Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
13/07/2024, 13:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240713-qnc64avbmb
- SHA256 76ce95326fa876b975b3ba93ca14941baf1d637ba755f6a1a92969f56fae92fb
- MD5 5f0ee4b8dbe1df9542180afb4aec8945
- SHA1 9d0e623735191280355c6693b22319c29c7fb770
- SHA512 363206273bbce1ad9b549b59674ca65770517460ce9b7f910f1ed4df3048fe6645d614e2a640da34d600d285e9fe758a6288602d8d75bfe33d13db730c5acb64
- SSDEEP 24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8aLP2Sbly7TWEPje:WTvC/MTQYxsWR7aLP2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3612 firefox.exe Token: SeDebugPrivilege 3612 firefox.exe Token: SeDebugPrivilege 3612 firefox.exe Token: SeDebugPrivilege 3612 firefox.exe Token: SeDebugPrivilege 3612 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 3612 firefox.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe 512 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3612 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 512 wrote to memory of 4676 512 file.exe 85 PID 512 wrote to memory of 4676 512 file.exe 85 PID 4676 wrote to memory of 3612 4676 firefox.exe 87 PID 4676 wrote to memory of 3612 4676 firefox.exe 87 PID 4676 wrote to memory of 3612 4676 firefox.exe 87 PID 4676 wrote to memory of 3612 4676 firefox.exe 87 PID 4676 wrote to memory of 3612 4676 firefox.exe 87 PID 4676 wrote to memory of 3612 4676 firefox.exe 87 PID 4676 wrote to memory of 3612 4676 firefox.exe 87 PID 4676 wrote to memory of 3612 4676 firefox.exe 87 PID 4676 wrote to memory of 3612 4676 firefox.exe 87 PID 4676 wrote to memory of 3612 4676 firefox.exe 87 PID 4676 wrote to memory of 3612 4676 firefox.exe 87 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 2360 3612 firefox.exe 88 PID 3612 wrote to memory of 3028 3612 firefox.exe 89 PID 3612 wrote to memory of 3028 3612 firefox.exe 89 PID 3612 wrote to memory of 3028 3612 firefox.exe 89 PID 3612 wrote to memory of 3028 3612 firefox.exe 89 PID 3612 wrote to memory of 3028 3612 firefox.exe 89 PID 3612 wrote to memory of 3028 3612 firefox.exe 89 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {38e31cdc-4802-4c9f-a801-4c58a68687de} 3612 "\\.\pipe\gecko-crash-server-pipe.3612" gpu4⤵PID:2360
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b194ca0-a67a-4247-b310-b92de5f4cd56} 3612 "\\.\pipe\gecko-crash-server-pipe.3612" socket4⤵PID:3028
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3448 -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 3488 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d50901d-dbf7-469e-9941-2f8c52ea4245} 3612 "\\.\pipe\gecko-crash-server-pipe.3612" tab4⤵PID:1588
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3924 -childID 2 -isForBrowser -prefsHandle 3496 -prefMapHandle 2948 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac72c875-9652-44ac-8f94-f3d00ce70a59} 3612 "\\.\pipe\gecko-crash-server-pipe.3612" tab4⤵PID:2704
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4216 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4208 -prefMapHandle 4200 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd696b87-a856-45e0-ba1d-275b0dd98f09} 3612 "\\.\pipe\gecko-crash-server-pipe.3612" utility4⤵
- Checks processor information in registry
PID:5044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5472 -childID 3 -isForBrowser -prefsHandle 5464 -prefMapHandle 5460 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc6500b2-ae73-478b-b11c-3a1bbc1dfc81} 3612 "\\.\pipe\gecko-crash-server-pipe.3612" tab4⤵PID:4068
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 4 -isForBrowser -prefsHandle 5628 -prefMapHandle 5636 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60af103f-8605-412e-be59-e8d55437c99a} 3612 "\\.\pipe\gecko-crash-server-pipe.3612" tab4⤵PID:1520
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5260 -childID 5 -isForBrowser -prefsHandle 5800 -prefMapHandle 5808 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecc310be-565e-4470-bfdd-e85350281813} 3612 "\\.\pipe\gecko-crash-server-pipe.3612" tab4⤵PID:3076
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ehv06adt.default-release\activity-stream.discovery_stream.json.tmp
- Size 29KB
- SHA256 aa1a5719a4d91579ea1ca45b7d156056f7692533add2267bc5d2cd3ca05af502
- MD5 ac56644bf917d5e9c4669ffc25fb5fa4
- SHA1 fc92e5b9af1e8cb63acb9c393180491e8de636bf
- SHA512 5ad30ad6cf6a642b2eff36c52c12142fed72abdc006776a75a092a910fd385ace46028f3650b6793f04ffbe4b1525f394f1500917e499d862a51082ff1581a12
- SSDEEP 768:uCgHprk1BF1nq9DWdUydksJ5VqJFR51tCtG:uaF1yWN6OG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ehv06adt.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
- Size 13KB
- SHA256 4f80d3aedc4b902f0fba43e3d9c11f62072b10dd8bb47fe6cdc238248f4c42dd
- MD5 46052cca72060dd8da0b4c6b6e4e6d78
- SHA1 f3ae74d0c2692817db1d5d22372c5fe5be6f2e92
- SHA512 57f777ea85ea9b27dc6e27fe68add82ae4e0c67a38c2851bcbe9cb6d00f67000789d24b8f0ec3f2d231accbafc23e147a6d0ff8fb7c8c7461c1f29ab523ac44e
- SSDEEP 384:HunTu9fiGLm4pUWKft2WlOX8lPLZZB7t0lpDIIrqh:dBi8mCUWKft2WAX8tzB7eD8V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ehv06adt.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 c9592426e95778c83d0aa88f6a82b8d60702d90072928a5e5457e4981292c3c2
- MD5 fe2ba2af5ad307e80bb521a5bfdf0a32
- SHA1 c76e7c0d90a71cba4b567769c897b14ca5ac8c8b
- SHA512 ec31d810cacf50e4037959ae4a556f66e3bc409305eccf64e6e84735811cb2d3e165acd57e47078210f1476a29d0891c8b6224f8b81105f4626ecc6db47e8133
- SSDEEP 384:H485u9fiGLm4pUCft2WlOX8lPLZZB7t0lpDIIjel:nUBi8mCUCft2WAX8tzB7eD8z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\AlternateServices.bin
- Size 17KB
- SHA256 6711fc57eda7dce33e24e37874822529898b0fc58bcb5ad346a169a8804a1f50
- MD5 a8a1737c5ddd3790c004e191914b3580
- SHA1 6d55c259efe553a32ba660f68ca56f6b276f0594
- SHA512 dfff04599011cdfbcb847a030276b655fb86233e6a58a27d100bf58ffd6a315eaba87c2e10c2704bd3b8b38903bb6aad29d9bc6b7f01db47a0cdaf6dc74b2a32
- SSDEEP 96:85oaebOJ/bhypebvpf+8b5bBbVtgbgzdb1bdbhbFbcHVrbgZb:851yuv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\AlternateServices.bin
- Size 8KB
- SHA256 d65d4e9f86d05a2c74d8871b83df987294698964188b57d556b722dd200d6118
- MD5 faf56ae2e32314e5ed59f701419008ef
- SHA1 b8fe8afa75b409ff86ae7bb6d5ae95b354840b8b
- SHA512 6d4cf0e53324f615e2aca3ff6f4879afcde8a5eb6f06aaa6aa3f81624fc2ff06d7185600530e733d4b4a5f79e1530701ef2b2219a5cceff22ea843182f6a318b
- SSDEEP 48:4tx5o0x9cOjoMftEapebOJ5Jbxpebvpf+5Jb:4v5o09ebOJ/bxpebvpf+/b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\AlternateServices.bin
- Size 12KB
- SHA256 8112dedd14ac262d6d04d14fcc0fdae92b7fd1e514875d687d73b7707a878294
- MD5 441823a9db3487156bd0fbec60ce8f15
- SHA1 19b769526984dda66fc04c87fd868f61c7f93af7
- SHA512 5a2bc1c14b446b1cd78938bbf6ba16c9453b4fc97614394a37eacc0d890e8e2a0f7417d85e4349ff80a1d3b99ddd92e8d486296e6bf696d990cc1cf1dea80cdf
- SSDEEP 96:4v5oaebOJ/bxpebvpf+/bqbqbVtgbgzdbhbtb:4v51ug
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\db\data.safe.tmp
- Size 16KB
- SHA256 6bacc9fb14a042ecb0dcf43f116d801ea4f505ff45553c209ae02376afaa784b
- MD5 9d752118d30a51762af0f51f0b29f0e1
- SHA1 49a934d97d4ba49d2c93e5aa4a192bb57fb9bb3f
- SHA512 0f6e05158903e9665a742ba5f35b50d7b0493228dcf1b31111f6f5da2742ca776086ea6a2c8ef87fdbb32750a8d5b70194536aeca63317b2a9288a9be67ea570
- SSDEEP 384:F1tdcvAtKD9LvnbJbQnbotvP4/66JozGzgC1bM:/td+AwD9LvnbJbQby9Em
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 2910f0b1c420d7a5930d8f092ccaec7cdf483f82859b81c889c5b5e32a2d7962
- MD5 eacbefe186e39832d9eb5b0f1c6d60d3
- SHA1 ec1e966e7487bb5914aa11746653e891b3042c08
- SHA512 24546254775dadafb5e35a98aa38b1ca84f1af908b256b10e2ef846f2f5f562e1a3694b40de6af10a56d151ab969cb2f0d339f11dd8c5d479c3bc3a16a23e55f
- SSDEEP 96:2dUQ3R4NAFl66JozGzgClKtmSS7SMF9ZbkW6ShmxoPP/PrWI:W3/66JozGzgCl6mSS7rvZboShMePCI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\pending_pings\03b84e1d-7bfc-4f1d-8bf6-b113c1db4665
- Size 982B
- SHA256 934a71c1e411172cc759d07d39bfe10337016c9a9e2c458e9e2bc6407f2f4a6a
- MD5 fb50f0490a6fe83e9f32a6e6796a27ec
- SHA1 a516114267f134882370de3e46d0b79bff963c41
- SHA512 41349d1ad5348946f88d523feee7cd2b91a5c5319f0220cf8ef4d1175bb6b766d5f8eddafeffb2790fb9b974b26e9458a076279993dba7cf348ea0dc4d69c240
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\pending_pings\33f84378-ff48-4271-9df8-ef0e14fd1bc9
- Size 671B
- SHA256 d9cbc4e1ca949fa87a4f9a9f84cffbfbf3a98bb855b02d30b70ddcdc373706b1
- MD5 12914feb2225228ffedc86be6d40a8e7
- SHA1 69639b32cc4b1af2bb017ea0ef0b949d15b9b654
- SHA512 12feac4687d07ba6e35500b5c31633dffdf960a9f33396961d6568adb2c18a86856406d3abc84847e5bbd2128349c1d57898ec82aa9172eb5a6bf53a3ca13ddf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\pending_pings\b1f7606e-7568-4b4c-94ef-d273ae6d57ae
- Size 26KB
- SHA256 b475eea6ec4a83d805aedb7e63a0e447a7e65de7c6f7893e6f068bd0fc7cd4af
- MD5 805e37de6e2f4867a651d5d87baf59d2
- SHA1 dbfc44b1eafd370e6a41e38aa44bd1e684e94a45
- SHA512 c887b9e8ccdcd6a8a1c51c75137350add0d07fe28f0b4e605b86fad2b03e99651258d3a5b96a4f7bdee99b6c726c5295ce45750996709d3b8b190a907db7eedd
- SSDEEP 192:hRzr8TkQ2y6kBhlDGYu8jVCJUCVMVj5d6UddAtnXXxTO9jRpCyzx9YzmEUSPAyVs:bX891jS+QURd0tbRiSJbOtaiOprc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\prefs.js
- Size 8KB
- SHA256 a56125f4e12640c40fa7119bd9073e93913e3a09ba87bae57a76ba9fddd28738
- MD5 5254d4fe70ce98303ffbdd685c75f658
- SHA1 f939a207d353c2f9b7f25eee0eeb99a61677563e
- SHA512 27014465016160664d0cd0eeea51954aa143c66a735a65294cc5f8c6e1feabc34248360839bfb0c17bb1b3bfd931623889f58ca888a8922d1044fd18e39ec0af
- SSDEEP 192:dd5nfRyfYf5+FyD4cd6l60ZaXOAFZuBw8VH:dcYPD9AMeA0wk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\prefs.js
- Size 11KB
- SHA256 78f51847e90b1c02062b33f660c93dd0208a829222c08ac62b5dd07813da3a97
- MD5 f31248cb37e87d91aacab2d18c7464d0
- SHA1 65f423638f6e951567eae1fd6362504ead3dd1bd
- SHA512 85a8679cc3e698e9c158234385b493f8ca4394fa2bbefbec2cd47737e24846d3da053cde461c8fca55b3ca784f69b3395742dc1eee8cd31b52579bd76e354843
- SSDEEP 192:dd5nfRyfYf5Ga9/2Yqd3sSJccdFYQdre1I0p60kaXLAFZuBw8HH:dcYnOJsWvz7yA0wq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\prefs.js
- Size 12KB
- SHA256 a871e345f3f2f14f2501c6437d5c28fda60591ea145b712ee7915a3622acd0f6
- MD5 443f47e294c92b601f1d276117965a86
- SHA1 e22438e37e43b6815a5191913462e804576f984e
- SHA512 a6282abf72d9c85803c9a84b283ee2fb29a76a736ba3a9d8d94e3df90be8ebcc9e3d64356f07ae991afc491e326bc4160b24fb35c860e1d47ff439c65dfab3ed
- SSDEEP 192:td5nfRyfYf5Ga9/2Yqd3sSJccdFYQdre1I0p60kaXLAFZfBw8Hks:tcYnOJsWvz7yAhwY
- MD5 SHA1 SHA512 SSDEEP