Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
22/07/2024, 04:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240722-ex384awepc
- SHA256 8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64
- MD5 48fa5095677ff648963744841e7be2a6
- SHA1 81c1f09032e8224dcf343a3cf1019f8ac4844884
- SHA512 63ec28b0e6aab4bde7513181ef3cc29aadef18fccd9d2a2c22ee7b794f76e7df34ab1ba7081cbde64d7431a0aa0a7974a8d705164462b7ab5dacd656e397ba3e
- SSDEEP 24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8aL72Sbly7TWEPje:ZTvC/MTQYxsWR7aL72dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3212 firefox.exe Token: SeDebugPrivilege 3212 firefox.exe Token: SeDebugPrivilege 3212 firefox.exe Token: SeDebugPrivilege 3212 firefox.exe Token: SeDebugPrivilege 3212 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 2432 file.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 2432 file.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 3212 firefox.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe 2432 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3212 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 4100 2432 file.exe 87 PID 2432 wrote to memory of 4100 2432 file.exe 87 PID 4100 wrote to memory of 3212 4100 firefox.exe 89 PID 4100 wrote to memory of 3212 4100 firefox.exe 89 PID 4100 wrote to memory of 3212 4100 firefox.exe 89 PID 4100 wrote to memory of 3212 4100 firefox.exe 89 PID 4100 wrote to memory of 3212 4100 firefox.exe 89 PID 4100 wrote to memory of 3212 4100 firefox.exe 89 PID 4100 wrote to memory of 3212 4100 firefox.exe 89 PID 4100 wrote to memory of 3212 4100 firefox.exe 89 PID 4100 wrote to memory of 3212 4100 firefox.exe 89 PID 4100 wrote to memory of 3212 4100 firefox.exe 89 PID 4100 wrote to memory of 3212 4100 firefox.exe 89 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 4756 3212 firefox.exe 92 PID 3212 wrote to memory of 1152 3212 firefox.exe 93 PID 3212 wrote to memory of 1152 3212 firefox.exe 93 PID 3212 wrote to memory of 1152 3212 firefox.exe 93 PID 3212 wrote to memory of 1152 3212 firefox.exe 93 PID 3212 wrote to memory of 1152 3212 firefox.exe 93 PID 3212 wrote to memory of 1152 3212 firefox.exe 93 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 25755 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {013263e4-019c-47d7-bcec-73a8755b0a8a} 3212 "\\.\pipe\gecko-crash-server-pipe.3212" gpu4⤵PID:4756
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2400 -prefsLen 26675 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19ba48fe-47b5-48f2-ae35-c340fff60d3c} 3212 "\\.\pipe\gecko-crash-server-pipe.3212" socket4⤵PID:1152
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2888 -childID 1 -isForBrowser -prefsHandle 2784 -prefMapHandle 3116 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c81e6f86-d07c-476d-b3e5-46569fc419ae} 3212 "\\.\pipe\gecko-crash-server-pipe.3212" tab4⤵PID:5076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2804 -childID 2 -isForBrowser -prefsHandle 2776 -prefMapHandle 2820 -prefsLen 31165 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95628d6e-a1d0-43b9-a671-04cf5ecc37d6} 3212 "\\.\pipe\gecko-crash-server-pipe.3212" tab4⤵PID:1364
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4508 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4496 -prefMapHandle 4488 -prefsLen 31165 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8f301d6-6853-4ce9-b049-8171dffb7286} 3212 "\\.\pipe\gecko-crash-server-pipe.3212" utility4⤵
- Checks processor information in registry
PID:4100
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5464 -childID 3 -isForBrowser -prefsHandle 3652 -prefMapHandle 5396 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce55f493-cc43-4f52-a7d1-040a77e3fa92} 3212 "\\.\pipe\gecko-crash-server-pipe.3212" tab4⤵PID:6040
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 4 -isForBrowser -prefsHandle 5656 -prefMapHandle 5652 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f3c572c-1413-4c09-92f5-953c09214f25} 3212 "\\.\pipe\gecko-crash-server-pipe.3212" tab4⤵PID:6064
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5876 -childID 5 -isForBrowser -prefsHandle 5796 -prefMapHandle 5804 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69234471-7463-485e-ab42-6def0609d6ba} 3212 "\\.\pipe\gecko-crash-server-pipe.3212" tab4⤵PID:6076
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onffaicf.default-release\activity-stream.discovery_stream.json
- Size 21KB
- SHA256 390a5454386f52bde28825a3ef01ac96040fc4a5b3495c0c26ce52ba0d1994e5
- MD5 6ecb7250f141e85cf60711670e4addc4
- SHA1 18795e527c11acd1982b7965e6cb3e473267bbd3
- SHA512 df56ede920cdcc41e12162fbe7763be37937f91bddf6964d8bfb656c5d5abe761fccf42b986cd802bebefef7503d51f419ec2fb0c781bf0539d38d5204d57cb5
- SSDEEP 384:i1PTYmyqD4UDA/C8Zu0lJ7uPzu9db8bdciyaurUZcUZf5:0PENSr8Z36q90ydrscsf5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onffaicf.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 652f1554e88bbc69f1570db88f4781b72166c3479826d7870eb88281cc0fdb5f
- MD5 4cf6eda64ecdd7d1d6fcb62bc51c62a4
- SHA1 d19068de5af7193561fa3a9218d1bf696ad6f709
- SHA512 41d0ca4195d6a7a5f7c697a2dddb8dc23f413fbf70620418553ed4edb6592f28aa8c5e4f58170a5f7e3a0a1d55d1b0cb92589938451cbdf312b919d0fb95036e
- SSDEEP 384:H485u9fiGLm4pUYft2WlOX8lPLZZB7t0lpDIIiMm:nUBi8mCUYft2WAX8tzB7eD8x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\AlternateServices.bin
- Size 8KB
- SHA256 f06153b80f8bcedd68527f3b3cac34f4b37ba56ad6ace1930c8550a39bad30e5
- MD5 b199486f900ab4c06cc507ed70c880ad
- SHA1 7477b662958ebd507731e33f003c9f5c041385b4
- SHA512 6bd72c1122d1087fd21d22f7b3af394e9cff838f72e1be4afb2d9ea78eceb070949982ab05969d5b3e998a20f10fef4bdf1e673d0ae7625e9ec618774c4f9aad
- SSDEEP 24:YuB1oTZhFsh2F3LFkm6gu1xgRb2mopR5cO/mnuhMZ2mzsJbF0JkEbeyWKsJblxW5:Wf65opo9cO+XzebOJ1beypebvpf+1b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 c913c140a799f66cfd3bfbcb2cf727294d34f6dfd68782c0fab2a836cae4521e
- MD5 4fde584b5f980ccf042d36a77afb9382
- SHA1 d294c258c5416f0b8221e1ecf96ad072a0f902a4
- SHA512 ade893a67ce171cad8137536b8aec325a66f9e10fa83a50181a85c65abeca3f6137d0a3489352b1ba6f723f554206141316070a346f4e3b68cfc6b27964c8abc
- SSDEEP 96:EGQvvmSFl66JozGzgClKtmSSASMF9ZbkW6ShmpS/PP/PrWI:EF/66JozGzgCl6mSSArvZboShsSXPCI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp
- Size 31KB
- SHA256 69295bb79ed5da1fc7ca5dd18b204af8ac720fa0414c4f504e8417d15a3a1a7c
- MD5 990aa627657d5fcf5de751664793fb7a
- SHA1 23d28cd186bddcc05bd76404116d94608bff1095
- SHA512 c9757153ec08a38d13b3677c6ba2d26e64ee85f9eb5a7add33b428d57e5030dd91993283034186e2bee933223816027ace71c178c119a13821e67a4dc5e28fee
- SSDEEP 768:7EQwWyjVVDcnPx6gVxM/KGCbpb+b4bKbLbab1bCciefZdCGp/Txc3lc:3wWyxVDcGciefZdCGp/Tx/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\114a2798-198a-4360-a937-74865fef24e7
- Size 26KB
- SHA256 eb2004c2a157e84450ad8d779a76ac1ac08cfdb09d6f3d68caa5524110a64ded
- MD5 b97f64d32a905aaa92eb2747a51035cc
- SHA1 b54807e8643e466171810cc78ba92f05a3adb65b
- SHA512 d3010421259efa106ece74259bca744d3d168474ed5618acc907073d79194c15ac5b9e5b42064ba0db4a247ff92f05a8bd07a09321add87222caadd04037c8d4
- SSDEEP 192:G99LAXaBUai5uzxR37/V8905M4J/2Go2kmKISTub4ctaVUh4dnmXeRcYwfG6rjNh:GoXGUai0lR358SmvuxLlHsEkavS05243
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\3ae76751-3afe-497b-ab26-6341932608cd
- Size 671B
- SHA256 f77d1cc6f6f74291790b18c3c67763d3707e905246cfc0785ec774e0c8fcfa09
- MD5 0f3662ae100d65119924cc0517afac32
- SHA1 34166f9af52218b19342d970a350bb18e8387688
- SHA512 742c2a73adf91ce6c8c70507c4e9b7c54174d424886adb5842a4b17237a878301420259c361d2e26b4d26951d1351f25ba551a3a14cb2cf02120aaa88bc9949d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\c937eeb5-069b-4d03-8761-6bd1b74b7290
- Size 982B
- SHA256 3ce31c94c796198d2ed30fed7335ee5e5c3c357ff407e2f36e4a782b4b44be51
- MD5 8f421c7ce0a5b8b64d5524ca439e5f86
- SHA1 647829391246d5160779605320889244bffe7697
- SHA512 2041e6038944e1ae4b95cbbce1558495f2c25b0bee95dbcd54f5b0a29e7c35379e4f0d8895ca4da1bba19d7a35353fa5f686543c138067e82ea855cfb26850d0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs-1.js
- Size 12KB
- SHA256 53773e76498160d80a8272e1a52046cd0c23ddbebbaf8edf9799d35f9b8d02a7
- MD5 4fe9833c943dd7138f16db458ba7cdea
- SHA1 dbcf36edaa143ddabfe58ac40046196ca1a57b89
- SHA512 1915eabc51e2f3c7395570a1409ded0b1149611e5239b48cd8c141063fc4632d61c63c4ebc3a34c13409e9f0da2529084ba158c7de200a59593f420a7678ae99
- SSDEEP 192:95nHdRZqzfvKjH2C8YYEd3eW+OhEsCcddYCdgdrl1I0+60OaX9ippLqY68Bw8Hc:vAzna8YTeW++PHIfWSDRwj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs-1.js
- Size 16KB
- SHA256 f0c490b147e1c8bffb0f809242ef1d58c7d529392c9f3229aa55f3df1964911d
- MD5 2b68a1d06bc819648bcbfcc83154c5cb
- SHA1 eed56315a88aa8931f2a74a72c80774a49aabdd8
- SHA512 69db5e1c3df73c504dbc1c9f6c8f94d4de9a0a901229c0169b12e1c0629becceb4942c2225534950a9f8ebc6d03d89ac7277093136b40acf72558c6faac5277c
- SSDEEP 192:96nHdRZqzf2jH2C8YYEd3eW+OhEsCcddYCdgdrl1I0+60OaXX+ippLqY6XiBw8H/:kAz28YTeW++PHIfLSDJwve
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs.js
- Size 8KB
- SHA256 5c7302fd6d279a654a94131ef1d654e00022844dee7cb64c9453e305c7872f2e
- MD5 2e620300ba1c70a2c0bca51f6bb7de9c
- SHA1 da0b63a1cfd5999d7e947738887488213c3b8e72
- SHA512 7d38bf86ce1c75dba18ab46a18ff53b0015928a38117e0b0cc61d677040b1568b66d4ad61835490db91d58cf997d10686fda8e7f79399633ead8cf2f8fb15c89
- SSDEEP 192:b5nHdRZqzfvKp7hgqD6cdCj60BaXTippLqY6tBw8Vj:VAznwDHkGDSDOw8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs.js
- Size 11KB
- SHA256 c165d0944a92501a574326e91088b40ccefa744a0aab7d55b5ad6401efc3f437
- MD5 15a60af89a216a720c05b8d17c652dcc
- SHA1 b203d508616c738ea4593a9878a234c91d28eb4f
- SHA512 e6a71b55e6ab69741fbcdb1eb574583e28b861d2e013b7aa13614a4afc99ef6983e83a8e9316883e3a79591149246e8de501f34f02a1d418160792144d788a7d
- SSDEEP 192:b5nHdRZqzfvKjH2C8YYEd3eW+OhEsCcddYCdgdrl1I0+60OaX9ippLqY6tBw8Hj:VAzna8YTeW++PHIfWSDOwG
- MD5 SHA1 SHA512 SSDEEP