Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
14/07/2024, 19:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240714-xxmkfssfpj
- SHA256 2b24d73e8d0a64bf8197e25498d46c9f9e4f8f5b8d9da3828d27f99ea10091a9
- MD5 46a27ed6a9d428eda2848c9eafb78166
- SHA1 5d72d92c7996c2e79db05fefae20e34fbcd13405
- SHA512 c89f23c363edcd512ece945e5273b65fa5c4cbb0a18e62239f1e6f33721e76313d2c3c47ab2df6052d1a2afa4f4ac9136f5cd8163167523e16cc2cacd4f3ecc4
- SSDEEP 24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aLK2Sbly7TWEPje:LTvC/MTQYxsWR7aLK2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3892 firefox.exe Token: SeDebugPrivilege 3892 firefox.exe Token: SeDebugPrivilege 3892 firefox.exe Token: SeDebugPrivilege 3892 firefox.exe Token: SeDebugPrivilege 3892 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3892 firefox.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe 3656 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3892 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3656 wrote to memory of 3476 3656 file.exe 86 PID 3656 wrote to memory of 3476 3656 file.exe 86 PID 3476 wrote to memory of 3892 3476 firefox.exe 88 PID 3476 wrote to memory of 3892 3476 firefox.exe 88 PID 3476 wrote to memory of 3892 3476 firefox.exe 88 PID 3476 wrote to memory of 3892 3476 firefox.exe 88 PID 3476 wrote to memory of 3892 3476 firefox.exe 88 PID 3476 wrote to memory of 3892 3476 firefox.exe 88 PID 3476 wrote to memory of 3892 3476 firefox.exe 88 PID 3476 wrote to memory of 3892 3476 firefox.exe 88 PID 3476 wrote to memory of 3892 3476 firefox.exe 88 PID 3476 wrote to memory of 3892 3476 firefox.exe 88 PID 3476 wrote to memory of 3892 3476 firefox.exe 88 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 4864 3892 firefox.exe 89 PID 3892 wrote to memory of 3348 3892 firefox.exe 90 PID 3892 wrote to memory of 3348 3892 firefox.exe 90 PID 3892 wrote to memory of 3348 3892 firefox.exe 90 PID 3892 wrote to memory of 3348 3892 firefox.exe 90 PID 3892 wrote to memory of 3348 3892 firefox.exe 90 PID 3892 wrote to memory of 3348 3892 firefox.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f56fc11-0c7b-4590-aab7-1697b4269e87} 3892 "\\.\pipe\gecko-crash-server-pipe.3892" gpu4⤵PID:4864
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5204df39-0173-4533-a8a1-5e49fcbb2e03} 3892 "\\.\pipe\gecko-crash-server-pipe.3892" socket4⤵PID:3348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3224 -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 3292 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30aa90c3-78e3-4a36-a8cf-1c0bf826d9b3} 3892 "\\.\pipe\gecko-crash-server-pipe.3892" tab4⤵PID:556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3876 -childID 2 -isForBrowser -prefsHandle 3104 -prefMapHandle 3064 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bc6f822-b701-431d-878c-015558033507} 3892 "\\.\pipe\gecko-crash-server-pipe.3892" tab4⤵PID:4152
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4776 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4280 -prefMapHandle 2776 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d2c1b24-655c-4b1e-a767-6f42f2df7dbe} 3892 "\\.\pipe\gecko-crash-server-pipe.3892" utility4⤵
- Checks processor information in registry
PID:3124
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5584 -childID 3 -isForBrowser -prefsHandle 5592 -prefMapHandle 5596 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b31b0557-546f-4487-b81d-51bb2c9e3d6f} 3892 "\\.\pipe\gecko-crash-server-pipe.3892" tab4⤵PID:3192
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5536 -childID 4 -isForBrowser -prefsHandle 5740 -prefMapHandle 5748 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ef0f13a-3c60-4ca6-bbb8-950f441dc64f} 3892 "\\.\pipe\gecko-crash-server-pipe.3892" tab4⤵PID:4004
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 5 -isForBrowser -prefsHandle 5780 -prefMapHandle 5784 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dde9ab89-62aa-457f-ad5b-499962fbd165} 3892 "\\.\pipe\gecko-crash-server-pipe.3892" tab4⤵PID:3536
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\activity-stream.discovery_stream.json.tmp
- Size 24KB
- SHA256 09a02cd47a7477bb6d056bbe1947a567a6c5d4084644beb1278e7bd5d2564aef
- MD5 cf9a30603e0098342f0f4b53fca93132
- SHA1 191ea64b5d8179dbcb4165f618596c723d259c88
- SHA512 323ce13511e936997b1b1a31bbc70ecf14604489588ae1ec391d4597adff6960bed3837b1e0f78690a28d64a6f08b0aea0c17a53bf30159ce3aef0111590b381
- SSDEEP 384:plU3omecWHWIYi91ARlUzofiY/Kv12gb/5dZ672Gxayau1ZGzxDC+CxjCxzG:pV9HYq12qDv1X9Uxayd1Qh44ZG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 59a69cc2a63552fe3874589953fcebcaad7c147b9171aad04688bbba4ab809c9
- MD5 91cccf9bedb7a4eeca170542370a973c
- SHA1 076ae87fc638c8cfe41d50bdd478cb24cf448040
- SHA512 65dd8d0c9d985a2415456b52a10e85bf0ef6b86b9a6bf2238183acc215ff9c87df8afb7dbafeb4eb047af36b564ecb769ec5689f99e27417d616f137abc518cd
- SSDEEP 384:H485u9fiGLm4pU/ft2WlOX8lPLZZB7t0lpDIIPnvnA:nUBi8mCU/ft2WAX8tzB7eD8ovA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\AlternateServices.bin
- Size 12KB
- SHA256 c8b2400804fa9d3b142c47f41fd751109dc688f118f098eb5ecdfeaf5c7d17e7
- MD5 3b1fd13e23f32ccf89f9c2fc21689096
- SHA1 b849aba648963f1684a39889d697115c6b2059d3
- SHA512 6f9b6dd72a3aea174872eaa1d9d5fa8e48c5982c8b41a58b9bb645e8b9417952078886709d9c484f530a75a96ffaec2e0acee5a6e68fab4ef89bdb90d2a89317
- SSDEEP 96:w5onebOJSJbYpebvpf+SJbhbnJbAgbgz0JbLZbrJb:w59qu/znVd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 9934b71e7b4a1f57b8567079ab376459ffd98bc82eb9f123c8acc8e702617925
- MD5 ffd74b69edd0a3016b9e6c7076ae1503
- SHA1 b091938f03455e42c6128e901df068e64a852185
- SHA512 b55e5a67ac1a7217025ff138a4218351ec7c3e681a4dd77bf8602dd196647c4172dd8804be86477cc08a4edb1eeebc45e798a1bd9d7af2b9f64a9f6e25ddb0ec
- SSDEEP 96:mSMF9ZbkW6ShmCQPP/PrWZJNlQTems8Fl66JozGzgClKtmSSM:mrvZboShXWPCg/66JozGzgCl6mSSM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp
- Size 16KB
- SHA256 7f361105530208f55b6c121f2c1d63f12b46e3962aae759b97a8052e7f66edaa
- MD5 7d546050ed8c5084984ac3ebfcdae187
- SHA1 d790e91806a32fd097106ad728bd49470c254154
- SHA512 5a2404df4887f1f73f249004acf2812a128546121075b847d0c370514cfca05965b81b0ea785888b6e5214c29e9ead8c320e9a04f95bc44d0d44ff3e7599f275
- SSDEEP 384:H/66JozGzgC1b971Suh1DPHvMb0bu0bopvlPv:CEP1BHDPHvMb0bu8I3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\9abcaad1-b327-48d0-87dc-e56092d854ac
- Size 27KB
- SHA256 34d0d3e9d2e1d44e07bc5015eb3401be63b2e7987d5e702894fbcc8232cf5502
- MD5 553962f48b37999e98929b6d3c61dc20
- SHA1 18a140c79a770a3e183154230100c046b25cc77f
- SHA512 42cefdffe34f86f364e2a40cc7dfece6759b6578a51cf3fda71f671c738873aa0ae32784d41d0681b53eb6c6056ab74d4739fce642d0e65e8632675a2b9bed7d
- SSDEEP 192:7O7b6HT7abDAbffd8ROpUOZ1xJxXFj8Feqjml1LD79mTPrMKOkMeIznaY6WkJwmj:785K7BP3yp84PIJqrjMK6Xcyb3Di
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\9fcd64d8-1490-498f-8f8b-18597920ef1b
- Size 982B
- SHA256 296dc780e187e852ec6db0003394fd8f82fa6edc4ee5da0f9b1adff404ea6888
- MD5 21ae043d74d68a31fe94806cbcbcc7a6
- SHA1 90cd2b65749526fe682352d5997710ca992f94d8
- SHA512 3edb82248bea9c2edbb0b3ac77fbb6cd51a26f161242dbec34f86145359a88ef83e375d06a38a3eae41074b464924a23568d8089c1fbbd33a6a071a161cec633
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\af8c74a3-b612-48c9-8961-2596e97a87c5
- Size 671B
- SHA256 c9c21bad6575b9efac96145c03d39193e82e1a79ab7af39368a75ad72ebeb38e
- MD5 b3f2b374cfbea58ee3c3295d9ba86f5c
- SHA1 d5c73e68b2d1e3c417f052d34289ea810aa7907d
- SHA512 715da38a8fc61b0da2041fb0068ac57041d1f9f6ac0d00b03a0a32c3fd7cc660bcd1311ff8c197576f7026efcf8fdb8503d62a5a3958d57ff378236c144294f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs-1.js
- Size 13KB
- SHA256 cd9ebc2350090a987d62b8b55c32e16fbd2df7af68f8288c52c4b7f39c1171a3
- MD5 714793aba34d7e39dc936925c60aae1d
- SHA1 51577be0f92ad623f2133a09fb783e46968bb285
- SHA512 f74192d15b3bbb3d81b4581c0c54e3babf94215b9d066987da4ccfc58fb240245781b8ee22a89e578759a4ada36194b91128c0dace53435b5a46f66effd4dc28
- SSDEEP 192:i5nZ1RZfBsnTIYpIW1sDJdcdMIWj1QHr/605IKaXQ1WBw8H+:UKpF1/OFhQLSu1UwJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs-1.js
- Size 16KB
- SHA256 accc86d102b89c6285d90810e41935943ff3508b50e1d3b89ba18fb0270a86db
- MD5 60bb6e328b7bdc703cfd90852e5bcc65
- SHA1 4f11c35277d5f359ac37299e8001d35c6d6fdc83
- SHA512 e60bc9881caff8957bdabb1f5922d7cfe129b460c5645d1ffc2cfd0d43e2e60c6d25e9cce6dd8e041b152fe7a199d14b85cf0475d4cd2b89ee4689e63807caeb
- SSDEEP 192:iinZ1RZfTsnTIYpIW1sDJdcdMIWj1QHr/605IKaXU+1Rw7iBw8HVFBUnn:TIpF1/OFhQLSz1RwUwKy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs.js
- Size 8KB
- SHA256 3f6d0e88c0a481029dbb44401ca2248e76edc0db40859278127c608f44f8b006
- MD5 ea0bdefbdffbd65ee62dec07274aba46
- SHA1 80452142c7e6466b6e46f15c77b2c8e8ab1a0e93
- SHA512 14b407521d9058cc9066a462051eac2cc502a5f5e86dbc6be8d83aad5ec832238add0466286e2f53e361ad0d5f1a05273df6b147a0f9bed78fc7db030017d790
- SSDEEP 96:xHC5nUTUpmPqGqZfBo4p4fzSyDiN1cdgCgi4160SaXenTjefqH8QFNBw8Vnj:M5nZ1RZfBofDD4cd6l60SaXtM13Bw8Vj
- MD5 SHA1 SHA512 SSDEEP