Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
19/07/2024, 23:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240719-3wpw3szfla
- SHA256 3e10227729314360aae35185ad417935965aa7e079192ccee034abddeecf4f1e
- MD5 84fbf6b5a3abedc25b356c8e7ef33850
- SHA1 4f8c4b8cd3178df7ee23c4146ecf25aefbb36b44
- SHA512 b127241f6ee9ef39b5aa67628f8b879619679db39c33f5f4e89ac52f78bc79ac58b437f4cdc86e3fb3f0b4416eaf0e91f16daa0e4947c84f76c44129cc6a227c
- SSDEEP 24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aLT2Sbly7TWEPje:LTvC/MTQYxsWR7aLT2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3624 firefox.exe Token: SeDebugPrivilege 3624 firefox.exe Token: SeDebugPrivilege 3624 firefox.exe Token: SeDebugPrivilege 3624 firefox.exe Token: SeDebugPrivilege 3624 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3624 firefox.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe 3564 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3624 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3564 wrote to memory of 4000 3564 file.exe 87 PID 3564 wrote to memory of 4000 3564 file.exe 87 PID 4000 wrote to memory of 3624 4000 firefox.exe 89 PID 4000 wrote to memory of 3624 4000 firefox.exe 89 PID 4000 wrote to memory of 3624 4000 firefox.exe 89 PID 4000 wrote to memory of 3624 4000 firefox.exe 89 PID 4000 wrote to memory of 3624 4000 firefox.exe 89 PID 4000 wrote to memory of 3624 4000 firefox.exe 89 PID 4000 wrote to memory of 3624 4000 firefox.exe 89 PID 4000 wrote to memory of 3624 4000 firefox.exe 89 PID 4000 wrote to memory of 3624 4000 firefox.exe 89 PID 4000 wrote to memory of 3624 4000 firefox.exe 89 PID 4000 wrote to memory of 3624 4000 firefox.exe 89 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 1700 3624 firefox.exe 90 PID 3624 wrote to memory of 4716 3624 firefox.exe 91 PID 3624 wrote to memory of 4716 3624 firefox.exe 91 PID 3624 wrote to memory of 4716 3624 firefox.exe 91 PID 3624 wrote to memory of 4716 3624 firefox.exe 91 PID 3624 wrote to memory of 4716 3624 firefox.exe 91 PID 3624 wrote to memory of 4716 3624 firefox.exe 91 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1920 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2de94eec-c3ae-43b6-bc05-040da97b6d9f} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" gpu4⤵PID:1700
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53c6659e-bb42-401c-bf6e-acd2838fcc9d} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" socket4⤵PID:4716
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3044 -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 3032 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36fc59a4-9543-4da7-8bf0-a2830988645c} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" tab4⤵PID:1460
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2640 -childID 2 -isForBrowser -prefsHandle 3684 -prefMapHandle 3680 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1df6636-ddbf-453f-8588-c5b4d8889f20} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" tab4⤵PID:4172
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4512 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4484 -prefMapHandle 4480 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ab008a5-75bc-46cd-b029-de477ea7098c} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" utility4⤵
- Checks processor information in registry
PID:2428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4836 -childID 3 -isForBrowser -prefsHandle 5268 -prefMapHandle 4736 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94f345ff-09b7-4e80-b7fd-cf418951fc3e} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" tab4⤵PID:3544
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 4 -isForBrowser -prefsHandle 5524 -prefMapHandle 5532 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc91483d-56a9-4777-b697-f3776aa82efa} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" tab4⤵PID:3392
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5724 -childID 5 -isForBrowser -prefsHandle 5800 -prefMapHandle 5796 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53177777-24ad-4262-b28b-6019826af1b9} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" tab4⤵PID:968
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\activity-stream.discovery_stream.json
- Size 22KB
- SHA256 f3bb7330f8c6f511858dcb280037d58dd9842045155d2137b4df5c04632a549b
- MD5 57b5056ee0b7b6efffdc9f8cb9f6da65
- SHA1 dc301687913ab03dffcc3c519bd4d060d7e14e63
- SHA512 fd61a9d6e6e6d7e7c02a2592d545d0aa4a8dad168fdfd93024610d3d902abe7bb96422257782ba98df149e05fb5297f95bcda9dae84c9e2797d7743c8bcfe5f6
- SSDEEP 384:9Z5CJ42k0ecG9wF2BScGQcZ+NwWaUvc2KEHO9h0A5aUtUFyaule5:MfYfU+NwWZqU1Fydle5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 15a074bf809ad32119031f9e4e57fa9412342f67e15f85a28e1774a315836d4a
- MD5 d084b3846232b0888c3c2235b22eb825
- SHA1 9dfe1a1caf0eed00cff93d701dd865390e989d33
- SHA512 e4eef8f9daaf63fda03fb471db68e26b7927cef654bfab19f21bcf7a5c8a8cef2373440625b5bc9a3d8304a62c558b2ce57f8ac494ca56da4f07c1e6f6b6d12c
- SSDEEP 384:H485u9fiGLm4pUIft2WlOX8lPLZZB7t0lpDII527:nUBi8mCUIft2WAX8tzB7eD89
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\AlternateServices.bin
- Size 7KB
- SHA256 e2c3f6885511564eff3ab23b186304bc955d0e284f7752bf6321f5154ab501f3
- MD5 0edea7d164ed77170431fa5005d74986
- SHA1 3e9e620ee20c291c2f4816f0c02d31ad35b661e2
- SHA512 6caa8abc2d3d7c204a6bf00a7c6a429b3488bca1c1b3921c493578d2715ca4fcaa399761403ef8ec005107376878cba8d98428dab8e245de04c02d20924ab771
- SSDEEP 24:PuB1oaDgu1xgRbSXpR5cO9guhMZSc3Fsh2F3LFk9TQahsJbF0Jk9Tcb:+5om9cOWeQ+ebOJucb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\AlternateServices.bin
- Size 17KB
- SHA256 cc0d5fedd1c62f812f1f85805a57e6666c10747bd977634b4f465a8077e19355
- MD5 f1f6a46afcf88fbdb0ea9b6ddfa1a6bf
- SHA1 36627cbd02eb4d5eacc913e2ca2748d1103c8d54
- SHA512 2e06c3348286e5b320f42a5ffe75719a8211495a170dcdb1d2f2c0f8a8cedf97f8f6e87e6c1f2cb82790dfe4dbe680d2dada11c55d7c16065e55fce0853c9d7f
- SSDEEP 96:a5oIDrZWeKebOJubbvpebvpf+FbTb7bxgbgzLbgbEbnbPb6HVjbCb:a5pDrP/nu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\AlternateServices.bin
- Size 11KB
- SHA256 ea09ccb74a1353ed83a18ca599f84516a2e8e0f4ee3183e8c6e58fa29721fbef
- MD5 cbbb28f8a65e28464f0592afe59c95f9
- SHA1 b24da5c51bdc135ecdba8c9bfbe79290db764cfb
- SHA512 d0b11128c933f5ff3e3c53a687adeab61f299241e44da1edbd34a71cbf359d281a98f3d03928f0252fc844513451b31069fcefca4e85f913e42d21f07a27ca97
- SSDEEP 96:S5oIDkeKebOJubbgpebvpf+ubb0bYbxgbgzLb:S5pD7/YuJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\AlternateServices.bin
- Size 13KB
- SHA256 0756cf4bd060a6d7d5ff9a30d726a48d53647c8da31e95bfa6733a3d8d384027
- MD5 1d0212b25964fb9392dfb202fd8259e8
- SHA1 e3cb103bbffd138508b1e400754c60b0b84225f8
- SHA512 3483a5525484bdd2245652f43a1235a3d6b519db23e2c272639febfe43a2e3d07ee4d26306a4728310c32e2bc44c4b197ae869b0ad941bcac2b6accd887ca395
- SSDEEP 96:S5oIDrZWeKebOJubbgpebvpf+ubbTb7bxgbgzLbgbEbnbPb:S5pDrP/YuJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 0eafb5a7b7afec4ef45462e2ae5e7ada67560f8b19b1399b66bbb76e5b24a68d
- MD5 dfa2d04720715be3343b73e3a305982f
- SHA1 3705a874fd8d944d91c8cd1fb4ddaea156dbe894
- SHA512 afba7161ab3d7b6ed531ac416fc5b73baee6ab920c079e0aef3c80caafa209e474e594d822858cfca7629a4018d2704190a03b07e9a82f8f39d3c426681458e5
- SSDEEP 96:3GQvz6f6365Fl66JozGzgClKtmSSOCSMF9ZbkW6Shm/oPP/PrWZ:34/66JozGzgCl6mSS1rvZboShmePC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp
- Size 16KB
- SHA256 e53ac3e22838bdc59c7951449aa1276b23201435ca0430629ce1736bee41928e
- MD5 f57b35431ca3b8aff6048c172f059dab
- SHA1 a142180a9a62325d26c759a67d483efd8ef2fe54
- SHA512 3e8f8d8b9c90e6476a52f9c120e6fec2e2162af707e7e13a3ffe3a2929e5c3e19c7d27d75eff9229b98613977ffb957d3db00be5806cc1c186a435a51880ae67
- SSDEEP 384:6boWbEXP1dbeu/FRKuzqDd52bblbGvk/66JozGzgC1bM:uaLbbK8qDd52bblbihEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 869e88c7b7ad7b1477f16b6f9416f164b40857fc034b0d61fd8cbb95b9496000
- MD5 3900df55511b5f4cb0f799650424d082
- SHA1 4763302cb2999ff98f81ffb5974050ca01a65ed4
- SHA512 1f1bfbd0743a32d7d5fe6f5ba45ea255ff9fa80e1b61484fdbd6d1a1f48cc8f087a6762d59868a34899c81d595042e4655a9d21fabd8598e82bd23bc9ca834b4
- SSDEEP 192:TrvZboPehwc0ePDfG4/66JozGzgCl6mSS:pboWWAPR/66JozGzgC1b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\13631055-e37c-4314-939c-6e510c706db8
- Size 25KB
- SHA256 854bf6f3c8dde03bd3c1168dd3d65a24597e3409125226ff8a85c0a33f3d10cb
- MD5 9801ebde141ac8197851fe3ce2c19fb2
- SHA1 20e1c7db1ac65e8d03f1a63d6c180ad35ca34540
- SHA512 2fbc7fa978c2943ab84427668e090feb421360a278943800920e1c3279fec282dd43c37fe59c8aa44f9780c799102ce31c573bd369c68c04bf61475a92b6a316
- SSDEEP 192:6pQjBnQMCrkZJbBKmJWfudQzdQtWEtqk06PujdyQuczY7SzxrC7oJERd7BJVDDvi:66lwYXj5Q9ENiuMUSlO7oud0Ux/2NT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\837afbfc-5a58-4912-8cc7-154b38b26ede
- Size 671B
- SHA256 7907c43352bad2f95e10987dc39afc465cd388b1a36037e366c0cfb18f6a32df
- MD5 b60e3ae0047b94911b22b52b41932302
- SHA1 40c57f824f75a7358932aa4e6f25a1c36b5baab1
- SHA512 c6127831cc4ad15ff7d2aa5e4b7d3f9be6d88a0408423db2f6f92ffb67c84c329531832fef85a1448cd30efff0bc022093bded3aa8608460c80d9879953f464b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\ef9c87da-4895-4ae9-897a-63339b1ae75b
- Size 982B
- SHA256 6d1acffe98406b6f3aa2ff5fc961ad7260722eaaed208ea8715e5e233fe3185e
- MD5 98d7cb75a0e6e50220ec4d688c479b24
- SHA1 bede691ca71f5c73a3a28572571c74f6d4a97e2c
- SHA512 3be0d221a430a5ed287313a0454ac2407f3795b92459cfce33bfc0f74e61ff3fe1b08d28db408f7101c8ed928dbc45f67ae8cb5d6694718f0864a12ed6f8e1b8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs-1.js
- Size 11KB
- SHA256 b978b2675f63462f76849d02ae3215ef401e7a9fb88fa41d912bebea247530ae
- MD5 4cc8c958dc0b83e005409e0087e70728
- SHA1 6588170cc509c0a8499d7d24d8423c026ec3e306
- SHA512 8be2a207cf1e62f7bb895a1eedcb6e9ff3402f6048e07c870a8403556402a09d3cb4c5d90f57e5f28189006079917676e3133d5bdd4faf5fe417863788a90f3b
- SSDEEP 192:p5nLRdf4HaiaCKYNd30Vx2qcdH9YbdgdB1I0c60yaXC0pE4DBw8Hl:TFpE0cN9l5lz4dwk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs-1.js
- Size 12KB
- SHA256 771bf7202e2c159234aae0bb4098ed798c6384ebdc0cfcd892cd01b92c0d49cf
- MD5 6ace1b3c9927718bb2aeab2b9c1452a5
- SHA1 4e498f44346021c322cf1d14d577998e75c365b7
- SHA512 0abb9f02d7bc52eb6fbe7d137c30c56783cc86f8aae26216dd0dbf762395c257c45b73dc7ca4de34017ee914cf7917af826da8afef90de551f09c14c1d44fdae
- SSDEEP 192:35nLRdf4eqiaCKYNd30Vx2qcdH9YbdgdB1I0c60yaX70pE4XBw8Hl:RUpE0cN9l5Yz4xwu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs-1.js
- Size 16KB
- SHA256 44012cc3ba88556f038d5e7dbd33a05349ebb9fea0dba40f69c16240e28f55b2
- MD5 b42101a2ef939fc76ba5213bcf767aa0
- SHA1 726f702993926a2c3e9f63e11e4c352caa9d0ed2
- SHA512 81d8e7d574b913826f2fb218a7815b15eb5143ddd80b935cb1b08374f0957131354c871059a5b87ec83a366459c94bc5310c8ea297febdb51e8b00e78e2c3d53
- SSDEEP 192:3KnLRdfYeqiaCKYNd30Vx2qcdH9YbdgdB1I0c60yaX9+0pE4iiBw8HyLHJGN:UkpE0cN9l5lz45wXM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs.js
- Size 8KB
- SHA256 b1525e88b3bcea1be0a46748291bea205bb4ee2b126e22837ed2b0d49358d8a3
- MD5 53e4504617fccfbead6813203ba671ab
- SHA1 ef1ef8824b5028d2b5cb62fd4559ff4f04066904
- SHA512 a93e6bdec08dce68098a6d71303dd35562b5b7d6529dee731e1334db0afe89724c766f5d48202aa28db5d58488afd0104218e9f5fc08b2944ad0e1d25c2f5648
- SSDEEP 192:p5nLRdf4HaZD4cd6l60qaXC0pE4DBw8Vl:T1D9AMlz4dwG
- MD5 SHA1 SHA512 SSDEEP