Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
13/07/2024, 04:26
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240713-e2hsysxhrb
- SHA256 1a367ea41eebe508b18e6932c5a2c4c4bf49d538f693fedf5ed9ac1a700256c9
- MD5 09152a5de42f88b88ae9c7742ea0f93f
- SHA1 d5dd93d7867c77c07a4e9a2f87ba888333c5df24
- SHA512 eb1ea8fbe2b259833fc4898c71bd5f597da1c6b78719e3eeb5f46c6f6840db29f52ceb7a5e219d17344541b653c30bf7e318d435f0dcfc3777dc16f3dd0d97b7
- SSDEEP 24576:IqDEvCTbMWu7rQYlBQcBiT6rprG8aLo2Sbly7TWEPje:ITvC/MTQYxsWR7aLo2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3144 firefox.exe Token: SeDebugPrivilege 3144 firefox.exe Token: SeDebugPrivilege 3144 firefox.exe Token: SeDebugPrivilege 3144 firefox.exe Token: SeDebugPrivilege 3144 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 2196 file.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 2196 file.exe 3144 firefox.exe 3144 firefox.exe 3144 firefox.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe 2196 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3144 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 4636 2196 file.exe 86 PID 2196 wrote to memory of 4636 2196 file.exe 86 PID 4636 wrote to memory of 3144 4636 firefox.exe 88 PID 4636 wrote to memory of 3144 4636 firefox.exe 88 PID 4636 wrote to memory of 3144 4636 firefox.exe 88 PID 4636 wrote to memory of 3144 4636 firefox.exe 88 PID 4636 wrote to memory of 3144 4636 firefox.exe 88 PID 4636 wrote to memory of 3144 4636 firefox.exe 88 PID 4636 wrote to memory of 3144 4636 firefox.exe 88 PID 4636 wrote to memory of 3144 4636 firefox.exe 88 PID 4636 wrote to memory of 3144 4636 firefox.exe 88 PID 4636 wrote to memory of 3144 4636 firefox.exe 88 PID 4636 wrote to memory of 3144 4636 firefox.exe 88 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 5060 3144 firefox.exe 89 PID 3144 wrote to memory of 4588 3144 firefox.exe 90 PID 3144 wrote to memory of 4588 3144 firefox.exe 90 PID 3144 wrote to memory of 4588 3144 firefox.exe 90 PID 3144 wrote to memory of 4588 3144 firefox.exe 90 PID 3144 wrote to memory of 4588 3144 firefox.exe 90 PID 3144 wrote to memory of 4588 3144 firefox.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f1b6477-cddf-46e0-bfdb-76b1f825383e} 3144 "\\.\pipe\gecko-crash-server-pipe.3144" gpu4⤵PID:5060
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2416 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93719498-15cb-4aa8-9ceb-5784e27d801f} 3144 "\\.\pipe\gecko-crash-server-pipe.3144" socket4⤵PID:4588
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3328 -childID 1 -isForBrowser -prefsHandle 3428 -prefMapHandle 3276 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84a094cb-1030-484c-a15d-cbc532d8add3} 3144 "\\.\pipe\gecko-crash-server-pipe.3144" tab4⤵PID:4848
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3700 -childID 2 -isForBrowser -prefsHandle 3692 -prefMapHandle 3688 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9485240-37bf-4447-8cc3-e7bfd948907f} 3144 "\\.\pipe\gecko-crash-server-pipe.3144" tab4⤵PID:2108
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4364 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4340 -prefMapHandle 4292 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46b2875c-0b01-42ae-a5c6-61479aecf484} 3144 "\\.\pipe\gecko-crash-server-pipe.3144" utility4⤵
- Checks processor information in registry
PID:3984
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5680 -childID 3 -isForBrowser -prefsHandle 4064 -prefMapHandle 5512 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7fa2ec7-da7c-4925-bfcb-b7cf08c4a0b1} 3144 "\\.\pipe\gecko-crash-server-pipe.3144" tab4⤵PID:3236
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 4 -isForBrowser -prefsHandle 5824 -prefMapHandle 5820 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2a76917-4f00-40be-8847-7f4fb6cc59d0} 3144 "\\.\pipe\gecko-crash-server-pipe.3144" tab4⤵PID:1968
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6020 -childID 5 -isForBrowser -prefsHandle 5940 -prefMapHandle 5948 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c54d5c45-2dbb-4309-a559-9f47cb00a40c} 3144 "\\.\pipe\gecko-crash-server-pipe.3144" tab4⤵PID:1660
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\activity-stream.discovery_stream.json.tmp
- Size 21KB
- SHA256 2a16d2321b0c53fb6138bc809bc26dd595141d25009aa69559e51234cdbf7d65
- MD5 1f1970298cac50c0797131d0adc82453
- SHA1 b7b3b5a57067b60c885fdaec15951f9e7496940a
- SHA512 1bf66d9d6cade1924c2395211cb5ac17631590096b7b56126fc617bfed55b392e1454c5a5be0fbb70a120db96695813e9fdca81a71e69c8ffe27a34f8da9dad8
- SSDEEP 384:2smeccfhtsWIpZJiz12A5lfHF1KzofiNbtN5jZ6Pjx4yauvF5i59G:2CgHprk1BF1nq9DWd4ydgG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
- Size 13KB
- SHA256 6cd3411157aee30148cecc11279248ab4db96bac2ec55faaf8d250084148a642
- MD5 6adb5893521d3639eb77712e7b850809
- SHA1 70c3174f404dbc39b8243c224e00dea0fbd81a03
- SHA512 f23f04bfc114752e7650f67e820c153c876624094f0af1ac4bca96246f01bb506b5a08bad7503a3e39271e48db8ee22dd2272ac6c2243d745a451a49e742ea80
- SSDEEP 384:HunTu9fiGLm4pUwft2WlOX8lPLZZB7t0lpDII4CA:dBi8mCUwft2WAX8tzB7eD8r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 4ac51026ba90ae9b531faf558162735117ea8d5a65f624c5e06fdcb06352c536
- MD5 dd763c87a6cca0b4981c5c2035ea6204
- SHA1 da419dfdf8f517cf558ecc2a9b3744fe740bd474
- SHA512 a8f25fcc8dfca23b6a6c0a5b118fa76cacde92c80af7125e4080e62e98510501bea488d98e45ee19cc9f5de1bd6799c14e59cf78ea0783ced8b98b2813801912
- SSDEEP 384:H485u9fiGLm4pUjft2WlOX8lPLZZB7t0lpDIIhhg:nUBi8mCUjft2WAX8tzB7eD8h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\AlternateServices.bin
- Size 17KB
- SHA256 a52a3fa1109b5bbfdf641e61370bb63168c544a62c3cc5781f84f2ce772db695
- MD5 5488705fc02defa2d4a361e322f4d295
- SHA1 df88b39ef744974debc5eb9ac5993dd474e6c0a9
- SHA512 345c3ec7d07f63cb26afbfaa84dca0b58ee1c97abbb7e91053c4785603c8d10b7d3781f63090a3c504e8b568111dece6b806e12022f523f31fc052cbc7d9b573
- SSDEEP 96:z5o0ebOJ4bWpebvpf+ebSb2b7gbgzRbWbybgbqbwAHVwbEb:z5Ju
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\AlternateServices.bin
- Size 12KB
- SHA256 7eae5fd7468a9c7604bd264832ce26ca1fb43d3377ef96f7e9ce04fd196e0919
- MD5 9365159894721280c44d4778ed05b0d9
- SHA1 131c42810756f2ba4a7ee6210555602b9622d6d8
- SHA512 ff97b5cda0293b16d02ddd1045578d2a7690cc0c24ad824ba8a11d40ebc462e7caf1ace102b58ec37314cf02461f8b0c20d5ce50c75c6b433d944417ef0f4f8d
- SSDEEP 96:T5o0ebOJ4bQpebvpf+4bSb2b7gbgzRbWbyb:T5Tu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 bedb4562852827b608d5dbaf13da1433f9323d26a6627d66d46c4bd7eff21d62
- MD5 979fe48f14005dac2da666c538f9ac71
- SHA1 10662ed9cd85489464c417f4dbbbf75d8a4b783f
- SHA512 3c5494609df923ce8b908aaa03ca33cf1199026e4d0821064b47b624b4cf08ed96a5a909140aeac1e07865043fea8bd0d2caa351ae7d07c6f6c5524830105d76
- SSDEEP 96:QNlQNfSBlFl66JozGzgClKtmSSkSMF9ZbkW6ShmsAPP/PrWZ:i7/66JozGzgCl6mSSkrvZboShJmPC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp
- Size 16KB
- SHA256 a9d2b0ca7081739abfbe75cdbb4c7d8201dbffc1d414d46c5eb2481d48613cda
- MD5 d8c081089ba3093128a8f17c488336d8
- SHA1 3b06a7550398dfc918151c97e9d3befc7a4a4238
- SHA512 bd10754ce2f734499c55eb251a72e43579387b6d3673dd83d350ae2672219ab0acb00f0af091da04c87f5da1ff6c2603c498d4ffd28e62a1f31baf8414f43145
- SSDEEP 384:LboxGsP0MwnHZP/iDTEo6lbEbLs7/66JozGzgC1bM:P4Dw5HiDTEo6lbEbLs2Em
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\159d7232-ecdc-424f-ae7d-050dbd72ffa7
- Size 26KB
- SHA256 c563cdf3e1c765d0a12560611294fec20eb081b103e137f7ed18b0c3ceb066eb
- MD5 184f1a61bb84aad4151130151ab3ef43
- SHA1 c68cc4fe29b04dff197fe7596922fb597ca34e1b
- SHA512 23c73b127e410b5f5f9055b45ed94379fc193f06354ab062a20d1508e3a1235b82b59c9bdf487af4f7af9a6e4411af9bbe5ac4bdc9713a2151d55562194e9262
- SSDEEP 192:eRtAYBqTsAX+GE0Nkzh7VahfJsufC4DMsNGJEutetdGULzxxR/uNS0Rxt3BxjS78:eEYVAOh7ueNtetdGwlXsabb+A4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\ad8c2f92-7d1a-4a43-b036-208c9e085f6a
- Size 982B
- SHA256 596eb1e4ef6fcdeb9a9bd00a8d01a18fc9cd4506c592701a7c272a2409f2deda
- MD5 9d4d9360a53a3a77b57459c5aa9e0883
- SHA1 7fb211528c3336330642783b2e86c03b37337c00
- SHA512 fc53106a2e8d54659f54c63b077a34857f4f9cafd0cf3698210ac31fae7eebf376318814a75f89b87b3b8a1746a3d1ea0efd3064740a3fd25847c09b5964066e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\d6889ce4-3ef7-481a-83b4-aca3ca2f34b4
- Size 671B
- SHA256 62c95365bcc9288e58f75d851bf0be57182fe491cf2fd1edb6837f38fcad83cb
- MD5 1e6ea59221393047dcae1501b61d4a68
- SHA1 8c223126058a736fe2e214744aabf946ea39ea25
- SHA512 7bae4d4c4286d8597992f36ec1c0fd6ce6b6d0b8ad6f94f2946039516b044ce434f6e9121a856018c8f96b38b79e6fcf91b3305fa3770dce2e74ed21aaf8383d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs-1.js
- Size 12KB
- SHA256 4e5df9b9b081ac729766260d78906606295a5c8e9a84c269d7c6ba735386a350
- MD5 10bc5c8380838712d4b80676edde5299
- SHA1 d39e9f3c81b127f570c9b7b7a2a129404053db34
- SHA512 c1350c65882da4f7aeca17dffbea57c03f58b7839afeb452ad36ef5ab9bbcc8c07da19ca672060c2022495d89564bbb182eabb7ef5ec65b07613fc6e706e8385
- SSDEEP 192:i5nZ1RZfBulaX1gIWE0lJEcd48HIW0Jy1Z/jZ0eaXI1TBw8HfL5:UbgFtBDHFsy1Z/jd1tw8F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs-1.js
- Size 15KB
- SHA256 8e62f70b2d4ade77b483e6bfa1c924b82bcdfe7908830eec312b16c9726e1d3f
- MD5 26e78e87e156fdb33c6565778e3f2a3b
- SHA1 356f00f71633cd75e1a966b73f7af30e7134d77a
- SHA512 0e89729757d538b8c56a16c646e2c674e3646566ff96df69ace30adff80b9784fd186f4177803d23e040f5ea33d0a1c30c435fb8b6820f544b52597ccd644830
- SSDEEP 192:iqnZ1RZfNulaX1gIWE0lJEcd48HIW0Jy1Z/jZ0eaXs+1ViBw8H9bnZmU:z3gFtBDHFsy1Z/ju1qwed
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 944KB
- SHA256 1e9c86fafd6d6e35a8562f7ba8f1a5abc42a4f6fea8275e4b753c54b51bbc0b6
- MD5 d3c46e2720b6a89b532fc119ddbe11cc
- SHA1 b7e05496837a1965bd10d5bc64be76d3a1ff0ee9
- SHA512 d3822b0885901d9df202749521d629b3ffdbb5ca322a324782af5c41f84b12621e716ed15d528287a1309322d56f96840d7954d1c9c2d38e213002e6832bf618
- SSDEEP 6144:rBgQh23C353MUB5iSrxDWUT9nU0479O6uaIkeH+cH26uaqYrvTMWJY45kw:UURNDTpURq40TJJY4
- MD5 SHA1 SHA512 SSDEEP