Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
12/07/2024, 03:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240712-ejg4pszfje
- SHA256 1c269084aaa81ff27f94106ab4572d394b2a467956f5bf0fff6fd130d00214d0
- MD5 fd0b9abb452747cdf5b01aa567ba1bb6
- SHA1 10964d022c5a21e53ec407facc763ba7b155b674
- SHA512 a0f6f551cbd3899044e2e6b7c47601b77fd1df92178cbdbb0a484f291aa656d2f71abc314870db7fe82cc06d0bc8af84887eaafd6f23faac3fec9e1db3730826
- SSDEEP 24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8aLv2Sbly7TWEPje:UTvC/MTQYxsWR7aLv2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4780 firefox.exe Token: SeDebugPrivilege 4780 firefox.exe Token: SeDebugPrivilege 4780 firefox.exe Token: SeDebugPrivilege 4780 firefox.exe Token: SeDebugPrivilege 4780 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe 1016 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4780 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1016 wrote to memory of 1996 1016 file.exe 86 PID 1016 wrote to memory of 1996 1016 file.exe 86 PID 1996 wrote to memory of 4780 1996 firefox.exe 88 PID 1996 wrote to memory of 4780 1996 firefox.exe 88 PID 1996 wrote to memory of 4780 1996 firefox.exe 88 PID 1996 wrote to memory of 4780 1996 firefox.exe 88 PID 1996 wrote to memory of 4780 1996 firefox.exe 88 PID 1996 wrote to memory of 4780 1996 firefox.exe 88 PID 1996 wrote to memory of 4780 1996 firefox.exe 88 PID 1996 wrote to memory of 4780 1996 firefox.exe 88 PID 1996 wrote to memory of 4780 1996 firefox.exe 88 PID 1996 wrote to memory of 4780 1996 firefox.exe 88 PID 1996 wrote to memory of 4780 1996 firefox.exe 88 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 3272 4780 firefox.exe 89 PID 4780 wrote to memory of 1672 4780 firefox.exe 90 PID 4780 wrote to memory of 1672 4780 firefox.exe 90 PID 4780 wrote to memory of 1672 4780 firefox.exe 90 PID 4780 wrote to memory of 1672 4780 firefox.exe 90 PID 4780 wrote to memory of 1672 4780 firefox.exe 90 PID 4780 wrote to memory of 1672 4780 firefox.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {783e0cfc-0e5e-4fa7-a872-1fef8330fb1a} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" gpu4⤵PID:3272
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2460 -parentBuildID 20240401114208 -prefsHandle 2452 -prefMapHandle 2440 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c5edfc5-92b4-46a3-ba4c-d1c58ae19d37} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" socket4⤵PID:1672
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3164 -childID 1 -isForBrowser -prefsHandle 1736 -prefMapHandle 3280 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09801e36-5eff-4982-a2ec-6df364266996} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" tab4⤵PID:2152
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3772 -childID 2 -isForBrowser -prefsHandle 3768 -prefMapHandle 3760 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {343db696-a090-4408-b033-572f4fbd3e5b} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" tab4⤵PID:3716
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4688 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4676 -prefMapHandle 4664 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d75d9774-4ca4-4c2e-9e48-e6940ce5b628} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" utility4⤵
- Checks processor information in registry
PID:3560
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 3 -isForBrowser -prefsHandle 5440 -prefMapHandle 5436 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74c24ed2-d3b1-4e5d-b472-0a6a3da144af} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" tab4⤵PID:5024
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 4 -isForBrowser -prefsHandle 5564 -prefMapHandle 5436 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b95c632-720f-49e8-aad5-9b0ba0759ccd} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" tab4⤵PID:1160
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5720 -childID 5 -isForBrowser -prefsHandle 5832 -prefMapHandle 5828 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f2861be-1cb6-4bd0-8a77-fddd151fe651} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" tab4⤵PID:2488
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4cs2motb.default-release\activity-stream.discovery_stream.json.tmp
- Size 18KB
- SHA256 34addd92cc5760a8f45e38c30bd0721df5b74774ec2a4e4c1ef6e4f8578fb43a
- MD5 3c85bca60e0311b033afbf74e4603c60
- SHA1 a212ed513a09779bcc4153aa2c11712d4e44556f
- SHA512 f8f1204aaa00d75833f217fa962af0953b50c32651e5f875b7141cff3f6353591f0e41c5c8b5d088e8f561e958c444b5842823dc9f450f80bc26696425a6c0f1
- SSDEEP 384:QG5+mecQPd3WINiDzr1APlxzofiUjp126buHZ6w0LDbyaE:Q//3HNU1BqU117870/byp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4cs2motb.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
- Size 13KB
- SHA256 12d556202edf21dab9e6ee5bbf6d95d977e6df3e7309b805a72b38c4f16f90d1
- MD5 69222b838f32ab66102314e80680cc5a
- SHA1 4fe067b72cf10bca8e210c935126de3d8f364e22
- SHA512 28df643fe3e1ba316bbbd402e63da66b7ead140cb3fab30b45c4d5bc768a9976b1c7cafd8ab1f89c77b44552a2378156be355750c1c5f6f4adda343ab3968417
- SSDEEP 384:HunTu9fiGLm4pUQgIft2WlOX8lPLZZB7t0lpDII4ZH:dBi8mCUSft2WAX8tzB7eD8z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\AlternateServices.bin
- Size 10KB
- SHA256 e0d6aff805771f88824296fe783801f9583e302a83a03b7235246d0d0732dca1
- MD5 e2b3cb8cbb0bf4f2470caa113dac6965
- SHA1 bf6b9a87ab928555f45a7a610594940d36f27130
- SHA512 4070006685a999b9c9b8543841e2f0e5b860465f87a3f5294d759e2bdd4f582f1bc69cf3778d90ed5c19857e23ba5d27657d617841c4ea8ad606d475573ab96e
- SSDEEP 24:PuB1odIgu1xgRb57Fsh2F3LFwpR5cOmuhMZgsJbF0JpbvWKsJblxWKf+pbpJbFFb:jI5odc9cOtebOJpbvpebvpf+pbvb7b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 01921d72e5438595581f19ae6d3a9e92d639455f42da1efa1b9dcda590cb8294
- MD5 96050bb591dc361ceb401e5a6692f8db
- SHA1 5f7f6ee04be2b333528175b318e86f0a591d8977
- SHA512 3873175171e1c0aa442e616824d500bdd526faa96978898bc4e549aa92c4a5919fa0b06fc3e098ec7fc8643b30c22abb49f2fc2528f56053b12349309a05e763
- SSDEEP 96:lBnxoSMF9ZbkW6rBB0S5zJEauP/PDHxkW/UQ39AcFl66JozGzgClKtmSSp:arvZboPNO7PlfR/66JozGzgCl6mSSp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\datareporting\glean\db\data.safe.tmp
- Size 24KB
- SHA256 ef4da4ea0030c308aad6049cf5029258629fcc4049df1b3bfc2f28eedeab84b9
- MD5 fc243fdd699c6ba568604eac8be14ecd
- SHA1 040e0bbc21e419989f06833487ea02de395c818a
- SHA512 99eb86f236d800b728ca9cdbe3b8e6d921a06606f1e1752de5657161b49b618eab5c4f9a60e76c4de1d284d45d35a025a3da518c9b2f624db7d42d7476ac6e14
- SSDEEP 768:YrOF6ednEhDNvUiNp3UfPGbKbtbHb/bab3b2b9b2hfhq91BE4H5:YrOF6unEjhfhq91L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\datareporting\glean\db\data.safe.tmp
- Size 24KB
- SHA256 b155eff689f242aabcdd739de469a66d94bb272923697877aa5c1d58eb28e967
- MD5 21734d2b523419fda4b9d674bec5b8c4
- SHA1 781fe8e377fe53a98ab4d5b6132cc5bf1ae539cf
- SHA512 3f23ca4aff43b6b4d274deff7eefaa232423202e69450cbd78764aa97a74eaad6d3ded26dfe1fd2d8c733a431b7a7cc4b33e3dd82c99f0a919592ab97b9f8701
- SSDEEP 768:1EMrOF6ednEhDNvUiNp3UfPGbKbtbHb/bab3b2b9b2hfhq91pv5:5rOF6unEjhfhq91/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\datareporting\glean\db\data.safe.tmp
- Size 21KB
- SHA256 30d8c4a3ce4012cd424a1ba848f3d6d066f67c2e3931ce16e68c887365ac1970
- MD5 d2a04b8c9f456dbd8d356dfd8097184f
- SHA1 f47840b0a4830492b8490a0b824c45c45d21471c
- SHA512 989da9f0fc1e716ae4a443e6d9bd4eb300c3597b9e0b316169b9e833b87e148121085fcc30bb155aae473d97771fb480a82a3071d1c1481b947bb92791cb8878
- SSDEEP 384:mBb2kpDVGLraMRScPNvVtNp3Uf7MbKbtbNbWbab3b2b9b5lafvJkvb1MboS9Ph/m:sbnDVGLeMRhPNvVtNp3Uf7MbKbtbNbW3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\datareporting\glean\pending_pings\92c54dc0-101d-418f-8f3b-d3d4ee3f0157
- Size 982B
- SHA256 a33c045e58443a2a9e977c81aabecced554f88167764414f71119e90d2a074a9
- MD5 ad22c8d2998ba0396468af4a073c01c2
- SHA1 408acf980908e22a3ed68e1c065a45f25e59f824
- SHA512 408226a725c8f18322c3c77270b73328d3d06ed6f3da88d2596d3be7a1e5ef5776a695363e85449411043d4b6dff235e4c41b8e6cf37a5c3fc170006e66d44a5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\datareporting\glean\pending_pings\ff50dad1-c566-4920-8528-c5182052b563
- Size 659B
- SHA256 3d425ab5fb314e7676c025094112da2eef37eea9001110f67f585632b159ecb1
- MD5 cb6ef950ff95550e04d72f637565d0d0
- SHA1 11aa001f52e3168b5954d99e0922f33dd535e9b5
- SHA512 d44eb8254e0f597430ffeff9514cd047b0817a57af439dbd68d3b898d8aaff929e31251997660d12704e1056a39531c4ea8583c68344af649150059aa36cebc0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\prefs-1.js
- Size 13KB
- SHA256 4f6ae44d2537bda411a58033540736de07bb4e047812acde605ec94c79cbab4e
- MD5 17b1b5b016426b6d17c731775388a767
- SHA1 94336167e07db22fdb9e363df4a8bd0906f79e61
- SHA512 897b8399806772c55bad003c8ebabc51bca045ced294d27ea0b4a0b2b928a8a5636b443fdfeb616fe9b166d88be4103fb401d796fd22ee6e521de80767c79d7e
- SSDEEP 192:/5niR13fMPCUyRgYGd3vW+8JBWcdnHYUdrK1I0260qaXOcQBw8HRUb:+TqNvW+wZH3SBpwdb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\prefs-1.js
- Size 16KB
- SHA256 7b1e0c6b9f12c7e66dc904a259962a4243b7ef9227253e0602b049c3e3086adc
- MD5 f299fe4def9abf4f800be026c30d078e
- SHA1 220741e47434fe1c01d0c1dbf0721b51c6e7c4d7
- SHA512 360472d3b4ef4a6706d7c79bbfebdfa80bffd067fe4c0997f1571b1fa04038db2ba696885a6372d12dd7b6b02365125d45b01b9cc451995819b637e7b7c84634
- SSDEEP 192:/VUZYEMQniR13fpPCUyRgYGd3vW+8JBWcdnHYUdrK1I0260qaXK+cyiBw8HRzW1v:9UZYEM1YqNvW+wZH3SqEwwqv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\prefs.js
- Size 11KB
- SHA256 4aa86dd43b7788f7037931271d81331ca26b8264782ecf3ee1e17f856dbcbc31
- MD5 2252fa4d7ef076e8c9ebb5d8fb12efde
- SHA1 6dd8f5fa48c656104e9140f3b3ae78a81be62ae9
- SHA512 cbb349d29ecac84f2039144c3ef6b93a4f2ab203fd3b80eb8b4055b96545584b2b120a18e0e4d2a128537f9e64b0f53f9d923d25e36492eb04a6cdf9ab8823a5
- SSDEEP 192:h5niR13fMZMUyRgYGd3vW+8JBWcdnHYUdrK1I0260qaXTc7Bw8H6:oLqNvW+wZH3SsAw3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\prefs.js
- Size 11KB
- SHA256 88e9ec8955e22072285aaa22f3603f78411dc08209382db7d7654dc5d039d377
- MD5 942bff5df17d1776c82a949114312a5b
- SHA1 6c4dd5a1df3a1b9b91f826b173cff2f5b18be71f
- SHA512 921cadde10864354742d7b114e1c6b475c688383e6995521983043078eef09b3113ffe1df7580cf497db7f4eb6c6603793a794ac1ab8f41500261809559184c4
- SSDEEP 192:h5niR13fMPCUyRgYGd3vW+8JBWcdnHYUdrK1I0260qaXOc7Bw8H6:oTqNvW+wZH3SBAw3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 1.5MB
- SHA256 bf95fd95d2de1ad537d21d1d3ca12779d1fb5994f4f90a13a1c19a1d84cb5cc4
- MD5 cabfc78bef134605ffac4f7daa3f2098
- SHA1 1693561fc4f166ce93ff0935c68128746530a106
- SHA512 70aa0a9e85d4450e8f72ebac362629840c9687b7a8738f800b4e1dd62e09f326eb7940e5ef0b8a6cd093b68728e20ae2b56f42eaf0bb16e44c1b09297622ec9a
- SSDEEP 6144:aRgQM23ZNR1HbIHHK+KrsUaj/nrZ8R3r3K393z3m32z0Pu/elcZpZNgXrvrudzcp:i5IK+Kr1cufTrmzcbT+wmKXtoyawou
- MD5 SHA1 SHA512 SSDEEP