Analysis
- max time kernel
85s - max time network
91s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
28/02/2024, 12:58
Static task
static1
Behavioral task
behavioral1
Sample
.gitignore
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
.gitignore
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target .gitignore
- Size 322B
- Sample240228-p71k3acb54
- SHA256 1e6f5136b87601c04384ef174c445c6fae4acebca8031bf9245f3b963fc68d9a
- MD5 63df42f85a68386eeadda4713a5e9590
- SHA1 40e9600b0afc389170ae64780af57d97f90ed8a8
- SHA512 2c3bdb547338c7ff80e9fb8d556faaaf14f936ee550114e7b631949de4b577c43bc7913f88b01288854024d2c44e6021aa8d395159825ea0aa2847e844f1496c
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1700 firefox.exe Token: SeDebugPrivilege 1700 firefox.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1700 firefox.exe 1700 firefox.exe 1700 firefox.exe 1700 firefox.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1700 firefox.exe 1700 firefox.exe 1700 firefox.exe - Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 3724 OpenWith.exe 1700 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3724 wrote to memory of 3372 3724 OpenWith.exe 104 PID 3724 wrote to memory of 3372 3724 OpenWith.exe 104 PID 3372 wrote to memory of 1700 3372 firefox.exe 106 PID 3372 wrote to memory of 1700 3372 firefox.exe 106 PID 3372 wrote to memory of 1700 3372 firefox.exe 106 PID 3372 wrote to memory of 1700 3372 firefox.exe 106 PID 3372 wrote to memory of 1700 3372 firefox.exe 106 PID 3372 wrote to memory of 1700 3372 firefox.exe 106 PID 3372 wrote to memory of 1700 3372 firefox.exe 106 PID 3372 wrote to memory of 1700 3372 firefox.exe 106 PID 3372 wrote to memory of 1700 3372 firefox.exe 106 PID 3372 wrote to memory of 1700 3372 firefox.exe 106 PID 3372 wrote to memory of 1700 3372 firefox.exe 106 PID 1700 wrote to memory of 4556 1700 firefox.exe 107 PID 1700 wrote to memory of 4556 1700 firefox.exe 107 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 1236 1700 firefox.exe 108 PID 1700 wrote to memory of 4484 1700 firefox.exe 109 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\.gitignore1⤵
- Modifies registry class
PID:2644
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\.gitignore"2⤵
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\.gitignore3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.0.1097748893\1297144810" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3294689f-9cba-4220-8d3b-c5ec876ce504} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 1948 16ed54d3b58 gpu4⤵PID:4556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.1.848606705\2008397950" -parentBuildID 20221007134813 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c132061-6483-4d37-b973-736cd4124db7} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 2372 16ed540c658 socket4⤵PID:1236
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.2.1862235253\1668750999" -childID 1 -isForBrowser -prefsHandle 3164 -prefMapHandle 3160 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b443703-3a6b-431c-b1e9-e6108186272e} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 3076 16ed94bce58 tab4⤵PID:4484
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.3.1447969160\952546440" -childID 2 -isForBrowser -prefsHandle 1068 -prefMapHandle 1376 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0af76dc2-a1d6-4751-9cd3-374f7caa4485} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 3568 16ec8a61958 tab4⤵PID:4460
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.4.1823499082\1859387080" -childID 3 -isForBrowser -prefsHandle 4580 -prefMapHandle 3732 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47e01f5a-c152-4bca-b8bb-ca3228d1bacd} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 4584 16ec8a63558 tab4⤵PID:5428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.5.417877703\991100207" -childID 4 -isForBrowser -prefsHandle 4828 -prefMapHandle 4832 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {316144f9-c04c-44c9-b334-b36613bdcc34} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 4892 16edb735058 tab4⤵PID:5572
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.6.1010857747\1100692049" -childID 5 -isForBrowser -prefsHandle 5032 -prefMapHandle 5036 -prefsLen 26300 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3de45fc-83ae-4a8d-ba1c-06bd49314387} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 5088 16edb73a758 tab4⤵PID:5672
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵PID:5136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\E66F5AA5E3C285C270CF84BD11111C74D38F245C
- Size 13KB
- SHA256 cf973a215ed4c9178b6f35f3ac5233de7595d324a22ebe431ccff9e3a6c14798
- MD5 9557929de8890e7e5f65537750fc8c7a
- SHA1 570ef02519aea7665796a515845c791b93a257bc
- SHA512 a5fd779fd01a47eaa1f78044f22bed9df2c84901ee22e0271a01c2153a4f7c4490a0e587cfb20a68300d1554a30b2461f6bc6e8ce05facc1a7f0fb68a2a2125a
- SSDEEP 384:H3vPu9fiGLm4pU7p0DuDyS4uWg938+iLO4O0lpDIInip:OBi8mCU7p0DkyS4ub9gLOwD8r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 442KB
- SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
- MD5 85430baed3398695717b0263807cf97c
- SHA1 fffbee923cea216f50fce5d54219a188a5100f41
- SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
- SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 6.6MB
- SHA256 2e771ddf5ea9b8ec392ccfe7f5d84a00a8e6f7a168b12114a7cc225fb319bdcb
- MD5 2a62c15ca07173bb693c345949b233f6
- SHA1 f58d02923fe1e13b151c05e67b7eb1154054572a
- SHA512 9eece32853f28e134337120d1bb4398c22cd334a2327e451a05264b43e87ea9011b0366a271781512e3b930b367631df3ef3f477804e28f5882f64c980ce523c
- SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEir:9tP7/cvflof0FzVgKRF9zr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin
- Size 2KB
- SHA256 a0e843e80495d02a3918b4348c91b5cbb52b7acec35ad47e667001168d04b2dc
- MD5 df733d28d992060fc6cb8593f26f6cce
- SHA1 f60987a59bf4deacd6e26723931f9fd5527fc016
- SHA512 85ab3f7bc2cfdec525794d681bd7ca21584afaf95a8762c5f34056e2fd3423cf1e72456141f8d03d9058ed737a472a0fc3ac67dc8af2e3baf68c67b0e44cd4bb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\0b679e31-cfbe-457d-ba46-ad857b479673
- Size 746B
- SHA256 84b2a58ff4f9783eb906022429f9f1f3f238942e8cd31fb216b6ee1d0e556338
- MD5 6c3277a64f9e9b35d5170bdbec3c85fc
- SHA1 524733c210d28f74e0223f90a376c8e10307330c
- SHA512 97b5a19c906cdda2e51f23208b5c1f930ecd74041e85947a45e7df8a9f6c92a08d387e17ac1cd13aa6e21ab1d5f8e1c707643fa892681921fd23f51d226be80c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\4b84d2c5-d0c3-4e84-bccf-0c6fddd7796a
- Size 12KB
- SHA256 d8184c93d651b0930ae5ae7aa5333e297b8ea6d139f93e4c6f1abe21f6c1443e
- MD5 ba60b17ed6d07c80a6927e01e905bbd9
- SHA1 844899e4bb6495d151f63a949441277b0cd88d32
- SHA512 2e6f5a724bbe9fc0c31419aaeb41bd9ad07c37400c166adbcc78b717b38d9e3356f2b62f028d3d713b0bc679f6ca9bbd9817e06362bad79cc1e89d2b13a0a9ea
- SSDEEP 192:rrWVs/HpL6SlnuBN1v7z7Ru4Lv4V4WoWNIhs2H4Q5TMSyqLYX3a6Bljq7VQA/nlM:mVYoNg7n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
- Size 997KB
- SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
- MD5 fe3355639648c417e8307c6d051e3e37
- SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
- SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
- SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
- Size 116B
- SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
- MD5 3d33cdc0b3d281e67dd52e14435dd04f
- SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
- SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
- Size 479B
- SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
- MD5 49ddb419d96dceb9069018535fb2e2fc
- SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
- SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
- Size 372B
- SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
- MD5 8be33af717bb1b67fbd61c3f4b807e9e
- SHA1 7cf17656d174d951957ff36810e874a134dd49e0
- SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
- Size 7.1MB
- SHA256 1aab4f4d3af994262f942f8c63644fb0b2874965133976b2e2ad6beb775fab83
- MD5 cbf391a29bb7f22d072fc8776bf5290c
- SHA1 f42bf51e76e6de9ec052a68132d63c344fbf021a
- SHA512 ee53ae60cf067dfb0af8febde3cbe133d93f2488c93e3df2d1bacacd7200ce9d5d167967f888a09916c279b990bb5b1f28c18171463b3e331aef4810e41abe71
- SSDEEP 98304:lP4WQvez+WLvb1CKAFw6Rq4ytbko4IA0Iv8oZX7MbhfzuCv:lP4/vkvbdjMq4ytbko4qIUcXkhrVv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
- Size 1KB
- SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
- MD5 688bed3676d2104e7f17ae1cd2c59404
- SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
- SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
- Size 1KB
- SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
- MD5 937326fead5fd401f6cca9118bd9ade9
- SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
- SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
- Size 6KB
- SHA256 5b07cda232ae8d8bc1f875f942f84e50e841f4eb46f894802f05e8c604ea5152
- MD5 fddebd0b9f4e696786ccfc9ac0281e2d
- SHA1 2d4ec6ddec8b63a5957a7fffa20c1a6e863f1977
- SHA512 acfb285842047a57c987c421801ffa296dc7d6e067185c151adbf8d16f737f02fd2d8fbddc77e6a545e0eceee19c23c6c3267b7a2cf7f3e366b6020f4f0bb857
- SSDEEP 96:xHGg5nUTeqGqpdIp0eOTzSWPXAnpjNHhE2u5Dt3Bw8H7kG:35nIRpdIp0e4PXihExX3Bw8Hz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
- Size 9KB
- SHA256 e8e7e3b8d639c72f7964cfe5947ec1a6cea689b6f017ce551698c82e3c81fc1a
- MD5 33b6c5f7bb52379c7a34b35b7926acea
- SHA1 585df19055af8c349dd61eac10df8a1b735f4239
- SHA512 722a6d9488acfc29821d71f8420e179b05b15236a59bf8e4bd2b4792275739caeab6b65d9ab2753a59ca82a05945ed1abdd68ef6c60b089152264d1c584356c5
- SSDEEP 96:xH5g0nUTeqGqpdIp0eOTzSWPXAnpjNHhE2u5DtyRBw8H79Nuws:80nIRpdIp0e4PXihExXyRBw8HhW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
- Size 6KB
- SHA256 6429bd4f1c03a60af05710c052c8413a50e69b7430ed40686dee6a10510a888b
- MD5 88c82e6876efc63b40c6396cbbe6b3f5
- SHA1 de2066fe763bbb433a52747dc3a7594bd6481346
- SHA512 35c66d8f37106f4194eede43a39f37af9995e93160458162b3cc191a9f6a1b4c0156c9f692550d8f0b8e1108f744784925223522ad1b7a094e02de27c4ad97eb
- SSDEEP 96:xH5g5nUTeqGqpdIp0eOTzSWPXAnpjNHhE2u5DtMBw8H7QJG:85nIRpdIp0e4PXihExXMBw8Hp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
- Size 6KB
- SHA256 d73900ad822efbf610ea71978bfcc5a264175bafa2443ce1f5d25366244ffb56
- MD5 54191faed4d2e79fe0b309f7029595e5
- SHA1 ee0be4fddb683d7f74e0e162bc21538be31f38ee
- SHA512 3825e18329839de230a3daf005522c60afbccb4da52ad80b54850015208ba20986b444c5e3a1644a4b877eee80bf34814ebef63e9ce435b3dcd40869813f90ca
- SSDEEP 96:xHGg5nUTeqGqpdIV6eOTzSWPXAnpjrZHhE2u5DtABw8H7kG:35nIRpdIV6e4PXShExXABw8Hz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 d495bb4bf0b233ae791e6744f81a363a3284c86761e45cf01d2fb30363311772
- MD5 d4d8d4e163f4e3e802bb572ab776e48e
- SHA1 4e283bd1a4f467b44870876c249fa62de18560cb
- SHA512 f8f87219dcfee1c70538378222ef8f2d5a8484c73339a07d79934e52e7d10a45fa23fc6665935b98f2268cd91ac6bbeb0e9aef030940fa300b889f4e44c11545
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 1.3MB
- SHA256 3988f069f080d79cf78944a3ed6049a8255f88c508d8805b4393586b0f68ef0a
- MD5 f0047aa7c2ac757499b577937d72c05c
- SHA1 3972f3d28d365f723526d4d6c0bb742970aba828
- SHA512 2f9c7f2cc342b07c1b709a49f66b3e1bc14d84fd6e66b2ef21f33dbe757867a797d062c1e7d85f7bb1226c2bdae103c1c240df82f5b56a689d37ed23817b4e4a
- SSDEEP 6144:eQlgK3y3AUSeH+cHKw6uaB6uajjudrr48CjQdMApO3yWiaLX4DN871nljcf/r3s+:8GUIriQpO3yWi2i81dcfjciZOU8f
- MD5 SHA1 SHA512 SSDEEP