784144d395ecab1d04ffaede56760329604f7989a258f3e75b3edc50d1400a47

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 896KB
Sample240906-mkd3fasaja
SHA256 784144d395ecab1d04ffaede56760329604f7989a258f3e75b3edc50d1400a47
MD5 df302225c2ef4a150c48fa19bfa69ef1
SHA1 af90c0b4960217bc9d1b346edc7f98d583b1102a
SHA512 5cafa55312f4b3b9912a9bc27a3384027705c96d18dfc9c34b89327a0dacf814bda0a63de8aa41c05c1861b6eed11950700f60e2ff1eec7a36f3e1b18e9faf56
SSDEEP 12288:TqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarT3:TqDEvCTbMWu7rQYlBQcBiT6rprG8av3
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	file.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1992	file.exe
1992	file.exe
3352	msedge.exe
3352	msedge.exe
4532	msedge.exe
4532	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	firefox.exe
Token: SeDebugPrivilege	2392	firefox.exe
Token: SeDebugPrivilege	2392	firefox.exe
Token: SeDebugPrivilege	2392	firefox.exe
Token: SeDebugPrivilege	2392	firefox.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
1992	file.exe
1992	file.exe
1992	file.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
1992	file.exe
1992	file.exe
1992	file.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe
2392	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 4532	1992	file.exe	85
PID 1992 wrote to memory of 4532	1992	file.exe	85
PID 4532 wrote to memory of 224	4532	msedge.exe	87
PID 4532 wrote to memory of 224	4532	msedge.exe	87
PID 1992 wrote to memory of 4620	1992	file.exe	88
PID 1992 wrote to memory of 4620	1992	file.exe	88
PID 4620 wrote to memory of 2392	4620	firefox.exe	89
PID 4620 wrote to memory of 2392	4620	firefox.exe	89
PID 4620 wrote to memory of 2392	4620	firefox.exe	89
PID 4620 wrote to memory of 2392	4620	firefox.exe	89
PID 4620 wrote to memory of 2392	4620	firefox.exe	89
PID 4620 wrote to memory of 2392	4620	firefox.exe	89
PID 4620 wrote to memory of 2392	4620	firefox.exe	89
PID 4620 wrote to memory of 2392	4620	firefox.exe	89
PID 4620 wrote to memory of 2392	4620	firefox.exe	89
PID 4620 wrote to memory of 2392	4620	firefox.exe	89
PID 4620 wrote to memory of 2392	4620	firefox.exe	89
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 2392 wrote to memory of 3320	2392	firefox.exe	90
PID 4532 wrote to memory of 1648	4532	msedge.exe	91
PID 4532 wrote to memory of 1648	4532	msedge.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bde446f8,0x7ff8bde44708,0x7ff8bde44718
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13935509423468527632,2437706140050377454,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13935509423468527632,2437706140050377454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13935509423468527632,2437706140050377454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13935509423468527632,2437706140050377454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13935509423468527632,2437706140050377454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13935509423468527632,2437706140050377454,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3992
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {713746ae-7c0d-406b-8691-92bd84a95384} 2392 "\\.\pipe\gecko-crash-server-pipe.2392" gpu
      4⤵
      PID:3320
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2296 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8abed62f-1206-4f21-81a7-214809b8be13} 2392 "\\.\pipe\gecko-crash-server-pipe.2392" socket
      4⤵
      PID:1308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3188 -childID 1 -isForBrowser -prefsHandle 3232 -prefMapHandle 2636 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd371fc5-6b29-489b-b37e-5b045887c1d5} 2392 "\\.\pipe\gecko-crash-server-pipe.2392" tab
      4⤵
      PID:4060
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3644 -childID 2 -isForBrowser -prefsHandle 3724 -prefMapHandle 3608 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8603648-7b39-45f7-abb8-bb76f98f2a7f} 2392 "\\.\pipe\gecko-crash-server-pipe.2392" tab
      4⤵
      PID:4496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4324 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4316 -prefMapHandle 4280 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cc14c1f-27eb-46b2-9edd-e261421d704c} 2392 "\\.\pipe\gecko-crash-server-pipe.2392" utility
      4⤵
      Checks processor information in registry
      PID:5676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5504 -childID 3 -isForBrowser -prefsHandle 5548 -prefMapHandle 5540 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afe979c6-1c08-4ccd-b0fc-e4668e7c5a31} 2392 "\\.\pipe\gecko-crash-server-pipe.2392" tab
      4⤵
      PID:5424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5684 -childID 4 -isForBrowser -prefsHandle 5692 -prefMapHandle 5696 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a78fcca-57ce-4a59-8da7-b130895e7190} 2392 "\\.\pipe\gecko-crash-server-pipe.2392" tab
      4⤵
      PID:5440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5884 -childID 5 -isForBrowser -prefsHandle 5892 -prefMapHandle 5896 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3ffa5f9-bd92-4032-81c2-1b33e37c1eff} 2392 "\\.\pipe\gecko-crash-server-pipe.2392" tab
      4⤵
      PID:5484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6336 -childID 6 -isForBrowser -prefsHandle 6280 -prefMapHandle 6252 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63505eed-2c80-4ac1-87e6-8cf16ef3dac4} 2392 "\\.\pipe\gecko-crash-server-pipe.2392" tab
      4⤵
      PID:1904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
MD5 eeaa8087eba2f63f31e599f6a7b46ef4
SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
MD5 b9569e123772ae290f9bac07e0d31748
SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 1bd7438696b4a1eb0cf4aeb6f1ded8bf6102f7f1b73cd2af778e8c94f012e01e
MD5 d184d36e9a84db8f6f25f633998375c1
SHA1 b3f01cfa39f097e85da39e1cad963a4f6540d529
SHA512 800fb83a86932114f3b5d8ac49bd3b6570354f24e7ff1b64a870f957c52d066ba4b28899076ec9ada09c73a1e93ba5deea9fc8e711294f86631cf4b8a5db4e71
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 be2c6d0aa57bd6254f509e8a39b9e5fbe05efba4c6f0fbc9aa8f5830e4b54a58
MD5 db7bba181748e2416de8dd2c0edc0199
SHA1 01ae0c43fbb22c7874f8a1e77248468ad9a1053c
SHA512 cd68342b10fe1ebd2c27af75807de41f21631f46f304b1bc1280c3e3141d32f259dd7227f3179131c91f9dc5f00c5ec585398e5b330c101d88ed68bdd5e64066
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 68bd49fcb8b8e5141c9b1036d0b56cbbeabbfc29d3b87ef321b71e99dc777730
MD5 3f6a729ea20576024617f32343a85bed
SHA1 ec496eee9e00fe288aed8621634557eeda24bf20
SHA512 c427e1ac7ce55edd955eeb04755157730e479d1963e54981aaed3b7036ef51f2fd04bcdd3339b1881ad2657ba6c3b801bbd2e14ba44c641b0220baaf2e2501fa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a8517860df07b47ea5f7b9d789829fecdae928180416bc153effe80b0485f568
MD5 c3c99a3a8990a065f7a2673145a817bc
SHA1 f5e824cc70d67b93a8bd10b516a4bcb604fbb927
SHA512 b3e0cd9be486e2e671346efaef6971ffa18653584804111399b6ad3e3ebd6a1496f5b7f7863cbac550213d2029eebbd54913f6d3e487caaf5e20c48f28872735
SSDEEP 96:nFk/XL1cSWwpvWMoiVmdeHk8CUWQyV+VDCziEwb:nFk/7NWGWMXoro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f6892688d33990e5d82b3981bff6221663c34f3e186305788d77dd3be739ecb3
MD5 3b9d49cc74f10f04a1cc7fa70dadcd54
SHA1 99a1485ab39884807229dc6aef889163bae3a890
SHA512 65b7a11f6ae0af25f7e782732b4fb1ee5e6161412bb4e303e8a2e942325752af56f56c95f835b42c6d0ecf6ac766e2f58e9e710301137f039a91a0c91fc67858
SSDEEP 96:nFk/4L1cSWwpIvWMoiVmde+ue1CxkBCUWQyV+VDCAiEwb:nFk/GNW5vWMOuewxJrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 acea74f4b8ea6d6b67dd09dfbef11e421e5f31eaa612d76060845196f8d10529
MD5 aa14b6732683213254c6cf8bcd64fcd7
SHA1 74e6b290106be31212f3caec135ac81807621ed0
SHA512 5d082d3aaa48d67ce57452c2aec4e9b1147a786791c31bc827726b62ed3d7d7f27e0ac6bf4e846abda3f75fcfc729a223904c65f3b21503d27f45504a65aa6a0
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe599205.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe599205.TMP
Size 203B
SHA256 38f751645d041417818effe4b32a9d12b04f6a78f4c6cf68badb8aadf00108e5
MD5 e93ca7fbcaf4a046ca61800ab74db86b
SHA1 5eb7d38493316c47ebbe48ed0fde077bc61557b4
SHA512 1289f4f0ed4b04fe4168b164e707941af51e4f6ab702cd250d578296a8ae4bf5a074a08420d6cab470a3d6d33afb581647b49183b31a0c4924c2fa864e40c7ca
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 df62de2be72e383e7b6f0561fa0de0eaf6742408b210a43cf2260fad419dbfec
MD5 33e9716fc9e47ae20c283d5a1ec97e73
SHA1 70f585b47fd1199f707e9829bd3ddf55d8f25feb
SHA512 00bfdda7d70823e0e41a7cf15a79985074d147938d935cb82b2a3f2c095686cd3a2bf585f1feba029a45f2e395d41528a372b958bb342b165792adb546adae34
SSDEEP 192:AoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupyKe2RUWmxnNLQOl6feAO5:49iIxuERzA83h09RZxYyEeNSg
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\activity-stream.discovery_stream.json
Size 33KB
SHA256 bf075103a14792e52e1b6c3765db4a6cacde22bd28c15dc44d472dc262f27eea
MD5 773bc877b00b29aa4920402f34b351dd
SHA1 d6457265fbad4e30976edd06119ed626ab915401
SHA512 66c30985ffd321738b372b46ad0a3a243626317e1db40a236a9f2a8526c6619eb17f34207cead09c8cce0f6004d311370b436801f5cdb0386d9ae891935f6b8a
SSDEEP 768:+ACqFtv/m6VtMyd1aUmcBQrLB0RWryzyiG:HrHmIlbE
MD5 SHA1 SHA512 SSDEEP

Submit Download

58EFA56DB4BFFECB0EDA547894BC9A057159E22F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F
Size 13KB
SHA256 65b2eebe238a66710b6d2a7faa0b6b3fcee6e2c7ce91964df17849793752d736
MD5 1115833ed3019dbabfb7132db42e1bf0
SHA1 758a1821a3b41e8294d296590d526e599e622525
SHA512 1cf10619b8c13cbedc14fd8773084255a31ec28c23b4a78a99281cfb08244fec1b67fe70b33ffbc3feba23f6d18a13a9dabae37c1515f80402d90f96668edddc
SSDEEP 384:HvGu9fiGLm4pUIpHLFoCr/E8HPJyD3VonFcP+AWRMACySNS3:PBi8mCUIpHLGCr/E8Rg3V/+hRMF6
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin
Size 6KB
SHA256 36a4bb21d93914a47a94a6d8d3ca2367851dc6901bd6f6d3537a20646a88044e
MD5 df74cca19e493b23f5bfb95ee06b92f1
SHA1 6400dafdd27d6adf605caea2d79726750288f881
SHA512 4a2b3f389adc9708f384ff8f4364bed1ec1701d59cf8a86690587b3f94d1c8f0a290eb96d3d541d526a7321f67f97c27e8efc366bb2f5c2a130b37763f9264d8
SSDEEP 12:ogQpB8gQWgQPew9SVHLSTQphMQSQs9SVH:xuB1ofw9SVrSTuhMZ/9SV
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin
Size 7KB
SHA256 4366698c57048544d6bb181f55be56f43a0f03db42e342230a0a84cff39e4225
MD5 74057a71fef56d24cc090ef428b11947
SHA1 7df6e17205a113700040c028a7bbedc64e88088d
SHA512 e609f9688484569b4821bbc37c62a6ce7859aa742725b1ebb2fcbec0c99c6f77872328178211cd21247b5be2089b66a6e532f5aa4942591401813b34aa96817c
SSDEEP 24:xuB1ofw9SVw3RFsh2F3LFH2WS9htKFTx+STuhMZ/9SVSbCgu1xgRbBTYpR5cOk:zSmw3B2WA7KFTxFnmSbC5oVTY9cOk
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin
Size 10KB
SHA256 f8b0c7fb00a7d40660cbdba9b79059113cb2229961d500fdc1f1a9c04750f475
MD5 d376f5b68f7ae2574ab639bbc8ace954
SHA1 e5b9a529f5fb56fa3307a77fae2f17099a8f2dfd
SHA512 645629a19e9b622f098d8c48a591324f35c09378acdf13daf6eb17120a53e9b591d01732de2faf8cd1b54b0321adcac2744f9550e323daf4bcfcd5b8e919b722
SSDEEP 48:zSmw3B2WA7KFTx2O3bC5oVTY9cOkUw7Txb1XTx:Wmw3c/Q2mC5oJUw5b11
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin
Size 12KB
SHA256 9ff23bd461e0bedb9de38120123b09f2f7df7e8b7101812ab79e01e5381d7f11
MD5 96357d104ffcdc67ee6d8d07e52077c4
SHA1 c88b7a5edfa4e735979829a3221913fe56730421
SHA512 9e36193ceccc7f612c60e4352068b5f44dc1a2da36ebdb2f766ff7e289e1dbbf3efddb35ae1c069de13bf1ec80e03ab6bdb7d4e87312dd6b19e45460678f91cd
SSDEEP 48:zSmw3BQWA7K/Tx2O3bC5oVTY9cOktwSTxb1XTxroCeFgNTxSF9wTx:Wmw3i/e2mC5oJtweb110CeFgHSFu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin
Size 16KB
SHA256 9878b33692f131bf1b020b9e03613c26f324c4cc87253071f09cdb7de15d0663
MD5 c91deb18789c0d7baaa49b5a4b1b22ad
SHA1 bf0abd831f6b82f690dafc5c9fae57a955709d5c
SHA512 b2165d4401f832b5a4ba393956cce04bbfd545949a5e50288d650cbe664626038a3fa40670a31311f221f50dd80d5e4a1197a0b6705870ba14931bed99baa5f8
SSDEEP 96:Wmw3X/3N2mC5oJtweb110CeFgHFNFxmODB3fHV:/YXsmC50t9Acqs3
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 433ad449520ef35efcb8578bdeab5440e4a0f34c86232ecfc907dccd006dec5b
MD5 1c88173045a79f8d4f689515d5789ad1
SHA1 b259a5c10371af5a2a821805f18efe8204432d1d
SHA512 ecd08d469c6909aefc62b57437705c485922463e6cad85720df03b7a448fa7513ddfcef6f03a1232c331e64fa273203443799edb0a32c0caf121ffdc8b2b5428
SSDEEP 384:M/66JozGzgC1bLbovEeXPevfsjR67DG5o0gbIbE9:JEBmoEgDWo0gbIbE9
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 7fa13a35915f47514401b8ddf02437c5236875cb101c03f6c87dee11fad666f3
MD5 a66132e4b2b86e8f4b54a697aaa979df
SHA1 f5488a0ba7d713e23514443fc261ad5a384788cc
SHA512 c9fb4b7ec1c2745cc920855b33b484c44a3ba3fe24c20cc9227e9cf11d73de40df06d45754cca1709278c2bca5a2fe9ac62b1d3955efb1ec9524e66b49e452ab
SSDEEP 96:6wQ8NM5Fl66JozGzgClKtmSSTSMF9ZbkW6Shmk44PP/PrWI:92/66JozGzgCl6mSSTrvZboShaOPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 b0cf526dcc0b028ada15c0ad8025f5c262a72e929f1a4097cae2a24d0f096a82
MD5 0e2644b24be4d2e02aef8269c9f88652
SHA1 a6eeb47e70c9aa0d8cef446813d443967707ef35
SHA512 8e750ec8e5ab062dfd43622952885945c54b1293c57e6a035f5b0dfc446c21f13be2262ab75f0c39974f69c4823cd391748946db453c157d953f671e9fd212ed
SSDEEP 384:dvfsjR67DG5o0gbIbEX/66JozGzgC1bLbovEeXP9:tEgDWo0gbIbEyEBm1
MD5 SHA1 SHA512 SSDEEP

Submit Download

267dbc1a-9e71-40ea-a90e-af9767f7de62

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\267dbc1a-9e71-40ea-a90e-af9767f7de62
Size 671B
SHA256 59fb4717d664051e3e88ae10b1f51f8f85fc72e2fad74699c388a85ea5d3e453
MD5 568b1278456a0861975e7f424dd2c671
SHA1 1b2a4de8f0cdaa58e51c8dc937a7d4f49025efad
SHA512 ef6bf4c9f2ecba88cdf9d6a2cb183cdb22a8d882db7ce122b98009aeb29362bc42b373acbee08bc6ac325a3826284177036487c51ff48edbd75b90943ff2c466
MD5 SHA1 SHA512

Submit Download

62912c6a-a726-4649-b0db-cf5905a8763a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\62912c6a-a726-4649-b0db-cf5905a8763a
Size 25KB
SHA256 32ba2b9a02d8692612fcaa1d5a8150b312c5e582cf6dffaa3d9e96ed5f04aa9b
MD5 ed6696c6a9a3754b9f68984c21603513
SHA1 0e37f5294d8e0653ca22eab9e6a2d6f442dbc2e5
SHA512 2ecf77a43ddfc41faffa649ee1f28576971f6ac0b9fe55e1036bd16ac043394449f1846e2f13fdd4325b7ecceadf38e7189f469f49daa62324eec64e4bca0332
SSDEEP 192:9hp43JFRQmFQcfhE5uW/V4t5OrUbzxNcaGY2lRxTNzdyjZY4KS3JuaODc7ZR2Sry:9MLbCsWk5lblNcZPlRfxOCAL2SG8M
MD5 SHA1 SHA512 SSDEEP

Submit Download

e7374c8e-b24b-4f27-a1d3-ec3626e9c77b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\e7374c8e-b24b-4f27-a1d3-ec3626e9c77b
Size 982B
SHA256 d19076e361e4f3b45b3e5224112de1c23a5d9a396497ee73079663d35390757f
MD5 74b0d7cd32467e62fda679f6ee1cd105
SHA1 4dcc6c1453204d66b34fd0ec686c00520a6bf2fd
SHA512 9f6336825a431dbd8a4567479f66085793b5a51ce5859f7038aee87036296fde3b7ac2ecbfaf75bf710630397568eac9e96f86837a816092542f02724f3f32fa
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs-1.js
Size 12KB
SHA256 66e99336eac95db5c59a27821206040579b1ce80bc03fa83e69e6f49511a32c4
MD5 994b3a433caf70b92e8ab538a4dfffc7
SHA1 c3c3296bc20029c565c7cca9cf7c78fc7e00d240
SHA512 19d756fa9fd8de009c8301d9c03f1d28065ae9076e42d231347221ba641368d0837f8bf5c61be113b07a5e854574f7bb8587870ea29ea709f52b325614b3b1ae
SSDEEP 192:AL5nnRDfYvRjlQZxnPpZgbcdA8XxnSBy1ZeY0saXCtZTiCLefBw8HL6:6UQZxPpZz/XxSBy1Z/TTio+wa6
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs-1.js
Size 16KB
SHA256 1f08a01f3dbdd54aeb766d032279874d655ee883d8eb693588b16e07a8c54b1e
MD5 651eb869e662f70eb857212d6db7d45a
SHA1 2ab89d6dad4e09abb2960fbe92300fea7e55dda0
SHA512 1c043b85b6d7813733738a12231338da078fc7aa92468cc35cc703fac39717a0b00ace421726c2817e25f59b9148e6d0293edbe46c7b78e23871eff93d0c47b8
SSDEEP 192:ALmnnRDfnRjlQZxnPpZgbcdA8XxnSBy1ZeY0saXCtT+TiCLeNiBw8HjENP3/0M:1LQZxPpZz/XxSBy1Z/cTioHwQEtZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs.js
Size 11KB
SHA256 6371e8e0cabc79d0022851a19d05e8ee4cbf1bae825037d0bac3e6ec16ac02f2
MD5 606da8dc6d72f3aa3815e8cd610c12ae
SHA1 5f4dd1a375f7d030c5c5b0657730f4639f0ceef7
SHA512 c79c4beb6a7ad6fe86c721f457e26573b3c03c2f634cd76768f76c402364d8c0c03e4b9fcbf42bccb66b155c287bcd449fc1afef9527d98b967c8b530c95aaa6
SSDEEP 192:nL5nnRDfYvZ3huZLf8tv1R1zcdjrf+tPDnjXl60saX0TiCLelBw8VB:DAwLmv1AxrUPDnYhTioSwO
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 bc61eeaad76235c717a50c23487ce1c4bacded6678281044f3a5c75270983a15
MD5 beb75ae3e561ab580f9257aa486117b3
SHA1 fc50948855d7ed6c9d13e60de4e252210064ece1
SHA512 d8d0289feeb3a46f399425fec82f8ec3955379e650c3fd10a898a04f05cb8c295ecdefcc52cab469b22a1a2f6c6256d3f55e9e07bf2b4b815bf1d47dcfcbf052
SSDEEP 96:53qlC6VAPHeXtwEGJF7IZMZkKzf8W8Qge3ZwS2T9kAO:53h2AveXtdiFaMZkauem9W
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.3MB
SHA256 e9ed49a6c99a4df3a14c2643f8493833692423569f847fb67ad4b2c328fa9630
MD5 e1dc0abd18fdbe46ac1f5b4aa0bbdd5e
SHA1 3fd7306a1dd4a2d5ee3aba846f24a2896d9ca735
SHA512 ca4e07f5eb47f781da1d86c7f78815f8858697abf74221625aed485896038c7457b60a6a579fb6364c25f9976b61b9823f862032892dc6b546aec5734f04e479
SSDEEP 49152:Qch5/RWNDnJpnZP5MC5fhmBGL520ybFREACSRyC5sJScDkTRDm1VFNxCTirAvtDs:rZS
MD5 SHA1 SHA512 SSDEEP

Submit Download