9d8a42eb0b3fc58eb7940a09c1a97d8c24dac32a995ee025bc405dea9ee1d2bf

Resubmissions

07/06/2024, 15:50

240607-s92gxsbf723

07/06/2024, 15:42

240607-s5l7fabe973

Analysis

max time kernel
299s
max time network
298s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
07/06/2024, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ultimaker-cura - copy.exe
Size 10.9MB
Sample240607-s5l7fabe97
SHA256 9d8a42eb0b3fc58eb7940a09c1a97d8c24dac32a995ee025bc405dea9ee1d2bf
MD5 257ef03065658a2daaf52dfcfbccd4a5
SHA1 0a3ccc8dda96634841cf5ed7f6ae676c99a48950
SHA512 ad74188c239b893b6c0bdca15790ffe4d34597d17cc97a586b74b68e6f2b78d153ea7422a9fe20154191816e6203c606d9597683f8064775ab5583c85329c156
SSDEEP 196608:GD95qO9+Jpvi5fxkzlHLAb5Qid6bIDe5gUq+qpXehpM9k4Rlj6mKWm:CSO9+JphNsb5td6bIDe5gnsZ4Rlj68
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeBackupPrivilege	3948	svchost.exe
Token: SeRestorePrivilege	3948	svchost.exe
Token: SeSecurityPrivilege	3948	svchost.exe
Token: SeTakeOwnershipPrivilege	3948	svchost.exe
Token: 35	3948	svchost.exe
Token: SeDebugPrivilege	1252	firefox.exe
Token: SeDebugPrivilege	1252	firefox.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe
1252	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1252	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 1252	684	firefox.exe	89
PID 684 wrote to memory of 1252	684	firefox.exe	89
PID 684 wrote to memory of 1252	684	firefox.exe	89
PID 684 wrote to memory of 1252	684	firefox.exe	89
PID 684 wrote to memory of 1252	684	firefox.exe	89
PID 684 wrote to memory of 1252	684	firefox.exe	89
PID 684 wrote to memory of 1252	684	firefox.exe	89
PID 684 wrote to memory of 1252	684	firefox.exe	89
PID 684 wrote to memory of 1252	684	firefox.exe	89
PID 684 wrote to memory of 1252	684	firefox.exe	89
PID 684 wrote to memory of 1252	684	firefox.exe	89
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 4772	1252	firefox.exe	90
PID 1252 wrote to memory of 2032	1252	firefox.exe	91
PID 1252 wrote to memory of 2032	1252	firefox.exe	91
PID 1252 wrote to memory of 2032	1252	firefox.exe	91
PID 1252 wrote to memory of 2032	1252	firefox.exe	91
PID 1252 wrote to memory of 2032	1252	firefox.exe	91
PID 1252 wrote to memory of 2032	1252	firefox.exe	91
PID 1252 wrote to memory of 2032	1252	firefox.exe	91
PID 1252 wrote to memory of 2032	1252	firefox.exe	91
PID 1252 wrote to memory of 2032	1252	firefox.exe	91
PID 1252 wrote to memory of 2032	1252	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ultimaker-cura - copy.exe
"C:\Users\Admin\AppData\Local\Temp\ultimaker-cura - copy.exe"
1⤵
PID:636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Users\Admin\AppData\Local\Temp\ultimaker-cura - copy.exe
"C:\Users\Admin\AppData\Local\Temp\ultimaker-cura - copy.exe"
1⤵
PID:1196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:684
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.0.1081774115\73302625" -parentBuildID 20230214051806 -prefsHandle 1768 -prefMapHandle 1760 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1687e114-f29e-4f9a-8369-4c0ea863caf6} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 1848 206df803e58 gpu
    3⤵
    PID:4772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.1.95076332\1568699650" -parentBuildID 20230214051806 -prefsHandle 2344 -prefMapHandle 2332 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {adc31c12-4b4c-4114-be6b-8d9ea77ba4d6} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 2372 206d2a8a258 socket
    3⤵
    PID:2032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.2.717447844\1427248346" -childID 1 -isForBrowser -prefsHandle 2936 -prefMapHandle 2932 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {750b669f-f3b1-41df-8d8c-419096a5b675} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 2948 206e21e9c58 tab
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.3.1488079273\578794519" -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3440 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ab659b0-0ae1-44e1-8ca0-bc148161cd73} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 3572 206e4c74258 tab
    3⤵
    PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.4.1537122533\962065852" -childID 3 -isForBrowser -prefsHandle 5124 -prefMapHandle 5136 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a42b43eb-4148-43f2-bb09-f9ee76c99898} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 4924 206e7b20858 tab
    3⤵
    PID:912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.5.1784156238\563789927" -childID 4 -isForBrowser -prefsHandle 5292 -prefMapHandle 5296 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {799e5fd1-b796-49b1-94ff-0e2afef1b680} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 5276 206e7b20e58 tab
    3⤵
    PID:240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.6.1281391873\327136379" -childID 5 -isForBrowser -prefsHandle 5456 -prefMapHandle 5460 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbab152b-f9b6-41b8-93a6-b62ed57ef296} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 5448 206e7b43458 tab
    3⤵
    PID:4440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.7.1431472015\1392751676" -childID 6 -isForBrowser -prefsHandle 2760 -prefMapHandle 4952 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfd6db8c-1844-4ad1-831a-225925085354} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 5812 206e65a4e58 tab
    3⤵
    PID:4692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.8.938582309\1024255412" -childID 7 -isForBrowser -prefsHandle 5764 -prefMapHandle 2748 -prefsLen 27960 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62f5a44f-164c-4b3d-8858-9fb5747edc4c} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 6092 206e6811c58 tab
    3⤵
    PID:4428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.9.507904647\2040447791" -childID 8 -isForBrowser -prefsHandle 5148 -prefMapHandle 2748 -prefsLen 27960 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7b05136-1f62-4ff3-bd72-5db2e8ad281a} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 5088 206e7bb3c58 tab
    3⤵
    PID:4140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.10.602000885\1076339141" -childID 9 -isForBrowser -prefsHandle 6344 -prefMapHandle 6256 -prefsLen 27960 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd6b78b0-188b-46a6-8771-12fc5306d728} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 6212 206e91d2458 tab
    3⤵
    PID:2332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.11.824595199\1355713156" -childID 10 -isForBrowser -prefsHandle 6508 -prefMapHandle 6512 -prefsLen 27960 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a2c090f-7a84-4bfd-ad66-9d6fd5c02b61} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 6500 206e91d3658 tab
    3⤵
    PID:3096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.12.703458603\1657195249" -childID 11 -isForBrowser -prefsHandle 5616 -prefMapHandle 6268 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8554b02c-928e-44db-b7c2-ea23eac948ac} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 5440 206e8e07e58 tab
    3⤵
    PID:3944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.13.661846798\1116188986" -childID 12 -isForBrowser -prefsHandle 6804 -prefMapHandle 6496 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3cf3865-d888-489a-b510-63c0c4c516ca} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 6528 206e5fe3c58 tab
    3⤵
    PID:3792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.14.2144200599\676070561" -childID 13 -isForBrowser -prefsHandle 4964 -prefMapHandle 6840 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9aa3161d-a87d-49e6-bcfa-0bb6c992fcf9} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 5140 206e5fe4858 tab
    3⤵
    PID:1388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.15.1506256876\546972868" -childID 14 -isForBrowser -prefsHandle 6136 -prefMapHandle 6156 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d69f73dc-4d16-46d1-944a-1e898ff99bad} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 6492 206dffcd258 tab
    3⤵
    PID:404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.16.901974561\1018766702" -childID 15 -isForBrowser -prefsHandle 6096 -prefMapHandle 1596 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8fa4054-b7b3-49a8-a749-abd397c902ae} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 6112 206e90b7858 tab
    3⤵
    PID:2984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.17.1157729160\533055912" -childID 16 -isForBrowser -prefsHandle 6312 -prefMapHandle 5452 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94f47adb-28d0-414f-9917-b7d86179c6d7} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 5216 206e9814a58 tab
    3⤵
    PID:1952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.18.1231091672\1396644223" -childID 17 -isForBrowser -prefsHandle 4628 -prefMapHandle 5040 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc9846f4-d1fe-422b-8412-d39072dc949d} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 5840 206ea3eeb58 tab
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.19.1542609558\302082415" -childID 18 -isForBrowser -prefsHandle 10192 -prefMapHandle 10196 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8689eaf0-f3c2-4ac1-8f19-d30354ba4e13} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 10144 206ea3ee558 tab
    3⤵
    PID:1312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.20.1863117467\2069254625" -childID 19 -isForBrowser -prefsHandle 9900 -prefMapHandle 5996 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c78d5fa-52e0-4174-951a-1ff44290ee6f} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 9852 206ea4bce58 tab
    3⤵
    PID:2108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.21.1323744383\1083320592" -childID 20 -isForBrowser -prefsHandle 9880 -prefMapHandle 9636 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3ea1e0f-aef7-4147-a84f-5a1085720a38} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 9648 206ea8f9e58 tab
    3⤵
    PID:1752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.22.1699045597\1385122358" -childID 21 -isForBrowser -prefsHandle 9480 -prefMapHandle 9544 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88595d33-4ede-4b7e-b940-3bd8e787001a} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 9496 206ea8f8058 tab
    3⤵
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1252.23.2071202998\369311951" -childID 22 -isForBrowser -prefsHandle 9784 -prefMapHandle 9832 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1332 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddbd05fd-2358-41d4-b571-1f0277968f07} 1252 "\\.\pipe\gecko-crash-server-pipe.1252" 9808 206e5407e58 tab
    3⤵
    PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\activity-stream.discovery_stream.json.tmp
Size 24KB
SHA256 d0c3f7a42bbfb620f6015b7c5005aac93a018817c40099ac1badaf47f00e9178
MD5 b3cbfbe08ba38e03fd577debe9b4a622
SHA1 8a0263ed6440aeadb149ac3e64eaa27612039b33
SHA512 b12e1b362d7e803ab207a24264190f2a14744022f7b2d823717eef8fc4504f880f3beb4895c190f1a1cf861376657496bd32e4a1b3c8c141febff37a236652b6
SSDEEP 384:rY4HexSeEjuoBURKSnoDfg7JkRjcmYITQiVOWChd25d6M/PAWjLepJyaa:rYOeKrUc9g7a/SiVohU0pJy1
MD5 SHA1 SHA512 SSDEEP

Submit Download

10701

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\10701
Size 21KB
SHA256 0dafd0d629c425ddf5563e6751db34bfe5fc5326627bc5064bd78230b7871877
MD5 a219e8d19a48a2a08b2bde58a8c21f92
SHA1 9e2a709380235893f37486f883c9d0a56ca49f6f
SHA512 7471372c9a7a3a07e8bda7f03212a9827279d79ec65e719d6e0fdfd280417a242b07585ae0b642e9e124a8030bf796a0cb6a599422e75e9ff732eab2c6f3682f
SSDEEP 384:W4da5FnYdsUbwfd3dRRWT9b3Md/lkIcAwbnDbwj6pwPm082nyFz//v7:Wga5FnYAtRWTh3Md9kuunDbo6pwPo28z
MD5 SHA1 SHA512 SSDEEP

Submit Download

12312

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\12312
Size 16KB
SHA256 525233564de081bcdf3d80b7203c67e12d61af95dbe5d717ad7d4c070e05a410
MD5 5e42b4ad3a3a96da75c64d9fcfc10809
SHA1 e80dbf76c24f451c099a429c4c6e22cb7f3fa8aa
SHA512 a79fdbb841c07515b527ecef2320bec111a2a95098143d2f1e26d2617d2c5e488e1884b286a7fea8e4a08934d3adad909f865dcad8d5833918b8738454e01dc4
SSDEEP 384:HXQFV5lHVqN4mA+EudYKZHIMhLb8eehqrufWWCt2BV1Qp:HXQD5SA+EudX1b8eehq4w2BV1Qp
MD5 SHA1 SHA512 SSDEEP

Submit Download

16243

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\16243
Size 16KB
SHA256 c9290a0d9b057a3e26af2df358a09154e709885b5a4a0a7d8efc6574415904e5
MD5 60f57a41e5be09380c8bf9861122ddf6
SHA1 bc88f8dc3a5e42aee09848086ee5a2872438ddc3
SHA512 93e5191ecbe8368d9f59d5e83f2bc126f5b2c21f8362ac4fcb6c08ffba57153432f37f4ed23f542ce5e86f3c8b9c5216c89e0b5372da4e5ec929e2919475e130
SSDEEP 384:/XQFV5lHVqN4mA+EudYKZHIMhLb8eehqrufWWCt2BV1Sd:/XQD5SA+EudX1b8eehq4w2BV1Sd
MD5 SHA1 SHA512 SSDEEP

Submit Download

19649

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\19649
Size 10KB
SHA256 21812d49bad4758f32e274afabdd47e343261e3fa096ea9fba65bf3ab4dbf30b
MD5 b69c7e40dc4897475fd6519ccb08e0f0
SHA1 cca131f516e0871da8aa1d7aaf2d172c659494c4
SHA512 90942c8b6a4f77c67f66eb163afacd2b54def7d05e96815078745cf5ddd162e1aec0442b1f37f58738af78805137d322763560d671c3ffde7ee162c168c0b082
SSDEEP 192:uHrudywVS3P1o34rqFT8e98hqrKcS+E+rW29t2BQOjNOjXw:0rudywVOto34rQ8eehqrufWWCt2BJeXw
MD5 SHA1 SHA512 SSDEEP

Submit Download

2363

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\2363
Size 8KB
SHA256 25bcb552e19a94a0255398dae7ed5677ea717585a3ed629efeaff710fe780d2c
MD5 d003c3a6a4241bbf414cbf2fed0b0ed3
SHA1 f6afe5813825de287cfbef3660e850a75f885f33
SHA512 a1d7c33aae317619b9b0d89492797e8a5b88cca79a94a62f79ce6d8066371ba44777ac251d39f7607a86695a1a5f9ca0ab328d650828a3614fdfc9eddf41fcba
SSDEEP 192:0KJKzJ95UApaHK9KJKzJ95UApaHixsMHJm4nOdAna0Axkium88:TOJ9KvKwOJ9KviBHJm2OdAnAUm88
MD5 SHA1 SHA512 SSDEEP

Submit Download

24410

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\24410
Size 21KB
SHA256 63e241caff5f4d559a8ac935fc0a5222737ac98f7894acbd102f2afadb896a62
MD5 f15590f468ada52e8f4c89310eb995f7
SHA1 87a75ca99aecf8b41850bd3ff4ef4abad0589faa
SHA512 0b226caae2f4f22853ad7e9cdf77b061c527d3257259bf055fc4627d4d595e848696720b6dc063d2e234e160c197ff0bf4f8f33227441d58bc2cee2d990e4dbd
SSDEEP 384:6qjSRZsFblPBbyLtnzQ6ZdohjJfV8Nkc4PFXcAwbnDbwj6pwPm082nyFz/ED8:6QSDsFbLbyLtnRdohJeNkc4NZunDbo6v
MD5 SHA1 SHA512 SSDEEP

Submit Download

27327

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\27327
Size 9KB
SHA256 7ea13184bfef08e4c1d2035cd05eb1b0c664b74bf6e64fc6b0e4dbc3a948a4eb
MD5 b2310e185f512fc75887176b0145f9b5
SHA1 7e3e0e63823ce4d59d4bbcd663616103a35df527
SHA512 c8bcc6144ca4bf99d5823471930d7a6fc9c6861f185806d52eb1ae30bbed084e96df23ecab5e901f6d13cabbae535d5b9f502acac710854490fb1762eaaf2024
SSDEEP 192:HP/Us6MajvmG0O/BAwJiFzmec8e98hqrKcS+E+rW29t2BVOi353N5:H0wy2kAwEFHc8eehqrufWWCt2BVOiJd5
MD5 SHA1 SHA512 SSDEEP

Submit Download

27776

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\27776
Size 14KB
SHA256 e83b971e2f5932e3d2c32ce8e9d5533396622d18c4880102999a0804b32a68bd
MD5 c1a7d197f34b3063d2839676c1a96210
SHA1 8f6d94c1c00d5268f5e75f0393e248a93d0e5072
SHA512 06463ee4527a88edcce1422c9ccaa7be6eb929a316c8fff0ed514ee9e33e1e82b6b3f8414591851e7a726cb1b455a046bbfa733893b48deccdc51bfe835f777a
SSDEEP 384:cHVqN4mA+EudYKZHIMhLb8eehqrufWWCt2BVpaG:xA+EudX1b8eehq4w2BVn
MD5 SHA1 SHA512 SSDEEP

Submit Download

28263

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\28263
Size 9KB
SHA256 4b2df10fbc7715c3eb63392129e57958228237428fcf8757daecccab78b9cd11
MD5 93770d50a74892c612bb091743e20bbc
SHA1 ddb59279760ba531c4f053a860092139ded2257f
SHA512 fa03c5a423245acb4c11b58aaab989fa559dd2c3cbc313f567ffcdbbed027780e0ef80867e536e679469b6c55f1e76f13451322d3ca0d9f778af629fe7a1aca3
SSDEEP 192:n/60VyAwbSe2+3jbs6MaejWUB8wPmiB8vA1n9E8emA/IDg:9cAwbnDbwj6pwPm082nyFz/T
MD5 SHA1 SHA512 SSDEEP

Submit Download

30362

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\30362
Size 16KB
SHA256 8a623ec56936b229306b0cc86f601529cbf2913db3a5112afcc38282698c1964
MD5 8d1421b05126992067a45f02c955b882
SHA1 b7c8ea9130d76abb2b4d08bb7b471a68e5c4f034
SHA512 766fb01da423b9183494993252d19ec7b0ea72829fffa0fe1e7989464dbda58642daf6ccd2d3621fed788a1c51a5823863f69be6d82efd71b6308cd734ce3725
SSDEEP 384:MXQFV5lHVqN4mA+EudYKZHIMhLb8eehqrufWWCt2BVBa6:MXQD5SA+EudX1b8eehq4w2BVBa6
MD5 SHA1 SHA512 SSDEEP

Submit Download

31689

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\31689
Size 9KB
SHA256 583592acd7aad42392c01d46d4daa05995bcf7d39165b88908bbe2a62d4b0aa4
MD5 9fa34521ea5579a4b51b67c82fed02b8
SHA1 c7876d25a294c5ab64165c3f745266c2bbb2591c
SHA512 8fad617998c06753261a22aabfbf010b56be27f49cdc405d2594a4a33c176b28fb4954a5eab8997d79ac8fb5058804b55137dd7fdee8a59dea304ccbb6a2f6fd
SSDEEP 192:p/60VyAwbSe2+3jbs6MaejWUB8wPmiB8vA1n9E8emA/IDt:ncAwbnDbwj6pwPm082nyFz/Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

4433

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\4433
Size 9KB
SHA256 9eb7784e7479b9891bd0b0eeb211601f31383db114fc718121833b561ddae69d
MD5 77ef7b58087807fca840f61635aba97a
SHA1 de9a7e0e5885b7a1f9e00b826f6a2812ebbd6a34
SHA512 abf811c6b0ca87559396665648252c56c2c3938eb9f523f75ee43a0dabd6b522b399b1bee15780306198ad199ad4a10b8006544aa187a4b03a49502e17d40b64
SSDEEP 192:Sh60VyAwbSe2+3jbs6MaejWUB8wPmiB8vA1n9E8emA/lE1h:McAwbnDbwj6pwPm082nyFz/6h
MD5 SHA1 SHA512 SSDEEP

Submit Download

8557

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\doomed\8557
Size 9KB
SHA256 f6791c3f839822bc3e23eac3dd32f6a6d75f1c3fbafe2c3f1ef962e4ea57810d
MD5 07649f8e9520a8952718b157e4ced659
SHA1 e5f881c243aeebf954fee6727e2fa5fb21789b6b
SHA512 0c6a42b068a9029707787dd11c167011470b6b22afe57c37363da75c51431f05736030dfe835d572903eb037a4864eb1580e320763eed6e103f0a42ff60a12a7
SSDEEP 192:MP/Us6MajvmG0O/BAwJiFzmec8e98hqrKcS+E+rW29t2BVOi3x3dn:M0wy2kAwEFHc8eehqrufWWCt2BVOiBtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

0953624224F7267CF05DA78CA4941B5655CC3AE8

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\entries\0953624224F7267CF05DA78CA4941B5655CC3AE8
Size 18KB
SHA256 18e740206b3662500286aa41892ad9e791922cef8a14a7413cca1342ec0ee171
MD5 37eb762f157456406bcb5954ccf87c4e
SHA1 cfa5ee15007a1476dd001984b9fd3517149446d8
SHA512 e8d30ca4371cdfa0df34871acc1a8cc0cc7cc094f65b5aebf26b873fd84d59a5bfa1c46f48198edb5d9862ca22d17585da128da6d63b5390a184c22e75c60b45
SSDEEP 384:pouyfUybXBP2glXs8GhKY0vIkdL7wy2kAwEFHc8eehqrufWWCt2BVfQE:poxJVPRlXBY0wu7pY31c8eehq4w2BVfh
MD5 SHA1 SHA512 SSDEEP

Submit Download

1B48121326934531C067045850F17B2DBAEF9C49

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\entries\1B48121326934531C067045850F17B2DBAEF9C49
Size 24KB
SHA256 75e02b3f09901b272f0db19e5bd8701793cbe971ddf9a0495f09fa87ebaac899
MD5 883f6543665bbc684110b1ad057fc617
SHA1 cf28da7f2ba53bb86005f61ebfd881203ffb6225
SHA512 6b01905f6202fcd4a5519cd3e92480c28cda9bdfedc4b073408274a42d2d999f49eda8c3ad6a5822778158c7f1e373298f2f4db64f0464c243338c48a1f68d04
SSDEEP 384:KHr8dnGrI+JCpYFXwxu+8n/wgmGWxPcMzwbyzAud3YpwPm082nyFz/d6wNB:yImIwwGLtWxpzmyzAud3YpwPo2C6w
MD5 SHA1 SHA512 SSDEEP

Submit Download

4354C6235A1E5E27D387148B46D7A569FA5E20AF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\entries\4354C6235A1E5E27D387148B46D7A569FA5E20AF
Size 42KB
SHA256 1c4f952f82e3be349d8b46a90f13b12127eddb439ee25971298216038d31a667
MD5 e0a4feef9d3142b686937e2c22a57ac7
SHA1 44d64f67a52d45dd247df0ce192bf8d21bc91ae3
SHA512 2a638f8b42eb0c78e24d16df98e6f150db168cbd92b3aa03d6efb8d14d28a726f540b6a6fb0b761fdaaffdabae18bbd2426dc09ce11171964cb2cf5906e29d77
SSDEEP 768:8pJf8lXHzTyT3P9QWCHmzL3WbHPBBWQfIKkydgMbG48B/xzmyzAud3YpwPo2D3:u0lDTyrKWCHeL3OBDwKdmp9ZMAYSQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

4797213D5690B0FD3C827A83BFE04F30DD62B596

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\entries\4797213D5690B0FD3C827A83BFE04F30DD62B596
Size 153KB
SHA256 a86e62a5c9b0cdd61436fa0438f63716c0b293ac7b07fa736dc2fbf0b963a70b
MD5 28fac862e09adae2e418fdf40dfb08d9
SHA1 ee242d8c61aaa63b1944cbf9173b0baf33bfba1c
SHA512 d752045e2376fccdce8944c966bb859920402447f99e8c9128aefbfe37e02e7df8655ce9a11a69572da5c35ee343e4e383e10f639f68ef30bb14bbea778de0d3
SSDEEP 3072:CIAy6BoZIqTvQqU054jzjRSeWTsTCEAy+bjxS5LgVi0oT9nZwt2MUU6W:oy6BoZIqTvFW75WJp1nxcgV3m9ZwH
MD5 SHA1 SHA512 SSDEEP

Submit Download

4D3C530B824A6A115A373A2B2082E2A529F5D9AE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\entries\4D3C530B824A6A115A373A2B2082E2A529F5D9AE
Size 17KB
SHA256 27561e4e82581ca3b1056f1fd55cb7719efb7404c91c2cb5e2e8d8f9abba5ce0
MD5 c5b1ab3a05a892e1a2e3f511c6ba159e
SHA1 b22bc339b5ac91f4bc5d085f558498eb761d568d
SHA512 aa35639c78a52e22ecfeb2e8f0cd2f38ba9b9ab8b9929c3aed9a3feac50b0717ea0bdbce243ff751f71bd2c597a75bdbd391dab5a84f9fad41e20af610207f99
SSDEEP 384:QHUKGhVf2DBrM6wTpPDZatDGzoi2uddjSpwPm082nyFz/bKg+:kUK7u6EpNyqzoi2udApwPo2MKg+
MD5 SHA1 SHA512 SSDEEP

Submit Download

59C5427C8576776BC47387C674875DAE50FA0251

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\entries\59C5427C8576776BC47387C674875DAE50FA0251
Size 74KB
SHA256 aee616edd6d21399012a8eb3860f96d3598cd042651846f12c6c28553652c695
MD5 6e5467c787fdef569742ce397985bd15
SHA1 ed48060ede24ac37af93cecc31eba6b537aa9fda
SHA512 cfe2fc31fdfdafc0bfdd9755ade2640c038e745095a78fdaa5efa6a826345b5b5392bdd7bebb99da80cf440e8a3f8ce9cbcdc613ae9d4782727d1f27a740cf40
SSDEEP 1536:AZLqpFJl3mBelLTR/J1uBziDynnp6gx6T9YSsPkjNOSNa2DU6SQrNH:6qRl3mITf1uBN6T9PfaUU6/NH
MD5 SHA1 SHA512 SSDEEP

Submit Download

830683B281D6AD4E20E4AB783378A45D27515150

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\entries\830683B281D6AD4E20E4AB783378A45D27515150
Size 18KB
SHA256 5773b55df11608a5df60f37db73afafb3a294303eee6dff07affc3bbd76fc84e
MD5 88b8442c9ab2f9ce3c23235b11c0f312
SHA1 a9b141062ad0d40b16994545b0324c8b50aee85e
SHA512 4a5d4faf176729536f30161de6fbde7b513717738d5fe3b22268d415530c83feff9a297ebbe0f994d65c8565006b1f2c79240368c7f349d1ae6f0656fa19cd1c
SSDEEP 384:JurO7QHidY/ygRHMxEnrRS50h/3Lc35qJwy2kAwEFHc8eehqrufWWCt2BVfBMx:fMHim/ybxEnY+BLc35IpY31c8eehq4wv
MD5 SHA1 SHA512 SSDEEP

Submit Download

B3DDE81EC76F05322B74890040A52928FD5A0233

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\entries\B3DDE81EC76F05322B74890040A52928FD5A0233
Size 751KB
SHA256 b9e26760595b1d3313a14750f1e7e5c519a8a797f2a14b582fb48087cfbc2e81
MD5 a5e76cdb2e24ea0cdb79b6f5a2ab9c47
SHA1 bd726dc7fe750a8ddfd087d515ca40de8e205077
SHA512 589d3d6b33bfaec20aad4681d045b49f0afaf8033e318231d66494e6b3e22ebfd8187b6bbe8919c0d3536d75d1e1863050bcce7595e1894233219204df33e06c
SSDEEP 12288:qljwgKD+1pO/61fiRxqXlWG7lQ3eVorRLpVo4KN7S7aQvDGkuM7oG51FcCohqgWD:2jwgKD+1pO/61fiRxqXlWG7lweVorRLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CE884FA702CF11C059EE9D9BD684EE0A1085F1BB

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\entries\CE884FA702CF11C059EE9D9BD684EE0A1085F1BB
Size 29KB
SHA256 680afb2ee1fe63bc7f2dddc44ae26045b5c2c302957fcd6b355c9b0884c31e1a
MD5 13fa2224158ea4dead440306c130dcc5
SHA1 809df91989c1c4193d771ed63a9f9d27ea0d797b
SHA512 79661ad524906139ac68c42a7ce6ab278f21f2123250c2cfe16a864972d5feff4afa237aae18f9ad73129781ddd24329e5d15a6bb164a8214e6bf418bde03473
SSDEEP 768:kbyNzywJj0DNaBne6AIMeM0X6ZfcqPCj4QLqDunDbo6pwPo2g:kbOeCjBBne6AKQPpnD2DU6SQf
MD5 SHA1 SHA512 SSDEEP

Submit Download

E64C5827E305F16483DBF1E3B074B0487DCD290F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\cache2\entries\E64C5827E305F16483DBF1E3B074B0487DCD290F
Size 13KB
SHA256 e58f310d187bca040084fb6039842f5fca4cdea032611efc812113f881d2d48c
MD5 ed76fcdd4a2ff882c5c2869a1dd1c6aa
SHA1 85dccac8d6856fb2e72b35e3c9cda49448b0ea66
SHA512 e82eca634f74061872d245ebdb7b622b96ce5fe0834cb08db2678c782c96ab296ffcf247147f9bba7484d6770761210a8cf9638afd127c80b0bcd243a1b4e4e4
SSDEEP 384:oM3voAu5b8h4WpjtrAwy2kAwEFHc8eehqrufWWCt2BmPL:o4vo18hdcpY31c8eehq4w2Bw
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\prefs-1.js
Size 7KB
SHA256 e90e02a6ccf9cd7834ce588fc9807c4c4cf6aadb693dcca3dc71ac09c8e8c242
MD5 c25c8552c75b3f0beec4050bfbe324ef
SHA1 17f05176237f3a1ae9c5c954b2bff1723256838b
SHA512 c06845acff413b0b01df9be1771f2f784389196589b508e5989f149ad85f8ee7e52178e5d243406b1d91e3955d5013a4d90d8c3747cf7e8d55df4fe2317f3768
SSDEEP 192:Tin4CRRMff7OX0XbJ3IYoGdzKMBw8H8QSo:7iML5IYoGd9wGf
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 ae8a2e8a02e8c309382a95fccc0b3e00e5ad0e464cd23020074d50593f0e9de8
MD5 1973eaa8eb2c88cc8d2dd91b3ba51bf7
SHA1 1fd83b8a390d050947797003aa3f68e0f458bf4b
SHA512 465cde3c374367123e7546d3f32dfe04e662af9d700a12e271bd8df33b453e092a5486c04c4e02e815f76740372795f37c2578602a052ec83de1f93e4c1ca9ec
SSDEEP 96:qgzdMcAqjF9+lJMNM6EGS2oUZ3EWNCE+s1:qydMcAqp9+l400qWqs1
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 cd93d9fab249eab60305132b12f6ec1cb4d3232d85b46b6aef8d22a925c1ce2b
MD5 be32f8e74542383fdbcfa7fb8b04e1eb
SHA1 d983d40d404beafd19c7806597043c274fd4d832
SHA512 07367f1384b4a301fae02a3b4718a9b8725d2845a88fd415f574fc9712384f917df5f73ec09b20a5f34c78a582cb30ccc31e3d70084853854591124a25ebaa98
SSDEEP 96:OzdM47TbY8EMJF74cMZk0zf8W8Qge3ZwS2CHPFey:kdM47TkRgFlMZkcuem6PF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 176ef5e839b2a2ab6bb292c6ecec4499c961d75d06a4388c6bb354594b282728
MD5 7ff7daf561a5855d74028a4d2cd36b3a
SHA1 e95c2a7e8acff44d7be0558a3fd680b93415fa61
SHA512 15f3ff1ef88aa7fcf9f7c475fb90825e59d89b53ae3f5ea24eed1269290e3bd458a6ddf12f5a61cf864236932d40778cc42c2340cbad2076b0cd1fcc98b5b351
SSDEEP 96:MzdMcAqjF9+lJMNM6ErcoMioqICEApc+GRFPddLnz2WbanvO1:udMcAqp9+l40rc0oQu+GRFPPLn6nW1
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 12014fb84900380246c4bce9e1af39deb21e89251278ada5ad0fce6762e4cf74
MD5 62d3d171ff14e7e724ccf39cc6d4b3bf
SHA1 1266bb7a944724144a235040c6068263930c8f34
SHA512 09ccb0ff950b614b5a304601d37bb17d5badc55b68ff26b20ce482d3cd8063ace42a70e83ee46cd8756b537d9c0b6654858cac751930449026adf2fb2b09e711
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 795d35e1361a69411aa5eceb7f001223d0bbccb7a3347cbdab8892f2583590c8
MD5 e73139f840e2aac8a856d05549da8ab2
SHA1 988726269986ccdf4c1878a3eba936dd3b3aa898
SHA512 c988ab176a097a6e2e600599fd294d0c78ce75e6dcdd194c7a119c832843abf0a4c93d1d06c81723a835d1c336c5f67abc1ea0bafc2e9755b2cfce84bec4897b
SSDEEP 48:XppGCp6sTcidMjFUPfTvA4uujOvA9a5l7MiMYfMNv9u6C+G/hi3UZPkcDGBUuy9m:jzdMcAqjF9+lJMNM6oiENbTOr6i
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 3a9174b3f2fe0be52b2666e3a789e6bff0e33521433da6af357d57a077ec506a
MD5 69e15bb56f7e66a4d492514094189986
SHA1 60845f26906142a688d60b5d5678fc4d385ea572
SHA512 7131f441b5935e5dbeaf6555bc6252c4e270b0419c75896151a6c45764e962f1585b4d9c9e699c6533431e79fe9d2d3516a1bde2331a0a0a0fad36915e5b9b3e
SSDEEP 96:AozdMcAqjF9+lJMNM6ErXoMioml7sLJK4wxwQ1:AadMcAqp9+l40rX0owEJBw11
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 2d7660cb28e0f82c9e793a9489d7083f188b8222024058eca11ccb51f75f061e
MD5 a8673b0dd31695e53afc2f950ad45afa
SHA1 40d0d9ef0e2853e61fb723a30fa9b07c00a9728c
SHA512 08ddd4d8ef0fd41b498e460a16cbb242cb4e841a7774a28a30fca789adadeeb2a1cb9ddaa81e506612ba7eeac89c0232297953700922bd5d45c509457ed816bf
SSDEEP 96:ozdMcAqjF9+lJMNM6CeFoBECqpc+GRXP5jefn1Jv1:adMcAqp9+l4y0lu+GRXPIfnL1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads