3509f32ef452e3d58ec0a9b355d033dbcbc6ba956d50a65cf6fe46275ad290ee

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 896KB
Sample240905-bkhj3s1dma
SHA256 3509f32ef452e3d58ec0a9b355d033dbcbc6ba956d50a65cf6fe46275ad290ee
MD5 d6b90c3bb4065e525a9c85af589a03a2
SHA1 c8047c844156fdb63645597dda66a79567342252
SHA512 2fe8bb0ac1662ff35c81c83c7f6b8d84af8d8edc99224ed33f5f5fb387697ec6cd3c142e1ea6770391f27a435210bc05f0c20b91d6dafeaa30beb6d5eda11b67
SSDEEP 12288:4qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTj:4qDEvCTbMWu7rQYlBQcBiT6rprG8avj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	file.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4148	file.exe
4148	file.exe
4928	msedge.exe
4928	msedge.exe
5696	msedge.exe
5696	msedge.exe
4352	identity_helper.exe
4352	identity_helper.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
4148	file.exe
4148	file.exe
4148	file.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
4928	msedge.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
4148	file.exe
4148	file.exe
4148	file.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1764	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4928	4148	file.exe	83
PID 4148 wrote to memory of 4928	4148	file.exe	83
PID 4148 wrote to memory of 1916	4148	file.exe	85
PID 4148 wrote to memory of 1916	4148	file.exe	85
PID 4928 wrote to memory of 3428	4928	msedge.exe	86
PID 4928 wrote to memory of 3428	4928	msedge.exe	86
PID 1916 wrote to memory of 1764	1916	firefox.exe	87
PID 1916 wrote to memory of 1764	1916	firefox.exe	87
PID 1916 wrote to memory of 1764	1916	firefox.exe	87
PID 1916 wrote to memory of 1764	1916	firefox.exe	87
PID 1916 wrote to memory of 1764	1916	firefox.exe	87
PID 1916 wrote to memory of 1764	1916	firefox.exe	87
PID 1916 wrote to memory of 1764	1916	firefox.exe	87
PID 1916 wrote to memory of 1764	1916	firefox.exe	87
PID 1916 wrote to memory of 1764	1916	firefox.exe	87
PID 1916 wrote to memory of 1764	1916	firefox.exe	87
PID 1916 wrote to memory of 1764	1916	firefox.exe	87
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 3636	1764	firefox.exe	89
PID 1764 wrote to memory of 844	1764	firefox.exe	90
PID 1764 wrote to memory of 844	1764	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffee3946f8,0x7fffee394708,0x7fffee394718
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,5006955868699580814,1189380607775914451,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,5006955868699580814,1189380607775914451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,5006955868699580814,1189380607775914451,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5006955868699580814,1189380607775914451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:1
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5006955868699580814,1189380607775914451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:1
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,5006955868699580814,1189380607775914451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,5006955868699580814,1189380607775914451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5006955868699580814,1189380607775914451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5006955868699580814,1189380607775914451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5006955868699580814,1189380607775914451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5006955868699580814,1189380607775914451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,5006955868699580814,1189380607775914451,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4608
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0c04d47-e5de-41f3-823f-5b9b0b1d9090} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" gpu
      4⤵
      PID:3636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2484 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0704e626-0716-45a4-a20f-14ff1ba5e49a} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" socket
      4⤵
      PID:844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3040 -childID 1 -isForBrowser -prefsHandle 3264 -prefMapHandle 3252 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92d5ca5c-2833-482f-b4e1-508b29a69df2} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" tab
      4⤵
      PID:2300
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3948 -childID 2 -isForBrowser -prefsHandle 3940 -prefMapHandle 3936 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec328b5d-663c-4fa4-b551-3561b3b25c88} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" tab
      4⤵
      PID:2840
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4624 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4616 -prefMapHandle 4612 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f82468b8-8772-4ef4-989e-cd58f78db79c} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" utility
      4⤵
      Checks processor information in registry
      PID:3156
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 3 -isForBrowser -prefsHandle 5416 -prefMapHandle 5424 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f33c2bf-656e-4c00-8913-ac443a7ccdee} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" tab
      4⤵
      PID:2556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 4 -isForBrowser -prefsHandle 5600 -prefMapHandle 5604 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee1864b2-afe7-4077-a6a4-14e522fcf874} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" tab
      4⤵
      PID:3388
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5776 -childID 5 -isForBrowser -prefsHandle 5784 -prefMapHandle 5788 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3703e768-37e9-47e5-8429-7aecf371b9b8} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" tab
      4⤵
      PID:2516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6180 -childID 6 -isForBrowser -prefsHandle 6160 -prefMapHandle 6168 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43b2ba9a-1dfd-41f4-a54b-023e8b4dbc04} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" tab
      4⤵
      PID:5400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 c932ada1af085f983a88b8f70570c10ac4dcfbf0ceafd504b2326e8bdcc8706e
MD5 f6b250fb40406e4e4d42f95b1fdab103
SHA1 3285e97f7835ede05986d19e9a0f874013195322
SHA512 9e3b635dedf46538e845352670b37120e8fbd01eab2012ea9e081e776701254cc7a481cd5be208204d51712cd91333c48e49686462864ad95acb56dd70f99f4d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 2755afd056327338c2c3a74f33ed761aadce7208228b9718b7b245473691deae
MD5 e3bcfa9c8df55b811a1be4ebfa9980a5
SHA1 46ab0510aa8e82c11b74c86504c784a51bcd91ca
SHA512 028d399d3dee88d895c6d4df0f87ad3286de327e057a0bc14a66ce06ac540bbc87204fa29c401bcb3ac1bd6d685336c656945861bd378882065fb6f0e01da15b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 f9a10b6b07538c63ed21532862cd22d57688fead3baf7e99893200a76710ca2c
MD5 5100fb6f099a46329ab1303318a5b887
SHA1 507ff86a3c68fe245607e5c4f79ac2219c3c98ef
SHA512 d36b6d22987b49c18ebd3f55fe7b01977c183981b067f998018d836ef6762e54bc6add0bdd82409662bc3e906fab50231803a7ec7920ff98a92cfb372f6f61a2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dfac0cb42081279c667303340d686838efcc1fb1dc2db852eb461b936bdfe1de
MD5 8eaa3fb53224dad9aa6e6ad2bfb35ed3
SHA1 81a6460d4b296c8bcfa4c0f376d99ef8af3fdbbd
SHA512 a4ddcb2d041a21b664dcea500a07f6516ce218ee90dd83ae93ad376b7e63242a264f3975eb8bcd444819f1fb8c25d5141b22c5b158704007a817eb2729434810
SSDEEP 96:npk/4T1mOfOrwpTOWMoiVmdeGuC16x4sGCUWQyV+VD7AiEwb:npk/K1KqOWMWuCYxrrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8dabd2cd9381d41b984ce43adc98da74946191acc540aa59c0c34cd46434e402
MD5 08b9430a7318b9b762c27c93b0029307
SHA1 bd160cb49ee6e738c76ee4c00199934e76a33ff9
SHA512 617c8c037cbc3f00882e64bebb3ddc36f4bf701633d326594ad09ab2d4aa08d415fa33b071bceb46bb012baa9cc875f78a794d3f91a3735a782a49539332631e
SSDEEP 96:npk/XT1mOXOrwpvWMoiVmdeH4s5CUWQyV+VDCziEwb:npk/j1CGWMXCro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 f0a7bf24cde98831cdd32c2d3c966e44a7c4c8372931db3b94fa99859e0736da
MD5 15e440db3b2a8455bc0c50012c009709
SHA1 c8de7dc8fb9ddc8f137f7bff1cb68b72d3ef53a2
SHA512 0ebc37d5f7264bcc1e1b3837217088ca104b274172df420805c1053190b29274d0cdf3afb45eb8826445b4d61dcb202faba5812ed7a2a5a054c9cd3f71c3bec5
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58f632.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f632.TMP
Size 203B
SHA256 e6a9c62cf33805a81426500deb34546d44d00d4b34fbcbb40842f8eea89a48c6
MD5 bcd082ea011f37f4ae57457f5777bd37
SHA1 12e5ff8c7e78bedfa1fd95a42b4dd250256d5798
SHA512 5bf289f31f3cdab06cd75587f3481401a3c42ecd94874ae5a68c152f23711cfcda1b90298fb91355733cac0d29c507183bbf6f2e2d52173355805dbc160f7018
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 82c125026a42ba056297ab72cb67c77fcc6905d59d95f1648e61adf447d59d49
MD5 4d504aaaced21a3a5c97302eac286918
SHA1 18f13ebd063d820d2e95b94b1127fa22e4e3dca2
SHA512 f139124c2d8234ebf39305d49776edbc9214983002b131f1251d9bb43ad865975d5ee702fcace0558653ee00009dfa3b51c162c103c03f82a2a9115f71a9bb4c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphge2RUQi61LQOl6feAOQ:A9iIxuERzA83h09RZxYcD1Sp
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\activity-stream.discovery_stream.json
Size 33KB
SHA256 ab980771f28f5db5e35c33f44e3137209a7dd88d6b398d7b65f27180a9a8db00
MD5 bbed99d25c684fd17f15b75452cc74a8
SHA1 c6f179a67606737d3a3971a8644296d5602f4e3f
SHA512 f0c2acc28674f6a7b2d74f052c5bb3ec9815d6e949efc4acf014c974b9f617442b492bccd5a971ed1b271bf1531dc6569de25fa04497b0f60375fe4f55eb49d1
SSDEEP 768:x4InufdUNQAWXNULP7jUjyd+K1TvVp7Lt7Dn:+InCdgW9UPXj1TH7tb
MD5 SHA1 SHA512 SSDEEP

Submit Download

58EFA56DB4BFFECB0EDA547894BC9A057159E22F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F
Size 13KB
SHA256 e9aa90073583beec433a3e183282edb4d0ca5d70f191bb629d0f7cbdc729da33
MD5 c1676aa69e18e2b6e5f43e165cb43855
SHA1 3d22581693ecbf28bc01c45c052bcd57e2eba14e
SHA512 3821162e4251380d85c20bd72a221e693d39b16c77013b42795e310d3db50c89b4a7b6eead88763dad37d9a7d662cc5e2f04e152779145cc9f3bbccc28e0e677
SSDEEP 384:HvGu9fiGLm4pURpHLFoCr/E8HPJyD3VonFcP+AWRMACQfF:PBi8mCURpHLGCr/E8Rg3V/+hRMFu
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin
Size 7KB
SHA256 08ecfd6969f88b98bb9b569244dfad10d5bcea319e7423235e04e376da57963a
MD5 c29a11dcd899df143025cade0cbcaf4c
SHA1 e695fbbc8412ff7c3fb296d453624634a806c689
SHA512 66661c98ff61cefecb78824896d6a6c93a9b607a2749d3a1b391e3f163b14269b5eb55ed5a2b663a62f85214c628be233a363f00bcdebf94c8c3eed2737487ad
SSDEEP 24:6uB1ogxv90fOFsh2F3LFrS9htKgvgu1xgRbiuhMZdpR5cO:90fqA7Kgv5oy9cO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin
Size 6KB
SHA256 05a8e566b2317e3443777dd4d629873fbf1b46ec808e9b560ce67feca3ae23b9
MD5 67fca89dc0dc0be85c92e081595dadc6
SHA1 98219b6a6b44a2eb0466f52f6b3d8f3134c657e7
SHA512 947a58dc08f412000277bee10a8da9c7a8ede2ea941d8436e05b9fe5c424533c9fa809bbf1cd847a10033240deb2b34ea2206f7c07b30ad9f345836237c10104
SSDEEP 12:ZgQpB8gQWgQxxv90frwPEQphMQSQuU90frw:6uB1ogxv90fzuhMZK90f
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin
Size 12KB
SHA256 b7763602c3187f2e35aaf43bf3d9ce207a57b5d6a8278c81da5c097583038243
MD5 db94052fa88c8ced58d52ecf2f864799
SHA1 306293382b0e525a88dbf91e7121be91c9b1babc
SHA512 01565dc62f457000dca091cb04b52b71be448cbfcc40e2595c2c2a4378186916f33ab2388e75b900e4adf456986f2f5d4c8447510bf1b68ba48d2a3ad71cf177
SSDEEP 24:6uB1ogxv90fOFsh2F3LFWS9htKLvgu1xgRbluhMZGpR5cOs9Bm69xC2Gs9l0GxG1:90fXA7KLv5o69cOeEYI5eFgheo
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin
Size 16KB
SHA256 7bb7b7cf297a72959e11a050f00c431211634e6a3f82a8cb13f6701a7c2a8861
MD5 a9d6973889871c52551157dfc553c7db
SHA1 2eea7296e843645c7b6c9f614b3fb6d9e73c8391
SHA512 0c4496b330d3a9e44f965c41e42bec5a0dbb5d85c529c16aa07abfacb01edd383143c2bef0a1d4bcfde87106e13c1622629bb68bd7c4272bede21999e493fe3b
SSDEEP 48:90f3A7Kzv5o69cO/lYI5eFgheo069h1CHV:904cv5o0lYI5eFgheov/IHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 076fdcc445571fa94ecf4b6e9680ff76d5c63d27abdd81149c172b200592598e
MD5 bcbd594f91758fdf6aee2ba62e401bd1
SHA1 a0a695561f439eaa97575dac8056c3c045c31c84
SHA512 d07dcaccca264a6acf572cc6670f6a2be3db8eeed8083a61def6b41d978c4cdb516af83f0947c3b1330b6b8312010eaa8ba47c704c8edf89953cfe1d8718ec3f
SSDEEP 384:osFMb+l0fDvD3PKPecnaMEikdbRb5b3b2bJbKbvbtb05/vTxsrCRhiboSyPn/660:o3bHfDzPKPecnaMEikdbRb5b3b2bJbKJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp
Size 24KB
SHA256 6ac24dfcb665d4e58f2f43520921bd558b207386fdc35ff46d9a10fe53482fde
MD5 0d060344f6be460b80f5d6eb22c3fb09
SHA1 0e28e23c3d2a526c8a86702b7bf392cf31b26218
SHA512 3bbfac54a9cf56642071e9d095f2e71d99296c4a7fec9ecdea64150a5d3915049dfd12d887284bbe0a036c992974f6938338e65f79c38aad5db0d11f9d8d74df
SSDEEP 768:5Y4EZop8+3FDKPVGnaMEiTgbRb5bXbebJbKbvbtb4oVoW3YKW1:go++3/oVoW3YKW1
MD5 SHA1 SHA512 SSDEEP

Submit Download

1b96a546-fcd6-43a5-ab34-9e78f3ee4166

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\1b96a546-fcd6-43a5-ab34-9e78f3ee4166
Size 982B
SHA256 edb9171e88b1f6f1f18b0c2de736e3244390d95f8b5ef0d584d47909fcada1e9
MD5 6296721ae02ce834e61062d40a0243fd
SHA1 dbf9e6e9bbdd186827c74d6638262c74c3b8262f
SHA512 121753fedc3798aa08808b3f553be8591041ec0fdbf4fb67f544068567eaf2ac1ee12836bbc3b9d38e6471e7328b5a2d2c572455a840e72990b4d6071e54ce91
MD5 SHA1 SHA512

Submit Download

f151c41e-f9bc-44bc-97ca-e9ed468905ed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\f151c41e-f9bc-44bc-97ca-e9ed468905ed
Size 659B
SHA256 f9b054b80c2fa40f432d9dc6b18e04bb667035391e4816671812537ccf331f5f
MD5 1fe7ad7f90ff0fee207cb374a26a911e
SHA1 b1c25e71baf665478c0f9fa67b10387c0157e8a5
SHA512 61201ac79b6600dcd9f7294f6413228e2f423f0a5a864f7ba6705b7aee1efb24089f73f2a324264462ac62a1bf3422ae02ea58268ccd64bcaf2eabeba166d002
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs-1.js
Size 11KB
SHA256 1b3cc67740ed73f7fa77bfa3f3ef9ab085f21072d3efdd13d191427a56a2d470
MD5 fa405d2803837d2cef09af044c11fcde
SHA1 b36123c399880eb2f169c1413206180a1caa531c
SHA512 bc00e455c90cce8843f0eea4eb44beadac575bdef844dc80c04b91ad1e9caf2ef8284c95a583327c0e843aeadaf1f0e6c16d41c73bb593d5e63a3c92f54c50d6
SSDEEP 192:d5nxRjfify4SfvtPJQ/nJGcdS88OfAtey1ZS50VaXP84rYuBw8Hk:nSSNPmZR9Key1ZSN80wh
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs-1.js
Size 16KB
SHA256 d7f9b4c827e06c94e435a7a473edb0d91a27956bf5366c4dabbd2841e3350993
MD5 69f24d23b23c833828901158a675dd76
SHA1 6eef3d7594e08e24766f414be285b0f80a8136b8
SHA512 0eb5946ba583198cdffe00236dd68b5bb51a88e9ff32272ca1be981698fbb57f8bb5792d37ca536bdfab1b0247ba63b0e768ed76c303984e018ae0bfea1633b7
SSDEEP 192:d2nxRjfXfy4SfvtPJQ/nJGcdS88OfAtey1ZS50VaXR+84rYdiBw8H1htQvG:mRSNPmZR9Key1ZS+86w2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs.js
Size 11KB
SHA256 c86a764455d6ca6ecc2c80cdc64f71ac03d69f4594ab67967543e227f730ef9e
MD5 41ffd743f738eff2337ae47a8e18c2ae
SHA1 5530a5924c245fd52bec35edffdcbf1905e00845
SHA512 d6d096191750a0486e529e05fd3011ed05bad885df8095159a721f2007c9c083fb39c42d036164b5abe07c829e2b5d73aadd50a4cce27b490cecfc45f8627a04
SSDEEP 192:C5nxRjfifuaf5fStvvZDoncdWfstIDnjXT60KaXR84rYGBw8H7:ksf54vvicAWIDn6G8cwm
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 02d51728686a18283faf705b3934153d1adb755b7016473e560e0716a298bd6c
MD5 520eca66234e40663c00c94e2eda3aaf
SHA1 eb8c940f0844c53b1989f1074d9c2a0a9fabb36e
SHA512 9e87a9ca5064fdf72eb9fbcd5a76ac6e097ef8074157d06e803ab91b677b9eb8ad5c4c8e8d0d7a8d1c0104c18710b2f12c68ede4082eb6e7e4943abb89f2579b
SSDEEP 96:pYwC6h1VwKRwQEGJF7hLMZk0zf8W8Qge3ZwS2PIEDl:pIKVwKC9iFRMZkcuemt
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 368KB
SHA256 e5157506ce78208b60d78755e8fd5cede3673e4601e54033664dca3965b9f563
MD5 0858c817b1070f1e765c8dee383217fe
SHA1 9d1359e988aaa08e5d0b1cc87cc0ad096fd5670e
SHA512 fe874a9379bc8f922fcaf877c7410f51bdccba2bef6cdfa1b65d06d35bf5d89c21a4527cb9b26dd65d07779021128c63c699f2b2e424add08b22ef25807dc815
SSDEEP 3072:9rcHaiucHY3y3JNudJeHoLTBnVD0Mis6uaihb+Ma4c6Y1dZzOZBY:9cHNuSY3y3+eH0npl6uaci
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.4MB
SHA256 d4b13568e5077d1d576a22f8f442cc684a0ba60a0160b4d55b8cd0454afa24e6
MD5 05614ac8da3fe0c31f7ec5c0a6dd4543
SHA1 7c3548bee233604afff9f2d4e3818d40e0187160
SHA512 9d534adb68e54fdf0ff73bcce53dd1fb9496399206ad1f06e2e2ef506189f6ebfd91c6dff9cf8aeadf0779f15c0e0ecdf6177c5a9be2b75eae7939bedbe615d2
SSDEEP 6144:19QWge1Hsy+s7aUrucrYc67m1A33393z3m3f3BBOeUetk2JukV9eIUKZmz0Pu/eu:Yy+s7fScOAHR9epMMas8g6jRfc
MD5 SHA1 SHA512 SSDEEP

Submit Download