Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
15/07/2024, 19:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240715-xprt7sxdpg
- SHA256 821c324879f4dfb22bcb915d233226fb7c9b5cd59b7f30ea55aefa64284332ed
- MD5 d645e90fed49da05e4b20d2c6cec379c
- SHA1 2cde523e41199e4b1803148b042d01bebb32c9f5
- SHA512 53d823da8e91844788d330987831d4d4c702f84c78fe7394d380bd006bc309fcb6a0ebe4d9a9fbe1ad2d7361ecd0ef065c0ca6359576ed6bd81baa1b1088ba77
- SSDEEP 24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8aLV2Sbly7TWEPje:9TvC/MTQYxsWR7aLV2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4780 firefox.exe Token: SeDebugPrivilege 4780 firefox.exe Token: SeDebugPrivilege 4780 firefox.exe Token: SeDebugPrivilege 4780 firefox.exe Token: SeDebugPrivilege 4780 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4780 firefox.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4780 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4640 wrote to memory of 1476 4640 file.exe 86 PID 4640 wrote to memory of 1476 4640 file.exe 86 PID 1476 wrote to memory of 4780 1476 firefox.exe 88 PID 1476 wrote to memory of 4780 1476 firefox.exe 88 PID 1476 wrote to memory of 4780 1476 firefox.exe 88 PID 1476 wrote to memory of 4780 1476 firefox.exe 88 PID 1476 wrote to memory of 4780 1476 firefox.exe 88 PID 1476 wrote to memory of 4780 1476 firefox.exe 88 PID 1476 wrote to memory of 4780 1476 firefox.exe 88 PID 1476 wrote to memory of 4780 1476 firefox.exe 88 PID 1476 wrote to memory of 4780 1476 firefox.exe 88 PID 1476 wrote to memory of 4780 1476 firefox.exe 88 PID 1476 wrote to memory of 4780 1476 firefox.exe 88 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 468 4780 firefox.exe 89 PID 4780 wrote to memory of 3020 4780 firefox.exe 90 PID 4780 wrote to memory of 3020 4780 firefox.exe 90 PID 4780 wrote to memory of 3020 4780 firefox.exe 90 PID 4780 wrote to memory of 3020 4780 firefox.exe 90 PID 4780 wrote to memory of 3020 4780 firefox.exe 90 PID 4780 wrote to memory of 3020 4780 firefox.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {54861d11-a683-4bea-b6ea-ace2fc29554e} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" gpu4⤵PID:468
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96acfe6f-39f7-4dba-b7b5-a87ccf29e7a0} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" socket4⤵PID:3020
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3260 -childID 1 -isForBrowser -prefsHandle 2708 -prefMapHandle 2704 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f5a5066-4d9d-426e-9c52-5923f9d42b94} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" tab4⤵PID:4484
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3108 -childID 2 -isForBrowser -prefsHandle 3696 -prefMapHandle 3692 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba4fbe69-5d73-49a6-8ba0-9fe9f38d0b54} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" tab4⤵PID:4428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4664 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4648 -prefMapHandle 4620 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79ec3323-33cb-40c0-b72b-889b47786fcb} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" utility4⤵
- Checks processor information in registry
PID:4892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5316 -childID 3 -isForBrowser -prefsHandle 5308 -prefMapHandle 5304 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc2123ae-40f8-4ee3-b818-bb43a5a1e900} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" tab4⤵PID:1276
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5456 -childID 4 -isForBrowser -prefsHandle 5536 -prefMapHandle 5532 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba0b0a8d-5bc1-4c81-a35d-a0e458efd40a} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" tab4⤵PID:820
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5648 -childID 5 -isForBrowser -prefsHandle 5692 -prefMapHandle 5700 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01dea921-a845-49d8-8b9a-c6f10809800b} 4780 "\\.\pipe\gecko-crash-server-pipe.4780" tab4⤵PID:628
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vvc8bff9.default-release\activity-stream.discovery_stream.json.tmp
- Size 21KB
- SHA256 9f48bf0ee650a3cfcb3c116784959372c0a51bd3bb36bb0f75da87f0c8c6cd30
- MD5 5ef2eb045203a86aa49020ca0bcddb19
- SHA1 482ee47d0ec51502d41286c32be1fa6b6c476bf1
- SHA512 d523a11808b2d7bae96172b8ba6318f31f89409b4f87dbf03312265800c3f81d5dac6df7f12b27960f68d53d807325e4ff6f60bd71b6807976179bf51478da8f
- SSDEEP 384:Xp5asmecLjzWIwif8zP1Kgzofiuz12cl4qxZ6IbxWSX8yaut9u9c5:XX0HwdP12qS15pgA8ydt9u9c5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vvc8bff9.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 a7716388fabda19a4770d624f5901734ef7eebcdc4b97dba446eeb46cad02209
- MD5 dfeee39b7e4645716e8229b01f253310
- SHA1 c8c2221043bedef1326d50db8ec558cb9255f96a
- SHA512 feeabab8fda6f3b071300d71266fd0c31a2211b77119930882f3b58816dfe799e8c4f9e9860aee2b3d20016ed713a06e6e9590b1d12f7beed8f47c2ebe34bb5e
- SSDEEP 384:H485u9fiGLm4pUGft2WlOX8lPLZZB7t0lpDIIF+v:nUBi8mCUGft2WAX8tzB7eD8R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\AlternateServices.bin
- Size 12KB
- SHA256 f3e6f534dac701a3eaa97203cbfe0a6f0bae95305569d571f6c7e5c5d7ba5665
- MD5 1f8ef727347bba3ec151aa2c50c1a472
- SHA1 83e0d8cb0fe22756bbe8032405d056d7f698dea6
- SHA512 ee6451f6ac55a3cbfa8495056b6fb74a980e9a87075cae606f61d937df66fc4fc398e0f78e676b2e2b1664a9e9dca2d69a5fa46dd73b867b9a6b6d2302e9e651
- SSDEEP 96:N5oWebOJwbQpebvpf+wbwgbgz2bJblbLb7b:N5Ru
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 524b8b031b7eecc5aad20c582c5464ffa5d43e29bfd1539a7728276c287676b2
- MD5 6199bdd68f00800539cfe0cbdaa968ce
- SHA1 0304e5e19149a92f44a4051e1b01baae8261dfd2
- SHA512 aa80c49c38957b6f4e187e28d18f16c4b747211c010c091678b0d363f6f88b62f82e5a2321c041e7e9b3d8f8aecf13db302353998e565e5932651116e8341da2
- SSDEEP 96:gvSRd5Fl66JozGzgClKtmSSS1BRSMF9ZbkW6rBByhm2NPP/PhxkW3:p/66JozGzgCl6mSSQrvZboPyhHRPDf3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 0c1c84aecbac0bb2f03e0ec7a03c4c2587189f3e92361529e96e37531d87ca06
- MD5 6b7f37b0c5c2794ebfdbf53fd2f9726f
- SHA1 c3cac114f88c724c16d6a2dd7265165b66e5db6d
- SHA512 e373dadbb454f58e27ec5337877d5b91c1542c6465e1fd656bcddd62f7ad3d2f08ad7cefd39d575c53d7cc075b2b5f4ac54d4d72f17420072d2eaf5a0e0593cd
- SSDEEP 96:/vSRd5Fl66JozGzgClKtmSSNSMF9ZbkW6Shm2NPP/PrWZ:G/66JozGzgCl6mSSNrvZboShHRPC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp
- Size 16KB
- SHA256 04873e44775081d219791ade2959d76c4aa43d17863b652c308a756826d33641
- MD5 aaa1334aec9c60b0a2658409bdeafcb2
- SHA1 c5928d1c3f1009f11d0174bb491f53ac899267fc
- SHA512 041e98dbb69057d7fd6b52d570e408f001ef3a34c0a5c58e6e389491aab41b4908dd8680caa860f7409fb40593275f6a73bbbf4821db2610ccf4328f6888e30e
- SSDEEP 384:G/66JozGzgC1bkYxcfKihDZl1wbNbwRRWboqC1yOPTd:jELafLhDZl1wbNbwGuZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\pending_pings\9935d2bf-73f1-445d-b084-9de54cc29d35
- Size 982B
- SHA256 e83ddeb10867902adfbc32bb734fe2871b36a3e97d6a1855aa1552885077ab45
- MD5 8ace0373797478c54e8b187fa80242e0
- SHA1 e7c8275b9868f5d4920527a8c75aa3d267581f65
- SHA512 bbf061f3b67304251a2322ebe33ec3b78733e0ef761312037c676da0522ea3f09a87da816523a2291c76cdca29c151be73b7de1a16dbf037f3a8fec5f54d9636
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\pending_pings\fd17ce83-0142-44cb-9da1-bfc5df605991
- Size 27KB
- SHA256 a88296cdbdb2ac56fe0009a20a9b321130a0ecaad20cacbd3620485ae5730c74
- MD5 595e8c0354280f46d1eca81cbee4d1a8
- SHA1 84ab87a5922bffbdce5fb2f692e06665b5a0330c
- SHA512 73289108482cfd22ac95aba4c3dcb36c303f800aed0544abdd2e93f4243bfe918dbee47b423ba7f6414e939664f0f538e26ff831de11768684c474c8cdae6ab6
- SSDEEP 192:1NUT5+Dkodjt8zTI0wiRsL7Ggb1+z1cRO6NbthNntQ1wsoHcdr9G7fGmTf7igWBd:1NHDb8zTiiaSgb1+BcRUJvSDH3R0/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\pending_pings\fd7716bf-dd19-4de5-9bf4-8c1a20061ac3
- Size 671B
- SHA256 f1c28a36c3d7b0fe8ab524498fdc02538fea74703169aeed50f4666a02fb38c6
- MD5 a675f3ab940b4ed20bd228acd8fb89da
- SHA1 da89c182ea63e3c39a5a7a96abb67bd36dbdfd71
- SHA512 7d12d93ddce04dad540dca7f79082bf736c85dffd4a809b2d8b4d38238aa50a5e8b7070896d09196c017c43873c487ebc7f4ad14bdfbfe668db2f50e471d1a4c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\prefs-1.js
- Size 11KB
- SHA256 986b16106d22c070a9d0bf72ce6233f88e5ba1004873bccd019dd6d523f3caa7
- MD5 dc89c7bf953f5776bd7aea72f6c8f6fe
- SHA1 f07f38a8e398b7320fbdaef5b72efe7533af5b25
- SHA512 906e86415d70d97872d3525b0267607a6f24b4619bdb0a47c692a8cd9bbf97eca190bd23e54a43efa985751d767cd2efccd7101c3e64a8d0fad03993fba6af59
- SSDEEP 192:Qb5npRofkF1JiXIW4mcdfrIWnQHrT60FaXrQEiXxoBw8HA:QGUqF4TRrFnQLWzQRMwF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\prefs-1.js
- Size 13KB
- SHA256 2a9aa08bdd4c030431847f6991b9309699fcf52bddc4b189469ed655ce9bcf74
- MD5 c9eb3afab6e5013da51a00c8eb4aff50
- SHA1 d15f747ee7e671495ed67cbde01e8b75f3e97e23
- SHA512 79527a8df723f9ab312c5925858dcc894c9ac87ce8150236fdf59fb6fcb50c027393ddb425dc6cf51ad05a4d681a717a336f9247a4384573ff7e476a0804296f
- SSDEEP 192:Gb5npRofkF1JiXIW4mcdfrIWnQHrT60FaXrQEiXxHBw8HF:GGUqF4TRrFnQLWzQR7wi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\prefs-1.js
- Size 16KB
- SHA256 3d83399b5183819a265cf6b55a536f2d0f8b511c7fbf37f8886e84129633a2f2
- MD5 c09989f9bf6477511a95e48c9607e7de
- SHA1 360a2fedb1b027a43c493c87039970a1bfa98013
- SHA512 d817e8302841302862d02b9a81d2329d8060153b72ca9e5b8df7232075fe276c64c89b504dbea981cc02e90dc3b1b11562220efd256e9a6c5dbf77565b7f3e28
- SSDEEP 192:GbmnpRof7F1JiXIW4mcdfrIWnQHrT60FaXt+QEiXxXiBw8H5hBWt1:GvdqF4TRrFnQLW8QRiwcU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\prefs.js
- Size 8KB
- SHA256 8e5f90911b6e8f5b88909fdee94744f813202c8b1c9f1571be4d54592ad04ae6
- MD5 00b1abb70868de02c685004ac13afb03
- SHA1 4f31c79dcacaa8ddfa7d0a84bee42c42bb33b0fb
- SHA512 05051819b5de08c31b6ef6e0261e1c3c39229dea6b9118e52b05b525493c390dfb6653e1cb2029b3f6e0fa81a2b2bc777e234b4aefcbb426103f5892cf4bc78a
- SSDEEP 192:Qb5npRofkCdOD4cd6l607aXTQEiXxoBw8HA:QGMD9AMVQRMwF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 984KB
- SHA256 54b8fbb09bb4c92dd8fe1c41e7931d1484fdfc3f100e91d110b5516f03752bb9
- MD5 b4f227bccea6baa3f83d4711b662e514
- SHA1 28f539a66a109004d3bd5f13b32a27f98100db68
- SHA512 af97815f69da2253753cafb3ca6d815338822fb5daa095350e0b9c830d7eea4f58689d9d85e53cb0e2f5bbf7da442a69b8401c00921768b9cce99620d61753e1
- SSDEEP 6144:L7rSAx3S393z3m3qTHs6ujWFpFUmyEqUJJYtZmz0Pu/el/o1h53QS5eHN1HmcH1U:9WFpum7vJm6v+u4ndyff3bZ
- MD5 SHA1 SHA512 SSDEEP