f35511e4296bc659a8ba30e0801bdac2c86995ef4ea5a48bd419989eca4f9daf

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 896KB
Sample240905-3tenbsvgpd
SHA256 f35511e4296bc659a8ba30e0801bdac2c86995ef4ea5a48bd419989eca4f9daf
MD5 bfa09926a7be8f00aa567eeffb93076f
SHA1 6d38ae47135b852d6afeea815748cf16225dce6d
SHA512 5a6764d68093f3858fb574c379f40c30d45a5f1402702f0880d4e9fd424b290c2fff9e67e72495e094c1b9193ce2dd3de84a4e52f74286d72af95aec598b95e9
SSDEEP 12288:hqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTf:hqDEvCTbMWu7rQYlBQcBiT6rprG8avf
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	file.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3416	file.exe
3416	file.exe
2472	msedge.exe
2472	msedge.exe
2432	msedge.exe
2432	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	firefox.exe
Token: SeDebugPrivilege	1812	firefox.exe
Token: SeDebugPrivilege	1812	firefox.exe
Token: SeDebugPrivilege	1812	firefox.exe
Token: SeDebugPrivilege	1812	firefox.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3416	file.exe
3416	file.exe
3416	file.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
3416	file.exe
3416	file.exe
3416	file.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe
1812	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 2432	3416	file.exe	84
PID 3416 wrote to memory of 2432	3416	file.exe	84
PID 2432 wrote to memory of 5064	2432	msedge.exe	86
PID 2432 wrote to memory of 5064	2432	msedge.exe	86
PID 3416 wrote to memory of 3212	3416	file.exe	87
PID 3416 wrote to memory of 3212	3416	file.exe	87
PID 3212 wrote to memory of 1812	3212	firefox.exe	88
PID 3212 wrote to memory of 1812	3212	firefox.exe	88
PID 3212 wrote to memory of 1812	3212	firefox.exe	88
PID 3212 wrote to memory of 1812	3212	firefox.exe	88
PID 3212 wrote to memory of 1812	3212	firefox.exe	88
PID 3212 wrote to memory of 1812	3212	firefox.exe	88
PID 3212 wrote to memory of 1812	3212	firefox.exe	88
PID 3212 wrote to memory of 1812	3212	firefox.exe	88
PID 3212 wrote to memory of 1812	3212	firefox.exe	88
PID 3212 wrote to memory of 1812	3212	firefox.exe	88
PID 3212 wrote to memory of 1812	3212	firefox.exe	88
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 1812 wrote to memory of 2700	1812	firefox.exe	89
PID 2432 wrote to memory of 2928	2432	msedge.exe	90
PID 2432 wrote to memory of 2928	2432	msedge.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dc1d46f8,0x7ff8dc1d4708,0x7ff8dc1d4718
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,909477245958611589,15705106640740669991,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,909477245958611589,15705106640740669991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,909477245958611589,15705106640740669991,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,909477245958611589,15705106640740669991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,909477245958611589,15705106640740669991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,909477245958611589,15705106640740669991,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4708 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3000
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {048bb4ff-71cf-448c-b0b7-aafa7053d056} 1812 "\\.\pipe\gecko-crash-server-pipe.1812" gpu
      4⤵
      PID:2700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2420 -prefMapHandle 2416 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53033855-2231-433b-9a18-eeae38751a5e} 1812 "\\.\pipe\gecko-crash-server-pipe.1812" socket
      4⤵
      PID:3948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1464 -childID 1 -isForBrowser -prefsHandle 1564 -prefMapHandle 3092 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {880faae7-7223-4fb8-926b-98f088ac06ff} 1812 "\\.\pipe\gecko-crash-server-pipe.1812" tab
      4⤵
      PID:820
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3676 -childID 2 -isForBrowser -prefsHandle 3668 -prefMapHandle 3664 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {551676ae-6f57-4ccc-a025-01f4642b382f} 1812 "\\.\pipe\gecko-crash-server-pipe.1812" tab
      4⤵
      PID:3168
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4212 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4244 -prefMapHandle 4236 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3abd3c90-1b8b-49da-a6e7-d180b54e8d48} 1812 "\\.\pipe\gecko-crash-server-pipe.1812" utility
      4⤵
      Checks processor information in registry
      PID:5504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5528 -childID 3 -isForBrowser -prefsHandle 5488 -prefMapHandle 5516 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbe3d52f-0293-4354-b7db-85bdf063141a} 1812 "\\.\pipe\gecko-crash-server-pipe.1812" tab
      4⤵
      PID:5308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5732 -childID 4 -isForBrowser -prefsHandle 5652 -prefMapHandle 5660 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11690cce-1be4-4888-b990-e01f3d472246} 1812 "\\.\pipe\gecko-crash-server-pipe.1812" tab
      4⤵
      PID:5320
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5832 -childID 5 -isForBrowser -prefsHandle 5912 -prefMapHandle 5840 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ec36004-d749-426a-87d0-f49c7cba914a} 1812 "\\.\pipe\gecko-crash-server-pipe.1812" tab
      4⤵
      PID:5344
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6228 -childID 6 -isForBrowser -prefsHandle 6272 -prefMapHandle 6268 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8657c4e2-b6b3-4129-b152-3ebfafebf0db} 1812 "\\.\pipe\gecko-crash-server-pipe.1812" tab
      4⤵
      PID:5984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 8e08956e23750bbf6ea0c9d113a12823734d37d158b988cae20614347dd74748
MD5 c2b6b1408ca69696f440e2065e3ffe7d
SHA1 718aa279aed17e9e3a82be037d7950cf14f8a728
SHA512 5c632172fdceb5f8267139021a24f2622799c97620fe2140eddae62ac273e20b58ece6db63aed7ae3b14b4e15b852a992f6642adbdc369749bfde232d3446205
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 e587504fd33318df114328c12df5ae4c0ff0530e59cdce3928c0bf5fde7135e6
MD5 ad2766ccf81151aa52d5e59979b13844
SHA1 870732cd4d5b0d8e6d812fd1f1293f1b3377599a
SHA512 8c19e8c1dcbccde1b22a263f0d4188390b3c1161929e30d674de37811b8892ad4e18fd68773f33e80ce8640f5ad7e1a8920a0dd8434c8d0bbc49d645ae2a3f91
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 44207ff36a3be1a9c6027d93bf9850dc896e0d5568d4ca5c1a42f69646d3b871
MD5 3a8116ed4c3fe0c3842a80d792a8efdf
SHA1 01fd046920ab5788e3b7d387ba73a40c1ef787a7
SHA512 a5b7e663db276f3e65bdcfd5cc28b1fd51bd38d540bb9fd286ba92a1c7dd0406f03625aa5d656ab715163ad90f5fb74613dfb2b4c38a9bc40c87e640eb05efb3
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 444e5ec0aaa296931fa274406f2d9992aea7f3dd3f8528144e7c8cd98e27ccee
MD5 aabe6e314112826d35115fe7ca494b90
SHA1 f09b40904a5383d6fb8cdefa376bf1661271fe21
SHA512 7d22838ad5729fc8e95ab0a878fd2948b030b737d92730ee0b3e4ec22bc2266dde1b3657f7f59018bf01ffa9477658ad417e5b4160c07bafed07f15df030c0b1
SSDEEP 96:nvkzXA1UQLSFhPwpvWMoiVmdeH/byRUWQyV+VDCziEwb:nvkzwCRFhPGWMXKro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 779efa5a11f33f47d43821bc523ba74ee82222db48d76caddaa29202e8daecf8
MD5 886fd600e3bba747e35e427145214d0a
SHA1 634e6857f767868b257e3b787f016dccee3711e4
SHA512 08f7c1d00ee39efcb9e34d4ee92bec4f5eb4846b4f3094a273e81a1e1d32110953cb060e937a2eb968c2ff96f6d07959041bbc3369b67fab7cb2f86b4c9cfed2
SSDEEP 96:nvkz4A1UQLSFhPwpM7WMoiVmde8ug1Jx/OyRUWQyV+VDCAiEwb:nvkztCRFhPx7WMMug7x5rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 311591c442e8fa9152792575619b6fe897b0ff0ab46d3abd0903828629a92006
MD5 2b3078e206878c7e3ae9e6b79d5f8b97
SHA1 2802380e60bc7cbe2e94549b6ef351d16690d2f4
SHA512 0926fa54d637c914836fee87e6b9d94fb009e3175f402b479b7a742f1aa8275e7350a29e703dbf8f104769b33960b9ff167b0a5f8ba2d8c1867810bcc61623b3
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58ab7d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ab7d.TMP
Size 203B
SHA256 25588d5effcdf451b2820f2924f99be60b1e3c7fc679e3e1e11dc7ba3baca974
MD5 1414e7eefee27f877e73af340bcd5dc4
SHA1 33126afdb07ca4fa8b5fc307be4502400d15eb19
SHA512 df69b6f713f3cf4c4059cbaff2f0434e66353877125494c72dea2d29ae45560d7ead0c3849f0c6f14e428b8fe324c859ba2047564c56d9a1bbb8070142dfd0fc
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4d2ce0b97a3824f6144714b2816c4105bf1f157e2d99c0d9910888c161bd7d8c
MD5 da26a1e24b52276e52b78c91e172ab48
SHA1 cc0e52417b4270f65e4b29fc26d610e6c04f56ff
SHA512 b2489c063ff9a2873e943104a83419a67c46c759d15267ae1979d05bebbc2c7f8f8304ac1c77228ef54c50c776736543432c744500b85a886159154589df5260
SSDEEP 192:AoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupX/e2RUVANqLQOl6feAOC:49iIxuERzA83h09RZxYXHbqSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\activity-stream.discovery_stream.json
Size 30KB
SHA256 6bac95af4fee0a31c0cdaf4bdd815c6503def74d2ee8610fab96ceab5a29676f
MD5 d8d85f0f1a030faf5a5eb225d1ce5a39
SHA1 b6c83f55097b36a4baa5e9540245a5dfadd2d2f2
SHA512 86e8d518659aa7f1eef00d0cc0a91efdb8c8fa0f3a973280464b14f8961a427bcdfbfd788b5a379b8e820c4bdbfc8121fc2b5366cd788da390ac587817ed94b7
SSDEEP 768:cZVsx6RSbxV9Us7DiDpydcsVJVZdaVwKFveZ5O5EG:c7wkSz9UE56WPQfT
MD5 SHA1 SHA512 SSDEEP

Submit Download

58EFA56DB4BFFECB0EDA547894BC9A057159E22F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F
Size 13KB
SHA256 66c367af5fbc469180e026880292a8b9b637790970c04d3de5007525847f8c69
MD5 43df873d363461b6a8533d8cb624772f
SHA1 087cc7c6e9b767fa822dc13582b7fa56856b8675
SHA512 0ab1d0e5740589a7aab91c9a663a18c79cf5689e6958d348fcdaa666ca5fb5133b4d12e0ce8006438d9ebc50d1d9e70dd8b5eb20f9430f7f50b00236bfc39f05
SSDEEP 384:HvGu9fiGLm4pU9pHLFoCr/E8HPJyD3VonFcP+AWRMACt38:PBi8mCU9pHLGCr/E8Rg3V/+hRMFG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin
Size 6KB
SHA256 3360ce7e2dd9128e04169aa81ad2b54e0aca2d0411e584e55d38717d654ece35
MD5 dc35862d4ac34ba5f4fde56cdc45f661
SHA1 0cc4676429c2aad9083e2aefd6c7fd21e9896319
SHA512 d3e65dd7195acddb03f138e9ca3580be25e92af48815f210aa8cf808a72996cacc7c2e4b65934139c53188efdc64405c9ce9ab327295ca1bd75a96e27d1d573c
SSDEEP 6:2Ugidpq88gidydgidsJld9toIImHgidpqs7HgidBgidx9to:7gQpB8gQWgQKd9uIIPQphMQSQx9u
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin
Size 8KB
SHA256 e320835069e705794341ae048e28a96656d46a7a69d917cf79a3bc41caf9ce42
MD5 41df56001851587658951f8c55e6de00
SHA1 e75a93f0100a2186d13f2367fad15d8d134d7fe7
SHA512 5f6673e6d11ee050693b26ac0e68e7df76a16c7757fb4a9e99565e87c3321619082f1ed520202fea0bb0d9e0a2ea8e2a6909408d026fc89cb893374aa80964d3
SSDEEP 24:kuB1oPd9mxFsh2F3LFSS9htK/Hygu1xgRbZuhMZCpR5cOk9Bl:CmQA7K/Hy5o69cOGX
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin
Size 12KB
SHA256 c5b38566753ddb8612cf10ae565e067e35a279f21af03bf0b7a57203d27ed26d
MD5 9f5614e7ef84688c2a4d63a49c5f7953
SHA1 e70da5b84440ed09fdd1f849047d27f9b7771973
SHA512 13ed762c983be1509aacdd4a4c4f536761bbd58e67f82e010dfe31929533a1d5628ad3b1f3622e41e0e66d884b364df3dbe79407680d3f4359dd1b9187def455
SSDEEP 24:kuB1oPd9mxFsh2F3LFQcS9htKyHygu1xgRbZuhMZCpR5cO69Bb+9xKdGs9l0GxGw:CmDA7KyHy5o69cOYdEYseFgctx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin
Size 16KB
SHA256 3f39b37780fbe54a715ac0ccc7a01efaf0a61ebceedf67cceddbc5f904b75be8
MD5 8495168d93b65ce68830ba5ba9693125
SHA1 7a5e07056c8e8358f956e4a4df897abfecfe192d
SHA512 6b892d8ea117254df5928382302676b373be08cec926169b6b196c6bbd59fb498504c4e7d1223fefb6c6c99a24fcbf7c4e2d0ef729d168057eec27baa4efb6fa
SSDEEP 48:CmUA7KTHy5o69cOTuEYseFgctxr9hrUWHV8U:CmVwS5oQuEYseFgctxrPrBHV8
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 56f0b5ccb27a352edb1ed1ef603cbfb88c5e47562b56514f8da4db2c84015dea
MD5 519b4c86d100da42de4a3710184cd092
SHA1 7ac7dc1f7b4ca698eabbc0556910bfe7696f847f
SHA512 245e3b341090ed405c2c4f6afb57356de1625acc4404665857a0ae4f7da34f033675b8942e918f4cff6e8f7078b887daef6f59beeb6cdce971410486f3ba2888
SSDEEP 96:AnQHw4BaFl66JozGzgClKtmSSiBfSMF9ZbkW6rBBIhmlbVPP/PhxkWv:8/66JozGzgCl6mSSarvZboPIhqbJPDfv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 0a82961a24b0c6fb872284cac5db688f142efa0ae25bb0ff964ca40c48467bb1
MD5 dc1df894630ef4a3c7915d0c1c2c8164
SHA1 cee20f7146c7c8beaa3d3d114ee0c6ca27d2df7b
SHA512 4d3e9f3179fea5039d0d5332d923ff6d25268939125e0a9c4542b80249d19148f698e8db49f143e93b522c059e50aff8131b56c39cddced9d28ab4e5b86ac1d3
SSDEEP 384:8/66JozGzgC1bueojtkPG5Dr24pb8bHHbowOSNPT:ZEloAYDr24pb8bH7GIL
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 4af8f2987d8cc474701e016e6788c37ecd067a86deffda29032f789781b92bca
MD5 24f97c1a8887086079047285f0fef113
SHA1 636c54adb425a546f4e4c6e431404b3ab533df33
SHA512 43c429b9ec231d9bf113ece11a71062151dcf43cfec625c6b2afad6142d92997221a0c2ff39945a1e85c7fe1c05e30ffd9e89dd492959d1a59e54f952da16ade
SSDEEP 96:AnQHw4BaFl66JozGzgClKtmSSVSMF9ZbkW6lhm8SbVPP/PrWI:8/66JozGzgCl6mSSVrvZbolhBSbJPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

4fe02009-9796-4ebf-8ec7-515364da21ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\4fe02009-9796-4ebf-8ec7-515364da21ef
Size 28KB
SHA256 b133ed19b946ab164eb015459d99339b2023695e84aa2e41332b6953f5799bc2
MD5 55407ea51b796dda187ebcaabc4e2eb0
SHA1 ad37a482eb0b85f511788de6c25ac4ad719682f2
SHA512 ec0bf612f3a54ed5a4e7a7d8f1178a8b59945e114bbf07563ad3035a10610053be3a001275320b83d6eaad24e5a9010d9280c043726d96cfd7f0cbadeb7aec40
SSDEEP 192:hcs76gUUSmLtGyb7gSzG7zgUcTypY595mfkZlGI2d3GgDliRis1ljr5uvq9kI9Ch:hcs7HSqoyb7gSfUSyq5VnGJ9qD1S
MD5 SHA1 SHA512 SSDEEP

Submit Download

9423a950-e044-42fd-9fc1-8d6881e484dc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\9423a950-e044-42fd-9fc1-8d6881e484dc
Size 982B
SHA256 2400cc8b6b0e93213b9f57d569bc94fd5b66ad7a25f4f2f54f5363e7fd937212
MD5 67c845ed2067fdb6170b55ee5d8714dd
SHA1 8b40816f0de53b2166d8d6ffd6427041d5a9b8eb
SHA512 e4760a5ddd413eb514a45b02ea731b9328699b3eef6fb88e8cd7f26c5d49b21f05ba96f014d91675f309604e63b29daf586fc8cdb3840d9489cda261808718fb
MD5 SHA1 SHA512

Submit Download

e2c38dcf-fabc-4c79-95eb-6a5a61e9c863

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\e2c38dcf-fabc-4c79-95eb-6a5a61e9c863
Size 671B
SHA256 405c77ee6c65067c28cc3ec43db9c44131f3bd5cb3e8b69adb520ff76e97dc8c
MD5 73a34ebe169fd4c46f79b87b12a282fd
SHA1 97c661a031ed10a753a78033770bc2263110909a
SHA512 20e0cd8e82cacfd23764af8fa36ad93e477d99dfb84dd15f1966473a9cf8ec9466368e7b101392a317d0e90f095fff87db1873ccdacfe5627f986d7734dec7ba
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js
Size 12KB
SHA256 96d44bb0f01a373a296811bed331fd4b9984a6d262fc475602e8d81c71e61179
MD5 c9026df756008b228f42a14d3bae1c8f
SHA1 8f589ed043733f29b456f827c3681a1f9200799a
SHA512 f7e2c05910d81e90154a020fa1c579144c0c2132ac93e7a208ac130dba7aca8aaf1251d54b7cd702d57aee53773e97053ce7d9b532033fbbcfe0ba1aa2b8fb82
SSDEEP 192:H5nIROfYLn+L0zhxnNapcdO8Txn/sB0KaXV5nsSDBw8HGz8:/qzhxNa25Tx//lsqwk
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js
Size 16KB
SHA256 68d31f8a2e921dd3a25a71ad6eea31a1a2c8ab15235e057714917f9ae172f1b3
MD5 e516837dad04d08e153a89889a952505
SHA1 de31be88d3011a0d5f351d6dfba5bc91b0a512cb
SHA512 b7a710d96c1aa0577fd26f0b8f05ba869ecf811a9105cf10199730144716aaafca70a9962ca81d1eab0f1a1e33f4315cdd93a2612b4d5115ddb421a20c61fa53
SSDEEP 192:HqnIROfSn+L0zhxnNapcdO8Txn/sB0KaXv+5nsStiBw8HGVvbHQ3:amzhxNa25Tx/AlsTwZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js
Size 11KB
SHA256 0fd1999cfcc285d44e052bc46bb5a855003c2978f0851425f6df7abfe5016669
MD5 92a069a3b48709f6e1541f098b82fa3a
SHA1 cff03f6c0c78c9f3d065bb6cff825b931b6854a4
SHA512 9495926fdf9b10f93fa205aa95f42468fab1ba5e98102d5d4ab8cf57b55edb8ccae2fc174e0efa223c972fe13c3b81260f9809908bfe9dcbcbce4e39fdd2bd26
SSDEEP 192:w5nIROfYLJoFLLf8tv1R1zcdjrf+tPDnjXl60NaX55nsS5Bw8V+:s7Lmv1AxrUPDnYNlsCwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js
Size 11KB
SHA256 70bd1241daa42150afba601c8b7830faf8d758e5b14b910e679f6cabfd9a4b10
MD5 361cba0f5bac204e25ec31ee5b906fa9
SHA1 3fa2827f75a943f0b6cb70dd6ee7608b48e82379
SHA512 3fd464f96305e27241b758a63f349a4a44328b81902c9cd12737a0c638eda6264a595d01afb34d3019919fd0b611468557be66890567a7ad194b26dc0ed43955
SSDEEP 192:w5nIROfYLn+L0zhxnNapcdO8Txn/sB0KaXV5nsS5Bw8H+:sqzhxNa25Tx//lsCwf
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 34baf7a0cda9604bba006bbf5e692a1a5bdc4ad2ba6bc1068d26f639ac784e7c
MD5 810dcbd1659741658ac4cc8f49f51f68
SHA1 3844b42599ccc0fddfc24350ac507f00f34c12a6
SHA512 8452b7945d6178f471c2d57d1a87ebcf670927eaa1615ff5af1a0917014d66996a07b2139c757707ee29468294a5ed6c9188d7feb3b08466dbdfb524c0da5509
SSDEEP 96:93xy3MyC63PGj0QEGJF7hVMZk0zf8W8Qge3ZwS2KRdR7Fa:9hy6qt9iF3MZkcuemuL8
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 376KB
SHA256 268e69f8b71019289f38aa11e55094d42d890f84a2ba1c5ae6c17e912a1fa04b
MD5 a189f92d14d5ddb0fd5ca892254188b4
SHA1 4bfaa34f1bf8141b7f135fe837fb38fdd60050f3
SHA512 a3b1fb9df9d4eb7e612c0c2f523479e0b7eaa3c1eedd82be85172ad59bede077d23cac2c7d90026df0a09d254bb953fa50461c18932200b5df0c7c36629b123b
SSDEEP 3072:LcHYiucHY3y3JNudUeH1LTUnDh9Mis6uaphb+Ma4tx1bwZzOZBY:LcH3uSY3y3veH6n1W6uafv
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.0MB
SHA256 170bbe3fa56bb812866f07df6ef002ced75f624eaf0aadd56fce6f6e654dc515
MD5 b8723b4e45b9836c89f21982299b9fe9
SHA1 aefebb93870911dc2ccd718877d73e98c6db4af1
SHA512 de6afd670d0508265ac4ae3c373435c8abb6aff4b33a0c8bb26cddd3e778aaca0fd5fb3a2b072367945665382c9d41d1e67ee06d30486b3c1269a68bb32e1203
SSDEEP 49152:acYC5dhmBGL520ybwByACiRyx1sTFXqDT5fdmUX/mznBUOKXBMcZ30hXBm7+vjiE:g
MD5 SHA1 SHA512 SSDEEP

Submit Download