Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
20/07/2024, 06:03
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240720-gr1l5ashng
- SHA256 f7b04796db2c4c83204a194936cd0862d69073f075cec7ca21e7f41c48673df4
- MD5 2eb2ef6ce0c74824f0f7bcd54204bfa4
- SHA1 be5a7de0c6770bd009bc8b06c7106bbd9afffcb3
- SHA512 4917f2b944313fabcb7993073e328c4e6b48357c863e373143341d62d61db011057b35b5b0be929c5b871a2b23d67b340fbe0bb7f89ac25a3f861d44ccc9ab80
- SSDEEP 24576:aqDEvCTbMWu7rQYlBQcBiT6rprG8aLu2Sbly7TWEPje:aTvC/MTQYxsWR7aLu2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 640 firefox.exe Token: SeDebugPrivilege 640 firefox.exe Token: SeDebugPrivilege 640 firefox.exe Token: SeDebugPrivilege 640 firefox.exe Token: SeDebugPrivilege 640 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 640 firefox.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe 3616 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 640 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3616 wrote to memory of 3648 3616 file.exe 91 PID 3616 wrote to memory of 3648 3616 file.exe 91 PID 3648 wrote to memory of 640 3648 firefox.exe 93 PID 3648 wrote to memory of 640 3648 firefox.exe 93 PID 3648 wrote to memory of 640 3648 firefox.exe 93 PID 3648 wrote to memory of 640 3648 firefox.exe 93 PID 3648 wrote to memory of 640 3648 firefox.exe 93 PID 3648 wrote to memory of 640 3648 firefox.exe 93 PID 3648 wrote to memory of 640 3648 firefox.exe 93 PID 3648 wrote to memory of 640 3648 firefox.exe 93 PID 3648 wrote to memory of 640 3648 firefox.exe 93 PID 3648 wrote to memory of 640 3648 firefox.exe 93 PID 3648 wrote to memory of 640 3648 firefox.exe 93 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 2188 640 firefox.exe 94 PID 640 wrote to memory of 644 640 firefox.exe 95 PID 640 wrote to memory of 644 640 firefox.exe 95 PID 640 wrote to memory of 644 640 firefox.exe 95 PID 640 wrote to memory of 644 640 firefox.exe 95 PID 640 wrote to memory of 644 640 firefox.exe 95 PID 640 wrote to memory of 644 640 firefox.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e150485-665b-44f0-8bca-fba8c1df1d84} 640 "\\.\pipe\gecko-crash-server-pipe.640" gpu4⤵PID:2188
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2356 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da01c281-d863-48ac-9d97-b24e73fd242c} 640 "\\.\pipe\gecko-crash-server-pipe.640" socket4⤵PID:644
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3012 -childID 1 -isForBrowser -prefsHandle 1568 -prefMapHandle 3004 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69b7ef75-05a6-46da-a026-84b504616241} 640 "\\.\pipe\gecko-crash-server-pipe.640" tab4⤵PID:3912
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3680 -childID 2 -isForBrowser -prefsHandle 3672 -prefMapHandle 3668 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37561261-540c-4a0d-8bc1-77ac58b2e456} 640 "\\.\pipe\gecko-crash-server-pipe.640" tab4⤵PID:1348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4512 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4544 -prefMapHandle 4536 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {701cad6f-0d78-485b-9834-3b942e1debf0} 640 "\\.\pipe\gecko-crash-server-pipe.640" utility4⤵
- Checks processor information in registry
PID:208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5312 -childID 3 -isForBrowser -prefsHandle 5360 -prefMapHandle 5392 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a551f2f-2306-408a-a68f-c80615eaeef0} 640 "\\.\pipe\gecko-crash-server-pipe.640" tab4⤵PID:6060
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 4 -isForBrowser -prefsHandle 5648 -prefMapHandle 5652 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15c69061-7e66-4a88-85fd-de3523680d52} 640 "\\.\pipe\gecko-crash-server-pipe.640" tab4⤵PID:6072
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5828 -childID 5 -isForBrowser -prefsHandle 5904 -prefMapHandle 5900 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b66bad5-f3ac-4184-8a4e-968429c00fc2} 640 "\\.\pipe\gecko-crash-server-pipe.640" tab4⤵PID:6084
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\activity-stream.discovery_stream.json
- Size 18KB
- SHA256 0da9b1c82c4baf15ec52f5f84d69c460e23d8bcd29566b9d98f3307f06f871ab
- MD5 4bd7673196414e23e0aa689ab1a4a2a2
- SHA1 e60c65ecc1d510774946103e0eef52c02dc255dc
- SHA512 c7d16f35ead411c2d1154c9ca9846c7f16e032363ee3789a750f7fe8f9d111f26125c783de102c9b233afa4e8c4ded2af36c2220ba500fe102fdfc63b7b79beb
- SSDEEP 384:qSJtwN7eJ6YhhaCs0MEybJZv0ooToZp4Z5CgkkUT9LyaE:RXckkCabNh3tgiyp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 f907c08169628c2afbcf1189e09f8664da784a17815babc49093527754feede1
- MD5 92fe6dafed2a0b2c32ffa651770e6c35
- SHA1 21f01c180fce113eb5b43ba7996b466311355dc3
- SHA512 b7f1eb659cac694cac2f08ec1dc20a27245e0e8c1e3ad78d39ed0b061be07553af96c60263d789d3d4044a14d0760873d04e177c980c8a51cba5f22437f3b4b9
- SSDEEP 384:H485u9fiGLm4pUOft2WlOX8lPLZZB7t0lpDIIzUX:nUBi8mCUOft2WAX8tzB7eD8J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\AlternateServices.bin
- Size 12KB
- SHA256 a2f8fba9547052469d6a1f4549c382c699b94c190f9172c2a59309cb5dcec685
- MD5 90a368e6dbf68753714024c4e4496412
- SHA1 5939976bb98595549c552792f5757966bf2d0ae5
- SHA512 95ef9c4b226d63ba6e142f263baa94618d6b46c34fab1c6f857cb3a2c95d66a8fe9651d4c69e354c626df8ec88b249837a21f177d4e87fe05d4621b9298d21ea
- SSDEEP 96:B5oWebOJIbcpebvpf+IbKgbgzUbvbXb3bbb:B5lu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 c1e23e3e8b2b3ccf077491e7ce44f6d3764963c60f84f66958e3cb87b4e352f1
- MD5 5d548c191b405b5e8f4cab5649db935c
- SHA1 eb06999b9f38ed535de62fb99a4bfcac846125a1
- SHA512 aa8289d47db2a255ffb8aadb89aa5c2bd14b931aa6b11135ad70636793add8a9159f4e41b3646281d8a134ec933da557948dfa47b1640959608d5883274b3a7b
- SSDEEP 96:JNlQ08U8Fl66JozGzgClKtmSS+SMF9ZbkW6ShmtIPP/PrWI:a/66JozGzgCl6mSS+rvZboSh4+PCI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 e6f6eb1f7dcb489243008ff7ecac43445b895c3dae7cbd676b420f0eb3997170
- MD5 b8ca6b4e4b541e4dd7c4fd0015217e46
- SHA1 a5464f9e6bf6f8eb846b2912876e3e56c2647183
- SHA512 ff837585b84b8f1430570af18dd5f8340846ab1fb0c25c7c3a376f6fdc3df9fc517d909b5404e4ab4ee75b17d0451dc6ffeb11cb5e31df10b9bc119a7bfc6eef
- SSDEEP 96:8BqSMF9ZbkW6rBBPhmYIPP/PhxkW5NlQ08U8Fl66JozGzgClKtmSSM:VrvZboPPhH+PDfq/66JozGzgCl6mSSM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 2e915fb268cfd2959a6ac3b4035704949461a10b6c77993251126b710f2145e4
- MD5 32e1a2321c79f421a16a439b50ad573e
- SHA1 78b32b3cf768f7f99763c896e4975b30c332c3ee
- SHA512 4890c0a9b32413df0a07b085e96dc6b4a2e29013a44aee563b52a60433f82618c54d7525abbce54fb7de351c0930dc24a6576279aba1e0c7441a74bc1f602d03
- SSDEEP 96:c1BqSMF9ZbkW6rBBPhmtIPP/PhxkW5NlQ08U8Fl66JozGzgClKtmSS:xrvZboPPh4+PDfq/66JozGzgCl6mSS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 c9c8e997122d2e1ed69953a2dcdef9ea6a3da660565ddff55ffbaaa0fbfa2f2f
- MD5 31965a400a041579c49f405cc178ba6b
- SHA1 939fc723d450ebdb7fddeb48ef1d4ae93d224a9c
- SHA512 d2bd656722e149ec6799b283eee17641edccb4cc32623f41141a1fe6a4635d660fb9c6ea56fc01937bba12934ac32509c859f8ff25f06a0a099e66686965c224
- SSDEEP 384:ncHA4RbU9y3D3F7kbubab/66JozGzgC1bTboXR7P5:cjG9WD3F7kbubaWEB2h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\877f54a2-d3d4-44b9-9469-57b2f2549907
- Size 982B
- SHA256 340864390d1e0485ea036a0431a7d29a477cbd7769a5cb9dba290bb573e73cb3
- MD5 1784cd6c246663f60860fa80341e7778
- SHA1 3219bd3423b5d2a8c779b8ca0bd518d70b620310
- SHA512 f7c54079200e185f6e07a5cec828be97f4b35abc608c5c2fff9da2eb8dbaa4a9cb67a25d17f949cd8596c6505e447d31cc26c6d0d53954a4b46646d96851ec0b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\8bcd8684-f942-4853-8790-df8fe4cc22db
- Size 26KB
- SHA256 d9b84ba52693582a0b8f960fd3c628291238a8e4008ccebd2902b1359917abed
- MD5 c4b9274c633a6c95b614a7883d849a84
- SHA1 45ddf6a62bc2b256c942ce74a7dffb82f07a6575
- SHA512 b325f9a743e9ecfb79b2a1c879858f378879a40f20ab164567ca95feb15cd39a6be84761d94e7af6bef6bf5ffea8501ace2852d4177aca08bb680cc85cb3ee54
- SSDEEP 192:1T/0uHdqF7L1+dzxJAH8o5eBqdrz9zszyIoEr6EJNymdOgyaRGbQ3EzYc2U6oDvr:B8WdqF7J+dlJrIeBUxoFrWYGz5EI0a9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\e058e0b4-085f-4260-b1c6-eb122551ec59
- Size 671B
- SHA256 f0ef7b52adce4589435ffba4285f9c122c5df50dccf048da91338b9324270a06
- MD5 d7ebd242e1386466620fa844235b4d7f
- SHA1 07b163a0475ce1a7c566da45891f831e64d6c571
- SHA512 968dbd7803ece4fbe58b7806fcc795ae2654aa01a777386d4c62917c8a4dec74dc0f97e6773cb66675c3fa813a1d7d9ae43100d6c4fe82926836ab558d17214b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs-1.js
- Size 13KB
- SHA256 219a9365375631d7ea00d23bfca6964e9beef048ea4e2d71236b19803458c2e7
- MD5 68a642753cf34b109ba1a8e0a4bb884b
- SHA1 a0de761a00feef39e331f3072476178d737dc0aa
- SHA512 36178b58e19a3fbe9d32e43d461dfba6c3fc87b0a48b982e0b1a11ea94fcd6a831ae68fc08e769e71a2005118923ec73ff5cba0733d1b5af922d9f7f0b83105e
- SSDEEP 192:i5nZ1RZfBxv8MyvhIW0/PvecdVbIWruQHrN60gaXW12Bw8HgpUeK:UpwhFoPz3FqQLUb10wvpLK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs-1.js
- Size 16KB
- SHA256 efc88659ae76ffdda0fb5883c7f4694645360de5d64618c81070658456972ab6
- MD5 0253b891b6e68f1cc731d4e915b1e1f7
- SHA1 918d62fa795ab0bb1d1fd69cab1c2d1cdf5266db
- SHA512 043cefc2a09e294a737e78f3f67c1ba8ae7d7ac242a1992b5bab0b0a7c50a6dcd75d3149dc16e677bca720c0d98879154e2fdd767ab19305ad180ac28a176a7d
- SSDEEP 192:imnZ1RZfnxv8MyvhIW0/PvecdVbIWruQHrN60gaXS+1siBw8Hguf3LwE:f7whFoPz3FqQLUU1fwvMR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs.js
- Size 8KB
- SHA256 631e7d343c7cc2d89c7c147cadad4e2f5357d539498b2adcd46d99bcbb259f39
- MD5 cecdff8f3ab8e78a0526ca1fd6980202
- SHA1 d4dc5e9e4c1d012fc918ef51025ca05505dfe484
- SHA512 80bd89e0d2d7dc3fa94125b338f10bdf5c8e961a4e1d1a9557076968c818cbb93337da418ac069150d248485de2dd2bdb6e7cf5d72e9d76237703ba9c2722628
- SSDEEP 96:xHC5nUTUpmPqGqZfBo4p4fzSxDiN1cdgCgi41605aXenTjxH8QFNBw8Vn6K:M5nZ1RZfBofMD4cd6l605aXc13Bw8V6K
- MD5 SHA1 SHA512 SSDEEP