Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
18/07/2024, 15:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240718-tdb3tsyfma
- SHA256 0f36417d31a14a0bca42c7159d76953c50119913e93fd3143753a47178d84c59
- MD5 2d8652f49fb8c8aff99f1b879983bb3a
- SHA1 bc0c6be7126346d585bf453763e5f9dceee1fdc3
- SHA512 e6a973cd7486a20da563b9ec3226340f18729ab7098db78164ff0ab315610c7d5f88e7716383c4375ccb0a50112039839fe2c69f76818f429469bf5d80dd4c96
- SSDEEP 24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8aLH2Sbly7TWEPje:iTvC/MTQYxsWR7aLH2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 916 firefox.exe Token: SeDebugPrivilege 916 firefox.exe Token: SeDebugPrivilege 916 firefox.exe Token: SeDebugPrivilege 916 firefox.exe Token: SeDebugPrivilege 916 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 916 firefox.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe 4140 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 916 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4140 wrote to memory of 1060 4140 file.exe 90 PID 4140 wrote to memory of 1060 4140 file.exe 90 PID 1060 wrote to memory of 916 1060 firefox.exe 93 PID 1060 wrote to memory of 916 1060 firefox.exe 93 PID 1060 wrote to memory of 916 1060 firefox.exe 93 PID 1060 wrote to memory of 916 1060 firefox.exe 93 PID 1060 wrote to memory of 916 1060 firefox.exe 93 PID 1060 wrote to memory of 916 1060 firefox.exe 93 PID 1060 wrote to memory of 916 1060 firefox.exe 93 PID 1060 wrote to memory of 916 1060 firefox.exe 93 PID 1060 wrote to memory of 916 1060 firefox.exe 93 PID 1060 wrote to memory of 916 1060 firefox.exe 93 PID 1060 wrote to memory of 916 1060 firefox.exe 93 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 4964 916 firefox.exe 94 PID 916 wrote to memory of 2708 916 firefox.exe 95 PID 916 wrote to memory of 2708 916 firefox.exe 95 PID 916 wrote to memory of 2708 916 firefox.exe 95 PID 916 wrote to memory of 2708 916 firefox.exe 95 PID 916 wrote to memory of 2708 916 firefox.exe 95 PID 916 wrote to memory of 2708 916 firefox.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1872 -prefsLen 25755 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fecbbebd-7b3a-4534-a392-69308a4eda88} 916 "\\.\pipe\gecko-crash-server-pipe.916" gpu4⤵PID:4964
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 26675 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56b070f0-d41f-4e92-a2ea-84e8dfa64edc} 916 "\\.\pipe\gecko-crash-server-pipe.916" socket4⤵PID:2708
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3024 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95f0db8d-db45-4100-9949-ea84bc4d64c7} 916 "\\.\pipe\gecko-crash-server-pipe.916" tab4⤵PID:3268
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4000 -childID 2 -isForBrowser -prefsHandle 4012 -prefMapHandle 4008 -prefsLen 31165 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {785aa175-1eec-44d1-b9ae-d2fdc887deb0} 916 "\\.\pipe\gecko-crash-server-pipe.916" tab4⤵PID:220
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4716 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4704 -prefMapHandle 4696 -prefsLen 31165 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a25634f-e995-4d5d-bcb0-a145a5806d9e} 916 "\\.\pipe\gecko-crash-server-pipe.916" utility4⤵
- Checks processor information in registry
PID:1532
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 3 -isForBrowser -prefsHandle 5488 -prefMapHandle 5448 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1efba5a8-2d80-485d-99f4-2b3a79d1ab51} 916 "\\.\pipe\gecko-crash-server-pipe.916" tab4⤵PID:1524
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5752 -childID 4 -isForBrowser -prefsHandle 5676 -prefMapHandle 5680 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8818c399-a791-421e-bd02-1797651e23a6} 916 "\\.\pipe\gecko-crash-server-pipe.916" tab4⤵PID:384
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5412 -childID 5 -isForBrowser -prefsHandle 5884 -prefMapHandle 5888 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18d3e4bd-974b-4537-831e-402bcf38c3d8} 916 "\\.\pipe\gecko-crash-server-pipe.916" tab4⤵PID:4024
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\activity-stream.discovery_stream.json
- Size 22KB
- SHA256 60204bb53a0a5f6d9920cb52d90c9526a76f538ca2f08a0e0522b722bfc0c8ba
- MD5 78e3fd228527470d567e63fa2e6dcb9c
- SHA1 b1b623425409a4a2546b3f1714f8cefc53d761e3
- SHA512 1e0132f06c0ffcfe65dadf70e1e1afc051ec6ec9771ca0c6f71a298a623a2146e0161a222cbcbc68d5df1c5984f0002c6ddefb23c18c67b20fcb026565eac0b4
- SSDEEP 384:es0AB3YwATX+/AZ3rIqxGgRctkITSvjBUydJyc9UK6XTOUYwcmBR6qyaujuqZqK7:eSB0DlZ305g8MNJOKiT0IR5ydjrgK7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 7594933b97de321988ae81ec1f5ad2e6efce136e06e4d4d4ce46d582c67f03ae
- MD5 484b2fa1189f4bcc4999868c274aa082
- SHA1 cd8f950a20da9984108ba98a4d86b58d00e49d5b
- SHA512 c2fb05106fa3cf661094cd011012c4530aef2545357924f56ff12fb968ddd3fc2cd92f686e55f077dfb3a052c0a383e8d90e0b285521f6249f5f7e817ddb8a0a
- SSDEEP 384:H485u9fiGLm4pUh3ft2WlOX8lPLZZB7t0lpDIIxjvjO:nUBi8mCUdft2WAX8tzB7eD8h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\cache2\entries\B68E3033124AEF93BD74E740FF3849EE78626BD5
- Size 13KB
- SHA256 a02212cc14d56a15547629f6e055d054481d8f741ef4951c9c142c95d56885a5
- MD5 5a7d6b7d7c6cad347430fc96f29a5111
- SHA1 a9907d8c84aa0751cca0d152809f4ac8489a2e75
- SHA512 9b8067c3e4fc9f7d8cc81bd2480c4f45436e31e52bb2911e6bb662f7b33baef89c4f3235a235218d4cb0b572d214f2ff2e3d5f58aa2320cee9dad730f7438ad5
- SSDEEP 384:HfOu9fiGLm4pUQft2WlOX8lPLZZB7t0lpDIIYGOpeGOpZ://Bi8mCUQft2WAX8tzB7eD8TZeZZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\AlternateServices.bin
- Size 17KB
- SHA256 f41cb487ba63302d752a0c852de57463a7914335dfcf8e65d9c3f744b6beb8bd
- MD5 6e26185a6f71b07073f97d11f967fd03
- SHA1 95921f0218c1a82ca4881f829ddb9b6a76824f4c
- SHA512 1e443aef7d345b90fa0d0f67f6a34f674b2071aaf27a0dd7d1a7c31cb4b99dbb433a71630af2dea4e8a9d24c340d74be1c2f63b69023eb2d248321887ebb1d37
- SSDEEP 96:rPdJ5ourPlVnLisebOJQbcJpebvpf+Ubc9bSbh2gbgzSbq0b9bXZb1bL/4kHVbgO:z5Lu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\AlternateServices.bin
- Size 12KB
- SHA256 b40084c5c99caef45f2f95136cee4b9d688cafe11f966c982e5e9c8ec4fdaa74
- MD5 d10e5a1377ae3e382716bff3b9891215
- SHA1 fb9a5951036efccfa84d9dde9a32172783572e2e
- SHA512 90b4af896588a98dca68593dd7cc7c0bb8ed6adb12af227c0e1883b349d39cfd3d863748991bb149796c532d0740e33c98be056ede6ac1ec1e72a8a99d498ff0
- SSDEEP 96:LdJ5ourPlVIWisebOJQbUJpebvpf+QbI9bObK2gbgztbB0bCb:z5WSu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 ffb9c5d8a864506b2061b24304a569a9f6586822d08878382e5855121a55112c
- MD5 f229b7c0cb9cd14979f4f768c35aaa15
- SHA1 8866954523724d072e559ced914dd4ef3acdff4f
- SHA512 a7f9878b6fb2657a8c8b1a96f982ee4d63ab7db0357ddde67b2b7cba6ae50b2745ed5e018797b3a5fc209e8dfa30bc3af46e912d90015b2fb8baee64bb12c31e
- SSDEEP 96:lSMF9ZbkW6ShmtBPP/PrWZX6QlEn4Fl66JozGzgClKtmSS:lrvZboShw1PCZL/66JozGzgCl6mSS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\db\data.safe.tmp
- Size 16KB
- SHA256 cfc4901795a8f8d96bb7913c8fd17d0b76e34a8dc5a840b83abd3154161f6709
- MD5 230395831bb07a42927d45989f15e72a
- SHA1 2d7b96c2d4d98d0491fad425dae009125ebee489
- SHA512 a2a1cf90a304c8430edfdc29c4263be62f063aefec84e8d37f4063cf9e38760f4833e4b52e71e76368871b117dbeb33f31eeb6a76d8278145b920fef2acd0c4d
- SSDEEP 384:b/66JozGzgC1b9TeNJl3Djn6fb42baEKbog1z/Pp:WE/8RDjn6fb42ba9dx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\pending_pings\4a0dd28f-2fe4-4b7b-b20f-2a405d9e9783
- Size 27KB
- SHA256 3c6458e60e77b81ddbdd08efdef8c43100d0cf1f9d94988dfabbbad24565e4d4
- MD5 2133c68957f9e0134bd84e3e2ac148ae
- SHA1 52b96a3305f4c5a8ab97ab53bd56f3d113747985
- SHA512 f0ff3973601b468b0652622e62df9e7ebbad7ff30a99aa12e2eb3a2ef9771cc994a980fc7ce7ba9a216cf14ce42e570ec04221edb919c67850b024fb4ce82751
- SSDEEP 192:Oo1AiJfkT5JTFDUMyitNoOj2aAiNArfvpxJmzFNsPHDYVwxy99Da1qRU3b5DfDUP:O4A9UIibLzxnt23Riab75TM1gxH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\pending_pings\858ce1b3-5d9d-4beb-a204-2cdfd5f470e6
- Size 982B
- SHA256 1aac126e4fac7e0f8bb1999621747686907b87fcafa931c92e9770108196ec21
- MD5 e12ad406cb83ac9e106514b96ffaef93
- SHA1 ab8fa407a0944f2298ca734c04834d3c96090460
- SHA512 b8db9374ac5cdf43dac3f01ceae132e3f0373bd3950e50f2bb0ca58e5cc481ff6422d2cd417c884de1970d334dbf4ed1c6ced7cd00868b0a23d6bfdc2f4f2671
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\pending_pings\dc1f80e7-5cf0-446f-b392-5e332ec3710f
- Size 671B
- SHA256 a2c0803f3a6e3eee7451036dc4bfa2a58a38ece8e774e68bae652088942607f5
- MD5 8a31ede4d445ef40b98614e89cec0b59
- SHA1 3c2a93663a4c7d94e9108e696f818e8c4a4906a0
- SHA512 54dcd2610b68aa7b28e3757f19614d1947fc313be239ae117873ca06c367c26809e512fbe97fe38682a3077af971bef13940d4cbce510fd3298ea730e63b0e90
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs-1.js
- Size 12KB
- SHA256 05af9adbed043e6928c956d9af22955ecc20d9b4baefcc6cc8f523094c480a24
- MD5 bc871ae7d5c985d0a43265db49e029cc
- SHA1 db1b66faf11d7f35affe7ebeda8b0b3feb833683
- SHA512 7b8f291513b3d3907c08dba58d4c574d25a785ae97e5da6e3766123cc8e8de4d1a64b00e5820ef1198133ec2234bdac78055b0b11c9ac018b466d841e47eefcb
- SSDEEP 192:em5njKRYfICoxvXUPzwi4/1cdyzC2QHri60VaXTPlw+Bw8H88kE:em0ezwXa4zlQLBzRwp8F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs-1.js
- Size 16KB
- SHA256 5e93196ec54035cb11c975630f95eabbbbe55ca1f005658d5e7f7632e6f5f27b
- MD5 6b0b49a1b3b2a46d3b396d8e42382697
- SHA1 c01c2df4f9b0842f9598b8809a34c3ddae5e7821
- SHA512 eea59ca114fc19f8a7a065793ab6cebfd6a52cbd4cbe0eaa041523173a6223c0e5ae12138b014dda9aac209234e4c3d66afd690584c1404ed092aa5b31e41ab1
- SSDEEP 192:emSnjKRYfpCoxvXUPzwi4/1cdyzC2QHri60VaXV+PlwQiBw8H8n8nfBaT:eZ7ezwXa4zlQLB88wpOO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs.js
- Size 8KB
- SHA256 d74e84c55522b0916726065502c000885c05f1178a8f31bb321f445e0467a62d
- MD5 ac44b64e927882cc7543f5878734721b
- SHA1 e37aa4ce31bc2c1344d37099fcd2524525a08042
- SHA512 58bd4ca12eabc53b2ccf6d1089e9563869c177c6003e70b7dd4acbfb3a9e3bbb3e7cc7a66dc001505c01cd69c98ed5ddc6133b19db5839c10edd3e09d7c0490e
- SSDEEP 192:Jm5njKRYfIY4wD6cdCj60NaXWPlwbBw8Vs:JmxDHkGGyw7
- MD5 SHA1 SHA512 SSDEEP