538096fd887edf7e8395e95446a2efa0b84d0e344c8ad6f251f9a9e6dc280f95

Analysis

user interaction
yes
max time kernel
98s
max time network
119s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
metasploitframework-latest.msi
Size 379.1MB
Sample260727-ejjbrsvfqf
SHA256 538096fd887edf7e8395e95446a2efa0b84d0e344c8ad6f251f9a9e6dc280f95
MD5 b81edb4c37e302da5d2f0c144147d232
SHA1 0eaec0b46dc4c8eaa82c818517b5bde5c9c40c05
SHA512 d17f34268a3940ecb64eee15b5526bd698dd54389e2cc51c575f399531e022234b14bb5a8668a584b8343ae61032185a137a3a4bb23130bb22b24a6e162159ff
SSDEEP 6291456:aY6B2YRV0RLigZTzjrEJhrNaJxoklW8v6Hur50Xy5vnjVEpFRMR:Fy2OORDBjrEnrgJxomSOr5Iy5pwFR
TLSH
T1BA1933A7B4938EAFFF9C7C39F0F12120C0519DBD242749CE3296FBA5997219A8731146
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2852	msiexec.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2852	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2852	msiexec.exe
Token: SeSecurityPrivilege	2956	msiexec.exe
Token: SeCreateTokenPrivilege	2852	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2852	msiexec.exe
Token: SeLockMemoryPrivilege	2852	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2852	msiexec.exe
Token: SeMachineAccountPrivilege	2852	msiexec.exe
Token: SeTcbPrivilege	2852	msiexec.exe
Token: SeSecurityPrivilege	2852	msiexec.exe
Token: SeTakeOwnershipPrivilege	2852	msiexec.exe
Token: SeLoadDriverPrivilege	2852	msiexec.exe
Token: SeSystemProfilePrivilege	2852	msiexec.exe
Token: SeSystemtimePrivilege	2852	msiexec.exe
Token: SeProfSingleProcessPrivilege	2852	msiexec.exe
Token: SeIncBasePriorityPrivilege	2852	msiexec.exe
Token: SeCreatePagefilePrivilege	2852	msiexec.exe
Token: SeCreatePermanentPrivilege	2852	msiexec.exe
Token: SeBackupPrivilege	2852	msiexec.exe
Token: SeRestorePrivilege	2852	msiexec.exe
Token: SeShutdownPrivilege	2852	msiexec.exe
Token: SeDebugPrivilege	2852	msiexec.exe
Token: SeAuditPrivilege	2852	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2852	msiexec.exe
Token: SeChangeNotifyPrivilege	2852	msiexec.exe
Token: SeRemoteShutdownPrivilege	2852	msiexec.exe
Token: SeUndockPrivilege	2852	msiexec.exe
Token: SeSyncAgentPrivilege	2852	msiexec.exe
Token: SeEnableDelegationPrivilege	2852	msiexec.exe
Token: SeManageVolumePrivilege	2852	msiexec.exe
Token: SeImpersonatePrivilege	2852	msiexec.exe
Token: SeCreateGlobalPrivilege	2852	msiexec.exe
Token: SeDebugPrivilege	552	firefox.exe
Token: SeDebugPrivilege	552	firefox.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
2852	msiexec.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
552	firefox.exe
552	firefox.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 552	4364	firefox.exe	88
PID 4364 wrote to memory of 552	4364	firefox.exe	88
PID 552 wrote to memory of 3812	552	firefox.exe	89
PID 552 wrote to memory of 3812	552	firefox.exe	89
PID 552 wrote to memory of 3812	552	firefox.exe	89
PID 552 wrote to memory of 1480	552	firefox.exe	90
PID 552 wrote to memory of 1480	552	firefox.exe	90
PID 552 wrote to memory of 1480	552	firefox.exe	90
PID 552 wrote to memory of 1480	552	firefox.exe	90
PID 552 wrote to memory of 3668	552	firefox.exe	91
PID 552 wrote to memory of 3668	552	firefox.exe	91
PID 552 wrote to memory of 3668	552	firefox.exe	91
PID 552 wrote to memory of 3668	552	firefox.exe	91
PID 552 wrote to memory of 1972	552	firefox.exe	92
PID 552 wrote to memory of 1972	552	firefox.exe	92
PID 552 wrote to memory of 1972	552	firefox.exe	92
PID 552 wrote to memory of 2384	552	firefox.exe	93
PID 552 wrote to memory of 2384	552	firefox.exe	93
PID 552 wrote to memory of 2384	552	firefox.exe	93
PID 552 wrote to memory of 2384	552	firefox.exe	93
PID 552 wrote to memory of 548	552	firefox.exe	94
PID 552 wrote to memory of 548	552	firefox.exe	94
PID 552 wrote to memory of 548	552	firefox.exe	94
PID 552 wrote to memory of 548	552	firefox.exe	94
PID 552 wrote to memory of 5248	552	firefox.exe	95
PID 552 wrote to memory of 5248	552	firefox.exe	95
PID 552 wrote to memory of 5248	552	firefox.exe	95
PID 552 wrote to memory of 5248	552	firefox.exe	95
PID 552 wrote to memory of 5256	552	firefox.exe	96
PID 552 wrote to memory of 5256	552	firefox.exe	96
PID 552 wrote to memory of 5256	552	firefox.exe	96
PID 552 wrote to memory of 5256	552	firefox.exe	96
PID 552 wrote to memory of 5312	552	firefox.exe	97
PID 552 wrote to memory of 5312	552	firefox.exe	97
PID 552 wrote to memory of 5312	552	firefox.exe	97
PID 552 wrote to memory of 5312	552	firefox.exe	97
PID 552 wrote to memory of 1676	552	firefox.exe	98
PID 552 wrote to memory of 1676	552	firefox.exe	98
PID 552 wrote to memory of 1676	552	firefox.exe	98
PID 552 wrote to memory of 1676	552	firefox.exe	98
PID 552 wrote to memory of 60	552	firefox.exe	106
PID 552 wrote to memory of 60	552	firefox.exe	106
PID 552 wrote to memory of 60	552	firefox.exe	106
PID 552 wrote to memory of 60	552	firefox.exe	106
PID 552 wrote to memory of 700	552	firefox.exe	107
PID 552 wrote to memory of 700	552	firefox.exe	107
PID 552 wrote to memory of 700	552	firefox.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\metasploitframework-latest.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {ea941bde-cf30-4250-83eb-776ab74f160d} -parentPid 552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.552" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27136 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {a73dc8b4-893d-4a96-8180-0991712677a0} -parentPid 552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3956 -prefsLen 27277 -prefMapHandle 3960 -prefMapSize 270279 -jsInitHandle 3964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3972 -initialChannelId {59f4676a-bfb1-4902-a114-8a172f5887dc} -parentPid 552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4124 -prefsLen 27277 -prefMapHandle 4128 -prefMapSize 270279 -ipcHandle 4228 -initialChannelId {731f0c62-7452-4851-b5f2-26f9a2913079} -parentPid 552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.552" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3052 -prefsLen 34776 -prefMapHandle 3184 -prefMapSize 270279 -jsInitHandle 3188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3032 -initialChannelId {c12ddece-ebec-4531-ac42-420e37b179b2} -parentPid 552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4932 -prefsLen 34932 -prefMapHandle 4936 -prefMapSize 270279 -ipcHandle 4944 -initialChannelId {3c8b7009-b4e4-46fc-8915-adf060ede93f} -parentPid 552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5076 -prefsLen 32952 -prefMapHandle 5080 -prefMapSize 270279 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5128 -initialChannelId {0b51361f-57b7-4f23-9b0b-d6ce1fe9a202} -parentPid 552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 32952 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {c85fa6aa-830c-4bbf-a074-677fbf56c51f} -parentPid 552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2740 -prefsLen 32952 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {1354af93-faa5-4dad-b5cc-0f8d96e120dd} -parentPid 552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3876 -prefsLen 33031 -prefMapHandle 3880 -prefMapSize 270279 -jsInitHandle 3884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6200 -initialChannelId {43688bb5-fbd3-4a2f-92de-6be3dbcba5df} -parentPid 552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7292 -prefsLen 39838 -prefMapHandle 6096 -prefMapSize 270279 -ipcHandle 6924 -initialChannelId {9878263d-68a4-46dd-bd10-571e823f8808} -parentPid 552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:60
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7296 -prefsLen 39838 -prefMapHandle 7300 -prefMapSize 270279 -ipcHandle 4656 -initialChannelId {1e2ec8a9-ee41-40e8-8682-3f8136ad38d3} -parentPid 552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.552" -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    PID:700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\33iyexir.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 f6ef08a19bd05d02246d65bbec25abf39ced388d4ab0b3d90ed5e5846e842423
MD5 a3da75480963d29c30055f7305196a30
SHA1 f588099a35fd034a3527b5c8c9e83dea081d55f5
SHA512 7e73b430f617b85c8a1a87c4b5e0a05317ab6519132a8dfd3726947b74a3bc0286af2a8cdf3f179215c2fe81c05a7af35b825556bfc6a58e427be42dae3d9361
SSDEEP 384:HwCe7iO024Ytdcs3hk2nhfdDE2Ba/rIVy8ewx+cx+7:QqZYtdv3hk2nhfS2sDIVy8z+G+7
TLSH
T1DA728EBBDF516C5D1927E585C8AD5365DD05F9ABCFF690B608243049C784326B0FA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 69KB
SHA256 e66652bdf1b0dea290d64823cdb019e56a4290a7fcf7d3d30d9c9774c683fbb0
MD5 bf7b7e27aed58eb5cb26c556cad11f52
SHA1 84f7834f32992437ac42459f0fe5b31bfc880ae2
SHA512 0208385734fb12a02b9b78eb2d1e231b75d8e84b90fe3fa56848221f7db1d4dd54c56362bffa808886b6a9a8b583294aaa0d76c26ea2d093d50d88f968b49fbd
SSDEEP 1536:RPUfyceTEQDKFud619r7g4BGPFnX513yXYd7p+X0E+6I:RMfpaEJAQ7v0yIDQ3I
TLSH
T107630044EB1A953FD82803BA9CD21B003F79F8895A1A2B67371C54386D873DD3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2aee439745b0994fe52ced2b82c5964fdd1a3d1bdaef54ae8abc27abe62a16de
MD5 abc533d4afabf9d3b11c3a868cc3d8cd
SHA1 008e508b1a3b4b3ebaf303138cd2bf74fa1e8f38
SHA512 1d79745d1b40d7b678b856ead51911bef2683c4ba480dfd3830b1309c314225a106622b9be4ef45951c015faf6905cd33416a1c34d3903964df4b381d546582c
SSDEEP 192:w1d66Joz1zgCl6mc0drOv5zbo4ZrOhyjwiX:qd66Joz1zgC1jebo4ZrYyjv
TLSH
T111E12E64F638863BC40502BBCCA61F414F79798B988E3F19359D650C2C472DE368E2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 07d88936207337ad52a29157710a1ad174b2612589d045ec985e3ae9f2e356b9
MD5 9339cbdf06e797ebb58eb3397e2047b3
SHA1 cfe69d3c631c9c9fce54c847b0ef32b1b513b799
SHA512 bfb2f565a5cde779ede71a93a857917d1d29b6533068a7e723d7e26920e26bebfd7de665270df09725181010ea7743622c0715405f6d805610a1e0ad59a4d92f
SSDEEP 192:w1d66Joz1zgCl6mc0dsOv5zboBZrOhyjwiX:qd66Joz1zgC1jZboBZrYyjv
TLSH
T116E10E64F638867BC40502BBCCA60F454F79798B988E3F19359D65082D472DE368E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 00409b7cd2d00458514b15f6ccdbee7926045f8ca44a4b72435dc71a57c71dce
MD5 1decaf679d42ec01707fab898842f120
SHA1 f4d72d91867189e1ad0595bc611486adbb7edf18
SHA512 a63e90c135abb4a87d2e40ccab21d36112bafb128806b4b043ff36d1480c25a49472ee51f0c61d9db4db9be41020b4def77cd8bbcc68fb3a31f630545e677c07
SSDEEP 768:TiOPJzJZ/vMsGcmhuHNcKqSwTlbtbPKpW:zzJZ/zNcrJ
TLSH
T178E20E84FB2A953FC41512BBDCA50B042F79F885591A2F5B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 69KB
SHA256 2893a1deef51ddae3de4ddbc45c5410516de4ffdb3cf4efabd064f4e6a87a081
MD5 a5dd076400a4d4b51159e780c1b8ec1d
SHA1 2d5a0e63fad105e7944b212691fe5588a458eca0
SHA512 566976a8b023f134211e54398c5c67021cbf8120c63094281f7f587e9f347b3fab69690ae5ad6353c08a41f7a5493e599859ff2ceb34118693b567552c6f6489
SSDEEP 1536:TPUfyceTEQDKFud619r7g4BGPFnX513yXYd7p+X0E+6O:TMfpaEJAQ7v0yIDQ3O
TLSH
T17D631044EB1A953FD82803BA9CD61B003F79F8895A1A2B67371C54386D873DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b793c1462c8b66bc02be2ad1290041489cac6c9dc67d5646584442da1a003e2a
MD5 c52df518be38e0181962f62143d858f7
SHA1 20fb39982b0a45e66bc33b227be8ab913c875f65
SHA512 ca8c9e794fe9e566f876022d976c38208e812516172a1cb3129d1d5255a8ab5a4bac428925aa446f6fac73c12e7b1f2d2f1f9665fd0238bc6b72d77516e2ec82
TLSH
T15B214C6C7AB84DAAADD7E3DC7480118E93554E4604871D430D12EF8DDED1ADA326A838
MD5 SHA1 SHA512 TLSH

Submit Download

4951cc24-dd8c-4371-a5cc-31a6089c105f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\4951cc24-dd8c-4371-a5cc-31a6089c105f
Size 16KB
SHA256 ee7037f6191049a55bb43eefab3ddc30c78947bea2f13775c3f911a00d2484a2
MD5 0d5767aafe2af6e4e664ff2f841eb25e
SHA1 debe777e515e1663a3d89b8019679fde49feea15
SHA512 8313365078070d73656808fa4cdbb3f79094b7a53e7b231c7f49227d0aef5ef43630a7f0748beff507e7cb277f351e65fcf6b6378499dc154f7c000650e77aeb
SSDEEP 192:kfVzeYAbIb9/gS8vXoUAKv1JnOX6MCLd6DVt5y95e8UFZ+RJoyhP7z4b6q+fGiop:OztmW9R88K427kb7+uiono5B0VMAF
TLSH
T19772C9166430457A8251E3A894FC7FC3E5F528CF4C419FCE9BE4BD0869DE0AE512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75bc3a2e-f7fa-4a08-baa5-f20d8bd36c5e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\75bc3a2e-f7fa-4a08-baa5-f20d8bd36c5e
Size 2KB
SHA256 bcf560da3568bde6b788b796d3a6a0654ec56ed9612d720d668f88b316185a24
MD5 d667185d9ee294599ac6af38e8d39a4c
SHA1 2421dbc355bc061663bd0d8ee1a1f3484448e8c4
SHA512 51fb491d7990d79129ff51e9ae97bac152137a90095c070ab912c5ae7941ab8bb4cfc79ffed662acc27c05ae4b9f9b42ebd01616883c53baa0f34f3f9ef3974e
TLSH
T16F41546C35784DB79C9BE68DD49227CE93A48A0300C61C477D51DE0CCDA679E237A63B
MD5 SHA1 SHA512 TLSH

Submit Download

98224958-c68c-435b-b1bb-e2ad44fba00a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\98224958-c68c-435b-b1bb-e2ad44fba00a
Size 235B
SHA256 8c95f03b2701e3130842dfb29f5360301e332e213040e8a056870d54b5f4a1e1
MD5 7490817f4f5663a7e85b54ede52c3c66
SHA1 fb0f098b0829b1d8038addf2a49fc79b981e3018
SHA512 1a32d0b04251dfbe824c20ea4745249f6d32507dfc2d0ac428340c48c013424eda9c638da6ed25a5527e14c8613eb3acdfe9d1114030955d05123965bdfe87fe
TLSH
T1EFD09788249C6B5D08144F0AB0A069D232464C332460A850965241749EBDAC98212997
MD5 SHA1 SHA512 TLSH

Submit Download

b4087ede-cd84-4fa2-bad9-b93b67a8b1c8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\b4087ede-cd84-4fa2-bad9-b93b67a8b1c8
Size 883B
SHA256 d815ca2caea58670b9c473f634fa8b28c0ca32f9af43a958b996128f3ccf8384
MD5 f25183f267bb07390895c8e5df032253
SHA1 e193560154084a853407ec45c31cb0d950281d61
SHA512 f245af42c0fed61af3db4610df2827da0f2f5bec73914d43a2a9925ba0aeb8663ed92b56d90213f4bfc260eb4eea72c4675dc3e40b33b1f4f6bb674a72d98a7f
TLSH
T1051100505634B5B2CC6CC29B89653B42DBE4B61380C558143DA12A180D7E95E93A670B
MD5 SHA1 SHA512 TLSH

Submit Download

bddde2d2-ef4d-4a7b-ad6d-76e1f804531c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\bddde2d2-ef4d-4a7b-ad6d-76e1f804531c
Size 886B
SHA256 490b2bf4c3adff38ec96c1a1e7a359f9d9fdce102bdc873ef9957797590a20e0
MD5 4947ff61f0d9a159387ad8559686feae
SHA1 f33820aaf6277cda529a4c64584fec5f0674b42e
SHA512 3c3def35f2f7c52dd4ad3f05f5b4d37fbed74e4d786109e0c7ab0dcedcfe21bc450a3b006ab83de9ce7d191fcb468b1d4db235936df2f7cb6d89ed8e28bbc194
TLSH
T1A51104504B7475B28D6C919B84A577828AE4A213C0C61D047DA16B140DBB51F93F6307
MD5 SHA1 SHA512 TLSH

Submit Download

e8efbee0-58d8-4578-8da0-c7ec3bad7fd9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\e8efbee0-58d8-4578-8da0-c7ec3bad7fd9
Size 235B
SHA256 551b452dac29312879b140b407390f1c762336717d9680dc202c21268d696ca7
MD5 0bcde861e84bcf4eefd8661a8e958da9
SHA1 b07179846b92be64c13da0164978ba3afcdf7cf1
SHA512 f1131f9c30fe5623165aacce0c2a88ed6e97e3e6249d3da874fa3b0a1771ca7ed11e16b6555203f0dfe7028e6f5e72ccd5c0a595843c8b3397e70fa3ad963e57
TLSH
T1DFD097801CCC73AC08198F07B0A02ACA30484C3B1064987085610234CFFDDC84291E07
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\extensions.json
Size 16KB
SHA256 f93256100556e15ea62ec1df992ffc4841441859ef7b63e60af189c0a9bb09f0
MD5 a859d53e16e4737671cbdcb4837576fe
SHA1 68d00cd43209b923f3bb585117025b874518c58e
SHA512 6943b687a57502de34469e4a779bb460926d35c94285e58dcc621d6cc9c47f061e676203f7ddf530efbccb70385105454563f03731d209b123461d219b4c8fc1
SSDEEP 384:VkI4vIUmldvT8dhWh94zX96ouL4HeL4PEL4HvL4HcL4H4P4h6:GI4gRfwXk4x634E424T4W464Y
TLSH
T15372411545048EB8298FA78BAA367E01C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs-1.js
Size 8KB
SHA256 0b25bb1629675f0140b5c2d3c60bdb30950d4fd2b8d0736e32444a79b1aee04d
MD5 d83ee345cac24862ed62e21f20c06c14
SHA1 298b999478453d6f75484bdaac4739f4f71c21aa
SHA512 507d99fc019f5de9fd699b755444da08df98eb74f18a04707953fed8e1e31d09cdf5d45617159a408864788000d5b4349eb0aa8a0c5c629dddbc9f573a86fb9b
SSDEEP 96:xHThVTUQqGqyf6U/ObzSXSSlNdv9jcnZRWRmPoedEBw88gQ+s8L4cnVWBGS:zmRyf6U/NSSa8RyT2Bw88qO
TLSH
T125020F3C9504CB7FB4B276ACAC6489715AB2023B76BF6CD750B95485050CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs.js
Size 6KB
SHA256 025aedeecc6c8a41024dd14cd6f373029fa1ee8b66e228dbde4202ed24170acc
MD5 a7c57dc2a996aa1bc0a44901363fcbf5
SHA1 e14086aac951c309e2b90f0dac14c7caf8cc46d7
SHA512 21f5dc220619f43d21d4a085e9d361d2292f3acbc9ce23a50f1053e557f56164ed5305a18a5c3affdd401983165fd1aef501d13f5b48bb20b7615d249f606ef9
SSDEEP 96:xHThUTUQqGqyf1B3J1zSzSSlNdv9jcnZRHboedaBw88P8L4cnVWE:zrRyf/3JWSSC9bT4Bw88m
TLSH
T13AE120789008CB7F74B677ACAC648D715AB2013B76BF28D750B95484051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs.js
Size 7KB
SHA256 2ee74e12888327f3e8544d85073bec447239e841ea7ecad52fd7f568fefc4c5b
MD5 777b76ba8de26776c71df99be344a060
SHA1 5b4c1148b291d278926c766fcf5b89dc8f530508
SHA512 a8a69c362a529ef30eee157603c486c007d4401f1ce357fa93ae7d5c58844a948cea1939ad7418a4ddf07639048270d304bc62f3fd864a0dc2cb6a77cc83766f
SSDEEP 96:xHThUTUQqGqyf1BU/ObzSXSSlNdv9jcnZRHboedaBw88P8L4cnVWBGS:zrRyf/U/NSSa9bT4Bw88V
TLSH
T132E1207895088B7F68B677ACAC6888715AB2413B7BBF28D750B554C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs.js
Size 6KB
SHA256 a663c16a73100cd353ab39da2bee85c18a53e966776e45d0dd7d10762a00a2c1
MD5 cc6a172a3a5f7a281cab2dd7ee18f9a9
SHA1 5fa269f35e9900193536ac3474a2bd2d07fc1e25
SHA512 99801d2b45efe33206995dd847ac08067b1fcc9c3d1cb0ac192775738a514ae072fc28da106a7f15b20b9067533d043706c80128a3476c65c7734c9402de2ba1
SSDEEP 96:xHThUTUQqGqyf1BU/1zSXSSlNdv9jcnZRHboedaBw88P8L4cnVWE:zrRyf/U/qSSa9bT4Bw88m
TLSH
T19DE130789508CB7F74B677ACAC6888715AB2413B7BBF28D750B95484050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 9e308431fe41d1e8f42c1b478a603472ca267413efb744c128bcdde70d1f9d97
MD5 0d3b737843143e2fa8834029e1d0b01c
SHA1 fcf4617954c61a4e7cbb9cf6094884fca2c11560
SHA512 d0dfbd04f9a8f7f146167970a82dc3fe033a6d5474dc7e2caaa6734d779699444a683aa29649b3651b673113415784ca74c43f58d24be46f48f90673468cf399
SSDEEP 96:zC+qMxvn3GCpH2MIN2tGYOgYW1KeZixz+OdFFoT+eWusnP0u/:zHqMZpHp2hj8KeZixVdFeKeansS
TLSH
T1A8917D47E1E15FF58587A132D0D7A315B84B081B93A52ACDE506F3108E0DAFE71BA26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b4c26af7d30d449ecc7e3d0fe0fef0f97003f2078a0017c52fc19686abebd018
MD5 64a172551058f02d1a58418b340aa421
SHA1 35f9b73a8eb4cd95e7cce0b15b0f2c9bd1cbfd64
SHA512 4dce8dd55792500ae564a6692603433c55b79b7355b01ac5bca5b9289e291a2b02f93fea2c51dc8e591d529af2515df35c03c137f60109ae046d46ce2bfd563b
TLSH
T11A21C55526F28CBFB615B225D0CA2BBDC5C8301248EDA8E4F8BEBB098419085677E356
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 f03ecf8b683365c6c3210f70e72458c36e458ae711bf50462c11a3d7e64ab59b
MD5 38ff78276f7103323e9bb3f9e03d9b7e
SHA1 dd4e048b53b345d90c0a01c2574c9e06e4463599
SHA512 bdd4d159d7b26e289fb3bc1bf517d989b9bfbff0b55acc9fab9308c034a59b749578d65c39b92c5bce5c5484a4998a543b918746cea82a535ae7d5ec7d570609
SSDEEP 96:zC+qMxvn3BCpH2MIN2tGYOgYW1KeZixz+OdFFAW+eW6snP04/:zHqMqpHp2hj8KeZixVdFq/eensk
TLSH
T1C4917E47D1E15FF28587A132D4D79315B847041B53AA1ACDE506F3108D0DAFE71BB26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3140325527hBbDa.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite
Size 48KB
SHA256 bc8e2fa086e4215af8a568a7e2917181ad1c3f3f5d728e9364717eafa07a0d17
MD5 3ab80cfcd062319c24bc4cc6c8d9621e
SHA1 94c493fbab69370d0fb46cc39777177582f3207d
SHA512 d3606f4fbb75089979d1913bd1587df121f6d49958861641ea499a20e8ece2de1572cc2741a4118112c91600cb760f90405d803e8b9677b647f6e4bcf4caba84
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEK:Oa16S6CKnqlizbxV+2xVeU7X2B0K
TLSH
T16B236F8E3F07E511C53AF0B178A08D52BC5E321D17222AD579D0DAE4C8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usage

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\storage\default\https+++www.roblox.com\ls\usage
Size 12B
SHA256 cc166c5323ea2e1ff45a6cb7ac1914ac4c41d311e3dfc2ec6cec221465e54321
MD5 054dea229683d6b0368f1518b81962da
SHA1 aa33ac8f72931fe66bef9720bda7aa2f0c8f190f
SHA512 9bef88a655710f0a3aa1b064c7742ca2a8877b0d76e2d2b3c59f6336ff8a6149a5851c3d494b30ed5c6e93e92c1dec5e11ccc54ec1af09e4bbec96f1c97c6ed0
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 d6a018656a99f220c12f39b3e56a5912f1652f4194ae84b95ef715353071f386
MD5 d1dc25e1a7283b8da1f97ccf0b663a0d
SHA1 caa0252a2dc0c871a1a33da106746d504baa555a
SHA512 2b46fedc7d8a0651c3c2739e92b8623fc4016f3ad6341921b2b2c8c8909951537355051d7c70a421da59b38003f8722fe0aadadc21b359b902687353f5847bb9
SSDEEP 49152:rVDdx4URVScAufOnXEqmNzT+ghHReb9QYzP+:xDv4UjScAufOjmNzT+ghH2+
TLSH
T1021639F824D1A257F3814033668563EF21AFD00C6467DD484BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads