Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
22/07/2024, 10:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240722-ml4pgssfre
- SHA256 e1ba7d54c2c166835918d5e7388945f6490d047c5f838c9ec153bcab5944977a
- MD5 38e7523eb5ba752ebb7fda106bf072b9
- SHA1 23555ae6b6cf3e3def07b31ee313895e48ffd2f0
- SHA512 77112aa14c6f1b96f164a4ad94e568f1cf6dad0a27b8795740c83997039a899b4eac2adc442ec7e1ca75595eded3c4b1c82ca87bbe7a0748db768637aeebc178
- SSDEEP 24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8aLx2Sbly7TWEPje:bTvC/MTQYxsWR7aLx2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4184 firefox.exe Token: SeDebugPrivilege 4184 firefox.exe Token: SeDebugPrivilege 4184 firefox.exe Token: SeDebugPrivilege 4184 firefox.exe Token: SeDebugPrivilege 4184 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 1744 file.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 1744 file.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 4184 firefox.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe 1744 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4184 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1744 wrote to memory of 1120 1744 file.exe 91 PID 1744 wrote to memory of 1120 1744 file.exe 91 PID 1120 wrote to memory of 4184 1120 firefox.exe 93 PID 1120 wrote to memory of 4184 1120 firefox.exe 93 PID 1120 wrote to memory of 4184 1120 firefox.exe 93 PID 1120 wrote to memory of 4184 1120 firefox.exe 93 PID 1120 wrote to memory of 4184 1120 firefox.exe 93 PID 1120 wrote to memory of 4184 1120 firefox.exe 93 PID 1120 wrote to memory of 4184 1120 firefox.exe 93 PID 1120 wrote to memory of 4184 1120 firefox.exe 93 PID 1120 wrote to memory of 4184 1120 firefox.exe 93 PID 1120 wrote to memory of 4184 1120 firefox.exe 93 PID 1120 wrote to memory of 4184 1120 firefox.exe 93 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 4676 4184 firefox.exe 94 PID 4184 wrote to memory of 3112 4184 firefox.exe 95 PID 4184 wrote to memory of 3112 4184 firefox.exe 95 PID 4184 wrote to memory of 3112 4184 firefox.exe 95 PID 4184 wrote to memory of 3112 4184 firefox.exe 95 PID 4184 wrote to memory of 3112 4184 firefox.exe 95 PID 4184 wrote to memory of 3112 4184 firefox.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cef61fe-b1ea-4a51-b138-84f15fd6fdd0} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" gpu4⤵PID:4676
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2280 -prefMapHandle 2284 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9bd10d2-c130-4520-be18-7905c2c7d5e4} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" socket4⤵PID:3112
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3156 -childID 1 -isForBrowser -prefsHandle 3084 -prefMapHandle 2716 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ffba3dd-ea4c-4e33-8087-a0da3746fcca} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" tab4⤵PID:748
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4124 -childID 2 -isForBrowser -prefsHandle 4116 -prefMapHandle 4108 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4924791b-220e-4f7a-b85e-df766cd9de67} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" tab4⤵PID:4220
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4820 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4812 -prefMapHandle 4816 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d50212e5-1141-4bfb-8a8d-a2569b3f9fa4} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" utility4⤵
- Checks processor information in registry
PID:5228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5460 -childID 3 -isForBrowser -prefsHandle 4576 -prefMapHandle 5368 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d823387-9a27-4775-84bb-e6ae41384c4b} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" tab4⤵PID:6024
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5676 -childID 4 -isForBrowser -prefsHandle 5596 -prefMapHandle 5600 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d48ef03b-091c-4fcc-9b9b-2d700583cfcc} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" tab4⤵PID:6036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5900 -childID 5 -isForBrowser -prefsHandle 5892 -prefMapHandle 4576 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f20b6ff-b832-4bf8-820b-b5c83f06d34c} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" tab4⤵PID:6060
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yol9faaa.default-release\activity-stream.discovery_stream.json
- Size 18KB
- SHA256 277590a144b83681179a049c49b465a336a7403a299d4e2ed2fa447b64465393
- MD5 a6a21d0d72456dbbeef4da7dc56e63c8
- SHA1 c63c275f383fe801ba414339ca04f2bee035aed4
- SHA512 b144e1ab9fa31fb201e2bfe5b8b407bc8a00f498abd2355512152f0f903b6b94cdd8efcb244bf8b4ff8bd02ddae4fcceba1d5f859415582b03107e77c7b008aa
- SSDEEP 384:17HoZ/4cUXJ7NkqCEWBup4UFPNxYm16nF1IyaE:1joSPC6b5Ygyp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yol9faaa.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 dc628674308f7140aa19a88531178f7df3128311a0cb5ccdd35c85c5e4ca1b75
- MD5 b96e7311d1e8fdb36609a7f503f89c7c
- SHA1 96522eb4ae67275e55175b8cc81225a5e12c4bd8
- SHA512 671ea6665c9946c62247832b9d77ed629c78a11a50c1b83f44c29b656cc3bd006112114c9be48bd97fda36e85747229057fcadcb1ba634fe104e66cb27c0b9ee
- SSDEEP 384:H485u9fiGLm4pUfft2WlOX8lPLZZB7t0lpDIIlx0:nUBi8mCUfft2WAX8tzB7eD8Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\AlternateServices.bin
- Size 11KB
- SHA256 c858fba1ba4e1d1c0f8aca194aa31a9351d2b65370587c6f69c6eac568d37a8a
- MD5 9acc5170091ff9052ad865b14be2550c
- SHA1 a9ad181202c712d9ac741347c64aa3561c87579d
- SHA512 4ce359b85dac1611913c30d51a877c446eb5690a14b89c5439adf0e3d290739a02684501968d41ec584751d9af8fa9d44e92710602da9c8ee9104a49776b74fc
- SSDEEP 48:29cOu5o+ebOJObOpebvpf+Ob6bubIgbgzKb:z5o+ebOJObOpebvpf+Ob6bubIgbgzKb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 fe49d10f3d3e81f245ab57afe1dc8a43d8656e00d0dd1c3a2419e41663669047
- MD5 7998a8e485e29d911770195a4d240169
- SHA1 10e9ad3533489e8ed15926ae704523d5bbc3ada1
- SHA512 3dff691485f63e5b448f5dfa60253bce3675193dd42e61d90f85d5435410da608edfd6000bb65a5e16b4f3b939a263f17115e86e180449e8d71e74f8345601bc
- SSDEEP 96:VnQVY4SFl66JozGzgClKtmSS0SMF9ZbkW6ShmpiPP/PrWZ:J/66JozGzgCl6mSS0rvZboShoEPC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 2de618ba3c80256bb24df354194dbf12b58aa584c97a48ce1684b6691af4e20f
- MD5 38716be7e4fb3cd2d0cfe5412383d6a7
- SHA1 c92cc94ab17aa220e47cb764ce7e86136901977d
- SHA512 6dccccf30c6478b26cdd6a1ff9765382643894f7a4a340e3a1dedc185bcfca7e40477134082a65ef631f2cd48c37d69b3cb271b6fdf6bdc6b7732d7e9caa4dba
- SSDEEP 384:J/66JozGzgC1bZboNmbPx6j4UVo54DVnEfbRbHY:sE/LUjLQ4DVnEfbRbHY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\pending_pings\164d0045-ddac-4429-b7e2-12fbdd37b86a
- Size 671B
- SHA256 343b0b17bb25343c6403bcf0c38dd129c4897ac8942024d710394ce0eb41e7a5
- MD5 4a231a06abafb8e1420156bd32277fef
- SHA1 8396de7e7d79ea8aa1da11d6266f1442ae4cf7a9
- SHA512 fc07a36d010d04a6fb5a90c02c6e10fefeb6a897971f93370e199a4bde216235349e0d00a3576e909915e98157b0a57187cd07a9b8e74a9cce2348f95eb2301e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\pending_pings\1e5179f7-ae42-46f2-83d5-f9b725c54285
- Size 982B
- SHA256 7d27faaebafe20f99503842c9c0234ab1538892f5318457b0b68f81d8de1b606
- MD5 5296afef50514d54e5fdacf83f7ba8e9
- SHA1 77158e63f9b1f165b9e28814c091621acf5c11a0
- SHA512 831eae41d943509f318135116e64e9dbf40a722d5c744e2a337e9dda7ed4ef42e5e52e60df24587888cef367df1ae3f0603b3fbba25cd29bb2733c26568ce6ba
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\pending_pings\38c1aeba-9617-48dd-9f1a-6e574f01a4cd
- Size 26KB
- SHA256 ab56ff0d84d38ffae8c17f14c4a52b663470400bbd2d90c91a33d3a7f652f0d3
- MD5 2321f842d49451aac6dfbbbdc558ad5b
- SHA1 1a62cc2e74edc89e2b95cb7cc64a901d8e802282
- SHA512 37ea840dacaf10d99b0d0c0e874c585687a46309e9f3cf32193f757f80a69e74bd83fba1db859e449e18d2da308b540bd18220c4947863706e4cc4843416ef67
- SSDEEP 192:twvWQyBVUGpITzxcdRvuQo+mS0V13cZZIX2Jo5JJ9sfm3qhKYhdqLPxwmZ2z0ZJM:uOxVHpGlcdRWn+qMiViNdzQDIQEtX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs-1.js
- Size 16KB
- SHA256 246158119df291455447b3f1979f0815bc0bff532a186043d691672e653599b8
- MD5 9e1b29e9132aa2cd730bc6a6481e4d58
- SHA1 7a9937c81c7af43c9b9cf8e358f3815603dfdade
- SHA512 2f176ad6b1bf6789765f8006cb70d228842384a7f960e2a859bdb2004b74f28090387648fb46bb4c624d450db0c7706f09d37f6bdc44595285974f51f91a64ed
- SSDEEP 192:jenJRxTfcrC6PtIWKEWzLJDcdHIW2aQHrj60gaX6+iyN5RoiBw8H03/BaM:KTSPtFKdiFF9QLGsjwdN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs.js
- Size 8KB
- SHA256 6019d087fe27f7f30969eb4902fd528ecfb6371641266b1b2097eab092ee33b8
- MD5 4cf2f54e4bb8a5ae2142ecf5d8caa164
- SHA1 19c4b64d5f30fd27886831767c0264af7a2a2ae0
- SHA512 e6c527105480a06c966aa0977dd8c813aac1f2005f75f70c9dbb5981d3bb51585d5e0a6ccaacb5f2cef097068ac4bf2c3c3daf68d16f1b258cf66afdfd0a3728
- SSDEEP 192:X5nJRxTfvP2Suncde060laXLiyN5RrBw8H3:fTPucEvjNwe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs.js
- Size 13KB
- SHA256 2a18c9c08ad7de39f711ea0f54856f974ca8f787beff8ab686168ffd724f922d
- MD5 c100ed39fee47540e0ff23dc92a99e75
- SHA1 1f45833385c138d0161b9cb0aecfe4fb270c5f3c
- SHA512 07517ef4628cd34d4271203a9c2167ab594ab6b4d2c3084f36a4197f5f36b8d1ef6ad0b493c2d8e57c846771a0c3714a025c072b82c13b956f1a84129f178974
- SSDEEP 192:j5nJRxTfvrC6PtIWKEWzLJDcdHIW2aQHrj60gaX+iyN5ROBw8Hn:7T/PtFKdiFF9QLGDEw+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs.js
- Size 11KB
- SHA256 835cb2ba59a6e33dca420c31b954f18bf947528dbbf69025c1c725bc6f7976dc
- MD5 d898bb3ad33470dec809557f2c27eb0f
- SHA1 b7c3d73705109ed652bcb0b74077294ba3a1d4c0
- SHA512 953ee0e53d2201c6f8dc7134c48173d2eafce4649ecf49118841e4a4be4172698c8d456844bbe8003f12c5b6347ca8a85f320dc0b369a30c29c2a739fded4508
- SSDEEP 192:X5nJRxTfvrC6PtIWKEWzLJDcdHIW2aQHrj60gaX+iyN5RrBw8H3:fT/PtFKdiFF9QLGDNwe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 968KB
- SHA256 c84308da5b334b0730c21c742dedb29a9e337c9939de1f5b65d22d98cddad704
- MD5 e08b684c5f94f6952b1ac1474d802c5f
- SHA1 aba223a056bd64639c3e771c441b9f9f91ce8639
- SHA512 75dfc6fa90bb5e019d853a4722f412aadc2d14219aad07165db55a834b2d0e5f410d7a51598f205669244bbc94a372ef3523d24ba3cd83b00dd371efc7f84cf6
- SSDEEP 6144:77rSAx3S393z3m3+THM6u7vOLTFUmUPiUJkR5Zmz0Pu/el+taGZq5eHN1HmcH11u:dvOLTum43J4MpYxElwDJ6q
- MD5 SHA1 SHA512 SSDEEP