Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
19/07/2024, 16:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240719-ve5bfavajf
- SHA256 d22cfc0f1983b5a3e773f25d818c5d36e6be6fcbc1b06bdee310c76de44b3b27
- MD5 ccc52ec299cda49dcaff13e1472187e8
- SHA1 a417b9d01fc904f16b2a83f256c899e9a5cdded8
- SHA512 b2806b5661e3f8bd3d3167aec4b3fc35bfd5c562d0b3a93b831c5bce2f9f8847100e12a996be67186f2f8855406167ef00e5227b18e3f6d939af9db28351651b
- SSDEEP 24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8aLI2Sbly7TWEPje:/TvC/MTQYxsWR7aLI2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2232 firefox.exe Token: SeDebugPrivilege 2232 firefox.exe Token: SeDebugPrivilege 2232 firefox.exe Token: SeDebugPrivilege 2232 firefox.exe Token: SeDebugPrivilege 2232 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 2232 firefox.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe 3548 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2232 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3548 wrote to memory of 700 3548 file.exe 87 PID 3548 wrote to memory of 700 3548 file.exe 87 PID 700 wrote to memory of 2232 700 firefox.exe 89 PID 700 wrote to memory of 2232 700 firefox.exe 89 PID 700 wrote to memory of 2232 700 firefox.exe 89 PID 700 wrote to memory of 2232 700 firefox.exe 89 PID 700 wrote to memory of 2232 700 firefox.exe 89 PID 700 wrote to memory of 2232 700 firefox.exe 89 PID 700 wrote to memory of 2232 700 firefox.exe 89 PID 700 wrote to memory of 2232 700 firefox.exe 89 PID 700 wrote to memory of 2232 700 firefox.exe 89 PID 700 wrote to memory of 2232 700 firefox.exe 89 PID 700 wrote to memory of 2232 700 firefox.exe 89 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4744 2232 firefox.exe 90 PID 2232 wrote to memory of 4388 2232 firefox.exe 91 PID 2232 wrote to memory of 4388 2232 firefox.exe 91 PID 2232 wrote to memory of 4388 2232 firefox.exe 91 PID 2232 wrote to memory of 4388 2232 firefox.exe 91 PID 2232 wrote to memory of 4388 2232 firefox.exe 91 PID 2232 wrote to memory of 4388 2232 firefox.exe 91 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2020 -parentBuildID 20240401114208 -prefsHandle 1936 -prefMapHandle 1928 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {962c357c-3a57-4058-8c8a-826703f143e5} 2232 "\\.\pipe\gecko-crash-server-pipe.2232" gpu4⤵PID:4744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2456 -parentBuildID 20240401114208 -prefsHandle 2448 -prefMapHandle 2444 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e883b05f-f05b-4a82-a6f2-7a4f9479a7d5} 2232 "\\.\pipe\gecko-crash-server-pipe.2232" socket4⤵PID:4388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3136 -childID 1 -isForBrowser -prefsHandle 1596 -prefMapHandle 3152 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cafa581c-ca19-4ed6-8066-7909c20d0e33} 2232 "\\.\pipe\gecko-crash-server-pipe.2232" tab4⤵PID:2732
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3396 -childID 2 -isForBrowser -prefsHandle 3544 -prefMapHandle 2756 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c39c8c7-9251-4b70-adb6-15617e5f8a45} 2232 "\\.\pipe\gecko-crash-server-pipe.2232" tab4⤵PID:2460
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4516 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4468 -prefMapHandle 4464 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d1194d3-9134-4448-bb08-82ed03af1315} 2232 "\\.\pipe\gecko-crash-server-pipe.2232" utility4⤵
- Checks processor information in registry
PID:1648
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5572 -childID 3 -isForBrowser -prefsHandle 5360 -prefMapHandle 5160 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bb7aceb-4b84-4835-9b9f-4053e64a5d02} 2232 "\\.\pipe\gecko-crash-server-pipe.2232" tab4⤵PID:1340
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5360 -childID 4 -isForBrowser -prefsHandle 5780 -prefMapHandle 5724 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b90d5bc-c536-41a7-80e8-b26651ab6414} 2232 "\\.\pipe\gecko-crash-server-pipe.2232" tab4⤵PID:2012
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 5 -isForBrowser -prefsHandle 5768 -prefMapHandle 5772 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93def130-0805-4ede-ba44-577c7cf1a178} 2232 "\\.\pipe\gecko-crash-server-pipe.2232" tab4⤵PID:4632
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85t3rifc.default-release\activity-stream.discovery_stream.json
- Size 22KB
- SHA256 9e54d389bb26b9ad2602458634bfd13d3e4da58f0906975ec4a82218aabe3ae7
- MD5 09d13a2298ac00b79be39a05b6cfd3c2
- SHA1 19abfc105a8f8ce7d30ee9eb198d0f96075cf375
- SHA512 42ce733125cc3b913b1076be9843b57a710d5c1a52a84461d6f181d900a9f8f3ff5067a70dd668c18dcaa587f923b293ce13a37544f8e2611c18ef69fa6330d5
- SSDEEP 384:KZ5CUuknU+c+FzGQsR9CUvcW2y/L5ESwWB+2jJ0cJy9Xryaukxp4Lp4k7:PiziDPwWB+Vydkn4t4k7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85t3rifc.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 679f536a40ae90ace03ef39093d5eccd5752052a1430b12c78be214cd04f9f2f
- MD5 2aa0c09d99a471b170d05f366b3461af
- SHA1 dd680eaf70ffeb6a22589c5777c8d7d68ec46975
- SHA512 3ab8420d160b10438960a022fdfded900fb2a87738b39d7b4e58e8d98e5e814c684f330ee92158218b44566b4857dc8e31421deabdbbc9430532a7d7b2384f3b
- SSDEEP 384:H485u9fiGLm4pUnft2WlOX8lPLZZB7t0lpDIIGUq:nUBi8mCUnft2WAX8tzB7eD8L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\AlternateServices.bin
- Size 7KB
- SHA256 2d0e148073b1a2fcea5267cc67fb561b2d4409dc7993de54b88dbb98e63aed31
- MD5 7facaf5b987c853264c69707e39060bf
- SHA1 00f82c89dcf74ab99c187e2dc850b5dde863afb0
- SHA512 6eae66f319a32ddd6c3726912e69dc0bae688a3d1a7d66414c6f947693a3dc8e753e88efc48ccf32b45cefe9bc8775637ea33183fac35e1eea591e1fa4d1631a
- SSDEEP 24:YuB1o1H6gu1xgRbZkpR5cOmn8uhMZabFsh2F3LFkUSsJbF0JkPb:o65o29cO2NSebOJCb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\AlternateServices.bin
- Size 17KB
- SHA256 a45e1a40fd10e1fd04fea82e5354b401ed1891944cf07c46d48adbbf9fe6c78a
- MD5 954a3893980ea6596d7500fd7dd5d877
- SHA1 e7b8fa206a82ec0c421c8957df4f3a012629d847
- SHA512 e703bd57fe5ad720e1dd94846f84192b58d813ca3ff585ff0acb05171dfe169f99d21c595163991f4a00e517a50ead34f7c7095c8c978461303556f99e8504c4
- SSDEEP 96:iX5ocLebOJ5bhpebvpf+LbTXbvblgbgz7b7b7bDbTbSHVfbWb:25fu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\AlternateServices.bin
- Size 12KB
- SHA256 50850bffc26869d813a0702ea2b57cfe2dbbb51734a1fa98824f7aa067acb9c1
- MD5 8ffdd8968637bb6e36b1dd58d2ec9918
- SHA1 ee1d49ef83bf0ace097551a293118d303e957469
- SHA512 99a00a3fde326d1e702b11e8ff82ebca19598a40688d85aa742637424b738ce83b4b549c3dc96ccd008ad3bd9f4b64fd84be1e3073b56220d7d3de427968ba3c
- SSDEEP 96:S5ocLebOJ5bLpebvpf+5bgbUblgbgz7bnbDb:S5Vu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 bc672777c18ee867cc8f625a7a5a34637e03eefb56a18a09e31c2f4756d06978
- MD5 24dd35a3962c0dce567d6923493b6739
- SHA1 5f92e9528369ba874bcb7ffd18beeb4c3b30258e
- SHA512 3691fbe96042b461c7e19c31452e6c5b26f91cfb69440385591c1c2442e64e68368eb069da0033ca3d27704784504f8cef4027ed02e28eab7f457790f9a37408
- SSDEEP 96:t+QQorQ/QmQQFl66JozGzgClKtmSSVHSMF9ZbkW6ShmeiPP/PrWI:Z0/66JozGzgCl6mSSxrvZboShnEPCI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 f2e7bc50007c604717878929c6a3860a76067b3ca3aedfc3935bdb5bec8cd050
- MD5 a0034254d0f56eb570b0e203ff6fd655
- SHA1 d881e3e9af8d4a10fe7a81146219e001cd14cf5f
- SHA512 7133483318e5231b02df8cc17024c6747b88d5515869980e54889684e16683cafc7ef53b6cb0fc724330501edce967f3be409e9f28580a00bceba55098f8e809
- SSDEEP 96:8BZHSMF9ZbkW6rBBsphmOiPP/PhxkW9+QQorQ/QmQQFl66JozGzgClKtmSSM:CrvZboPOhxEPDfp0/66JozGzgCl6mSSM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 174e1b4d30246156137e72a2abfcfe8b9ffa1259461ad9c79a8d9cedbd71d68c
- MD5 a30bd93e0e6eb324ba0b53248d913bcd
- SHA1 150e044153bf23d59469e4c6440d46deb797b4c1
- SHA512 658971a5626efaf615352d6e1ec3f3f3c2673cf7eec12e44c92b755d6c8f89db9ea671f2f7102f4d74a3e118072063eadd8895a69f4d507823ac088e4f0e0a1c
- SSDEEP 384:FkWd5NjDr24cbUbDpbo270PV/66JozGzgC1bM:Cm5VDr24cbUbDpuAEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 22fa5ff59f230e06a93268b225a388de77f7fb3417a552922457c6c69560ad4a
- MD5 155d258d85048c24dd119ec8253bc02a
- SHA1 684827c89e482e8ee7e8189bdd163fb5667bfad9
- SHA512 779fa6048e9bb20d3125fd6c0ebe019399f63c914a881e818784e93cb79e0dd158b31b4a80a10ce3ad97aacb550a66e063529f460ce1bde092e76372dac01077
- SSDEEP 96:8BZHSMF9ZbkW6rBBsphm4miPP/PhxkW9+QQorQ/QmQQFl66JozGzgClKtmSSM:CrvZboPOhIEPDfp0/66JozGzgCl6mSSM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\pending_pings\a47a59e8-ff82-43ca-8df9-d5d136703331
- Size 25KB
- SHA256 a063de4f695934a2e9e739aa4e9c8dac6085e9f7c9042099f819d521d5e28936
- MD5 f5a314d837887d5d07c5991153f1e83e
- SHA1 f260eda5a92325892b96cdacf88192999a3b9aba
- SHA512 ce73d050b6dcd5b66427c91cc616fe3d4d9610880a9c972e8b385a60662875d6df401c015f8e80e055fe59dc1683a276bfd70d8ab406a57e9df5fb2d243b157c
- SSDEEP 192:b/fGxhq89YRFavbVRyV2TDuQAx1B7hJ45qBtbnj5AZkAbnj2I3QsBzJssWuGvb18:b/eYRonG1VeaRGmH4AU89XYl+Dfc7B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\pending_pings\b966d1ff-5f4b-4974-b98d-c61fba904d9d
- Size 671B
- SHA256 f16f76a64c82cc04fba2b0f48eff54579a50238bea92b8a7a8b631d683bf1d98
- MD5 3a95b1acedafd9eb093f0d7a019902f1
- SHA1 a9ae51869ec0075347bf0c2c8dd61a0a4d4d8f38
- SHA512 df1c2cc2d511befa7226e56683fd6196c7d09610beb5efcfdd13db65bff5e3ea1bd9d05d136aa1a5c9842fce50d9752ffbcd61efa9033b47f90836192618e1ad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\pending_pings\c11af581-2059-42d8-868c-234d60511b2a
- Size 982B
- SHA256 5b5bca4871f2b8ddcc907f8c46e4fb17cceeab57e53ff0e5a053174b8dd87612
- MD5 f0f6657d7b271af3e56e723964722fd0
- SHA1 f49bc001df75fa36fa5a520aa1e95cdfc03a49c8
- SHA512 401992d54f04c028aa1106b2b7848a3ae08a253f1e81832391fd4e4708f1a0fb7a794f543297e29a2f7734ca52f977839bebb1dd8eb934bf3caa27dba4cf5c29
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs-1.js
- Size 13KB
- SHA256 be7242b75451d1d82ef5f7b5cd7323e16be43d98b4708d3fe6918fee896e6a31
- MD5 efdb154b41a15b97f9b324b7986e110d
- SHA1 e8975c0ebf9b428ccfdcfb7960cd69e9d97d8bbb
- SHA512 fa96f8f47d4aa4f4a9d476447f48fbb7b3161232ce5af883d2e906742f8f72452c073db55e2d53e58a111f6d1734cd87440459a2a066c9ed0490fe0be6bd4a97
- SSDEEP 192:G5n1RyQfMK8hWDYJd3gFN4cdnYbdgdR1I0O60ZaX82mP0y/Bw8H2ia+:3QKUAgFLJt/I2mFwbiJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs.js
- Size 8KB
- SHA256 be8b8064adcbc9b9beb9596d9e9d9b53913a04ad67a6d32e126ed8f21a0f6590
- MD5 97e6e9772d01246b1be5d32b7e8c1bbd
- SHA1 dfd6e9a7b751d61393bae5df524d2a9e7120cd40
- SHA512 82ca036ed5d10c1cacd6593541cf31cfcbc22fdc9d8fe8aebe5264baf224f2a132a63cb676777e533392b230429306d09dbdd057ca0a639c2fc75f1406f0a520
- SSDEEP 192:k5n1RyQfMKKE/uncde060paXm2mP0yiBw8Vm:9Q9ucEvK2mUwh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs.js
- Size 11KB
- SHA256 21f0b354662925c864ae9be9ce671d9859444eee5c88ce8c0cf46e196ac2fbc0
- MD5 e3b5ac9daf7e45e864b3fa095a7ec331
- SHA1 ac6a090e148e7fd64a28163585c8c77be0fc6483
- SHA512 fabdb36cbfac3d42333225567225cd9400c538dcdb2d9254c120f157c88071a3cdcd1060ebb2b04a14b02e7750afa5e857930eabcf0cd347dd1c1e25d8e9680f
- SSDEEP 192:k5n1RyQfMK8hWDYJd3gFN4cdnYbdgdR1I0O60ZaX82mP0yiBw8Hm:9QKUAgFLJt/I2mUwH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs.js
- Size 16KB
- SHA256 6f2bd27640cb5e4c6acee83e9b45c70b9aa40c88a31f1af8e3a8e0347ad1af9d
- MD5 11438fcb46645c39e6457c6d1ad12e96
- SHA1 b736fd84f0c52f3f95eb1eb98225ae3edc827080
- SHA512 1b04d991c814e21910c86aa9f3a175d5dfd25f77d4e78a591cf203316d5203db21228585563be95f458532ef1396b6876715de487911a669b681ca0881b47ea3
- SSDEEP 192:Gyn1RyQfMK8hWDYJd3gFN4cdnYbdgdR1I0O60ZaXA+2mP0yLiBw8H2BNBChG:CQKUAgFLJt/12mAwbTn
- MD5 SHA1 SHA512 SSDEEP