Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
18/07/2024, 04:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240718-e64afsydmf
- SHA256 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473
- MD5 7db296a5f3818d7d11d994f2a26cc6c3
- SHA1 7e56f88358d914b90ee037145b14c622a52dd47b
- SHA512 fb498212823d9c1b13d1179ff37bbf6fd1fe671206f3021f5418fe47814ac6ef99149cef4434c46fa438f0a73a1c73304e41bf3629c1438a7176354b0086d065
- SSDEEP 24576:qqDEvCTbMWu7rQYlBQcBiT6rprG8aLo2Sbly7TWEPje:qTvC/MTQYxsWR7aLo2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4864 firefox.exe Token: SeDebugPrivilege 4864 firefox.exe Token: SeDebugPrivilege 4864 firefox.exe Token: SeDebugPrivilege 4864 firefox.exe Token: SeDebugPrivilege 4864 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 4864 firefox.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe 2748 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4864 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2620 2748 file.exe 92 PID 2748 wrote to memory of 2620 2748 file.exe 92 PID 2620 wrote to memory of 4864 2620 firefox.exe 95 PID 2620 wrote to memory of 4864 2620 firefox.exe 95 PID 2620 wrote to memory of 4864 2620 firefox.exe 95 PID 2620 wrote to memory of 4864 2620 firefox.exe 95 PID 2620 wrote to memory of 4864 2620 firefox.exe 95 PID 2620 wrote to memory of 4864 2620 firefox.exe 95 PID 2620 wrote to memory of 4864 2620 firefox.exe 95 PID 2620 wrote to memory of 4864 2620 firefox.exe 95 PID 2620 wrote to memory of 4864 2620 firefox.exe 95 PID 2620 wrote to memory of 4864 2620 firefox.exe 95 PID 2620 wrote to memory of 4864 2620 firefox.exe 95 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4760 4864 firefox.exe 96 PID 4864 wrote to memory of 4532 4864 firefox.exe 97 PID 4864 wrote to memory of 4532 4864 firefox.exe 97 PID 4864 wrote to memory of 4532 4864 firefox.exe 97 PID 4864 wrote to memory of 4532 4864 firefox.exe 97 PID 4864 wrote to memory of 4532 4864 firefox.exe 97 PID 4864 wrote to memory of 4532 4864 firefox.exe 97 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bee2aa7-3797-44b4-b632-034c4760feba} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" gpu4⤵PID:4760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2328 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccd3c835-875d-4fb8-8403-346580d5ef35} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" socket4⤵PID:4532
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3024 -childID 1 -isForBrowser -prefsHandle 3064 -prefMapHandle 3060 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cef7f21-2c0b-4dc8-8af5-321bf890b079} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" tab4⤵PID:5036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3360 -childID 2 -isForBrowser -prefsHandle 2792 -prefMapHandle 2788 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccb7db36-7636-4fec-844e-2748da78f325} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" tab4⤵PID:4456
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4228 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4216 -prefMapHandle 4172 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {834cf7be-9732-4f84-b2a7-79b7c4424a18} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" utility4⤵
- Checks processor information in registry
PID:5324
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5340 -childID 3 -isForBrowser -prefsHandle 5336 -prefMapHandle 5324 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f19e63e7-a07b-4999-9b56-56d7c90df451} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" tab4⤵PID:5940
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5472 -childID 4 -isForBrowser -prefsHandle 5480 -prefMapHandle 5484 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84188e3b-92f0-4dc7-9ea8-337694a673d2} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" tab4⤵PID:5952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5676 -childID 5 -isForBrowser -prefsHandle 5684 -prefMapHandle 5692 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91e794cf-1e0a-4f6a-a9a0-221b864fb079} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" tab4⤵PID:5964
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85t3rifc.default-release\activity-stream.discovery_stream.json
- Size 22KB
- SHA256 db7da3a76f24faa33eb9841bd39c6d426c43ae2689ac6072697cc0f471de7b60
- MD5 1d68c31218e3856fcd26c2cc67ced65c
- SHA1 a12c62976a77c1b5626bcfa60ce17c903ce62b72
- SHA512 69bb5bf6c0a9b63dee72971e1b23d0a65d08ec7dc85d9840d13dc2260481a6c8e46dd889774519d77921cd5c09577c0e8828618f68fc64988af95a58c09c8a14
- SSDEEP 384:N0ACaS9Yr+/AZ3rSg0bKXTNicxBLTaEUOwFGvXebHfsc6Bs9qrWs10vyaukwAi7:xJJlZ3W1bKXTNdXfgFGa5ksEZ1wydkg7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85t3rifc.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 9264891fc0b2f4a76dcf43553ee0214818a9a2a58e03fa4074bd6117abb546d0
- MD5 41e5d573e01b1b64438c53df1cc37304
- SHA1 37dc524807a43a4af41dcdff086b945943af981d
- SHA512 3ba338cae9ef7f694ba76eb69193af47d57b0a9b440175520695d2054f9f02431862d7d55dd3151831cb0f7109fee597c75c7bd1fb6d4db2fd80dbffb1ff5493
- SSDEEP 384:H485u9fiGLm4pUNft2WlOX8lPLZZB7t0lpDII1jpjU:nUBi8mCUNft2WAX8tzB7eD8l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\AlternateServices.bin
- Size 7KB
- SHA256 2c4d4b690809b1fc4a5bb405c336964b756d35605ac72d889ca32802c4ec3f2d
- MD5 9b2a500acb637b183a36dc46235d44f8
- SHA1 a43f1c60e67eab636afffce8e4a6268f937318f6
- SHA512 842940a0add35f58005e9e0e5498386679064aed18330d887bbf3bd4bb412b7e3bad425384862ad33e81137f10e71c6d47e2ef9fc0b632934b36995c484ff97b
- SSDEEP 24:YuB1o1HYJgu1xgRbLjYBpR5cOUBuhMZfIYeFsh2F3LFnssJbF0Jlb:AYJ5obYB9cOTYIsebOJlb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\AlternateServices.bin
- Size 17KB
- SHA256 f86dba4099b6575e0f69fe3ff271f45a725fe203d226ee3ce4a7a432d89c0ad3
- MD5 ba717ef64717443b491ac07b915a61ea
- SHA1 2be061707560de77e3fae2539eaf20519cf92626
- SHA512 f006757f8af370dee156fe69a8fe4818cd9f94acc57e950d5d070c414b5ee2c03f5997fd99a34bee803d639f5c0862d0d30fda7cdaaac22411b1e9b85ab29d80
- SSDEEP 96:QEJ5oMRu7sebOJabgJpebvpf+Yb29bobU2gbgzHbz0bsbLZb1bBqTkHVungbBb:95Vu67
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\AlternateServices.bin
- Size 11KB
- SHA256 d3db150e5e1619580aaeb2dc3cd9bb47d41cfcf77740e852e8b64b9208a49939
- MD5 2b7ab44266c13dd9b28acb50c9f3e533
- SHA1 4ae1df8c7d39e571ba9afe88a74aac6e4767449c
- SHA512 173bab87adce5a069f070ea8f42d39f8a6ea919fa7d2422743295417b05bcfee3d8a5b3e4a1d53f2b7595e8581489ef3be5e595e1854c6bc371fb50705bd9cba
- SSDEEP 96:zJ5oMRu7sebOJabKJpebvpf+ab19b7bv2gbgzgb:N5ru
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.bin
- Size 5KB
- SHA256 f2ede4f1dc2fb210e5cf4f54b1dd9286db167fef6a02b39bc1cd259cb9a1f01f
- MD5 70c23943b9edafe9f9dbad4b6082a2bd
- SHA1 5c80bab0a615f091048bad3612343c16fbf7f032
- SHA512 c11a22a1721da871ddaee6c96ff392bb0a7cfbfd081d9c6db6cd5e5817aa743025ae7503cb825123789b7981e5e7e9ec746a0feae876f63663d3c58b361de9fc
- SSDEEP 96:G+Qt3GDFl66JozGzgClKtmSSDBDSMF9ZbkW6rBBchmNePP/PrWZ:l/66JozGzgCl6mSSNrvZboPchqwPC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 21df61eb355f53fb9e687425e524788f1f9645a858bffd75507998d0619be860
- MD5 744e94e64d937c4a0143004d2581be82
- SHA1 273e784249807620ac9f16f0511aaa9b4cbc3915
- SHA512 5b980f6d45d352aff476a1674abcbbdecdbb53a2dd47a9dfe2bf6d3b04ff35be672b10d4f03eabb4a38a077cf64ac27e5acd8837d997341f98554546710ecb27
- SSDEEP 96:NSMF9ZbkW6ShmfePP/PrWZt+Qt3GDFl66JozGzgClKtmSSM:NrvZboSh6wPC2/66JozGzgCl6mSSM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 5c27f2d1fc435113ea592a9f1b697c4a237a633ec274194a3f85126b9b19b6de
- MD5 e269af6b2895e611f33567d513a7cef0
- SHA1 0d2f4c260a5295f8250906d09a533b99087b2d91
- SHA512 5ffb3fa4e50258f39d986471467ee55f060cb846a3a2adee7fca2f15cf39bfff9e44d70b38f5a0777158086118dca0c36cd9058bc6a0cb05f9034215312fd60c
- SSDEEP 96:G+Qt3GDFl66JozGzgClKtmSStBDSMF9ZbkW6rBBchmx2ePP/PhxkW:l/66JozGzgCl6mSSjrvZboPch3wPDf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 16KB
- SHA256 e47030c69275fde3fbd425cc3d432c266f55cb9f38acd7dc6da0eb0b2db41333
- MD5 6fb890be495e67a0d48e923227e9a171
- SHA1 7dd683e74d700f73da8c80c7e78c22727a02ceb5
- SHA512 97ea46302b6ee7f0b6d39456648cd434b42fd639546c1a86a88dd64a6bc698920ff62b155f9c4bed3190d9693415924b9642efb6f751c7ab3304a9629313112f
- SSDEEP 384:swJpAlNMxAZhDXFbxbebCU/66JozGzgC1bqbokVpP/:3JOcKDXFbxbebCxEQrn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\pending_pings\35e1fbce-85ae-4d47-bb42-f7cae7719fc9
- Size 671B
- SHA256 97433a54b93c60d39f4c245f4f6d7d210c578b2855a2b359798dac1f97a4b747
- MD5 32c6f82935c049db3c0b5635f14af5a3
- SHA1 80c45ac153ca190e465c0daac7d547beb08ea447
- SHA512 86527ceec3d5cc3db44f20891bce45e78fa6409f6b5f8f71eb53e08cbf5db4d7ef6e2991fd0ebb0477669bb51f98d9dff7959b21e26cb4eca97a780b446e3f42
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\pending_pings\3e973f80-349f-411c-b51b-1b8e6c616265
- Size 982B
- SHA256 ac97b392965de76cadf76b5eaadcd86a70c78e1324bf91fced377f46bd763d1a
- MD5 f2b5676626158793b8117d425b297a31
- SHA1 9ce40e3e6fa066675ffcb3eb946deb94e0fa6df7
- SHA512 782c7ef122718239b899688e7a7681de36e36425022cca63d6f3bc194c3955e47885958927eb894fe92c154716eba6f3ab5cdf557da02ac8700940ceab0e90cd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\pending_pings\6e9479ca-ef4f-4fa4-865d-6754058ee499
- Size 25KB
- SHA256 9009c742a1b7aa422c8a187aae9798fc11e57a66c8d8f21057e4c4dfc024ccc1
- MD5 f58e5d3126447826c0fa509f15faffe8
- SHA1 580fe00bf7754a2f118afb3567e67d9e7e22c87e
- SHA512 57c3687a4cedfb71ddef09b710a4fd2983291b4d64b2f4a7302db5092ec2a39979a089b4075e102f2ab4e177fbd5700bdf83f60738442e4143e60a68fd52128a
- SSDEEP 192:f6/1UkLRcKi+sNLGSz58TkhhybVyStdPkNnYYxj/o8VY9c3djGXAK6+hAsFs5M88:ftgRcKivNCS18XRPijnlqL/iccYn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs-1.js
- Size 11KB
- SHA256 cf7c75f78d6eb25310b45ddc1225e9f20570510995f2618cd75db26bdc90dcc7
- MD5 611af77dfca6d4171c295fc763a4ae59
- SHA1 af81c92e8816df56d2d656814fb759d9f7060768
- SHA512 30eff654d24be482e4709d1c6d74651422e2b49e84cd865236173517ca265164dcaad8562bb177d535d33d4056b4a8d00a75ab86584eeedab49ac5de470f4cbd
- SSDEEP 192:k5n1RyQfMQAusN8m+zmONEcd8wdzd1xQHrSO60/aXT2mP0yiBw8HE:9Q1sNWzmONpaIzfxQLSNV2mUwZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs-1.js
- Size 12KB
- SHA256 a84b0702adc909c4311c90eb0572c286c63118f6df4b6f55d0b70c18b9183fd3
- MD5 fd9506c0f42b70de4bf1d23072cbb8f1
- SHA1 d4e4701b57b1088010062f2c6572bc6efe42794a
- SHA512 7870edc989b4caed62a9618eb3ed5dbe849c45e332c0bef2a9e4bd78a6a6349d625b8f864ced05cdc8fd2c7cf1abdb7f350f66222391f2b9ce5223d14d36a136
- SSDEEP 192:G5n1RyQfMQAusN8m+zmONEcd8wdzd1xQHrSO60/aXT2mP0ymBw8HSwt:3Q1sNWzmONpaIzfxQLSNV2m4wOt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs-1.js
- Size 16KB
- SHA256 5db158d38babd0b8a3415457180336dd215eea3eb3e35d125168c26d7f957ae9
- MD5 373ad3129c6a64897357f465c214f1e6
- SHA1 19150e938c7a2ccd099427cf9ecbcf5871899668
- SHA512 6d4950657d9e6ff38314082e3f067a3a3f1c5d33181c087d8f9bb46db21abdd0af74956921792dfe465e1d68f32a128f4783fa9d177e2cc606bac527355f6488
- SSDEEP 192:GaZytZhEn1RyQfrVQAusN8m+zmONEcd8wdzd1xQHrSO60/aXV+2mP0yKiBw8HSpt:6QksNWzmONpaIzfxQLSNW2m1wYS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs.js
- Size 8KB
- SHA256 229f3a723f1f084dfe577c1a35735b1bccd217894bfcb3761d72702a14cc6564
- MD5 495927512ba819ea4da7724c3b27d483
- SHA1 df04a33dc1d5ee6104692e14ae25898994a2c96d
- SHA512 0dccb556bdd0a92f3f8487455408257bedd238113963a4cc379157aacb559bd70618c3b576944bee745eadfb99b86f3d1a7e32e1afb6f7ce9f86fd3456c0b5d2
- SSDEEP 192:k5n1RyQfMgKHQuncde060caXA2mP0yiBw8HE:9QjucEvB2mUwZ
- MD5 SHA1 SHA512 SSDEEP