Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
19/07/2024, 03:11
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240719-dplhmstblh
- SHA256 290b60fe1b5bf475c352faa81824d0bd12e22bb06572dd5593421a9c308c2c53
- MD5 66d3762e66d57b6082e958a358bcaf4c
- SHA1 abbe3276291ab43c00998c53b62baa3fca7101ae
- SHA512 797f3da0c4bf4b0540e17623cc0336b44a8c72f9d2dc09d3ca22d78bb74cf5441d71be04016ef17565886bcfc14afe822f0cae15335ec766aed9cbceeb3ac5bb
- SSDEEP 24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8aLI2Sbly7TWEPje:CTvC/MTQYxsWR7aLI2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1056 firefox.exe Token: SeDebugPrivilege 1056 firefox.exe Token: SeDebugPrivilege 1056 firefox.exe Token: SeDebugPrivilege 1056 firefox.exe Token: SeDebugPrivilege 1056 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 1056 firefox.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe 5012 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1056 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 968 5012 file.exe 90 PID 5012 wrote to memory of 968 5012 file.exe 90 PID 968 wrote to memory of 1056 968 firefox.exe 93 PID 968 wrote to memory of 1056 968 firefox.exe 93 PID 968 wrote to memory of 1056 968 firefox.exe 93 PID 968 wrote to memory of 1056 968 firefox.exe 93 PID 968 wrote to memory of 1056 968 firefox.exe 93 PID 968 wrote to memory of 1056 968 firefox.exe 93 PID 968 wrote to memory of 1056 968 firefox.exe 93 PID 968 wrote to memory of 1056 968 firefox.exe 93 PID 968 wrote to memory of 1056 968 firefox.exe 93 PID 968 wrote to memory of 1056 968 firefox.exe 93 PID 968 wrote to memory of 1056 968 firefox.exe 93 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 4192 1056 firefox.exe 94 PID 1056 wrote to memory of 3044 1056 firefox.exe 95 PID 1056 wrote to memory of 3044 1056 firefox.exe 95 PID 1056 wrote to memory of 3044 1056 firefox.exe 95 PID 1056 wrote to memory of 3044 1056 firefox.exe 95 PID 1056 wrote to memory of 3044 1056 firefox.exe 95 PID 1056 wrote to memory of 3044 1056 firefox.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 25755 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {599cfcf3-0fa5-444c-981a-7107f3af8ab1} 1056 "\\.\pipe\gecko-crash-server-pipe.1056" gpu4⤵PID:4192
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 26675 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24bc0b45-c572-4ca4-831c-db1bb7d93e88} 1056 "\\.\pipe\gecko-crash-server-pipe.1056" socket4⤵PID:3044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3212 -childID 1 -isForBrowser -prefsHandle 3012 -prefMapHandle 1608 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a0867da-177a-4694-8ce4-0831d3506090} 1056 "\\.\pipe\gecko-crash-server-pipe.1056" tab4⤵PID:1376
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3940 -childID 2 -isForBrowser -prefsHandle 3748 -prefMapHandle 3744 -prefsLen 31165 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cb161e5-3bb8-48ee-87ab-019e4f32ef85} 1056 "\\.\pipe\gecko-crash-server-pipe.1056" tab4⤵PID:3988
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4640 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4596 -prefMapHandle 4560 -prefsLen 31165 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76cb817f-45ba-4a91-a2a1-671c2499b5af} 1056 "\\.\pipe\gecko-crash-server-pipe.1056" utility4⤵
- Checks processor information in registry
PID:4976
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5480 -childID 3 -isForBrowser -prefsHandle 5472 -prefMapHandle 5448 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {347d0190-470a-468c-89fa-5fa1d24f41a9} 1056 "\\.\pipe\gecko-crash-server-pipe.1056" tab4⤵PID:5728
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5652 -childID 4 -isForBrowser -prefsHandle 5608 -prefMapHandle 5504 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d318354-8932-46bd-9f2f-386de28ba858} 1056 "\\.\pipe\gecko-crash-server-pipe.1056" tab4⤵PID:5740
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5848 -childID 5 -isForBrowser -prefsHandle 5804 -prefMapHandle 5636 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2eb5a278-ff15-4652-8096-b0da7ff55d48} 1056 "\\.\pipe\gecko-crash-server-pipe.1056" tab4⤵PID:5752
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ehv06adt.default-release\activity-stream.discovery_stream.json.tmp
- Size 24KB
- SHA256 27d4f2681a492e9cc60512619627d703e7b4d61bd1b4d93a5da18af3b7294044
- MD5 15fe834ee5bee7144b8e6843a54a9a66
- SHA1 f65e125f3db029e7a5291337640d1f1ca565254e
- SHA512 21d36797f8270597c7cc278db29d0ad6f0d4a31b93824acbbb7456840f6c34836b57ed66400d68b9afc8605d3cb87bcff0f0d6e1fa1f17290cf4db497752f026
- SSDEEP 384:EUvc1ZTZ5CkwW9O4kbE5w2O+fGQFcBU9TFg0Agqc+/AZ3rcyauU0WtWG:EZqkwWQ7+fvGgrlZ34ydUEG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ehv06adt.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 c41574b4e9bbb099451807838b52cc5f16fbefd01ba4f98249ae17fe151abcf1
- MD5 a3c2374c300b7a6b97f62f2176a72e2f
- SHA1 91f11c043accfdff9b3901a223b58163f0c0150f
- SHA512 e0bce79931ee8a2d434378f01d393c5b64e61172d5fffb47d27bd303cecd2c405f280d0f71408af2be1df764894de9e46c37c4905bb4a14d704c34c6c90e2c6c
- SSDEEP 384:H485u9fiGLm4pUWft2WlOX8lPLZZB7t0lpDIIhG7:nUBi8mCUWft2WAX8tzB7eD8X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\AlternateServices.bin
- Size 7KB
- SHA256 a04d7687677aa96f094f9194e6f3c3520d09d9d566b34446916aae5146751afc
- MD5 48d9eb7b2febc0fbdc686f502c858b5d
- SHA1 ae7312592ece92a7cff05d26e1ec5d8ade5b31b6
- SHA512 2049010358eb53c4778936e7a2b9bee7533f9b00609cacec827d957538f5016748331e22fec8f13c0e09520f275330dc6e76f304529babe60068a6b2f7447691
- SSDEEP 24:PuB1o2tLgu1xgRbyvpR5cO17uhMZdPFsh2F3LF/ZFVsJbF0J/vtb:4tL5o2v9cO171ebOJ3tb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\AlternateServices.bin
- Size 11KB
- SHA256 50b26351f7505f39fe2e21716859cbcdbbcd965d0d678432751ddbaa7a7e94a1
- MD5 667d43054cbae3b5e0bb81eb8b6864fb
- SHA1 1f7e28234852cbedee2bebd0d7766616dffac4f7
- SHA512 a383a7a87bdcf040d699054e751ff0612c89eff54b01dcea8de5ab86484d5a01eb6d8d018e6d2f53e613cca8e773055dde96919c880eeb105d2f3980bbbffdf8
- SSDEEP 96:4R65octebOJGb1pebvpf+PbGbKbcgbgzeb:4k5hAu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\AlternateServices.bin
- Size 12KB
- SHA256 f9a15f141ca9765c7b0026e66b30bb043a4f7998ad505c065e69a91133df6c8a
- MD5 e6dc304cae8cdd7d21a77e299e92b033
- SHA1 474799b103902cb393be22d0312a4b457052a112
- SHA512 ca533aabeaa975679d9cf33893456e413c409f7c2d186a5fac2d7ab9bb0a3d5a98e3e80a11aa4fffe7f323873459b4febcfa2ed85fbbd627548bcba611e7bafd
- SSDEEP 96:4R65oc1ebOJGb1pebvpf+PbGbKbHgbgzVbqbmb:4k5hYu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\db\data.safe.tmp
- Size 21KB
- SHA256 26a0c9cd680c5eed73abbdc1fb52fa350f2f20135c2677159243a375f81d689c
- MD5 e0f14d3e43e71a16574f1f001720747f
- SHA1 f78bc7ef0cce627ffe1aa9d6da0314e90fd47a0b
- SHA512 c0fbc7b9030b6c2cc41734c0d32ca6c4e488678019c22b0a331db7551f2fa4295b37becaa050fa604c3799f2f4cdd146015cf4050390971c82d4c789fe582417
- SSDEEP 384:yboSRPZ/66JozGzgC1b/4Zur15l7mNchmPfy82UK8UiFUbMbFbBbObMbAbJbCbpj:2HkEAABmNnPfy82UK8UiFUbMbFbBbObU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\db\data.safe.tmp
- Size 22KB
- SHA256 4806065667dd16183c4672b099f524a99743d90f331bd624c33ade01ec5b3fb2
- MD5 e1875ff9e91eabab8558d8f2e471eee1
- SHA1 b97921bd205bbaa543781c1b20add8400a8f9658
- SHA512 b8f38c02cf7b1f4feba8931afe50d5d9ff9c0ccc33fcf7b2e75f441f66818ff74e18f2c59ac4173836946b92e21320b545919f68b2a62649f664892745e0b742
- SSDEEP 384:q/66JozGzgC1b/4Zur15l7mNchmPfy82UK8UiFUbMbFbBbObMbAbJbCbp3AD4ECQ:HEAABmNnPfy82UK8UiFUbMbFbBbObMbm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\db\data.safe.tmp
- Size 24KB
- SHA256 7aa71966a6d5f368cb1ebec0b2468aecedcf16a34860c63043c66201680c06de
- MD5 d0cef02326314928d0cf8bbb2f93f096
- SHA1 c335dc0dda16492c7d91dc4b39f037081d772908
- SHA512 d7ead4241edd519568f47fd75daf605fff893a975b06bd3bd6e4d090e6c0c247ef89d7997a7558c9b9f66ad95527cd5551be332845d912f05df1993427888d33
- SSDEEP 768:MTafnQDfykvUK8UiTcbMbFb2bTbMbAbJbCbz4fyr2/Eb82:MGPB4fyr2E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\db\data.safe.tmp
- Size 21KB
- SHA256 e67b04358c0faf34ddf8f6ef03d27d13e4a09427b5f0da8057692350833e31b2
- MD5 e35d8e098ed717d2bc36256e9d21fcdd
- SHA1 b9bc9778f349bf0ea2d9f867f882d94f8ad91e68
- SHA512 50e64fc9cf363d3da61eed9a37175203a307420a384dc62b61e1c491dc489bb09ea6fc4552323f605dbac82fe4df27954433b2c31c6dbd36ad2edf605fbd12dd
- SSDEEP 384:q/66JozGzgC1b/4Zur15l7mNchmPfy82UK8UiFUbMbFbBbObMbAbJbCbp3AD4EC5:HEAABmNnPfy82UK8UiFUbMbFbBbObMb3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\db\data.safe.tmp
- Size 22KB
- SHA256 a11ba90af96ff0ff9c79ed2e2ef40077a3a770f6691f0919ee8875d447d64794
- MD5 c051086c8b1a36746e5ff181a1562a92
- SHA1 a7c2029f1a30a71f22c3f5187aeec516be0b9215
- SHA512 ab3c5eca87de0625208faa364809e98fd637c28cc968729bb0db6c93f1596d58dadcdd6b5e329bc827a1ce3f2a31c5e91b3006d2de5fd9da0ee0ec0aa0cc5309
- SSDEEP 384:t4Zur15l7mNchmPfy82UK8UiFUbMbFbBbObMbAbJbCbp3AD4ECAu/66JozGzgC1Q:sABmNnPfy82UK8UiFUbMbFbBbObMbAbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\pending_pings\4ff71495-a8c8-4a54-b061-f405411c90ee
- Size 659B
- SHA256 e8dcdf5792b14f0e6d4388154a4638a77b1280d0e4c4a7e986dcea4acd36a2ed
- MD5 4ecbecbd8146062c9844271b05016066
- SHA1 5b67fbaa9816e65315a67b9e5053d8ceea479c37
- SHA512 6d9afafac7f6f85ef1abecb03509ec2b8fd05da37e1cc1d542cee086702714d8f4f513ae62db83102a586a8fa118f2522b19f0bad05021a5dcd7444e2a1d0316
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\pending_pings\7c456773-3448-438c-b08e-5c8293413243
- Size 982B
- SHA256 028c45abcd96cc33d361ac9cfa08da78d9495cbb42c232dc7d17079eb3034a24
- MD5 8824cc64aeec5f9c8b34982659c175eb
- SHA1 84c9a6357cf9d639906634123a500c0618e21780
- SHA512 5d82bb51132e63e103c9d234e6deec79b6a8f6dd21c18f9478fc85e265ca310eee5d01637621b073553cb7fb53ae145a3c30d07b3572bbcdda385509ffc7850d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\prefs-1.js
- Size 12KB
- SHA256 9ecfba34f6e4ccacda17660ee19bbc91d2f5e90cba0fdd5671e885c3525ca1ca
- MD5 3dc65a28dceb55215058317dc9014f71
- SHA1 d48f7fadbd8dc8e8fa7215afea183bdde781d4a8
- SHA512 8a89bedbbcc8ffaa6d64a836daba82b2eeef077561cbf44e3c7279285e6091096313c96255ff7eacbfa93657bafa09b8686a635e13177f18a5140ad1c95909c6
- SSDEEP 192:td5nfRyfYf54kOJ8DmzxfkJMdcdYZzP1CQHre60MaXHAAFZwBw8HFsr:tcY88qzp76oz4QL94AA+wrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\prefs.js
- Size 8KB
- SHA256 f93d4f51a0cd02e4fd310c5c467dd883a0c43b6685e6b51275d5aa000f55853a
- MD5 9584cf5dcb523bcfcb2c35b8fa5a8b57
- SHA1 e1c8e907803928c58d01aba0d5ec072c8dcc2867
- SHA512 8ceba13e6866314c1feb50e027e1d74b13a84cdefc50fee8c1da8adb11af3e9dbbaebff32d1dfade65a2eb8ece9eb5273156569f528d99ddc68412464abbbed9
- SSDEEP 192:dd5nfRyfYf5+F7D6cdCj60XaX1AFZuBw8VT:dcYmDHkG/A0w8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\prefs.js
- Size 16KB
- SHA256 0c837cc108e88f3503dc3b372e509d3fdba79ace4fc064a22296bf210c211cd3
- MD5 74c94f4225be6a0139ac38ecdab8f4cd
- SHA1 7c8a41afaf2c2c8306d54d5bd066e942cafb9981
- SHA512 79a85578c73b6af9ada0ed37531bdf3d818424440640d9c7fc2e767c6f318e27109c17d3e14ac3b75c35508da8dbe9ab9b33e16a026463571ba33478183bfd6d
- SSDEEP 192:tdunfRyfYf54kOJ8DmzxfkJMdcdYZzP1CQHre60MaXHE+AFZC1TiBw8HFfbn9OG:tVY88qzp76oz4QL94dAa1swG3
- MD5 SHA1 SHA512 SSDEEP