Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
16/07/2024, 03:46
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240716-ebmdfswfkd
- SHA256 79855f319ce1ef7e4e3d23b09c0a9c2cf1526d3dbd42eea417e6ef421eda4d7e
- MD5 dab6b0665216bf762bd4b314370a0e66
- SHA1 d3642be9e94b816a973eefd3be270fadae66baa5
- SHA512 e7384991329dc9e2e0cacef70b1bf98f2f54772f90e508bfa1c27ed3acb6a3cb4e23d35ae4016d6447e4a61127f15e8aefed54a2b853c69a3cab84d6faeb3005
- SSDEEP 24576:1qDEvCTbMWu7rQYlBQcBiT6rprG8aL42Sbly7TWEPje:1TvC/MTQYxsWR7aL42dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 532 firefox.exe Token: SeDebugPrivilege 532 firefox.exe Token: SeDebugPrivilege 532 firefox.exe Token: SeDebugPrivilege 532 firefox.exe Token: SeDebugPrivilege 532 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 2656 file.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 2656 file.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 532 firefox.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe 2656 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 532 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2104 2656 file.exe 86 PID 2656 wrote to memory of 2104 2656 file.exe 86 PID 2104 wrote to memory of 532 2104 firefox.exe 88 PID 2104 wrote to memory of 532 2104 firefox.exe 88 PID 2104 wrote to memory of 532 2104 firefox.exe 88 PID 2104 wrote to memory of 532 2104 firefox.exe 88 PID 2104 wrote to memory of 532 2104 firefox.exe 88 PID 2104 wrote to memory of 532 2104 firefox.exe 88 PID 2104 wrote to memory of 532 2104 firefox.exe 88 PID 2104 wrote to memory of 532 2104 firefox.exe 88 PID 2104 wrote to memory of 532 2104 firefox.exe 88 PID 2104 wrote to memory of 532 2104 firefox.exe 88 PID 2104 wrote to memory of 532 2104 firefox.exe 88 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 4492 532 firefox.exe 89 PID 532 wrote to memory of 2476 532 firefox.exe 90 PID 532 wrote to memory of 2476 532 firefox.exe 90 PID 532 wrote to memory of 2476 532 firefox.exe 90 PID 532 wrote to memory of 2476 532 firefox.exe 90 PID 532 wrote to memory of 2476 532 firefox.exe 90 PID 532 wrote to memory of 2476 532 firefox.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1936 -prefMapHandle 1928 -prefsLen 25755 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58d03757-6eb8-45a8-bcbf-eccdecc70114} 532 "\\.\pipe\gecko-crash-server-pipe.532" gpu4⤵PID:4492
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 26675 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44bed406-24d6-48ff-a422-57ba0baf258b} 532 "\\.\pipe\gecko-crash-server-pipe.532" socket4⤵PID:2476
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3192 -childID 1 -isForBrowser -prefsHandle 3208 -prefMapHandle 3204 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36680bcf-6b0c-4e1f-974d-696a5a5d6742} 532 "\\.\pipe\gecko-crash-server-pipe.532" tab4⤵PID:2824
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3860 -childID 2 -isForBrowser -prefsHandle 3884 -prefMapHandle 3880 -prefsLen 31165 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1452359a-51d5-42c8-a487-281037505d64} 532 "\\.\pipe\gecko-crash-server-pipe.532" tab4⤵PID:4148
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4524 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4552 -prefMapHandle 4548 -prefsLen 31165 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5a284a3-fadf-4706-9e50-390bf6ba9617} 532 "\\.\pipe\gecko-crash-server-pipe.532" utility4⤵
- Checks processor information in registry
PID:348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4584 -childID 3 -isForBrowser -prefsHandle 5240 -prefMapHandle 5412 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc7244d4-1a4e-46f0-901a-3dae77b25665} 532 "\\.\pipe\gecko-crash-server-pipe.532" tab4⤵PID:1712
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5692 -childID 4 -isForBrowser -prefsHandle 5608 -prefMapHandle 5612 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6676f0c3-2f79-4483-ae68-5eafb982672a} 532 "\\.\pipe\gecko-crash-server-pipe.532" tab4⤵PID:892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5816 -childID 5 -isForBrowser -prefsHandle 5892 -prefMapHandle 5888 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b524d909-0872-41a8-ade4-b1d29091e936} 532 "\\.\pipe\gecko-crash-server-pipe.532" tab4⤵PID:3608
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onffaicf.default-release\activity-stream.discovery_stream.json.tmp
- Size 18KB
- SHA256 01fb91f4c2842c52b83a63581ae7c0ef1659df1667e0bfe751bcf37816dc4bcf
- MD5 85a079992182a8fd5557684ed9023065
- SHA1 c879a7b535fdeb7871f5a8fdf9bfa6083c2f9b84
- SHA512 ba173229e72cd3b756ba914437697e264e0e1395ab43b2d35dbb724ea888754ce4fcce77941b5a6bed7232464c9109dd1c8a825cd870b32dce2be12cf23daefe
- SSDEEP 384:xm5y3mecxi1tWIslPQVRzofiUb9ickl+12aoZ6BGwgyaE:xrDT1tHu4kqU9t1cNwgyp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onffaicf.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 43a2870d1964200057f53a917541757c7ae23b03790f5119a6fb1dcc86f6dcc2
- MD5 47e8831b47f440a2b7c744393ff74c88
- SHA1 355313dd3b414c26278490c937efde04356890f0
- SHA512 8a45a1fbaf1fea7bb01c20be9ed6d8d146142db46ea52b7f90138c93e23b90ce3a4ba8ff6b88fe16e380bee9e43739ca597a8f33044f6261ab72a3aabe05cc8e
- SSDEEP 384:H485u9fiGLm4pUNft2WlOX8lPLZZB7t0lpDIIHI6Ip:nUBi8mCUNft2WAX8tzB7eD8SVS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\AlternateServices.bin
- Size 12KB
- SHA256 93771a04f16ce9c3eb5fe0cf7d6b366aca13dce88e1e19bae429f0f0b652c099
- MD5 1392e8ba7ffcc218cd164358e25ee68d
- SHA1 ea608c322db7cef80ac64d36551e33c86a81964c
- SHA512 46ab92ebd18863a5d4a466fc12aa0ada5e834db4a54ec0ab714d811f7878926f31e5cd1a7094d5e44ef8f120de4c136df717662dbfcaa7ee938fbde83e32552a
- SSDEEP 96:WDY5o3g6ryebOJ6b6pebvpf+6b4bYb9gbgzjbnXbrb:WDY54Xr4ub
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp
- Size 23KB
- SHA256 c99c7c0830eb5e50c30425edb7c38a1a8c19f428db1ca99415542ad6eeeb1396
- MD5 12dd08d005eed4939df73a075a21cc36
- SHA1 202c0e9f16253578590533e3298cb9eb3eb1fda1
- SHA512 b6f16c030e7fe9e82890476078970e56f6f6219a938d9e43485d58fa0ceef8abb249309d8cd795c04a592a6d4d91814f1f74b787e069a6c9f25cef906de01a60
- SSDEEP 384:NjxPLXgu0kfuLfgPG+EjhqMU/x5b9bxbxbabsbUbJbjbNsJQDXNl/VwTQQ/66Joo:9xPL90kBPG+EjhqMU/x5b9bxbxbabsbT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp
- Size 22KB
- SHA256 c97aab9e6779ee55e12cb4e8faef7402adb80e1a052f703cfce591f4994189d9
- MD5 a62d9b258273a8fe910610f61cad86eb
- SHA1 b44eef6982f7666d0b8539e6ea62be40fb9a496b
- SHA512 796ef0bfd46e9babbcfc742074dd6ee961ab7853280380c2508f783e75095ec97174e7a24de5a1a25bc54b7dbfda64af76d89eec0a612bc1e165bc5ef37debc7
- SSDEEP 384:RQ/66JozGzgC1bTjxPLXgu0kfuLfgPG+EjhqMU/x5b9bxbxbabsbUbJbjbNsJQDG:DERxPL90kBPG+EjhqMU/x5b9bxbxbabS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp
- Size 25KB
- SHA256 57ab09705b1da9af852f7928b1bd5826f4230203298313f38ba2feae345ffd57
- MD5 d347f3263db5805e4500b75d01a45cc2
- SHA1 8467491af984d593691c40b58427e2099f307686
- SHA512 96d1df8c73983f0dbd2253ce38727dee31731feff9e1b011a0afb8e388112152ee79037fa7fffc52292fc7e15fd19b53386d06f4b5974f6472ff3dbd25f9a238
- SSDEEP 768:DEZHWa4pmcn4DG+8jhqMU/lWb9bxbwbUbsbUbJbjbQTVm5R0yse:13pm+ETVm5R0yse
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp
- Size 22KB
- SHA256 72fa4bfd5ecf0a1893af147298af2da16512eab0ffa830a76c8cdfbea0cf2317
- MD5 bab0b3b81b420870b9cce13b204cec9d
- SHA1 3a629e96c4a2644cfb9fa50b172637682f5d7123
- SHA512 d85aacea8a5d2eacfa4b10faf120cb6a5efb29bc876e01bd6d6b6b7ec5679a074fcd4537a590adf2eb194aba198aba1475fda769387e589941f6ea0536327ae4
- SSDEEP 384:RQ/66JozGzgC1bMboSOPajxPLXgu0kfuLfgPG+EjhqMU/x5b9bxbxbabsbUbJbjE:DEmQQxPL90kBPG+EjhqMU/x5b9bxbxbn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\46094ef1-9b20-4eb3-b000-bfbb7798d659
- Size 659B
- SHA256 55aee5d0ba6cd4b9a039bdcac9742a49e2e9951729ae1b6c16958074e9f3a0fe
- MD5 1c867082499b15f8775b5675e991f462
- SHA1 ac83904cd80b9b8b9bacb5ea13fe65659542190f
- SHA512 ba18f82008b3308a949adb083dee07faeda9d112a61291fc1854a1141f3a5560c6309e30e1318a033693b52023f9d52e94248cc68966a914dd4e9dbe28a837e9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\5c62c7ff-d1e9-429d-8e83-3226d32f84f5
- Size 982B
- SHA256 51d309122e2f0e7592ff93e80b75c767cbfc577f7a04b4b962a26b5dbeb56074
- MD5 6135ff7ef7d01e5340dd66e08dbee38c
- SHA1 708e5dc86426d1980529edbe64865e998fb6a148
- SHA512 c99d0f32fec6f2a471622f84ab389b328394fa25750ba021e4fbc78a0c8e89c7c8111c77ce38d6ca0192b76b86a8bc296327ce97d3e7670ada9ffb94752ec255
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs-1.js
- Size 16KB
- SHA256 5cd668ad54a7c989243f6dcc9d3d5ed2ed6d9eeaba390a2570738a45354c4c41
- MD5 faafc10060f3c84c4751d2788caca242
- SHA1 cecbad7a09741988818834fac398e5b3c910396b
- SHA512 bcd82bf32d6b83b14c6d5352a30eda1bb5315a82406508dff4b865fedacc4fca701a7df963daac7092b1b01f79c8f426b24f128ac69f8d568517c8c63becba85
- SSDEEP 192:9OnHdRZqzfg5EtIZzZQcdqnzhQHrM60jaXMg+ippLqY6KiBw8HlPf9Kt:IAzNIZzZ10nzhQLn+SDkwu2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs.js
- Size 8KB
- SHA256 8af694fd7a8b18beb616f33e240cc3721377baad84182d19330a2584fa5d7fa2
- MD5 ed202971c336a4e1af5779f3dc6fa5f3
- SHA1 a8dfe19ae1f66b710cecc3ad180940c65ae5143e
- SHA512 51144e2af844905119c1352ad1b93687f4dea6c7723ad0c0cf5a88c826162841a389860553a8067d65cd77195642e9e80dacda81202e276efacff5e4d248f1bb
- SSDEEP 192:b5nHdRZqzfvKWKvD6cdCj60oaXIippLqY6tBw8VC:VAznoDHkG5SDOwV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs.js
- Size 11KB
- SHA256 a44184f7037f775dcfd04d2ad40a0368e2686fa35aa5b9d5476b4a422e51d4fe
- MD5 c5ae1da438e50ccec369c12dea352a04
- SHA1 c1ff761226a156af4c43c2b95321343ea14612eb
- SHA512 0c3b92198e3e7bed904af3616012cabb8d65d50e4a699ef5e211ceed09f4ef610e68a5d85b528eb4f3e201bbb3e95c210371b56592ff40d1b083248975663e35
- SSDEEP 192:b5nHdRZqzfvK5EtIZzZQcdqnzhQHrM60jaXMcippLqY6tBw8HC:VAznzIZzZ10nzhQLnNSDOwT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs.js
- Size 12KB
- SHA256 048e621651b46bddc6eb8ce02a098f9089a4a7853a03493e3c106bd6f96c0129
- MD5 4efdb866c9be3831781bfecba5e9fb35
- SHA1 00e5ee5cb2271c2390b134cd7ef793b9d02cb82f
- SHA512 2d13af6dcb0a0b469feb0ac03a9b4e6316e05cbf6f5bcbdb7ec845c8c5c480d226b6703b6a4b459db9e9ed9a53b9c457f136a63fe24ad7b6d0499ce408a2a757
- SSDEEP 192:95nHdRZqzfvK5EtIZzZQcdqnzhQHrM60jaXMcippLqY68Bw8Hw:vAznzIZzZ10nzhQLnNSDFwL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 1.2MB
- SHA256 a644597c6b1f494716ea1f69b0f25682c88be96e2ecf784b99188a598cce4600
- MD5 c18e9fe0511d7d9459203cdd84b74a8c
- SHA1 0d6d0ec69eccf9a76c3579db99e02a01f7e0d8d3
- SHA512 2af28223c66d520d19fb98b4a3efe0adc5c7e4ec1938a0329c54bee65d64c9eafb6ada573585dcd8d9b7efa65688f1d728df6f6cd22d8b118017e5f5f1066463
- SSDEEP 6144:mIoI+43S393z3m3OTHX6uPVM03juUULUU15vKZmz0Pu/el3Af6DfhAk0NMSeHN1g:+VM03juLN1ldvMztntpFG
- MD5 SHA1 SHA512 SSDEEP