Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
16/07/2024, 02:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240716-df6gfsvcle
- SHA256 2442861699e2ffd0911d1f26663d83606906d02fd0fc804131e7bc333c02e921
- MD5 acc0e5d8a85e6a72ec5665a45831bd76
- SHA1 df71a4713fe3ef8a35c0653f2c4a84a24688f47c
- SHA512 cc6587a2a2a476e1a3467121331d403e3c6608e49ffff0a218f8c30c04c793e96e9140e1f8b091243e6c4e6d970fe6c210d808d9163e2bb81fd1a78e7023e475
- SSDEEP 24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8aLm2Sbly7TWEPje:VTvC/MTQYxsWR7aLm2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3368 firefox.exe Token: SeDebugPrivilege 3368 firefox.exe Token: SeDebugPrivilege 3368 firefox.exe Token: SeDebugPrivilege 3368 firefox.exe Token: SeDebugPrivilege 3368 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 3368 firefox.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe 1560 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3368 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1560 wrote to memory of 2344 1560 file.exe 86 PID 1560 wrote to memory of 2344 1560 file.exe 86 PID 2344 wrote to memory of 3368 2344 firefox.exe 88 PID 2344 wrote to memory of 3368 2344 firefox.exe 88 PID 2344 wrote to memory of 3368 2344 firefox.exe 88 PID 2344 wrote to memory of 3368 2344 firefox.exe 88 PID 2344 wrote to memory of 3368 2344 firefox.exe 88 PID 2344 wrote to memory of 3368 2344 firefox.exe 88 PID 2344 wrote to memory of 3368 2344 firefox.exe 88 PID 2344 wrote to memory of 3368 2344 firefox.exe 88 PID 2344 wrote to memory of 3368 2344 firefox.exe 88 PID 2344 wrote to memory of 3368 2344 firefox.exe 88 PID 2344 wrote to memory of 3368 2344 firefox.exe 88 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 5116 3368 firefox.exe 89 PID 3368 wrote to memory of 3312 3368 firefox.exe 90 PID 3368 wrote to memory of 3312 3368 firefox.exe 90 PID 3368 wrote to memory of 3312 3368 firefox.exe 90 PID 3368 wrote to memory of 3312 3368 firefox.exe 90 PID 3368 wrote to memory of 3312 3368 firefox.exe 90 PID 3368 wrote to memory of 3312 3368 firefox.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4149a9e9-eeec-40c8-a10d-e8ebef95fdf6} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" gpu4⤵PID:5116
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {475e08c4-66e6-4bc8-9013-9c3b17c96cd0} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" socket4⤵PID:3312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3188 -childID 1 -isForBrowser -prefsHandle 1392 -prefMapHandle 2844 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a0bfcf4-15eb-4e5a-af9b-52e69039ada2} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab4⤵PID:2308
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3144 -childID 2 -isForBrowser -prefsHandle 3708 -prefMapHandle 2744 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36720011-5c0b-4798-80fb-4a2fd9aed1dd} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab4⤵PID:3940
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4368 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4448 -prefMapHandle 4444 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06df5a2b-0a3f-43c3-8aa2-2a3ff1d3377c} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" utility4⤵
- Checks processor information in registry
PID:1624
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5444 -childID 3 -isForBrowser -prefsHandle 5436 -prefMapHandle 5432 -prefsLen 27050 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a038cb39-3657-47b0-b6fe-85f9be205bd5} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab4⤵PID:2824
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5584 -childID 4 -isForBrowser -prefsHandle 5600 -prefMapHandle 5456 -prefsLen 27050 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80e2c6b4-4a65-4e5a-a7b1-b95cab10aa88} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab4⤵PID:2680
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5808 -childID 5 -isForBrowser -prefsHandle 5816 -prefMapHandle 5820 -prefsLen 27050 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b27d0d1a-f2b5-4016-b850-46af6d97c39d} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab4⤵PID:3544
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\activity-stream.discovery_stream.json.tmp
- Size 24KB
- SHA256 09a02cd47a7477bb6d056bbe1947a567a6c5d4084644beb1278e7bd5d2564aef
- MD5 cf9a30603e0098342f0f4b53fca93132
- SHA1 191ea64b5d8179dbcb4165f618596c723d259c88
- SHA512 323ce13511e936997b1b1a31bbc70ecf14604489588ae1ec391d4597adff6960bed3837b1e0f78690a28d64a6f08b0aea0c17a53bf30159ce3aef0111590b381
- SSDEEP 384:plU3omecWHWIYi91ARlUzofiY/Kv12gb/5dZ672Gxayau1ZGzxDC+CxjCxzG:pV9HYq12qDv1X9Uxayd1Qh44ZG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 593de28da732e5f5e3fe8253939e3ad873381a2716a4e3b0997535f7f03f1031
- MD5 c9cabba68503edab776583e3e520ddb9
- SHA1 5d18f23ca97228372f36f1ffbabed03d67445f74
- SHA512 17afda002db1eef08ad3a785214b645ff1c9b9708057e99346de4e7f833099cd99d65a3769c207405f8bcc9a890a03dcc1d33be6a27e86a0155bf61219663570
- SSDEEP 384:H485u9fiGLm4pUmft2WlOX8lPLZZB7t0lpDII8FhFv:nUBi8mCUmft2WAX8tzB7eD8h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\AlternateServices.bin
- Size 8KB
- SHA256 f20a4067ab46f3b63bf8476af5c4bb9af001c9aea4f31bfa3756de8c00b60366
- MD5 bb5d46e847876158b94e29828820c631
- SHA1 4ca7e890be2f1bf8409e09c866a9277ebbde3f05
- SHA512 974f1ca4b102fa7482d70def68301c75d2dbbcf8a18b0039af0fd536d0d0e7b340103c1e30526f176d5914470626a098dd4c058ae3bb520cc3c8d78d2f218a76
- SSDEEP 24:PuB1oOuHUgu1xgRbehFsh2F3LFeKpR5cO2zuhMZHsJbF0JYzRb6WKsJblxWKf+Yd:l05oqB9cOWebOJYzRb6pebvpf+YzRb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\AlternateServices.bin
- Size 17KB
- SHA256 aa737024f41d0f38c9f791592f1ecb716490605c595fe4cc250b3f2591e95070
- MD5 a1e6755fa067e4a3da0b4f19778a82df
- SHA1 7418a9ea67f7f58555f142304f82b4c94464f2f2
- SHA512 37af2c9c27329fe75e621939a05de66d95ee2c77fb90056109e4e839208c4110328ede593976ce7568a8ce9b0cc52898c31792ed359102c17f4df1ba87920bd8
- SSDEEP 96:q5ovebOJYdbKpebvpf+8dbobqdbqgbgzmdbI7bedbDOb2dbDbMbidb:q5cuA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\AlternateServices.bin
- Size 13KB
- SHA256 9bc2175b6d8aa76904f506ca978d0a537b7a5e7058b821b93b1105d7a6ef8dbf
- MD5 5ec3fd9bf756297d849e927c2a4ee45e
- SHA1 21f9b6ca016a421acb7ae1eff2dd153c167ef035
- SHA512 cdc1a8e53b8a8fc88e1f1da91097f2eb2092a240393005ec51dc5f0eaa5f2096e60821c582f830173a0db670187b3b18ee05e5d55b4974676e14709b0a637ca3
- SSDEEP 96:C5ovebOJYdb6pebvpf+YdbobqdbqgbgzmdbI7bedbDOb2db:C5suM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp
- Size 24KB
- SHA256 baae59d13f4afeb5213660f22df41951284518a8c4ce354f1f3fbf55357f0e71
- MD5 f9ff6e9de5764a4ed7189c2dbf15c7c1
- SHA1 f0674ee79567597b7d9445b72e81bbe869b0ad5c
- SHA512 5fb78ff3a70c0becbc29251ef568767aaa113e552952be5eb37ce98fff58b8dae4e8a5dc61606c697b831666c792bb2eb3779b72a30bc322f486c0f94c8ebde8
- SSDEEP 768:gz3ZIGvGsDN01EftnE1cTbkbgbsb/bgb4bQb7bGSxcEJeX:gz3ZXvGbSxU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp
- Size 22KB
- SHA256 154dea7de5e648d016a8a5ab9fed9f504cd5435f0e84ccb7cc51b0d804759120
- MD5 003dd2cb12887be3574b3e0cb0522e55
- SHA1 9e0d98eb928f3c12e71f0b1066d634112a499bbf
- SHA512 88d4b5368c304f1cd08ccb12aece5b92ead2088aa7bd05af7652321aa8ac3f6355962751c6b4c78cf692b0288c34c99033dfb3567413766aeb788bb867d6b535
- SSDEEP 384:v/66JozGzgC1bx74KmJyhxNrZdxRPN08sftnE1CZbkbgbFb1bgb4bQb7bAsSTjrG:KErcK0yhxxZlPN08sftnE1CZbkbgbFby
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp
- Size 22KB
- SHA256 af15309b8f79e6899f5e5447d8709fa78aa82293cd395fa1fceee32f8d72bb48
- MD5 74c51bb6a1db2e7861b32050062a4021
- SHA1 afd1418e2f91436d443ce876acb40cf33061e80b
- SHA512 2a7881b1dee797aa20453c9ea8d4640d39affbba0b4dcee4cf0deaacb31fb40823dce873cde839519427ba3067f169e5cd76f9c968d4b40b08d2ac4f15a443df
- SSDEEP 384:v/66JozGzgC1bIboPDPG74KmJyhxNrZdxRPN08sftnE1CZbkbgbFb1bgb4bQb7bF:KEOCecK0yhxxZlPN08sftnE1CZbkbgbq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp
- Size 21KB
- SHA256 3654a37ddb2a4d41948418134e9420f5fb45b32a2176ea472be072417a74aff7
- MD5 c9fb2de4d253cf8641cf5269580ead12
- SHA1 4c9ec0b6ef618034999976384bc59f0dfbd22e4b
- SHA512 f5e29ebd52d59ba98c5c47f95d1ae2f1f99ce037c4f10939d2f3613b889afae9e8be255b345e03c9797edf56eb5be3c055740248420507428aea252c5b8e63e4
- SSDEEP 384:v/66JozGzgC1bx74KmJyhxNrZdxRPN08sftnE1CZbkbgbFb1bgb4bQb7bAsSTjI1:KErcK0yhxxZlPN08sftnE1CZbkbgbFbO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\0ab2fa4d-0104-4812-adc9-1db8387ce149
- Size 982B
- SHA256 bb088d0bce772408465376d9f74fff0f77ec852284f21b20ffe9469b2d076a4e
- MD5 650a170dd3d547a652c350d2a75a1f3d
- SHA1 37cb637b623138cdd925831684a13f714821fdda
- SHA512 74c4cd96dd9568bfc89ed5638f5a2a861907d78db01e2cb811d2cc5d6450c277ac4c2253e01dc424937db1f31a434a55248860f9f9614de2447a5272cc684115
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\70f5642d-b17b-44db-8921-90bd24f8e831
- Size 659B
- SHA256 f3b0c4611905adccd921ee54d50953f0dfca4a8266a568025f81682e30249822
- MD5 f2cc53fd3a06d50d6dc6229beb25bba7
- SHA1 05df487caaeb40ce6576eadaa8ad90a9cc7fb8bf
- SHA512 6af0e6783b540f8d01d1a2445e99b918c324e92c6c07954471aa4a23f7cfc15e4746d9d463856377c7d41c5d4aa6954e2dc8d309eda346075f5f30f101c03ef7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs-1.js
- Size 13KB
- SHA256 1c6fbaa01e40d75fa4dcc3f021f26ea07b5df1cae90ef6be4c368394201ef4af
- MD5 2ad30a05afcdf8ac20b38f47885ad3d2
- SHA1 185003f8b79920e1926d4059c1040e00d83a511e
- SHA512 901749f3d7badaa072472e9ce20a962d49e7f103895cffb1be6f2b68afd2f2b162f355783f83ae015e8c71110d66b4e0bdc76d54aaec49019c6f20bb3689b8db
- SSDEEP 192:i5nZ1RZfBHOwtzrEw7JAcdE9zQQHr560MaXG1TBw8HS:UxtzrjTW9zQQLQH1tw3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs.js
- Size 11KB
- SHA256 6345abaf24c17b47dac43c0ee8070afe74b25dec30e2b73bd7874ac77e40e1d5
- MD5 1923155ef00e9da1211f70902c860da5
- SHA1 f7a09fcd5c9d1abc4f6ab2a02e8b4b8c31e899ff
- SHA512 cb39fe4eed8515133c86dc02cf38381a0f1ce0499db57ddfd24831d3a904933242f85463cbe0047f525f671ebea14437c294417397515726c23476df69bb1b9a
- SSDEEP 192:M5nZ1RZfBHOwtzrEw7JAcdE9zQQHr560MaXG13Bw8He:ixtzrjTW9zQQLQH1Rwf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs.js
- Size 8KB
- SHA256 49e4a6de7d1c7f160c90d34c3470f3622eb5c212348d28d909d2d394ea3da9ce
- MD5 36a0ad7c596234095150057e7ca804b7
- SHA1 d38a93b3ea55bf13ee1887880581f9e56400b0b2
- SHA512 eb23a9a3a750818f58f577a399dcb1d54e7bb797a90ca5051dc76b10efe045d09bd2a9c675909e8a3bf8555749619e235239254c84977bd8ad0dac00f1613dda
- SSDEEP 96:xHC5nUTUpmPqGqZfBo4p4fzSZquN1cdDCzg5160B/aXenTjXH8QFNBw8HnQz:M5nZ1RZfBofFuncde0605aXS13Bw8He
- MD5 SHA1 SHA512 SSDEEP