4c128e1e1ce95fbf6f20463bfaa690a410acc2d38fe575e8e84053166ee6e61e

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 896KB
Sample240905-sefxqstamn
SHA256 4c128e1e1ce95fbf6f20463bfaa690a410acc2d38fe575e8e84053166ee6e61e
MD5 5c22e55be4b9216e6158e75c0dc17757
SHA1 d46b92b1307ff10680bb1250150e30a1340d7b72
SHA512 07e98468c517fb72985380ef4e7fd331d1f5992f7c9ab3755e746824273e313ddce25668d75603a16a09bd4bf57d478fe184841fbdefbe5a6241c6365dd58cd0
SSDEEP 12288:IqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaDTg:IqDEvCTbMWu7rQYlBQcBiT6rprG8aXg
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	file.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2520	file.exe
2520	file.exe
2224	msedge.exe
2224	msedge.exe
1520	msedge.exe
1520	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1520	msedge.exe
1520	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	232	firefox.exe
Token: SeDebugPrivilege	232	firefox.exe
Token: SeDebugPrivilege	232	firefox.exe
Token: SeDebugPrivilege	232	firefox.exe
Token: SeDebugPrivilege	232	firefox.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2520	file.exe
2520	file.exe
2520	file.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
2520	file.exe
2520	file.exe
2520	file.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 1520	2520	file.exe	84
PID 2520 wrote to memory of 1520	2520	file.exe	84
PID 1520 wrote to memory of 2460	1520	msedge.exe	86
PID 1520 wrote to memory of 2460	1520	msedge.exe	86
PID 2520 wrote to memory of 3820	2520	file.exe	87
PID 2520 wrote to memory of 3820	2520	file.exe	87
PID 3820 wrote to memory of 232	3820	firefox.exe	88
PID 3820 wrote to memory of 232	3820	firefox.exe	88
PID 3820 wrote to memory of 232	3820	firefox.exe	88
PID 3820 wrote to memory of 232	3820	firefox.exe	88
PID 3820 wrote to memory of 232	3820	firefox.exe	88
PID 3820 wrote to memory of 232	3820	firefox.exe	88
PID 3820 wrote to memory of 232	3820	firefox.exe	88
PID 3820 wrote to memory of 232	3820	firefox.exe	88
PID 3820 wrote to memory of 232	3820	firefox.exe	88
PID 3820 wrote to memory of 232	3820	firefox.exe	88
PID 3820 wrote to memory of 232	3820	firefox.exe	88
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 232 wrote to memory of 3120	232	firefox.exe	89
PID 1520 wrote to memory of 5028	1520	msedge.exe	90
PID 1520 wrote to memory of 5028	1520	msedge.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdeeab46f8,0x7ffdeeab4708,0x7ffdeeab4718
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5308293423595051707,302648868026610663,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5308293423595051707,302648868026610663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5308293423595051707,302648868026610663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5308293423595051707,302648868026610663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5308293423595051707,302648868026610663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5308293423595051707,302648868026610663,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5004
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:232
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3b33b32-bad3-4f64-8790-c3a20be1bf5c} 232 "\\.\pipe\gecko-crash-server-pipe.232" gpu
      4⤵
      PID:3120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2480 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2436 -prefsLen 24522 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bb180aa-17ba-4f34-8e38-0341ac0973d1} 232 "\\.\pipe\gecko-crash-server-pipe.232" socket
      4⤵
      PID:1420
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3172 -childID 1 -isForBrowser -prefsHandle 3184 -prefMapHandle 3216 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c793ddef-56cd-4793-ab80-fdc59ecbd2d3} 232 "\\.\pipe\gecko-crash-server-pipe.232" tab
      4⤵
      PID:2724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3752 -childID 2 -isForBrowser -prefsHandle 3748 -prefMapHandle 3744 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5bd47ca-a038-445c-ac9f-f61ab8bc8475} 232 "\\.\pipe\gecko-crash-server-pipe.232" tab
      4⤵
      PID:1836
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4796 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4788 -prefMapHandle 4760 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e472436-e980-4535-b93a-1edbb18074c3} 232 "\\.\pipe\gecko-crash-server-pipe.232" utility
      4⤵
      Checks processor information in registry
      PID:5436
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 3 -isForBrowser -prefsHandle 4764 -prefMapHandle 5516 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {184a188f-936e-47f6-a94c-3515632322ee} 232 "\\.\pipe\gecko-crash-server-pipe.232" tab
      4⤵
      PID:732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5652 -childID 4 -isForBrowser -prefsHandle 5552 -prefMapHandle 5396 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f63b29b7-515e-489b-9de2-7ee17f32b0ef} 232 "\\.\pipe\gecko-crash-server-pipe.232" tab
      4⤵
      PID:4880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5788 -childID 5 -isForBrowser -prefsHandle 5796 -prefMapHandle 5448 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2cac50d-d6d9-4450-9c08-e262e731f92d} 232 "\\.\pipe\gecko-crash-server-pipe.232" tab
      4⤵
      PID:3128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6228 -childID 6 -isForBrowser -prefsHandle 6216 -prefMapHandle 6156 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbfa1d2a-cc3e-4ad6-9cd5-a68014f3af3e} 232 "\\.\pipe\gecko-crash-server-pipe.232" tab
      4⤵
      PID:5680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

925eb2da-e195-465b-9669-de38f88ae3ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\925eb2da-e195-465b-9669-de38f88ae3ee.tmp
Size 5KB
SHA256 f7265e2f139b407e63f6d08fba26c518c41b5d921a3e2faf9c48c77cc0b7d139
MD5 2ce2197c4ec40053e29fd67e7f51b4e6
SHA1 7f538c0421a3bb279396659dbad8f4fe29cf9312
SHA512 7001235270674149c44bc34a128923f160ee22423aee67734b0e0e4b1854d878ce4c7fa79655eba5e99f7556f55191fd33a2b974f3fd6b45ac8b1c6cbed01797
SSDEEP 96:nik/Xj1PXOrwpvWMoiVmdeH4s5iUWQyV+VDCziEwb:nik/TZCGWMXiro
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 6a9222ede4fee95b966526fcf30087411a8578d04a36669dee71c42da196d109
MD5 28616ede5c3821820e27ffd78f40b2bd
SHA1 eb35e4daab16f3d4d194f866d33aa2674837f3fb
SHA512 431d1c01060691cd95f0d4eb9d635fedb8434803ef66cc75f6b0db0c3540c1b04846a486e46e7ceedef42f3256e59cf1d5bf872da844b6f1a8b01f5b7b46d944
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 1689a79636dd8d67e4c592607bd9075f8456082d250d2d6ffa156c1fcea9cf67
MD5 3acd15812a3304237782f0ba8a27765e
SHA1 847a55130907bc3677d38e3c7ae4db6418568d3e
SHA512 d8722e87f2bf203d039b98b04c8bbd9849ce522c6d72265a94801619546e8ff3e187c7c0b08edcd1fa513bd2e78068966c75ca261960c6bc5037a9b0a8b09d07
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 a31bc1a7a2541f69676db752528ad9bc5d499b21ce1db604a9cfcde161fc7b30
MD5 ee6386104ceed9d6c17631ca2d356295
SHA1 e025aded8718bcc3da18ffc061a0a3d275e22f09
SHA512 439b16543d2259ea16d9cad5e078b8ff5207ab58b4292edb0d34d3e9d1bb8d435fdec4928102716d36339a89ab179c223e0a5463f7283c64ef704c0b5d7a4932
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a0ee64a5f68786c5306522d7f71741bc145fb3813b26ba89705cc501033aa0fd
MD5 0f2ee7c92b20763835eee8d5b0272cd4
SHA1 1db36ef39113cbdd1c7658e1e3fe40ba430d07e0
SHA512 78748fea1e0e16b4d19b822b0f7295b292109069d9a1144f7661189e50525939e722441bdc221b411523141f83b8ed1a968e25fa282deabaee002f1b66d5a1ba
SSDEEP 96:nik/9j1PXOrwpuyWMoiVmde3u+1Ux4sHiUWQyV+VDCAiEwb:nik/FZCHyWMHu+Cx4rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 84752a514fdb8cbe3eee8614f1f81f5f9a5f96b38297c0aac2e5a6856267a4f3
MD5 3de9c5585510e07e8b52bd55b7f515e5
SHA1 8f0d5f0a07e44e65d4881b3a2af42a321bc758e5
SHA512 d99f4dd61145d3c822d5a5997d3f3b49fc2d261df2017fb0bc79aee938ddd121c5caae6758aeb57e498eebc0fb7df66a97a867ec7c981b8b206dc24219e8cac4
SSDEEP 192:WoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSe2RUyi62LQOl6feAOO:S9iIxuERzA83h09RZxYsl2SP
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\activity-stream.discovery_stream.json
Size 36KB
SHA256 e4f0aa7829b1954e626867195031ac036d285cd20d1af8894c53bf6b14a65d8f
MD5 3b66270b9ade7f76144b73899c12fdb3
SHA1 40d4431cf32b2a75fd666a5bcdefff6df92e22f2
SHA512 648f956f3f81cf0f52e0905b4c2006f9f1104e1f4f4da17006511edcc23e967123ff68f8df6d6597c2cabc03720df55b834b8e3a022c6e3c522338b92b01b331
SSDEEP 768:AkVY96v6RSfxaoPuLoEydZ2dF4uEd5E7n:AGY96sSMk5udW78T
MD5 SHA1 SHA512 SSDEEP

Submit Download

58EFA56DB4BFFECB0EDA547894BC9A057159E22F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F
Size 13KB
SHA256 5fbee204274b4cac0e90124371a05fc2aaf18b37c402fd9d88dcab8123205fde
MD5 945caec519a699e28c8f9af881be0a90
SHA1 855407a4154502f355fca87eb4df8569dde7361c
SHA512 2ca5622d4b2f682199137d1d4ffb727c3f65221aa608af10f4f6cb56fce6e9209da468f8d8b1d0ea5ace1e2c34373326829d69b7a3f04083ac90221ad21e2498
SSDEEP 384:HvGu9fiGLm4pUkpHLFoCr/E8HPJyD3VonFcP+AWRMACuOm:PBi8mCUkpHLGCr/E8Rg3V/+hRMF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin
Size 8KB
SHA256 aabe9e0f36b38a0814ae0baf88c867bd467bf586ec39de7c340c04c32726f91c
MD5 72392b2b7bf04b1060ff08957c0620a2
SHA1 92a76c78f18037eb49c65f4ab654640c1accfb6c
SHA512 d9551b7a992883fdd6ffd9cab9ab4f97fe843a9b2b01f88bb49588741ac859cb1135fc2de3f280c428988e16ac05a7d28d731f584e98508c7be1bee7222d6728
SSDEEP 24:6uB1ogxv90fhS9htKGijFsh2F3LFcgu1xgRbpuhMZipR5cO09Bsi:90fhA7KZY5o69cOW9
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin
Size 12KB
SHA256 b620cf86a157178e66c9b91a0c9e309424236a9c7cd90ad35208a22aa3c03927
MD5 49cda8d77002a9715898c092aaaaf3aa
SHA1 926666bdadcb77bb0a67870ac514688338b956c5
SHA512 00960fde812ee0c39ff8d463c626fa33f410319f25f8a98f23dedb34b0e604b6bf610315ea698cb5bb9ff25c7accb13abf14586fb1334ba238637392d9cae64a
SSDEEP 24:6uB1ogxv90fjS9htKUijFsh2F3LFcgu1xgRbpuhMZipR5cOV9BTik9x1iqGs9l0N:90fjA7KjY5o69cO/AGydeFg1nP
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin
Size 6KB
SHA256 7a6683cd6d7800cdf281a837e253204c86ad488e72572540fe17580c189ce519
MD5 c90d86e85a6e1a1adcb15211220f1de7
SHA1 33a70b32017b0a24606868472548f7b07732e2ee
SHA512 7bab9dc649b02fb75772508b9cf93d33f78f9a27a475e4fa1d962525bb442f71b8c5204d938177dd64123a4b38fa174c08038534dd1b2042caa56addbd45335b
SSDEEP 12:ZgQpB8gQWgQxxv90frweklQphMQSQIE490frw:6uB1ogxv90fzquhMZY490f
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin
Size 16KB
SHA256 ea2a40a3cc6d346da835991763f056aeed18dfe8fa5739d9c44b679603433479
MD5 f639cabb0136c178facdcf1e5f373e60
SHA1 b075e733e1687b01691c0c868c14dd629dcd33b5
SHA512 d73904733fae5ae85be698844debdffbb055f0bbf129b41c48da42fa2c47711c4094c7c7abfaf33da4f0d9ac6f7ab82896b60f8b0f1ff95ff41d1d249f50812d
SSDEEP 48:90fNA7KFfY5o69cO/AGydeFg1+cS9cgHV:90GiY5oEAGydeFg1+cSCgHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 15dec9db139ee9e4429567a1d45e026ecce3c28dc3149ab8db72dfe803cf5eb4
MD5 a5c78823ec232d02390fbac21a803a5b
SHA1 047d938e25394e87e94c89a000c6dfdd37ac39cc
SHA512 5adf0268db5591aae7b3497c45b1eb40c95dc677233a6607707751143d4a5f3307f38fb4f786c517510c58ec13ede84dea6f90bb73a10218dd2f5426ba4eeb00
SSDEEP 384:TiX6wr/66JozGzgC1bRKbodIlbPI4A8XmOcnD/B4RbHbx5:c4E6rnA8bYD/B4RbHbx5
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 80a841546f7c71d41abfde6feae16fea89f061897719a3ee2d15c5563a68ce62
MD5 3713939a11c1f6916c1acbd8c3903f71
SHA1 fdb927340d53935e70cc30e5ecf888cd6caac806
SHA512 5674423b1d03d8ff0d7202f19c604ea2f33f0135b50b9d95e8dccb440152385945bd7ef9b929ec82bb866fd4cf4569079b758df954d19f39b0f21dca93d30f1d
SSDEEP 192:8krvZboP1IhIEDPDfkiX6wr/66JozGzgCl6mSS:8SbodIdPYiX6wr/66JozGzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 15cfbc284843b17528342c1c168cb6ddf0badd35b18fb3e0c8e4189f8b87e797
MD5 c4182083f6408b16b71aee9abcf5c43f
SHA1 e974fa43486a59b0d47bcadf04e77d1eefce4f96
SHA512 0278e3a0334a1713587471f5a375aee15fc61758c9b7149bcf001921ce69787a097c51a66d529c486319e2b60ce69c58d28d5e0ac80536d8eee8f0e9b03fd514
SSDEEP 384:n4A8XmOcnD/B4RbHbxdKbodCbPSiX6wr/66JozGzgC1bM:4A8bYD/B4RbHbxYT/4Em
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 ee491e52df5ede512868420922b39067b1e9ae429c1da515b130adfd258e7355
MD5 1e6afd5139a1c305c1763dea8a753173
SHA1 f86e4487379ed8ae7b8b16f7898a285634b93087
SHA512 9bc9706755901738ff26f2f8fd057a5185e55480f1ed00c28abfed927a59737593990c2ad8796566dacc9bceabf0ba02aa027b91d40a6ff99b209f2ad2c668db
SSDEEP 384:TiX6wr/66JozGzgC1bl4A8XmOcnD/B4RbHbx4KbodIDbPx:c4EEA8bYD/B4RbHbx19J
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 78ae709d59293269fa9eafb73e7e51c118817a8b0d5ea28d1b4cd11511d15f39
MD5 704fb9ef4399ddf7b12a0f9182d66613
SHA1 66b48345c78db91ef0e3eaef2ed408e7d8094941
SHA512 b8f2f019dc5e84eb04ff299fce8a1dffcfd5153f6f0f73baeb3c8d47a3a9ddfaac2e20ebac7ed14af9046846b05682bf19ff0f4152b4aedef0dc729e2718ed08
SSDEEP 96:MkSMF9ZbkW6ShmnrPP/PrWZyPQBkBXcBKBrFl66JozGzgClKtmSS:MkrvZboShaDPC1iX6wr/66JozGzgCl60
MD5 SHA1 SHA512 SSDEEP

Submit Download

271759c6-02a3-4304-88f3-8cd99999aa13

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\271759c6-02a3-4304-88f3-8cd99999aa13
Size 27KB
SHA256 a566d1fee9e7c2e24e4a798d864e07b60a5a20f3e0bf966193c8488880df35ef
MD5 6da417d0af07e0cef624ae7edde658c6
SHA1 8f38ba40b505401614caefeecb90dbefe9c73e9e
SHA512 6daf9b0a2800336cada096e21097028d36abea1e9353d1de3fcf6d6b1fd26dd395b99c791d809dc97103851b9f63ce461a907fb6181de1680c1ce4a588a076d2
SSDEEP 192:b2jc7nVtCxquq61Ww/4oU/wn7viYXAgpMuiQzqKRxUGEFFnqyIjZc6klN6cGIz8y:b2jc/BLS77lFDiQeKRxH22CKgi6/xB
MD5 SHA1 SHA512 SSDEEP

Submit Download

a26ecf3b-6a1c-48f3-972e-b50055904ea0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\a26ecf3b-6a1c-48f3-972e-b50055904ea0
Size 671B
SHA256 0c4144065ed94014adb3416c540dfc516b99ad8e202ef369f325edf534516959
MD5 3184bf469cc3d351154dabf81e9a7240
SHA1 a860efb89ec2e0d831d8e0d5d9b23ae15ccdfc01
SHA512 2ff5a423679481ea995a340654e25d5d8ce9838f56445781316debf6980274769636ac8ab0d5c69878f066497574370abf65c3ae3f2207e6b58efb2e701527f2
MD5 SHA1 SHA512

Submit Download

c8e27b1b-aa36-4602-b663-f943ea2c08a3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\c8e27b1b-aa36-4602-b663-f943ea2c08a3
Size 982B
SHA256 45bc8ccfc3788b04f275ac21480497d74faff6e694717ebec79cacf922492fd0
MD5 b1d6aee14e175cacdaf507dbc1d51fc3
SHA1 fb15a9ee0fb6a7e40af85de22943bded01ac7efd
SHA512 c83c0db160f0771776ee5a4295e872db072f4f82f465da78909606381dc153b85b308dfda8af6bb128befa951ae07af85b06c75f67c99dc2b92e9c4092687266
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs-1.js
Size 12KB
SHA256 987ad74884104dc9669aaeef8dcd4ac87518591ea0279a69bcea0920ff5e85ae
MD5 749f449872579baced62372ac8ad044a
SHA1 3507622760243b224bf41dec277ef5985baa9f78
SHA512 7198f02e1101d4e23c7315626491ecb5ff2be8cd3ae54bbd4be7069523293dd13cb1d56e9989e2b5f93fcc9938a27ae4f5c0ad9ed5c80dac9b1e0d83561d9182
SSDEEP 192:d5nxRjfiiIqxz3IBXuJcdQ8vLt520xaXZ84rYnBw8HzbTm:nfz3IB3nvL7A8Zw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs-1.js
Size 16KB
SHA256 7add134e9ea7ea086843450496d84da52df257a52646dd5db27ca70538033adf
MD5 42de4206b07ee60d6f5c18587e2b893b
SHA1 e92c70875a87ac7e48fc523cf388d7090fed503e
SHA512 d498061bafe79d9b26330673f76a56d5e0d0259a596dc614108aa77d917afac2e6a87a22b84fd79b9b493deaf871540171566ea000aa48dbdfe63cf2e8aeacad
SSDEEP 192:dunxRjfuiIqxz3IBXuJcdQ8vLt520xaXT+84rYpaaiBw8HzbCt1+hb:mrz3IB3nvL7d8EwBa
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs.js
Size 11KB
SHA256 c12dc5f43ae5f140cd9677aff3a480a6f4caeb64c1455e181729664c00f5aa3b
MD5 bf7f13087560f01e85854d28c23e39fa
SHA1 a889667540f0a43a5deff1ffb5227db7bb64a9fa
SHA512 1c537dd9aad40e283e34b4f6421b4b693001e11a0d2dc7cf5cc591ef70d3318f813889d3c1b77e3709ac5588c6f2fe1a4e3c28016650d133abe13a9e6f4e4da1
SSDEEP 192:C5nxRjf85vNxndz/NcdNxnIzQHrK60eaX684rYGBw8Vo:kCvNxdzyrxOQLpB8cwX
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs.js
Size 10KB
SHA256 1866510e84e78fcfd8d2f59332ebf3810b42aca5c372044422b74d0e1cfd255e
MD5 d6555585a0d9cc19561ec3d7bfbe1e57
SHA1 7150900f98684cf54561346afc9ef9a0324bf426
SHA512 b6dc5959c0bbc7f71fb5404d3e25712071c2856cc43487905502682a5537ecab91e3a73def969df64aa48b171fdd893cd09d69f36894110a37aba1ea925f4785
SSDEEP 192:C5nxRjf8qxz3IBXuJcdQ8vLt520xaXZ84rYGBw8Ho:kdz3IB3nvL7A8cwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs.js
Size 11KB
SHA256 97cc424ff2809f6f4bb7fc8097f21fd80b692d7d3642f2b777fa9474ba37769f
MD5 0dd15fa632f41173139c365515588427
SHA1 54373cd11c2912a6b47ab396ec671059205d199d
SHA512 73a31cfab64bb6a777574ab372cc2e9abf82082bcac86527f9d670b0f5a60417b86274b5bc568b72fa28a9fb837342d5dbe6f9f2187756cad3b0d363d27b2aca
SSDEEP 192:C5nxRjfiiIqxz3IBXuJcdQ8vLt520xaXZ84rYGBw8Ho:kfz3IB3nvL7A8cwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 072419b9a513e97038641bef5e7c2f19bde4a4af74d0f17a8aa8abe0a9e57893
MD5 ed40133da4a1a71057a82e4848672c2e
SHA1 0772a331bb2e3446385a726667496ca3dbb66082
SHA512 bfd225582c4b7c072a7d4c6de33cdb88676b337cb3907b81541faabbf0dcf34dfe5625d6ea82fcfdc86e9123d929449911741559bfb827192556fcb94ec634dd
SSDEEP 96:U/JC67uWmMQEGJF7h4MZk0zf8W8Qge3ZwS2RI9:UcGmM9iFiMZkcuem8
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.0MB
SHA256 85198e64f5c62859b71b557f481096a71b159cd2236705ab8f6427d46a609c63
MD5 3ddf02f6cb422c76eafed5598807df51
SHA1 716c72ee7c96a9c8ad9f32fb68211a4a66cc9922
SHA512 9d9fe1e39a4afcd66f82673978b31ce0ee660110c9b4d68181ed1a4185c5f4db1de9325e446608b23ee285a5452b1d0930ae1befd4b7be3e4541a503f0e9640a
SSDEEP 49152:RciC5dhmBGL520ybwByACiRyx1sTFXqDT5fdmd6/mznBUOKXaMcZ30hXBm7+vji8:Y
MD5 SHA1 SHA512 SSDEEP

Submit Download