4460dd8114b5609ea4e9644a659de0f5b188696d27dc8846d633628b3ade7c31

Analysis

max time kernel
79s
max time network
81s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17/05/2024, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Set-up.exe
Size

7.3MB
MD5

41f159509017d234e08eb4f820bab935
SHA1

1c27a70f922a95f66f58d8e4b7e91d92c84da6e3
SHA256

4460dd8114b5609ea4e9644a659de0f5b188696d27dc8846d633628b3ade7c31
SHA512

0fdbad1473708fbf1116638195881026caab40a5b64ab31ca25a027af81189bf94af403d5b1c35c5561970adaeef648b8ed5ef8c3ba63b163e931787e82636ab
SSDEEP

98304:wz16s9EwkidrwQwPdz9u/ZZmDZJErFXQbZT7wIX025:wz16gBrd3gu/XmDZiF0t5

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Set-up.exe = "11001"	Set-up.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Set-up.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Set-up.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Set-up.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4660	firefox.exe
Token: SeDebugPrivilege	4660	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4660	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 4660	980	firefox.exe	78
PID 980 wrote to memory of 4660	980	firefox.exe	78
PID 980 wrote to memory of 4660	980	firefox.exe	78
PID 980 wrote to memory of 4660	980	firefox.exe	78
PID 980 wrote to memory of 4660	980	firefox.exe	78
PID 980 wrote to memory of 4660	980	firefox.exe	78
PID 980 wrote to memory of 4660	980	firefox.exe	78
PID 980 wrote to memory of 4660	980	firefox.exe	78
PID 980 wrote to memory of 4660	980	firefox.exe	78
PID 980 wrote to memory of 4660	980	firefox.exe	78
PID 980 wrote to memory of 4660	980	firefox.exe	78
PID 4660 wrote to memory of 3156	4660	firefox.exe	79
PID 4660 wrote to memory of 3156	4660	firefox.exe	79
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 2152	4660	firefox.exe	80
PID 4660 wrote to memory of 1660	4660	firefox.exe	81
PID 4660 wrote to memory of 1660	4660	firefox.exe	81
PID 4660 wrote to memory of 1660	4660	firefox.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies system certificate store
PID:4024

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2200

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.0.521979320\113767181" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcf83735-49fd-4206-af2f-cc9e2b7519fc} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 1796 214a2fd3158 gpu
    3⤵
    PID:3156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.1.1039364302\1536520070" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da3bd5cd-7461-4b8c-b037-a94187e63b57} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 2152 21497e71958 socket
    3⤵
    PID:2152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.2.748684756\1704320123" -childID 1 -isForBrowser -prefsHandle 2804 -prefMapHandle 2784 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1204 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {514a0ac5-fc24-40b5-ab2f-7bf18ee20b03} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 3008 214a729b158 tab
    3⤵
    PID:1660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.3.1860909524\1715063878" -childID 2 -isForBrowser -prefsHandle 3484 -prefMapHandle 3480 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1204 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e86e5f0-1817-4c5d-8864-b51101aa1c33} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 3496 21497e62858 tab
    3⤵
    PID:2956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.4.1713360030\866374394" -childID 3 -isForBrowser -prefsHandle 4176 -prefMapHandle 4172 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1204 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3da78689-3ba7-41d0-8667-13b764d8ae02} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 4188 214a8eba558 tab
    3⤵
    PID:4272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.5.464141042\164405622" -childID 4 -isForBrowser -prefsHandle 4880 -prefMapHandle 4876 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1204 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f325c59d-4a9c-4ad8-a1dd-10db8daba45b} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 4868 214a5680458 tab
    3⤵
    PID:4108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.6.1880763044\48219471" -childID 5 -isForBrowser -prefsHandle 4952 -prefMapHandle 4956 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1204 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2dcab834-358a-4a6f-b6d0-f49da927acd4} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 4944 214a95a8258 tab
    3⤵
    PID:3636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.7.1555330623\335732334" -childID 6 -isForBrowser -prefsHandle 5128 -prefMapHandle 5132 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1204 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce213da6-4221-487b-a70b-025c6d2e6584} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 4916 214a95a6a58 tab
    3⤵
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.8.1117274040\1666201227" -childID 7 -isForBrowser -prefsHandle 5596 -prefMapHandle 5628 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1204 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cfca5d4-0cd3-4b78-b1a5-dec054ea0149} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 5588 214aae3ac58 tab
    3⤵
    PID:168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.9.388467068\494258242" -childID 8 -isForBrowser -prefsHandle 5464 -prefMapHandle 4848 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1204 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {25ccc90d-7884-49b4-8c4b-faf500fd500d} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 5660 214a8818b58 tab
    3⤵
    PID:3804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
c1ec37c5d5da194f7f65f2ba5c78118d

SHA1
c1f34d34d15b3e5eef3bd64868716bec02494ce7

SHA256
0d1befaa24e9821059936f3d63feff8344304868b67b88f769fb1b65b6fea24b

SHA512
f6e88c5dc0c56d2ed8c637567064d50071de320c1a2a1cde2020bd41e0eda08a6f58a60ba80e06d2d34373a8daebaa01baba1de0201e293de134c8d96e821818

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\6c366798-d17c-4084-a732-71ae55771658

Filesize
746B

MD5
4713440bc9ca8bcfd6b6df98f0ea78dc

SHA1
7faad0c7393110702c4fb48822d861b977e4d447

SHA256
6dcba2093ee9badf442bedcf5c4a6be465d71a01bed17e6c046e979407726eeb

SHA512
de78cc9fa4c15bdb5d1464459ad179c3ab2e07358908eef70e419f088f6f02240fe25294eb029ae08810f157cd106bf2792e82ccf1b503be0a367b58e744eb1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\b623db26-3950-4a3b-8c54-c7acc3771c16

Filesize
10KB

MD5
f39ad2bb0ef6d8d0aa0508f4e39698db

SHA1
45db8a556b0a8a7e37712c55e6d0451b08044e72

SHA256
d200ba79bd3973b0bdcbe02666be22f8184f2791731cea2604d1a2f3e25db5e6

SHA512
5ba5ee0851d95ce9f816d75c9f68ac806f44e41f4223aa1e3ee69b0d321552450060502ae10fc938ab493964bf8312c8dfee191b65910142e5bd0a9473fd8090

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
da2d4f0034d005f91f260bb53f253c9a

SHA1
a266a41683dc66129009232ca570509bff293f46

SHA256
4fa740824859ac526f8839f87e9b069a6b51b76e578eb5ee6be364eb6e75aa7f

SHA512
9064e6b89ee3b1abe878a77d0474e1ab3805389913f6c746bd0e2736ee589b2977f62a0461f2f9225ca3198a0fc445dd0c050efc13bcee721da031ca444e868f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
30312316b41a876c640a746b079fcb82

SHA1
7c4917b3e503112034b4ad88f4b4962ecf9037f9

SHA256
c22b4e017081a76a33544595d1e4833359d197379439a83251345f5a0c6a764e

SHA512
84e21fdd321c19941c1aca80d035b93f4562a3c1aae42f5702f42dfba3a10af2cc13c745208bd01c63eadb06ef2c82dbd9c3bd1f580c068caf6cbfbdc3032171

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
77a2d027fc6378d6cbf158dd06dc6b75

SHA1
2e4a05fd383534a61d5375b12bc8002cb3f4356d

SHA256
a3baff6fd95b9190407646b467c0576a04e11a27de5efcd621594c2a5e195331

SHA512
df523086c5fc9eb45095cd664b012bf51378c64bf91c0e91e213d0fea3eccc362762bb7491556df0b9db76e0444c9fc7390a5c6aefe0c6d53f1304118c5c36b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
41f55839dea81cc01abe4bedbb02702d

SHA1
b5723113ebe9434a1ae439a9798a26a8af64e910

SHA256
781339868fdae7a2fc6831e69b1a58b3ec49e0e9f304d99ac503f705482d88ed

SHA512
8f28c026c30698e1b2d56ae573745eb5bd34b1c83df968671a0dd6201b2ce845147c23a3f27a878c440ce73cb0bb7d90c4670bfb9726225e84ae28c8c10f2346

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads