ee7801cf713dd681147604fd97334c57ab51fa2bf7b907551156b057b0d58f2f

Resubmissions

31/07/2026, 02:23

260731-ct8nasbc323

31/07/2026, 02:09

260731-clhf5s1frf3

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
madvera-image-ads/SKILL.md
Size 28KB
Sample260731-ct8nasbc32
SHA256 ee7801cf713dd681147604fd97334c57ab51fa2bf7b907551156b057b0d58f2f
MD5 a1e247bffc56ce6c30b3662332e299b8
SHA1 f4f6f89b9c657746d8685269fc53ae9cfa6c9b44
SHA512 0997d989886d65cf3d6a0dda573dbb9621d1071a9b68ab4b8ea21b97b66d28a3b0cd554308a259dfd8d9b23e8a6f06a41ba84db25788e6526bd2ef0b5378c0dd
SSDEEP 768:nhpRxeKUYBDMD+Q5/omhYR7rty5C3y8TJ0vbVjZpD6dJU:hPS8kPRoXRXtIC3DKb1LD6dm
TLSH
T13CD20963FB68133755A60065778F62C9EF368466335528A8F09EC068B354D3843B7BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4588	cmd.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3372	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4180	firefox.exe
Token: SeDebugPrivilege	4180	firefox.exe
Token: SeDebugPrivilege	4180	firefox.exe
Token: SeDebugPrivilege	4180	firefox.exe
Token: SeDebugPrivilege	4180	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
3372	OpenWith.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4140	3372	OpenWith.exe	95
PID 4140 wrote to memory of 4180	4140	firefox.exe	97
PID 4140 wrote to memory of 4180	4140	firefox.exe	97
PID 4180 wrote to memory of 4548	4180	firefox.exe	99
PID 4180 wrote to memory of 4548	4180	firefox.exe	99
PID 4180 wrote to memory of 4548	4180	firefox.exe	99
PID 4180 wrote to memory of 3780	4180	firefox.exe	100
PID 4180 wrote to memory of 3780	4180	firefox.exe	100
PID 4180 wrote to memory of 3780	4180	firefox.exe	100
PID 4180 wrote to memory of 3780	4180	firefox.exe	100
PID 4180 wrote to memory of 3800	4180	firefox.exe	103
PID 4180 wrote to memory of 3800	4180	firefox.exe	103
PID 4180 wrote to memory of 3800	4180	firefox.exe	103
PID 4180 wrote to memory of 3800	4180	firefox.exe	103
PID 4180 wrote to memory of 2140	4180	firefox.exe	104
PID 4180 wrote to memory of 2140	4180	firefox.exe	104
PID 4180 wrote to memory of 2140	4180	firefox.exe	104
PID 4180 wrote to memory of 1328	4180	firefox.exe	106
PID 4180 wrote to memory of 1328	4180	firefox.exe	106
PID 4180 wrote to memory of 1328	4180	firefox.exe	106
PID 4180 wrote to memory of 1328	4180	firefox.exe	106
PID 4180 wrote to memory of 5716	4180	firefox.exe	107
PID 4180 wrote to memory of 5716	4180	firefox.exe	107
PID 4180 wrote to memory of 5716	4180	firefox.exe	107
PID 4180 wrote to memory of 5716	4180	firefox.exe	107
PID 4180 wrote to memory of 5740	4180	firefox.exe	108
PID 4180 wrote to memory of 5740	4180	firefox.exe	108
PID 4180 wrote to memory of 5740	4180	firefox.exe	108
PID 4180 wrote to memory of 5740	4180	firefox.exe	108
PID 4180 wrote to memory of 5748	4180	firefox.exe	109
PID 4180 wrote to memory of 5748	4180	firefox.exe	109
PID 4180 wrote to memory of 5748	4180	firefox.exe	109
PID 4180 wrote to memory of 5748	4180	firefox.exe	109
PID 4180 wrote to memory of 5780	4180	firefox.exe	110
PID 4180 wrote to memory of 5780	4180	firefox.exe	110
PID 4180 wrote to memory of 5780	4180	firefox.exe	110
PID 4180 wrote to memory of 5780	4180	firefox.exe	110
PID 4180 wrote to memory of 5440	4180	firefox.exe	119
PID 4180 wrote to memory of 5440	4180	firefox.exe	119
PID 4180 wrote to memory of 5440	4180	firefox.exe	119
PID 4180 wrote to memory of 5440	4180	firefox.exe	119
PID 4180 wrote to memory of 5244	4180	firefox.exe	120
PID 4180 wrote to memory of 5244	4180	firefox.exe	120
PID 4180 wrote to memory of 5244	4180	firefox.exe	120
PID 4180 wrote to memory of 5244	4180	firefox.exe	120
PID 4180 wrote to memory of 5136	4180	firefox.exe	122
PID 4180 wrote to memory of 5136	4180	firefox.exe	122
PID 4180 wrote to memory of 5136	4180	firefox.exe	122
PID 4180 wrote to memory of 5136	4180	firefox.exe	122
PID 4180 wrote to memory of 4632	4180	firefox.exe	123
PID 4180 wrote to memory of 4632	4180	firefox.exe	123
PID 4180 wrote to memory of 4632	4180	firefox.exe	123
PID 4180 wrote to memory of 4632	4180	firefox.exe	123
PID 4180 wrote to memory of 5548	4180	firefox.exe	125
PID 4180 wrote to memory of 5548	4180	firefox.exe	125
PID 4180 wrote to memory of 5548	4180	firefox.exe	125
PID 4180 wrote to memory of 5548	4180	firefox.exe	125
PID 4180 wrote to memory of 2508	4180	firefox.exe	126
PID 4180 wrote to memory of 2508	4180	firefox.exe	126
PID 4180 wrote to memory of 2508	4180	firefox.exe	126
PID 4180 wrote to memory of 2508	4180	firefox.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\madvera-image-ads\SKILL.md
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\madvera-image-ads\SKILL.md"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\madvera-image-ads\SKILL.md
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {16b3cb30-c0ed-4bab-92e6-85a76ac61761} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4548
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2504 -initialChannelId {763eaf17-be8f-4f0e-aca6-528a74f40218} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3744 -prefsLen 27276 -prefMapHandle 3748 -prefMapSize 270279 -jsInitHandle 3752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {b3eb710d-414d-4d80-868e-e6376527eae6} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3908 -prefsLen 27276 -prefMapHandle 3912 -prefMapSize 270279 -ipcHandle 3996 -initialChannelId {8415b2bf-26de-4624-a9ef-40730c9595ae} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4348 -prefsLen 34775 -prefMapHandle 4352 -prefMapSize 270279 -jsInitHandle 4356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2800 -initialChannelId {e5e409c2-d56e-47d7-abb1-47a21db9d327} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:1328
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4852 -prefsLen 35012 -prefMapHandle 4848 -prefMapSize 270279 -ipcHandle 4820 -initialChannelId {2f0fe0a1-31e8-4649-87c7-7db77430f40f} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5008 -prefsLen 32952 -prefMapHandle 5012 -prefMapSize 270279 -jsInitHandle 5016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5024 -initialChannelId {364cbb58-b936-4496-853f-3603fd98b0c1} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 32952 -prefMapHandle 5116 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {5e97e8c0-8480-42e9-93e8-c8d4010f5b2c} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5748
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32952 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5444 -initialChannelId {5d8255ca-76fa-4388-9a2b-c25613c2bc5b} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4536 -prefsLen 35081 -prefMapHandle 4540 -prefMapSize 270279 -jsInitHandle 2984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {04dae4c8-c6d0-4782-b47f-2a26666792a5} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:5440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4624 -prefsLen 34113 -prefMapHandle 6172 -prefMapSize 270279 -jsInitHandle 4792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4596 -initialChannelId {1ae4cb9d-dd88-4852-a5aa-58ca26ada39f} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
      4⤵
      Checks processor information in registry
      PID:5244
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3140 -prefsLen 36677 -prefMapHandle 5876 -prefMapSize 270279 -jsInitHandle 4592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3192 -initialChannelId {433f4a04-d755-4a6d-8f11-dd59b320d9f5} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
      4⤵
      Checks processor information in registry
      PID:5136
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6824 -prefsLen 36677 -prefMapHandle 6828 -prefMapSize 270279 -jsInitHandle 6832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6840 -initialChannelId {8904a9a9-c15c-48a0-a530-98f83218b31a} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
      4⤵
      Checks processor information in registry
      PID:4632
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7064 -prefsLen 39592 -prefMapHandle 6972 -prefMapSize 270279 -ipcHandle 7188 -initialChannelId {d5bbc6b6-b040-49fa-8200-950052313189} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
      4⤵
      Checks processor information in registry
      PID:5548
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7308 -prefsLen 36677 -prefMapHandle 6816 -prefMapSize 270279 -jsInitHandle 7316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7764 -initialChannelId {0cedb7ad-7f68-4ae2-ba91-b024b31b334b} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
      4⤵
      Checks processor information in registry
      PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 6949ebe75f4ec5247f66b69cbea52d7ba896f89a1d4b6d291f1a90f7596f46bf
MD5 124823b24e704fbe7516ec6e99df6c21
SHA1 b09db2701b7edd513e18dca39d8818f31cd49037
SHA512 f506d697db4b2cfe6efbd84e09d12a4dd42b63d87347772b2a67a31a374b118b569044a6d62945dfdebdf0e608cf8f540e026c37c3233bbc2c7d93a3459502a4
SSDEEP 384:HwCe7iO024YIDL84KKDL849B7SOEAd9KVRaAcP+AWRMAkhvGo:QqZYIDL8lKDL8CB7S/AmVAf+hRMpOo
TLSH
T121728E3E9F413CAC1597C0E8C4F852DA8C18B6A7CFE6806D25683D0DC794969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5948E24416D61F80680B7B5CADF7704B9A8209D5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\5948E24416D61F80680B7B5CADF7704B9A8209D5
Size 110KB
SHA256 d0349c4eb00df09f4c958bd5aa423c21ce186d2fd0929e5fd766368cd5fa0732
MD5 22432019a57cf32ccf5d6f12d83a7467
SHA1 3316b9c2a52e1a1d6d718d10711a023f4343e424
SHA512 bf954d6236c8994a7be8cfa59c39125a19d370defdbc81e58625a560094adf9166fa5a9a0734e4c99cfbe0d458e58ae47b6722fe18dc7136f98f3c3f22e3b46c
SSDEEP 3072:ut4wzik4FWB/T0SOWZVWIN/JnDHlae26iW28oq6eb/tWq6eb/tq:LiotHIN/JnBakV28Zfq
TLSH
T172B3CEFBA604491D1FB097E2B626369CD637540DBCD1E8F8E026AD6114F8FB3E219D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\AlternateServices.bin
Size 27KB
SHA256 7a9ba6c11794b352be3d84b3b87c83fe5973a27846ccba8545ca58c30e5af0bf
MD5 26123705808e938ebdb6a3e5e2666f96
SHA1 b2e903c474e486bfb3f85329c1f97151ac6cf71a
SHA512 9ab946341c75f8320a09fa9fb124f5ef1b90f776a1a75d666d2000d68c519c029e09d32904d2dab39bc16de9678f09b1975c229de8e735d14b9434fd735da6c8
SSDEEP 48:h4gKyKEg9VRx5LNWi2W4i7QpbXKbpbApbApbXJpbxrpb:h4Sg9Vrqi2Ti0pb4pbApbApb5pb5pb
TLSH
T1CDC2C5FB63B2A262F5A14FF420DD31CEDD332239D99485688B05D4E6458B7D0E42EF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\AlternateServices.bin
Size 11KB
SHA256 e2a7bf1f4eb09269e66b8657da19c6e54d42a7992bc730bae1c664370e472767
MD5 6bcb1921ed6e7d54f640e0f0535eb7e0
SHA1 7b1c0363fcbd86a834904ee61edfea81d3532d00
SHA512 42ba3aee47bee13f77901993694e58188a716cb183433c9bf5e0c6ed49adb30dab6ed5312495a1e27f6453d2f65af4128e2914ae41fadbd677d9f81c37b3981f
SSDEEP 24:OuhMZD+lzetvM3dWIPmWbYkXkPX9SPtKZP:e4/CyK
TLSH
T14932B3FB53B292A2F1E10EF1208D32CBCE333239C490855C8B06E4D6454ABA4D46FF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 24KB
SHA256 7777f5dbeeb2c82d4ecfece8f93f9bf6271108a68a17407ce0bf1e520d85f804
MD5 9c50974cac6992655257606209e8970c
SHA1 cffea3729147e84c5efd83e40b4c1103a24ee059
SHA512 f8ab77f6218365e7b63fe888608c4da1eef184575713c8def7a0c09b2fe54de5c3491afff77e04ad4f2d41325d4dfaaaa91b4bd3d37e7c38ab04aa5ee5a7db6e
SSDEEP 768:GVbq321cGcmhuzspRK1JEokbYbmbmbd5E/:Sbq321pEg
TLSH
T120B2FF44EB1E953FD41952BADCA14B002F78F88A59192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 8c51d00be56915ba5090284d495674ce8b0936aeabf30124894bd4a9978beb47
MD5 81820ee45073553fa21733d4578a3e31
SHA1 55e96a79d060b5a5435ae6344298d0a680ae40d5
SHA512 7c494dc31f8a487a3b33796ba2f4332a02ae546de1f98c5768aa7624469bea4fa859a68a9799f78f2455f2108642f82af84990935b63a48803e78ca46f2e3d3e
SSDEEP 768:ny5ELbq321cGcmhuzspRK1JEokbYbmbmbd:Lbq321pE
TLSH
T147D20144EB1E953FD41952BBDCA50B001F79F88A58092FA73A4C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 254386afd122f992c699785d3343c32058e703eabe267643a14677dfd9c450d2
MD5 0ad80b8fbc0f0e3633c53a3ebfb7e065
SHA1 2ca7ac4604f7ebceb651f4194e2229eb5fd0e760
SHA512 6beb7d8135ca2e656a14cb800eb714035a584c91aed09e985f95b4ebb556027a3670101c3d18756ddce5ae4dd1cc405a2e380c29df3f38b881d2cf5b1b8ed9ea
SSDEEP 768:cbq321cGcmhuzspRK1JEokbYbmbmbdW65E/:cbq321pEo
TLSH
T126D20244EB1E953FD41912BBDCA50B001F79B88A98092FA73A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1b9d5e8a4d3ea1ddd3c5ef3dd7a9d700a5fa29ded6acdad7c752e20343c7785b
MD5 138ab6b82190709967568465d57868d8
SHA1 5ef44dc877b331781f1c917cbf52a2f9ea27a162
SHA512 2ac7fcc6fcdc9122fe10a99869d6ff9178ec28d314dc008a72b1236315e329ed2a506ac08b7e861c9254d6ced7206e078736c694ae221b8ca5f61da167bfea17
TLSH
T1DB118C9C39FA4E6AAEC7E3DC7490128E5B158A0B05871D530D12EF8CCEC2ED9326947D
MD5 SHA1 SHA512 TLSH

Submit Download

284ec907-9927-43a7-8efd-3a45e377e5e7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\284ec907-9927-43a7-8efd-3a45e377e5e7
Size 871B
SHA256 66ade9e689eb9b4aecf0a334164164b9eb2b7ec642fca391d802f31ef4b69c21
MD5 192e53a3ce2ef500c0dc2edb68c274ee
SHA1 ed06d90345414890f62c96adde3e66e72e3e224a
SHA512 26a65ea11ced98aa53d3e103d204011565b1f7a6a1cb08d248aa7ae30984b946ba9adf2ef7d4e4b3ab6ba91bdcb8481f5cd36113840dc04e46dcbec9fde8f241
TLSH
T146112341D638B9E3CC78824BD5A237428FF4751384C958547EA00E040C7F52EA776347
MD5 SHA1 SHA512 TLSH

Submit Download

3e07f0cb-f0b9-435f-8042-d66ccf106169

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\3e07f0cb-f0b9-435f-8042-d66ccf106169
Size 235B
SHA256 6f767b09599b52965a10a90623dc33a74adc163039368efab74749d1a9bc5d52
MD5 dfa6efb660b372a17f88e2d2f36310c6
SHA1 5f5f018bfe2573a2e24f18507c792f687e758eb8
SHA512 804f45f4d6ecc6f1916e7c1fc8f8ccd10f494b4a392e0d54571782503ddf92e525e94c351a173d021524eaedd746938dbcdf6dbb9163ded792f635fb5eea194b
TLSH
T1AFD0238428B8635D48000F07F0F47DCA31C8CC331470D810D6E08274A9FDFC8826581F
MD5 SHA1 SHA512 TLSH

Submit Download

3fe9c0df-b1c9-4567-887a-5232e0599210

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\3fe9c0df-b1c9-4567-887a-5232e0599210
Size 2KB
SHA256 0c0ecc9dd06309a2418e074ec98988f9a78b9c15cac160bc48dc2d799dc109b0
MD5 94815c00ec48eb29364311f54b4759d6
SHA1 fc194eb5c483c19f026397e055f496b1983e42db
SHA512 b8c30bb036bc3fa26530e51e549899c106d7be662ef09e7932727fef49d83c7aa666665169176162bcd17baddaea65fc81c834d0f0a9e3ae120a40d88f08095d
TLSH
T1AA41337875B88CBB9996E54DD49133CE4B248A4340C31CC37E51DE0C8CDAA5A337A56B
MD5 SHA1 SHA512 TLSH

Submit Download

5f9086bd-0ce9-4bc5-83de-976e569364bc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\5f9086bd-0ce9-4bc5-83de-976e569364bc
Size 235B
SHA256 273641afdccea25c9ce57440d6afe7b9caf02fb2b8ff815548c9850a037b4d55
MD5 5b069c17430f479e55c114fef778f94e
SHA1 cadd02f4e8f09f5ad086efe3a7b4727dfae2907f
SHA512 53ba2a85418267eb3bee71f05a418cda96acae3016b43d7f92bc8cf7975a0a81cb55ebad60292dc6b90bf1ed0db308bec33c45e14154f213cc66e02c5fe036f2
TLSH
T195D097C0248C7B6D08000F4BB0E828C231898C3324A06860C66005B49AF9DC80212C66
MD5 SHA1 SHA512 TLSH

Submit Download

d09ba004-abf8-4141-b07a-666ebf40e16d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\d09ba004-abf8-4141-b07a-666ebf40e16d
Size 886B
SHA256 30628783ef4d403463ebb05ce9c9a844963808f2284dc2d58ffe7057d8147ac7
MD5 45cf5ed6e383901edbc4091124d6488a
SHA1 9d2bac0e0d6c3b548d9e03c735e3d160f8afedba
SHA512 da24e4153a2e9652bff989b018baa6fde1f673eb36c8a8d806cd9549e88c0c79f3a1d37b799d8b0e329c9c0cece43784678bff47d6c31124735c5a04289efed6
TLSH
T14E110041EA3CBDF2C8388387E4A177828BF0701380C91C507EA15A080DBAA1EA66630B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extensions.json
Size 16KB
SHA256 0b6c1ec544ac48f44e3de7dbd28359c93a110b3357a96f00091286c2a3fb5775
MD5 de08cfb60d407fa027eb47492c305961
SHA1 49b356e94f3c3b8b375ec2a7a1af41e0eceef638
SHA512 ffed4a51583e12975cd8f62b554d730f47d2f5957d612dcc17bbf5e2791cf24e38df291c5e927be8b3d6a823ee84043e51c142f6cd9f4cfd99f0c48af8df3ab6
SSDEEP 384:AkI4vyUmldvXf8dhWnV94z6196opL4HBL4PlL4HDL4HfL4HGH4hG:nI4qRf/0Xen4K6W454d4P4j4M4k
TLSH
T15172422545049EB8294FA79BAA367E01C37D433B60845C78B4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 7KB
SHA256 2721aeb3af62495481f11924a13253a24e3f270081cee755872e0c8a3d36115a
MD5 d78e6b61fc90f344c7b072e1150ee279
SHA1 11d01b7f759f51ff6e179296b80c1afbce9f149b
SHA512 005b54ec63a19a0275b6759762a7faa085d45f40ea03356ee9d615dca41ed07cdb1b2831fc239a4d8f90b25fb7bf6218319097422e8e4b865391c0328ac7ca1d
SSDEEP 96:xHHFTUZfvqGqqkfVveObzSSSSlDdv9jgnLHH4/30Bw88sV1r8L4cn/MVhPGS:91RFfVveUSSeH4/30Bw884RR
TLSH
T1B3F1FC7CA004CB7F79B237ACAC6449315A62023BB7BF68E750B99485055CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 7KB
SHA256 c3ba535961db731da707fe4f6c7ad79c1b58fd84302012872979ab963e85c5b2
MD5 569fdea253e970271b02de9c8e40978f
SHA1 78bfde97344c1e7c1d4a4c87022990fbad60e482
SHA512 0bf94df9d464cbabce7de7b4d062c98127e30ab63dd299849c7df35bd05361df4e037a228c07b100def8cf2dc1da2a727a35f751c63038318b7c0958527124f9
SSDEEP 96:xHHUTUZfvqGqqkf+veObzSSSSlDdv9jgnLHH4/39Bw88n8L4cn/MVzPGS:9QRFf+veUSSeH4/39Bw889H
TLSH
T1BBE12E7891088F7F68B677ACAC688D316AB2013BB7BF68D350B59484055CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 0c0de5ff3313a72ba7acf7927bb637a4db9a383691293aba605ba2a8743a7506
MD5 a50ab12663862fd054c7b7d8640052e1
SHA1 2cc03c87b01155b8ae06d3ef26801aa89351dc4d
SHA512 62007696e2b314e81558a23a3efe9b01f3513ff5b7b8e13b66b3ec9efc3d04f6e611d653ef4a5104f93af1a52e5c776577845e18d8b708464b57aaf8383e3489
SSDEEP 96:xHHUTUZfvqGqqkf+lE1zSWZSSlDdv9jonLHH4/39Bw88n8L4cn/MVzW:9QRFf+lE7ZSS6H4/39Bw889g
TLSH
T16FE13F7891088F7F64B677ACAC688C716A72013BB7BF68D750B55484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 7KB
SHA256 729f271e8ebd7ed9411d388a7faaeddedf96f99e528af29bb68d3c3fa6d95dab
MD5 6615a012dcda620511e537d83960bbbf
SHA1 217a8ef32ba110ae43a71ed7c696b7b802651a4f
SHA512 4f6c5d6ff1bcf4729749add1a0447c9bce19a4c18a0808e0ec4b57ec495da6a1277e577e31938801ab56da8f43733c9ab2f0c73cb25cd1efe2d97635c1fb1c14
SSDEEP 96:xHHFTUZfvqGqqkf+veObzSSSSlDdv9jgnLHH4/30Bw88p8L4cn/MVzPGS:91RFf+veUSSeH4/30Bw88/H
TLSH
T19FF1FD785004CB7F79B677ACAC6489315A72023BB7BF68D750B99484051CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 0233ec050c70a44531d486f601faf60f909e2111a51af85fd2e4c13d07c5820a
MD5 5b6da5acbd949b686012167331608279
SHA1 e054fd85958b32b68697e5520888e3491d2c00a9
SHA512 43b3b74bf9607cc47d34e411e35aeb6ea1327bd6e602c14100f4a9be33ce6fdd5b337894864aef211d059affc43bf5ef4837844cab959a4897523b3531285596
SSDEEP 96:xHHUTUZfvqGqqkf+ve1zSSSSlDdv9jonLHH4/39Bw88n8L4cn/MVzW:9QRFf+vejSS6H4/39Bw889g
TLSH
T111E12E7891088F7F64B677ACAC688D316AB2013BB7BF68D750B65484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b3f1dd50b675979dba7df2af3bcde899fd36dee2211277dd790f3a3bdc3c5601
MD5 38c7b46a7e142f9e6a39c7cdf2a4c218
SHA1 1c46487e09c677b5f617ff49a3311a46525923b8
SHA512 0ddbc08268083ae20025dffdc5a23e77d81d05f3cbe204dcb4f9b9901ae2eac63ebcdfa506fff567694717b788847914e7007afcf129fb1b4ee069d1bf7cf286
TLSH
T1C541C615632B15FE9A41836E50C44BFBCB00B132C9086894E51EFD1C86A266F337E9A4
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 5ac73d202d52b60335953bd7d48ccfcbcb2289a7d27c048381c29a31855c34e9
MD5 303dff50426fc095bd794b843f2973f5
SHA1 abae2ab89c26308a8ca2f286d8b3d8f49ae027c4
SHA512 b7f08a0a0cc0004982cb3ab2b1e0e337e6b5ddd20aa2e7a366916852bbca305e2fb2dcc96c44f602cb4f0ffa424142739001a3e1cb86b498494b81885bfd806e
SSDEEP 192:bMJWXqauFvHPsdE6SkFfbLG4/vONIoa6g85KxDR4qD4RYO6bJkYgBfj:AoXqakfPcLDFf/G43kIp6z2V4q8D2o
TLSH
T1CA22BF530F0717A35C6A69FBC5AF106A9E0DB6B7CE262204F18437184098E1FAD2E1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 0a13f526a53a99e878295464ee3e7db72038909fdf59f4dd909f8c8419b33566
MD5 d3627e9211f2a29bcecee1178c0359d5
SHA1 1cd97a7a6f499482b3d71dca1475aba7aa6f84ea
SHA512 e9db2b285993065c3a437fc4effe12bbded143b91648b33c813edfab5a929bba0c343d49d92f8ccc6a55320564ed881df3bfd317ea385d319684de7f224cf85d
TLSH
T1B6210B5769171FF5B7604285E4C0CBF6CF00713544B1C850D15DDD0C424656FB36B91C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 ac264e8fe36a7144a3a9be439e054e37552dc9dc6249b2ca99e619ce26a7e9b6
MD5 ab6a19ee25bbeca343102e7e7161ccfd
SHA1 7e256e066600eb04400077adfc77d2769bc53975
SHA512 360f3fa60e42dc6e22b4896b988f2c46573cd3b5c6b60d7f240874824050db836be15816c8e34458b5365118a377906477d2862b583d77716c4db1262c419e4a
SSDEEP 192:DMJWXqauFvHPsdE6SkFfWLG4/vONIoa6g85KxDR4qD4RYO6rJkVgBf9:ooXqakfPcLDFfcG43kIp6z2V4q8DU/
TLSH
T1A722B0530F0757D35C6A69FBC5AF106A9A0DB6F7CD122214F28437184098E1F6D2E1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 fb1b9f6dbe3f7d668dcd113b57d09fa0ba3a51ee2c452d08e2d09e6d91b97e0a
MD5 a00d1ddfdf3a0867ec8321aaf3953d74
SHA1 1b9dcf009784dafa08720c6c77c039620be564a6
SHA512 7e349ab636bda8fe26a9959b9d9386162f90b04ea6a4aa75de17bbb506d5dcc32ed5f6be76e8cf5a4bcb76741fc0e4798b9f28d12270353f110bb5bd0d37b8e5
TLSH
T188311947A5171FE47B60919AE0C0CBF68740303484E4C4B0D04DDE08A28EA5FF326A4C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 d9c3d2f117917ab419fdeffbc80c15fafd70374c9871f1e30e95902e03811ae8
MD5 4e4dca089613e5a4b098148d438781b6
SHA1 f3fb8274a0ff3c759a6e47e3148591b8ecbe30a6
SHA512 a8ebc1b7d8da5b87e342e51c62053c38710fd72b9b016f2879726bf50039a08e0b9c363facb14e87999499b280f4a44a1a7300c2bdba4d82e0dd186266dc257a
SSDEEP 96:OJIMoCW3nqaU8G/D5vptTzJyPwaeyXBiY/tS2ZF5y6RtoubCDBJBnmFuy:ZMJWXqauFvHPsdE6SkFIkrQBmUy
TLSH
T1ECC17D53990B179BCD391ACAD25F05EA4B04B0B6CD535A14F2CE3B184029B5E952F4DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads