Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
13/07/2024, 04:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240713-erc5qaxene
- SHA256 b08afba8093c51912e21ee6dc2eae69fc4088ccd76d1b28289f41211a0b67f61
- MD5 7d5ee23626197bbbe12391de38d6632a
- SHA1 5cbc52e7ac1add29a5d514e7648642a9045cf146
- SHA512 45153feae904d3e4d5bdb105f01e7bba3c0989bfc7e8aaf6a42342f6db49ed3d5563deaa2ae3f3d8789822e98d462020fb341e555e62b9b32ccb85d53862658d
- SSDEEP 24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8aLj2Sbly7TWEPje:UTvC/MTQYxsWR7aLj2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5016 firefox.exe Token: SeDebugPrivilege 5016 firefox.exe Token: SeDebugPrivilege 5016 firefox.exe Token: SeDebugPrivilege 5016 firefox.exe Token: SeDebugPrivilege 5016 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 860 file.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 860 file.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 5016 firefox.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe 860 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5016 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 860 wrote to memory of 1080 860 file.exe 86 PID 860 wrote to memory of 1080 860 file.exe 86 PID 1080 wrote to memory of 5016 1080 firefox.exe 88 PID 1080 wrote to memory of 5016 1080 firefox.exe 88 PID 1080 wrote to memory of 5016 1080 firefox.exe 88 PID 1080 wrote to memory of 5016 1080 firefox.exe 88 PID 1080 wrote to memory of 5016 1080 firefox.exe 88 PID 1080 wrote to memory of 5016 1080 firefox.exe 88 PID 1080 wrote to memory of 5016 1080 firefox.exe 88 PID 1080 wrote to memory of 5016 1080 firefox.exe 88 PID 1080 wrote to memory of 5016 1080 firefox.exe 88 PID 1080 wrote to memory of 5016 1080 firefox.exe 88 PID 1080 wrote to memory of 5016 1080 firefox.exe 88 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 3976 5016 firefox.exe 89 PID 5016 wrote to memory of 4952 5016 firefox.exe 90 PID 5016 wrote to memory of 4952 5016 firefox.exe 90 PID 5016 wrote to memory of 4952 5016 firefox.exe 90 PID 5016 wrote to memory of 4952 5016 firefox.exe 90 PID 5016 wrote to memory of 4952 5016 firefox.exe 90 PID 5016 wrote to memory of 4952 5016 firefox.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9996ba1-23fe-4fff-8863-99334cb67921} 5016 "\\.\pipe\gecko-crash-server-pipe.5016" gpu4⤵PID:3976
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2384 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e68dfd88-4cf0-4343-85f7-0a26a2b0eac0} 5016 "\\.\pipe\gecko-crash-server-pipe.5016" socket4⤵PID:4952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3084 -childID 1 -isForBrowser -prefsHandle 2868 -prefMapHandle 2952 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9d5f271-fcb2-4969-bc5e-3fc1db904c05} 5016 "\\.\pipe\gecko-crash-server-pipe.5016" tab4⤵PID:3924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3920 -childID 2 -isForBrowser -prefsHandle 3912 -prefMapHandle 3908 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2645a338-05e4-496a-9ce5-b1c086e3a1c6} 5016 "\\.\pipe\gecko-crash-server-pipe.5016" tab4⤵PID:4436
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4740 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4688 -prefMapHandle 4680 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e05052c5-cbab-4445-982a-aec2e92f1e05} 5016 "\\.\pipe\gecko-crash-server-pipe.5016" utility4⤵
- Checks processor information in registry
PID:5024
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 3 -isForBrowser -prefsHandle 5332 -prefMapHandle 5176 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3aa22cf-5b33-42e1-9f7b-7b5123ec40df} 5016 "\\.\pipe\gecko-crash-server-pipe.5016" tab4⤵PID:4364
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 4 -isForBrowser -prefsHandle 5552 -prefMapHandle 5556 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {530f5899-e721-4f11-81ef-0d60e28aee4f} 5016 "\\.\pipe\gecko-crash-server-pipe.5016" tab4⤵PID:4408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5728 -childID 5 -isForBrowser -prefsHandle 5808 -prefMapHandle 5804 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {128c413e-1cab-479a-9787-f1b4263b08e6} 5016 "\\.\pipe\gecko-crash-server-pipe.5016" tab4⤵PID:4992
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1l89xtkq.default-release\activity-stream.discovery_stream.json.tmp
- Size 18KB
- SHA256 98224a71cdc98dd4572d51f039e34bb35f84f3e90a2fd2bdf5b8817ed1183a1c
- MD5 b41d4eedb32e1326e1e262c560f2a3ee
- SHA1 06deb38df5d8e51690c8a91ae8faed7492ab428c
- SHA512 e47bbf57d628726dde23af8e5c414cc190021cc6227b5432d0a14ae0337ce4a6a4216ab4358cff607a2962e076d7cf56c4255f998470c437ecb18514ccbc926e
- SSDEEP 384:oMmecSagIFWIu/lXVtif1dzofip12I5Nb5WtZ6G143NLya3:oiuHu701mqp1BWw3xyE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1l89xtkq.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
- Size 13KB
- SHA256 a80f896347d1bd5704a90129facf66e7ba2d9ca2a34f93b562e8489368d4976e
- MD5 ff590cc7cc4fc728ed865372fda5ebbd
- SHA1 e31e1e40f5e7e6de39396ad44912ef2772a85de3
- SHA512 6b94d398d90f60f54bf20b2f171f7b6c6b2642507a47d6af7ecdfb8d817d3e89b0e17fbb64d2ce61c0b17bd5af7efb06428931d5f1590409d15f1a01cee5bdad
- SSDEEP 384:HunTu9fiGLm4pUSft2WlOX8lPLZZB7t0lpDIIraw:dBi8mCUSft2WAX8tzB7eD8w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1l89xtkq.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 ef5c36371b45bea4496b2a8d8ab90412d3ab5b454af01e4e6a3e3fb06022b3e8
- MD5 ebc7244dd650516bc658913c9a30b4b0
- SHA1 1a309dece7efd08e0a822cbec4e18298736ebe05
- SHA512 923acce2946ded62c7f0c53f21010627e7c6ee9cd9c5fa8be210ba77a0bc373b0e38c979b0061cd48825d108de7707b3a7c938947546155007649a5100efb509
- SSDEEP 384:H485u9fiGLm4pUYft2WlOX8lPLZZB7t0lpDIISTt:nUBi8mCUYft2WAX8tzB7eD8x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\AlternateServices.bin
- Size 17KB
- SHA256 84abe108aed789e6bb8897b470e124e8e7857168928ad027f17685aa40080906
- MD5 fe055291275a6e0dbab07e1eed9a4ca0
- SHA1 e237efa69c569d09141a139b63963121625f6792
- SHA512 60c0adb7b9084bdd2f2b744e64bcdf0399cf04acd3a6f90aa1791c3982d234153910bf44b2b4ebf0ff1d3dcb74a699be07bca938baf969dcae3399b787f4d21c
- SSDEEP 96:gC5oOebOJYbRpebvpf+V5bDbXbBgbgzbb3brbPbjbeHVvbOb:95Uu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\AlternateServices.bin
- Size 8KB
- SHA256 f2ce9e61d8be52a9f205de2fcdc44fd89cd943d9e5b099ea9ac54d65364d9ae5
- MD5 0649380fee50c79bb3ea46db2f0998c6
- SHA1 049a11e895c8c9682c7df6d75d8d0b6b2aeb04cc
- SHA512 3beccea40735e13f5e951446d8a9c3003827d19698a1cf077fc02c95a99af90375571fddb84c21b4a88346c54082ec9558c4db060fa030b513089d58803708c5
- SSDEEP 24:YuB1oWgu1xgRbepR5cOzMuhMZK3Fsh2F3LFxFsJbF0JSJbfWKsJblxWKf+PJb:R5o69cOHebOJSJbfpebvpf+PJb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\AlternateServices.bin
- Size 11KB
- SHA256 98137e220632ab116a004b010a43b84252479ad25d069f60b2d06b6cf672ae52
- MD5 782f9bde49d15622313765b44bdeb81b
- SHA1 1493183c28d2f58211de09064416f1d4a243e533
- SHA512 e7fe36cebe08f53973061329e73c62a1c450dbd00d38b6b04d898c9b8890a421bc7d665641ab23d4c781671a4056182e05f962757fa618562277a8e876d265e7
- SSDEEP 48:R5o69cOjebOJSJbfpebvpf+PJbEbaJbBgbgz9Jb:R5oOebOJYbfpebvpf+BbEbQbBgbgzbb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 d03e714e16049a4297cddc124f492f7b60a3c631791e17e48b0839d86e16cc83
- MD5 63c03060ec0f4f4456f4b147d16930d6
- SHA1 c3f009272f5b86a2c2307bae8fc04f3f53c76d58
- SHA512 33010a9755d35bf5f65ab07a56c5b7924197e3aa0d214db9091e5b211012682de4d7ada7e92cfa8bbbae03045569801de905716c6f522c925e8f915add857093
- SSDEEP 96:geQl0hhFl66JozGzgClKtmSSz1BPSMF9ZbkW6rBBwhm1KPP/P6xkWv:gQ/66JozGzgCl6mSSrrvZboPwhAcPUfv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 cb26d1810d169444b604d31a8b225e2409f9248ba5b9bbec506c674fb511285a
- MD5 22b243996cf53340284a42f1226cd2d0
- SHA1 5f8d8a1c8ddd210f10c03ad007c27ffd5e75a3a2
- SHA512 37aeba9bcc99897d21656c721f86297ed6cb1f6dd223efa82b9f58435fe2044a95975296d3b9cf61e13ce7d1c3b4aeac67713fe7ebc63e21cff057891e59d9b3
- SSDEEP 96:geQl0hhFl66JozGzgClKtmSSeSMF9ZbkW6Shm1KPP/PrWI:gQ/66JozGzgCl6mSServZboShAcPCI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\datareporting\glean\db\data.safe.tmp
- Size 16KB
- SHA256 e67e756d81a5d1f396d733a731e35c0cca517aa826ceacb21d0a9df765e9dc13
- MD5 b3842a8edf5e098ca726579319212841
- SHA1 2f0f39d2bc156a0817d7b36791eaaae62081dbd6
- SHA512 5a2f21b226d65f7e57ea655dd8d2e03161d65ae0e738401290c9a1a545e24e397ead1a3a80502870ae70b58115b3f2ca977bdc87017d409fb1c10ffa56c9b83b
- SSDEEP 384:PB7VVUrxvQhD4MWRbpbIwboYsrPp/66JozGzgC1bM:p7V+xYhD4MWRbpbI4AkEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\datareporting\glean\pending_pings\174dcfa5-df69-4cd3-80b0-6a087f800d9f
- Size 25KB
- SHA256 9546792a2fdb3fbc77267455929a207aa215b19113ac00c06e56cf294cec76c7
- MD5 fe793aaedd38b899d94a84d1605c7019
- SHA1 2ae4842112b8d5d7a20b51ae82a8d8dda958f506
- SHA512 1bc80756e1fc207227c472ad81933551626638027f8cf58f641adb2ea4a7359b96166feb12fce7ff0cc1b1502151d9eb15c83e67cfec002b68cb9b51bf59074a
- SSDEEP 192:VE9Bcf4pDJfb5x2veJIpTHXxXSW+zwMpo94Kl9XmYAG4lMfA/Xepi2nYUF3umJuH:VEQp3S2kU7libbXl/5RczbhMfMdZSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\datareporting\glean\pending_pings\79e06852-7899-406c-a1f9-516c90311220
- Size 671B
- SHA256 f4a0583ae2c7315e33096adf6b38d781edc50e0d4a5e8e18938eead3354a4ec6
- MD5 34645a2ea05e3cfa6985af817eacb6f5
- SHA1 7646395b51d9b1881f17f4d7e6a58ecd96a070e3
- SHA512 8d9a095c0e986a59f768919b276d6f9ac7e21fa21cb3e739a6758a0ab77825e1c0373b0546ffcb6b921ef90e757341ec000e72bacaef93622dbc2c666c189d0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\datareporting\glean\pending_pings\8688111e-3ae5-4ab3-9fe0-29df94712a61
- Size 982B
- SHA256 fc98c3bd5f2c7b89d5caaa5dc18da951491adb9800e93252fc944a98d81f3fdf
- MD5 273a3c2d224d30e257bb101a2364f402
- SHA1 77f20b1f693154a61593780e20e034316a0e0ba4
- SHA512 47804d62dd8fbb1c4ac293e0401fd47d28960aaf6016f60194b7e8c08ed244023550ef2f5b66c3e208e658cfe0b946551b9c080ae2f556caddc28e56836ad3c1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\prefs-1.js
- Size 15KB
- SHA256 041e111594d70087d59886e5f6051a28a0224b7a51725649d48bf9692bad3e4d
- MD5 9c807da1bf0543edcd37e340f6ad84f9
- SHA1 3fbc8c7138e3159d036d2b15123fadf737841fd3
- SHA512 80f44758350961aaa548c9716c983fffdac19a2895505922c676e53fb729e70553077a009ef1ff6a2cc3c9a48af1af894ec4c2e0413a203224a2bc7e43c1532e
- SSDEEP 192:VKn6RXffXqLgIWE0lJEcd48HIW0Jy1Z/jZ0BaXfn+1mYvJ3BFiBw8H8QZrOVg:/igFtBDHFsy1Z/jh+1mY3awAX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\prefs-1.js
- Size 10KB
- SHA256 8b0d2f1114d3611d9f5446a04f366ccfdd3cc5c21bed48d52f5c7ddd4442a7f0
- MD5 9e53ae4e0c0360dfd53f40a77092f820
- SHA1 e35fc653791a5228d1d526cd9bdd308a87cd8b01
- SHA512 a8eb2e0bd78b57eadf766cafcbebfe78c42a74ced291e90475f3039288e48bc9c8f4aed3f217f449fc2fdcf83ec4fbebc25bb15d02986e82fcf8aee6135bf0d4
- SSDEEP 192:r5n6RXf3XqLgIWE0lJEcd48HIW0Jy1Z/jZ0BaXfN1mYvJ3BDBw8HS:EqgFtBDHFsy1Z/jhN1mY3dw/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\prefs.js
- Size 11KB
- SHA256 fb0f93b113d2bd3940b02a507fadc66359b4dd041be0589bc019f62cb3640f54
- MD5 0c8359d6e623b54c57e5060309ac208d
- SHA1 a245c7d85d02bfd090e43bb66d260944bcb74e31
- SHA512 c3b87619c0a2dc8b7757b5784941bc3c7bd03970c2131e6a4eb97d65ce5a8a5b5fe8f5ef3afb3fea4a711277d579e7b1bbd3c3f71c1cb09890be55b7537c84cc
- SSDEEP 192:V5n6RXf3XqLgIWE0lJEcd48HIW0Jy1Z/jZ0BaXfN1mYvJ3BLBw8H8Mz:SqgFtBDHFsy1Z/jhN1mY3lwS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\prefs.js
- Size 8KB
- SHA256 e93bde945af32034bdff4ad2d278f75bc6113f7c63d42603b863280f8b81a560
- MD5 2027de44a735ac772ad9dde4a0499559
- SHA1 4d1bfea5b65cc7147c5542ab8d35352b7f9b8d7a
- SHA512 1599b2a39ec70a5708781a13e8c374a591a27e8a5e883273908fd93908aba6d0778b4b7ee1ae6af202f8fe055373387b86bcfc8155f9a63629e0067f6c713120
- SSDEEP 192:r5n6RXf3LBKgtJuncde060GaXN1mYvJ3BDBw8VS:EtucEvO1mY3dwl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 2.8MB
- SHA256 ac6cc5c77019a685b1a0a5db7da16176de2ac7408e9a1bddf8e39b79e8684588
- MD5 a277b20b5b9ff9b0a139f8d4bbb47a60
- SHA1 a3e21cfa8a5871f6356471d3b2861dd24c8b3534
- SHA512 066320dd98ed35a27bac10e33eb2d0a39f458d8b86a793e2a0e53819ce2a1827177d31c12b7f80d024b8f786073045486bee1f4bbfa478998e6a4d11e67f1c08
- SSDEEP 49152:T+GfFMpOj+j/FXrBKMBOj++MUDFod8ivoKVJ4djiMX1Xddofc8Xn2cmil4EuUZAf:T7b
- MD5 SHA1 SHA512 SSDEEP