Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
19/07/2024, 11:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240719-n31vlashrh
- SHA256 7912ad248bf2d4e42152a79a6cf7cc39125aa8d84a3cbee325d9ee71c2a97433
- MD5 b5bfdded8a5f4bfb05cb5e000fa78378
- SHA1 74eb9b66061e5f981199fb5fa73fe271e8cf1aad
- SHA512 0c5d5c0bf6160374552da783271f7287924dc021efb58d30c34475859c00f867f410e43d27ef4b93d31b457c0393934755744b5f5abb432a90ef67b1159b4052
- SSDEEP 24576:rqDEvCTbMWu7rQYlBQcBiT6rprG8aLt2Sbly7TWEPje:rTvC/MTQYxsWR7aLt2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4716 firefox.exe Token: SeDebugPrivilege 4716 firefox.exe Token: SeDebugPrivilege 4716 firefox.exe Token: SeDebugPrivilege 4716 firefox.exe Token: SeDebugPrivilege 4716 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4716 firefox.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe 4208 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4716 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4208 wrote to memory of 4520 4208 file.exe 89 PID 4208 wrote to memory of 4520 4208 file.exe 89 PID 4520 wrote to memory of 4716 4520 firefox.exe 91 PID 4520 wrote to memory of 4716 4520 firefox.exe 91 PID 4520 wrote to memory of 4716 4520 firefox.exe 91 PID 4520 wrote to memory of 4716 4520 firefox.exe 91 PID 4520 wrote to memory of 4716 4520 firefox.exe 91 PID 4520 wrote to memory of 4716 4520 firefox.exe 91 PID 4520 wrote to memory of 4716 4520 firefox.exe 91 PID 4520 wrote to memory of 4716 4520 firefox.exe 91 PID 4520 wrote to memory of 4716 4520 firefox.exe 91 PID 4520 wrote to memory of 4716 4520 firefox.exe 91 PID 4520 wrote to memory of 4716 4520 firefox.exe 91 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 4924 4716 firefox.exe 92 PID 4716 wrote to memory of 3164 4716 firefox.exe 93 PID 4716 wrote to memory of 3164 4716 firefox.exe 93 PID 4716 wrote to memory of 3164 4716 firefox.exe 93 PID 4716 wrote to memory of 3164 4716 firefox.exe 93 PID 4716 wrote to memory of 3164 4716 firefox.exe 93 PID 4716 wrote to memory of 3164 4716 firefox.exe 93 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {44065364-e734-4143-aafd-53e6a933bb18} 4716 "\\.\pipe\gecko-crash-server-pipe.4716" gpu4⤵PID:4924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb15fceb-67b7-4eaa-b764-e376eeeedd9b} 4716 "\\.\pipe\gecko-crash-server-pipe.4716" socket4⤵PID:3164
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2940 -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 3124 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5f7ef93-7865-4db3-be9d-67c979c81478} 4716 "\\.\pipe\gecko-crash-server-pipe.4716" tab4⤵PID:3188
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3960 -childID 2 -isForBrowser -prefsHandle 3752 -prefMapHandle 3856 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c8f257e-85a0-402e-a01a-30ad29cf6887} 4716 "\\.\pipe\gecko-crash-server-pipe.4716" tab4⤵PID:4880
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4600 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4776 -prefMapHandle 4772 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {799a75d7-a18f-4ae1-b3c6-24f4867c1382} 4716 "\\.\pipe\gecko-crash-server-pipe.4716" utility4⤵
- Checks processor information in registry
PID:4668
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5620 -childID 3 -isForBrowser -prefsHandle 5352 -prefMapHandle 5384 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {edb61c24-52a0-4a55-b029-fcf92f8b7815} 4716 "\\.\pipe\gecko-crash-server-pipe.4716" tab4⤵PID:5096
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 4 -isForBrowser -prefsHandle 5788 -prefMapHandle 5784 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab459018-4068-4a11-989b-321ae9ca60c4} 4716 "\\.\pipe\gecko-crash-server-pipe.4716" tab4⤵PID:3928
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5696 -childID 5 -isForBrowser -prefsHandle 5924 -prefMapHandle 5928 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a32eefb3-0019-4b43-a45a-47760cf5ca7a} 4716 "\\.\pipe\gecko-crash-server-pipe.4716" tab4⤵PID:2448
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85t3rifc.default-release\activity-stream.discovery_stream.json
- Size 22KB
- SHA256 8ab31f3607ca07406f284f37f0b78004009c67f5de7bf343c983ec5625325379
- MD5 6a1688ebf5fecf3774ffe1222361f322
- SHA1 a8ff5a2d46670fba87e06d914e26b48ca2267e59
- SHA512 561958bbaca7d3f2146c007973aa6d9ef2aa33261412d4488670278d88baa324fca5e3f11ed16e2bbb0271b4c3a96d2b05a60f18af562f7d5c0c46d9db83d655
- SSDEEP 384:kZ5CW2F/PnoIwUvcJcp+akVE5wWRGQj9Uo0AWnnOt9+/AZ3rTyaujfTJCxLTJCxW:p1XlL+GwWRnWnu9lZ3Pydjsy+7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85t3rifc.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 30120bef56df638fef322920a294084a1f2f7703b5783339c1090b8a58032fea
- MD5 291066a45b1b4f0c09cab713ca058004
- SHA1 f257d0b70ffe8abb72808605aece8c194c37a4d9
- SHA512 9d37fe46c1d7a9ecf8c0ba6d91e3c1c5a5585aad41e6622e13ba7030d92edc84d32342fba65c77c6eb5cdfa1c121a4c9fa983dda04ae31b88d223cc3b963b286
- SSDEEP 384:H485u9fiGLm4pUnTft2WlOX8lPLZZB7t0lpDII0PwPs:nUBi8mCUTft2WAX8tzB7eD85
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\AlternateServices.bin
- Size 10KB
- SHA256 8e13317b1108d6adf2b1501d291b72fefc48fa7c042690709e88aba8c7ed37da
- MD5 800a3f99fd1411f465055d2fc49f0806
- SHA1 76b827f07ae55ce27f4b91a377f68f881c2898d5
- SHA512 c635ab3bc6c43c1a9403e34adc221f3323ddbc5ff3526ea059585fdc5b965fdc08d2e145f371ffda0bb0c30d6518b2161c241783d006868cd08286dd68b39821
- SSDEEP 48:y5o69cO3ebOJ13bPpebvpf+t3bBgbgzD3b:y5oSebOJ13bPpebvpf+t3bBgbgzD3b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 b43d130fef73550f3c1ea7403aaa30df431b0740563296e64e815383d4993b31
- MD5 2b6ba5d17209d8c6dca9c1d50e84f5c1
- SHA1 efe4fa37439f1cd219d3c4c58693fcb5c84e0af3
- SHA512 883c523d7d0f7c9065ea3f1df9f8fd392f2e45b55973dbaa9ca383da99a1b7a5d27c953e6459d279727454733915cd905839ad43039a4a5ec4058f7852410cff
- SSDEEP 384:gg0xyrI71jAjxD6s/Hb3bQF/66JozGzgC1b4boSPzPJ:F0xyACD6s/Hb3bQYEWNx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 1505302ddcf6fa5870cfeb12c8f5a481f9129be97eab81bc71679e6d4ce9248c
- MD5 3fbc5d46f9efd614d87e12fa8f02c0c2
- SHA1 12b2574e66416985982927a854ee10b69b049ddb
- SHA512 f8b8edea2f24a9a3b02a6c88d33622f2eaf261f4503fee171fea21aff97d5d6ed5581c276f121dc5119880bd6126c11d81ec93f89ca6707e67cf9be43df30db0
- SSDEEP 96:ESMF9ZbkW6ShmsvCPP/PrWZG+Q1rPjeFl66JozGzgClKtmSS:ErvZboSh1vkPCIy/66JozGzgCl6mSS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\pending_pings\0adc79c6-f090-4f74-839b-90056e00c780
- Size 26KB
- SHA256 5e97607c01ffb164036072997f14581a476e73b5b9daeaab24ac8c038abe86c4
- MD5 b25c862279eb4941188c01584787a97a
- SHA1 d402369d7f3ac6551ab9bb763735da7bf7790460
- SHA512 6fee3a99c94e45d224b811c9abac28bfd396222e1b3b9e5aaf3636fad08e2b44be6c32f569cdf3687dd0ece5a8e28de9819ce64bfec45132a8530b3ba18ee893
- SSDEEP 192:o229LwOFu4AMXApZuDsYsxNi+GYPXLalC3yWMcpLbQsxG3T1IpSDhqqvmBWj4+4n:oBbKtMCGPYWTVyif1VCR/RCNb7ShBPJj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\pending_pings\515ea339-7630-4284-9ee2-3d47fece0ee4
- Size 671B
- SHA256 59c92b91c2b88f1560d8a66d53468c145ab9a5b7b4f5ccd455cb95cdb9e53fe4
- MD5 f20da0850fbd2dbf18f56bcafa2840ee
- SHA1 b6e7e4c3f5b9180c6dec43a9e2207f248ae4b385
- SHA512 f09cde1e7fd8d3147436eb344749b3ecf9040e8c3f05727f1c3c7dc599bd62f775f686c0bf77b964f7692f10efd8a41348462b21ec71c561c6cfb499a1467bbd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\pending_pings\ba435315-8da3-4dc3-9eca-ecf6b65dca76
- Size 982B
- SHA256 971a86aec0f1a2829c918fc05635c72d6b02c6226609cfe3c23c68e232830175
- MD5 dd5fddef44a3ff56f78ec551ad7e39c3
- SHA1 727d7ebab60bb43844bd8cbfb196ee25045af956
- SHA512 45a47a1982679ca36ac58b5cbeb5dae0ba32e689c97b7a331ed9f7bd13c01435254f59f5c7827546939ad31da3629ba28098e24940abc4e41cdaf58764f06f0a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs-1.js
- Size 11KB
- SHA256 56352dcf0158b2dbe88c47db31a8d811c74ccfdc0839a4578e479076629a35e8
- MD5 05564a1c8891ef36289e1b642ada6e53
- SHA1 7514e4017d5d700ef07b399ab793575d81f40a5e
- SHA512 7d1cd873143886a832efd3b205660904a0d1410e39ba682026c6742c1e7154812b6eabfdf9bb4aa16585a29bac1a4fa6d684a614c260094bd1c0cc2a58f304e8
- SSDEEP 192:k5n1RyQfMU5f2NazlYSlOcdHKz/50QHrg60NaXb2mP0yiBw8HJ:9Q0NazlYSRJKz/+QLb32mUwg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs-1.js
- Size 11KB
- SHA256 93b0cc0d2f6d47efcce149580170ca3cecd1e8364a5e8d929929bdb9d276008d
- MD5 3cf7b96588bdcfd69fe8c0d21dbb09e1
- SHA1 83d297a7d15b9a3ed2d471e50180fe47a19b1f43
- SHA512 7dc85575fbb2ada619e0367320299a3831627d287dee1384d3d6f43a03b12726964097481bc675b5b105f52f585d3fd8c69d2d92d668ed4dedf676d0c0a480f5
- SSDEEP 192:G5n1RyQfMU5f2NazlYSlOcdHKz/50QHrg60NaXb2mP0y2Bw8HU:3Q0NazlYSRJKz/+QLb32mIw/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs-1.js
- Size 15KB
- SHA256 e95b7ac6dfffae77ae7e1379c8d2ee68a5ebbec76c5d059cbbaf325467bd21cd
- MD5 a1db6f7627725c32ccac66451940e25e
- SHA1 89c004261833467987daded684206548a87ed10e
- SHA512 682ad7b8548bfc5f24123fe87e36078caf248ca7fac790734ea9bb903517cdf26b971f64e8d53777076b7203ac4cb8ac783aab3665037d0ac21cd1e034be383c
- SSDEEP 192:G6n1RyQfUU5f2NazlYSlOcdHKz/50QHrg60NaXd+2mP0yABw8H43PpiA:yQcNazlYSRJKz/+QLbI2miwJD
- MD5 SHA1 SHA512 SSDEEP