60b9f6e2c0234da8a4bccf810b3d4f3ffb9d0f6d1afade46974715d6e96c0b16

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 896KB
Sample240823-ty8mjavfkh
SHA256 60b9f6e2c0234da8a4bccf810b3d4f3ffb9d0f6d1afade46974715d6e96c0b16
MD5 56aaad783fcbaa57b86ad79e64d17b1f
SHA1 0888ac0621ce1ebf1d44d10c50f5195d3773090a
SHA512 a0634cbc2a41e3188bba1b2ad1a863a8f1dcf923c53e506fa1e0952c6dfc4ea09d3ca36a6f798a773bc243e41a0587a2dc9f5f36f5ef1b98430fe6da642a9b68
SSDEEP 12288:RqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTG:RqDEvCTbMWu7rQYlBQcBiT6rprG8avG
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	file.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1532	file.exe
1532	file.exe
4484	msedge.exe
4484	msedge.exe
2548	msedge.exe
2548	msedge.exe
5616	msedge.exe
5616	msedge.exe
5616	msedge.exe
5616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	firefox.exe
Token: SeDebugPrivilege	1404	firefox.exe
Token: SeDebugPrivilege	1404	firefox.exe
Token: SeDebugPrivilege	1404	firefox.exe
Token: SeDebugPrivilege	1404	firefox.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
1532	file.exe
1532	file.exe
1532	file.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
1532	file.exe
1532	file.exe
1532	file.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe
1404	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1404	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2548	1532	file.exe	84
PID 1532 wrote to memory of 2548	1532	file.exe	84
PID 1532 wrote to memory of 1516	1532	file.exe	86
PID 1532 wrote to memory of 1516	1532	file.exe	86
PID 2548 wrote to memory of 1104	2548	msedge.exe	87
PID 2548 wrote to memory of 1104	2548	msedge.exe	87
PID 1516 wrote to memory of 1404	1516	firefox.exe	88
PID 1516 wrote to memory of 1404	1516	firefox.exe	88
PID 1516 wrote to memory of 1404	1516	firefox.exe	88
PID 1516 wrote to memory of 1404	1516	firefox.exe	88
PID 1516 wrote to memory of 1404	1516	firefox.exe	88
PID 1516 wrote to memory of 1404	1516	firefox.exe	88
PID 1516 wrote to memory of 1404	1516	firefox.exe	88
PID 1516 wrote to memory of 1404	1516	firefox.exe	88
PID 1516 wrote to memory of 1404	1516	firefox.exe	88
PID 1516 wrote to memory of 1404	1516	firefox.exe	88
PID 1516 wrote to memory of 1404	1516	firefox.exe	88
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 5036	1404	firefox.exe	89
PID 1404 wrote to memory of 4440	1404	firefox.exe	90
PID 1404 wrote to memory of 4440	1404	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb53e546f8,0x7ffb53e54708,0x7ffb53e54718
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,303649361000342230,12475180615926424730,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,303649361000342230,12475180615926424730,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,303649361000342230,12475180615926424730,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,303649361000342230,12475180615926424730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2588 /prefetch:1
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,303649361000342230,12475180615926424730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,303649361000342230,12475180615926424730,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4696 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5616
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1952 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1492 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a434b505-fd03-46f7-9f5d-60be140cada1} 1404 "\\.\pipe\gecko-crash-server-pipe.1404" gpu
      4⤵
      PID:5036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2b7886a-1f2e-468c-a93d-134727f2ace5} 1404 "\\.\pipe\gecko-crash-server-pipe.1404" socket
      4⤵
      PID:4440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3392 -childID 1 -isForBrowser -prefsHandle 3384 -prefMapHandle 3380 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01b94b47-871e-4bd5-b0f3-c7ee44d3bc6c} 1404 "\\.\pipe\gecko-crash-server-pipe.1404" tab
      4⤵
      PID:2408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3732 -childID 2 -isForBrowser -prefsHandle 3228 -prefMapHandle 3244 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3365f02c-4a67-4dd2-b4da-b72c1566790b} 1404 "\\.\pipe\gecko-crash-server-pipe.1404" tab
      4⤵
      PID:2284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4256 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4268 -prefMapHandle 4264 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86a72abb-766c-4250-a456-70edba61de27} 1404 "\\.\pipe\gecko-crash-server-pipe.1404" utility
      4⤵
      Checks processor information in registry
      PID:5396
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2836 -childID 3 -isForBrowser -prefsHandle 5480 -prefMapHandle 5280 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e314e27-602f-49b6-b5d6-c0973a9c18b4} 1404 "\\.\pipe\gecko-crash-server-pipe.1404" tab
      4⤵
      PID:4420
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2836 -childID 4 -isForBrowser -prefsHandle 5548 -prefMapHandle 5552 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d804d762-2e8e-4be3-911e-b69eae0cedc1} 1404 "\\.\pipe\gecko-crash-server-pipe.1404" tab
      4⤵
      PID:4976
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 5 -isForBrowser -prefsHandle 5732 -prefMapHandle 5736 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e9b9e5d-1978-4c43-a437-bc3881cac39e} 1404 "\\.\pipe\gecko-crash-server-pipe.1404" tab
      4⤵
      PID:8
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6164 -childID 6 -isForBrowser -prefsHandle 6156 -prefMapHandle 6148 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f546de56-98ed-4d5b-b35f-9b5dbde4266e} 1404 "\\.\pipe\gecko-crash-server-pipe.1404" tab
      4⤵
      PID:5724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
MD5 9b008261dda31857d68792b46af6dd6d
SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
MD5 0446fcdd21b016db1f468971fb82a488
SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 71fef69984cc1e844586d7549ea442a76412b43cdf060fe6a244585d21165a0b
MD5 6c172cac9474b5620f5691735f42ef02
SHA1 b9d3822edaf4f66c6040cabe5f56351aae49a0d5
SHA512 7dc39113307fefe5576791fe9e809010d0499d3daea42bd008a2241db870ba06807130b8e4548aa70100edd141471bbfade6532c0115750e2bf37381b963caf3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 3d9ada4cda02bb71e54444990ae07bcf08f753ad0af8da37662bde100665a95c
MD5 29acb76171d6c8d535ae403b9064dde6
SHA1 98e18438ccc4df788e7d13466c8cb839465f29dd
SHA512 bc33fa9ef72d05b29a32e7ab2c392eb47f71374d8ebf9714b3ecbdbf00a8cc71a00e4d68070263e5330701fdaeb6d54284d20aa937d827e128c24532491e39f0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 5358b80acb0c03303b6f1b627d9e0edfefbbba8cd145da82a1506ce8f6b6503d
MD5 904d326589c9d788dde79d8e8bc6de7d
SHA1 87ce4e6d0479ebf3adc2d977afc34e6a10057aeb
SHA512 2f0f3379544d78bc2717a5572fea70485bdb0b3efb72f1cd25bc5e4a66ed745bc1987080367bf01d5066ec56183fb174cfa6ae87565f119950741b4602415761
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f6e0dd58d1e68203e96867d3a2a707a3af65e36fc02a24aff86411e6d9e984b5
MD5 79aa0dcf623b7ba9269fade58d35719a
SHA1 fd8e218157ca1b7c03cbe998b28005c2723bd868
SHA512 94bdbf2b66039ef712e7b53e81543108da19d62c701ed074ede7271d6dc61831499928f1ec08f2b8926aa5d338c9bfaf5d8038fe9995e055981378da55dc890c
SSDEEP 96:n2kxFM1qcdwpvWMoiVmdeH/ddGvUWQyV+VDCziEwb:n2kx6cqGWMX1yro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 30b924740095d935712be1813dc0f2e99a2b7fbc47362b669dee3c4921174b89
MD5 6e628ffd1ef1c9d1c27ac0a0089ecf14
SHA1 dd1f0c782a17861590768fe58c5377ef8c5faa00
SHA512 50959b978f891cae3ff9e87930e3e790b48e61c70fc4bfeaeeab52fb28ee8427e5fe209edde65630055cee24682295a0de916202ecf12658428ecedcda363a55
SSDEEP 96:n2kx+M1qcdwprBhWMoiVmdeeuZ1ox/dSGvUWQyV+VDCAiEwb:n2kxPcq2DWMuuZex1/rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 050f164bedbefc151e548a7af45e02d3e8f6ee8021f4b760f90a9fba38186cbc
MD5 2f43467a0d3f2adaee736fe5345d1195
SHA1 39e81b62ed732fd5d639bbc89281f3f64f576370
SHA512 5049de5f48dc32ae3c0d4a10cfd696ee855fee50f7d1648db51e94551eb0ef46cfdcbf4cf7235d8ffc8ef07a70571c275e380a5a2d33bee32ceb3eb2b2cde823
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58e20e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e20e.TMP
Size 203B
SHA256 3ab85f929ea0cc884afd95c3758f32bb32fbbcb08ce47a0218262f46d69f67ea
MD5 6bdaba96dbf5e0fa9163ceafb580d594
SHA1 c9d924530a49cf07fe9b4d741e169c18e179752e
SHA512 3a705d760255a592609ec87f17b675d335cff326dfe6a09d4bb3dc05271cd2efd580244d4ea41bc20af10e1fc5e01fb20fb62dbf5035a2d9f57e0bccc5d9428e
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5c66287e86dc119297867ab30bc32b7894ec36483b6fb3e45c0dea5e9062424f
MD5 b90de1b5c934f3a67c96c38d76a0e385
SHA1 f88d29eb695c2cfb2647f543b8bd1b235c1bbe2a
SHA512 570c4ed92aa6a19618e94c3b8a77b3f6bb5e5c35caa84e9b988e319e964d26edbac0146d4e5a8167161b335a78d3a2d937635d933b2399232ca57e2e7af94e61
SSDEEP 192:MoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupsNe2RUj2eI9Rw5Ytj9ZklV:89iIxuERzA83h09RZxY6tr+kLsxvv
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json
Size 35KB
SHA256 e75a176c5772da5cf13f13bc8dabc01d86321d1700d9af64d4ab3d28c6dbe99b
MD5 d52f679c31b83ddf35780c03627dc9e9
SHA1 6afbcb7d5eda7554f8af568f25e62c90604a46a4
SHA512 a8161fd9eca6808e1ef23caab9458e50e0c3c11ae098058ea1fa7744df66feb927cba51750fd72a10d4f435220320f0fccde1d8c9426aca02296fca25f2897b4
SSDEEP 768:OSAc8qNpQDlydFdYnB2OfsoLOWxR1uNJldi1uV:sYEE+BmEub7
MD5 SHA1 SHA512 SSDEEP

Submit Download

58EFA56DB4BFFECB0EDA547894BC9A057159E22F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F
Size 13KB
SHA256 2abab888efea487913fd891d936a526f90e8346a2007ad1e3e94f799fec83d73
MD5 09ff6f65015e8b27c25dd269d1438ced
SHA1 4d97b193a184c1c3c90b67f952b8b6ac1bbd82c3
SHA512 3395d39c004f07f2fee93fa3a230a811c83839f6ebcfcc47c6d1b6ea170a01bd3c7ea591885f8e40a18007ead40e976f28748d89385d5ccaaf7b73f932be9a60
SSDEEP 384:HvGu9fiGLm4pU1ft2WlOX8lPLZZB7t0lpDIIEAU:PBi8mCU1ft2WAX8tzB7eD8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin
Size 10KB
SHA256 8156e0e54d019ed79fc987f9e8e6078add207c025c771c4ff45f1f5e91912cca
MD5 dd326f3f3a4a1f33a467b700a3c20cc3
SHA1 feca17eede76ce1b6d6c925c5cadd29ccd1cdff3
SHA512 e14a93d170decdb5d58fc697bd78f12348c555a94e6d1e02830efcc08b79140799f28d392c15d4ed9ed76bab4ded8776d7c8645b6258566b3d57ed9663ddfb4c
SSDEEP 24:kuB1oG9STeJgu1xgRb09S4eFsh2F3LFS9S6BpR5cOb9Sn4UuhMZ09SgFS9htKuQM:9Oy5oKvn9cORPRA7Kf0eV0ZK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 25392b4390b2cd10c245a2b02a1d56bcf6a84cf34568a76dc9a7e69500059a88
MD5 6b08e2533f67c4dff3676b7b4a02cb43
SHA1 bda9b0e7150028cc87370713395cc314f9ee7e9c
SHA512 0c691d0e84ea81f1b09bc8ee1549e43ea1705c21f12bff527ce65160cd95499748afe3079affe7a6de881e942a25e2b8caa08cacd0eb2e7f02be4717a7e8355c
SSDEEP 384:ntCrLiCDdfh9bjbjV/66JozGzgC1bVbovIPY:tCPPDdfh9bjbjIELTg
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 f34c46f3d93ba01969febe2d7bd94a0ce0a07f298f86ca4ae910e62f72569169
MD5 0ee47ad5d11b16ec5ab68d958ed8e12d
SHA1 7461ed9f5f553050c45c6520abcecf6bf5cfd837
SHA512 a1a95ae7ac03f2393d6a1e9b0ef219084dbd2add137929c6975b4b51d0b34d19a06704c446b9b2c02c13668bfae5e78e404efb10db54778c934a518762112180
SSDEEP 96:ssqQDa2uFl66JozGzgClKtmSSKSMF9ZbkW6DhmFnPP/PrWZ:0/66JozGzgCl6mSSKrvZboDh8PPC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 416039b7080c8c71695f2e84886c83cd297102a4006017f3ee6c7e2e9dd9b64f
MD5 2cb8486d9f929df37fbb0cc5e37e8085
SHA1 51a4a12a23c03fe3dad02507f74a482554bc778a
SHA512 752bfaefb394a85d36a6050091e3f55eebd17fe0cdbac673743a8a103159f08c4a99dd39d540e26a792c292877eb6bfa49e06c3fcd975566cd9f63126e75a1ad
SSDEEP 96:ssqQDa2uFl66JozGzgClKtmSStBJSMF9ZbkW6rBBahmzznnPP/PhxkW:0/66JozGzgCl6mSSprvZboPahEnPPDf
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 063ae88e8c98fd9908bdd17aa241a27714dc1cb6840ba5160b20d68a40481d28
MD5 0abf7ad2561fa8894e85a3af1921619b
SHA1 10f06ce69873a2f9228c0b296e755b984b4d4e46
SHA512 596158578450725fb9f75c91578583d79d0c8c98625e35ad3552739342691b8941374574639511f12472b6c444a743d82196d40ad825eb6d8e8e472bd52e4a82
SSDEEP 384:6boyOIP5tCrLiCDdfh9bjbjV/66JozGzgC1bM:u7/CPPDdfh9bjbjIEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

5c38fc0d-6b2a-4563-bd84-342b30142241

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\5c38fc0d-6b2a-4563-bd84-342b30142241
Size 982B
SHA256 e3e47de9739869a4d01e8c788f077656dbaa92a91a3096388a5c26fba9dfade9
MD5 72efaf3c9c3fe3704af09030af040548
SHA1 440ed5c39ce9f7c9f4cacb7fb04f9aa05cd8341d
SHA512 681ec3597825ede36948e4c8964c73bf3cdb0190eac45708d74ca6e79692cab56dfaf4499117e9c53463fcc78c21f31e8174343657f06498b1f14d9d3ad10d30
MD5 SHA1 SHA512

Submit Download

934ea1be-ad7b-4316-a047-c0d0ff256724

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\934ea1be-ad7b-4316-a047-c0d0ff256724
Size 671B
SHA256 64e9374ce03bd8aa674f6eeaa60932dcf922da8aef96c87780dd43c507303be0
MD5 522141207d0dfcc8690976c72553473c
SHA1 b14130126231fd7097e7a1d615e617a744f9a4e9
SHA512 c8738a64efe3505ef2f5467cdb5974b6bb28568d21203790eb8e485ecc4a36892bbe1aaa80d827c38dd6248dd22ce656d46b24e9c9fd82aa49f1f1ed7a14cfcb
MD5 SHA1 SHA512

Submit Download

d0b840ab-4226-4743-98df-cdfd4b4234c0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\d0b840ab-4226-4743-98df-cdfd4b4234c0
Size 25KB
SHA256 ddadbfa847cd118b6bf4b6a5ce3b60d69e71f07fae9961058f015bd2774ea848
MD5 11fd45af73a49cc0a53f246e63eb965b
SHA1 1861bb68e5e205dafc9cb89b628eacb563005d7d
SHA512 76a1b252bcc08bfb8495b232217fd2292e76b9a74df212553f28690a198343a7c410fcc63f4863baaecf6b82af3a63ea6b70b738245753990f9cdd1090b8d0f4
SSDEEP 192:zHaOTri5UQKh4szkgYz/6XG+nRQVbUpzsIWrILqtVWf08BEi5ilX9389bIoH0IxX:zlrCq42s+nR4bUpIVreqDeoDjG0i
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js
Size 11KB
SHA256 87df34ef0ab1add988f827d6b9cfd4ab3e0a9b8fd8d72dcc5c80707243446010
MD5 430f9638d7ffba45a48169bc22b150e6
SHA1 c35884865e5d3634f98c2b75f54ac1de6a9db307
SHA512 2593062dd9dde4723c1919ba3c8c831affb3bb7196f652b7f3981aed6ae48b6d2f0f9f192146351c9a18a17038c5b09348d4a0b73af4baea2beda24aa8f53e73
SSDEEP 192:b5nPRsfD0fg5Rf/tv20rGMXcdkfltYQHry60haXqVnp+Bw8Ht:4n5Rdv/rZM2PYQLxaywI
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js
Size 13KB
SHA256 f48def122e1f9072b53ab48400b347553df99ac5cd7eb41932b874020121ad54
MD5 31e3b08915bef68178a9254b8872265d
SHA1 cc47deeec274fe21a9b5cbbc9e4fd551b37a1a10
SHA512 792a437b42d39950f4ad767ffb72ea19bf2152af1b7bfc84491452b69e06dd4c4cb4727d8d5eb4152667a015857dc004428bd010c0c509cbbe9f299c2b5e0ca8
SSDEEP 192:Y5nPRsfD0fg5Rf/tv20rGMXcdkfltYQHry60haXqVnphBw8Hv:/n5Rdv/rZM2PYQLxalwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js
Size 16KB
SHA256 627468390cf5d46c9e6fa1d38e0e7282a0f84b0cd34dfc38c7bf632488fa9932
MD5 f7495860ce9bc0f9f7c6f7f79c480022
SHA1 1d6cb4b0ce76276cb77ec18c39015a3001c4e5ab
SHA512 f43c8e9f640451e38d9f2b6d69a3b79529d864d37593836dc7f660dc62c4282e1174a268f98ab197eb619f16f4167680a7f1d90a222856f76a5e861c838ed8a7
SSDEEP 192:YSnPRsfJ0fg5Rf/tv20rGMXcdkfltYQHry60haXqVJ+poiBw8Hw3/nsw:UJ5Rdv/rZM2PYQLxH1wNN
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js
Size 11KB
SHA256 665310d034f2180966ebce3471b4e682f16aa9fd6146b70cbdc4fd7fc57cdb7d
MD5 f79d2b08ab55216e06f22582cbb55627
SHA1 eb8572b1481fe608467b9c1a4d1b3d6a14aea16e
SHA512 16c76f00cd06088f19455a29e5598644e88cd7b15d5a941e02f64d31e35c7ad31e99ea4a98510e8631685b582f2eadcb5b97cb6230cddbbcb23d5945fc622aae
SSDEEP 192:b5nPRsfD8hJtcff5fStvvZDoncdWfstIDnjXT60kaXrp+Bw8Vt:4+fif54vvicAWIDn6eywC
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 7de05c15f56cad863d2991e1f8f942f97ee16168a60fecb0944888b7d1f77dd8
MD5 4904215264edbc0c1fdbeed97b1d32a1
SHA1 915dee55e2e5c9b9936a6e683c6e65bec8d9d363
SHA512 2e12b34bc04e929fdcfbd0b6f6e7796bf4224d014b243f6770feba18fbc6ec1c2367723997e97d12039eddc12e7a925844db388db8703849379dc2ef50d57c95
SSDEEP 96:nqftfaC6r0NHQEGJF7h4MZk0zf8W8Qge3ZwS2Npi94:nMtpS0NH9iFuMZkcuemb
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 952KB
SHA256 d7deca50f6dc7f12128685c26046539ed001ab8784a86536d0dc156fc6c42f14
MD5 bbfd93ccf2f0d9802db46805ac6d9b11
SHA1 d428f0abbe697a8e7b7ff2039d86a606a8bd979c
SHA512 5b90028bd58d257853df5f7cfe8f1fbb0694f146f9e13d3b3d92e531e5f01463dd711f6397ce654562d821cfac14f66f35fb9d437bb02c353b4a973424a10162
SSDEEP 6144:+7rSUjn393z3m3P39TH7y+IwbUXYHUqR8pFPFphkeHN1HmcH11HucZmz0Pu/elvy:vy+IwwXRqWFF801M6Myq
MD5 SHA1 SHA512 SSDEEP

Submit Download