheOTzSpPXAnpj2CHXxFVd7LClBw8HEvGS:S5nIRGd4Ehe3PXyBFr7L6Bw8HY
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\prefs.js
Size 6KB
SHA256 4f42b2251ae795745091693dd5636e05c4749393f11e651c0a64f1b9d92740c5
MD5 14954438b03539a1344050c31f6235d4
SHA1 c2bc51be3a7c9d29aa58d5def238be22c2f72f30
SHA512 68985ad323491644f4a7b085c2a9cf0a15bda063e5c5a5d1d88c731a3dc2fd0938903b4a7c4f3f7b6a93eddd33e28439e6fc7044055563fea459b9dee67a78cb
SSDEEP 96:xHg5nUTeqGqGdL0EheOTzSbPXAnpj2CHXxFVd7LClBw8VE2:S5nIRGd4EheBPXyBFr7L6Bw8VX
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 b96560466d3d69f07e528f9162fba612c142546bf25f599cae3f0e545f94dc15
MD5 b04405183ef5fb7494c6397def6011b6
SHA1 4b697eedaad2d47cde25c94e72ccf9fd25a25fde
SHA512 04bff5cc5f8699ef8393fbe7909e6df0c8b794029f88a6335f1db9a3912dda8373f7e4da9a5b8cfb7fd226ef2faf596caa6a37cf58cd4f630961579fdb66975c
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 4415ead91c44bfca0e68f4ba47c74fad4106d12dbf2c4d19d0fba0cc496c81ca
MD5 f1cdfe3b466461ca87b75d4d1280ee35
SHA1 460560e20395ee09bda9e3987bafb934aa2348aa
SHA512 b27395a15cf3edafef950cbc2011b61ea4f3bb1893f7b46fc2ff1fac1db1d9f53c15d3553d6c5515b4bcb818769d22c77bfab0d8b085e457b0fc8d1af4217de1
SSDEEP 96:klYBaqMm825eU/Fe8EMJF74HMZk0zf8W8Qge3ZwS2ajxX78wypP:kxqMm5/8RgFqMZkcuemm1rByV
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 2bfe7dd977949b492970f0741db7972559b6f6d0ed46d559e4b4d323176052ec
MD5 2a9ba4a853708d008a0331d9a5b7d052
SHA1 e84e6fc6f856c2b197ffd01bcaae8466a5d5a403
SHA512 53ed37a0ac02e772783b985b8c49bdd18059b649ec90f76979c1998e11255f7a57073c24f4a29b99a6b7e5c043c00ef84c7a2de57323ba8e9f7b58c5aea45f44
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 f688d7a85596115e42a6542e30fc28b059f891009ffebadbf926ed978ee07dc6
MD5 e45d57a2b5e384a16e32799647807fbd
SHA1 a581747bac826f04bbb4bfb7712b23b39a47a5e5
SHA512 7119c36bf76b07ea2228bb62f1d9d7c0b9d1ccbe56af07f01d312aec7ee34cda5bb92c844c10127991a2e4edc51b274e2b8c42e3e87bc49f35d014a686e0764d
SSDEEP 96:klYBaqMm825eH/Fe8EMJF74HMZk0zf8W8Qge3ZwS2ajxXC8wypP:kxqMmo/8RgFqMZkcuemm1SByV
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 6724ae7a5ba6eb16b6713ef659b108dbd829a835c82cfa66ef0f5d73de0e5f62
MD5 1ce376ed3290492f79539a7158cf519d
SHA1 aa0456d901e0c5b48ad20ffe296887e6257585dc
SHA512 434268727e3d17eb80310309379edb878bfd14ccd2d5bc80924955d378972645e9e22e966d7c86a1d8667ae2284380afa30bdbeb99999febe0dcea31731a8f30
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore.jsonlz4
Size 3KB
SHA256 f4e538555dbe02a16d7bafbcc3ddabbb2db1209b4b65882d39b2a2483ca610f8
MD5 f10f7c591c0eca8b1d07e0fb73874859
SHA1 9a259787713beceb480d3ba2c3f3d9cab870d01f
SHA512 b2863c1146ea6e2cb1365790b31a4b11ffd86c34903414a24dde0fc2cc69e466e9e38c883e416c6bd35b6c6dac605ea60c6ad6d52bba2da65f9de44ef1f38f88
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads