Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
23/07/2024, 21:41
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240723-1jrh2ataqa
- SHA256 a17e67c8f8666092aeafd7e8bf32fcd60d6b7db354b750ae1e60cf0159c63642
- MD5 912d9bf77409d738c7f60ef05b1860d3
- SHA1 06511fea6420d5ff8395cef3a413880f06668c25
- SHA512 c6a43b91bd177bd9f57e6425c032cc53b2bb801af2faadb4e072b7e07a9ef7ca231aaa7502f4d03669631aa69b023518046843c092b1d26e11e1e5a5d2c27178
- SSDEEP 24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8aXt2Sbly7TWEPje:FTvC/MTQYxsWR7aXt2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2244 firefox.exe Token: SeDebugPrivilege 2244 firefox.exe Token: SeDebugPrivilege 2244 firefox.exe Token: SeDebugPrivilege 2244 firefox.exe Token: SeDebugPrivilege 2244 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 3952 file.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 3952 file.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 2244 firefox.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe 3952 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2244 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3952 wrote to memory of 3492 3952 file.exe 93 PID 3952 wrote to memory of 3492 3952 file.exe 93 PID 3492 wrote to memory of 2244 3492 firefox.exe 95 PID 3492 wrote to memory of 2244 3492 firefox.exe 95 PID 3492 wrote to memory of 2244 3492 firefox.exe 95 PID 3492 wrote to memory of 2244 3492 firefox.exe 95 PID 3492 wrote to memory of 2244 3492 firefox.exe 95 PID 3492 wrote to memory of 2244 3492 firefox.exe 95 PID 3492 wrote to memory of 2244 3492 firefox.exe 95 PID 3492 wrote to memory of 2244 3492 firefox.exe 95 PID 3492 wrote to memory of 2244 3492 firefox.exe 95 PID 3492 wrote to memory of 2244 3492 firefox.exe 95 PID 3492 wrote to memory of 2244 3492 firefox.exe 95 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 1320 2244 firefox.exe 96 PID 2244 wrote to memory of 2316 2244 firefox.exe 97 PID 2244 wrote to memory of 2316 2244 firefox.exe 97 PID 2244 wrote to memory of 2316 2244 firefox.exe 97 PID 2244 wrote to memory of 2316 2244 firefox.exe 97 PID 2244 wrote to memory of 2316 2244 firefox.exe 97 PID 2244 wrote to memory of 2316 2244 firefox.exe 97 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64a430dc-51ff-423f-993c-e1e56a832d54} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" gpu4⤵PID:1320
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b0f640d-8863-4fcd-b0aa-e74e215edda0} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" socket4⤵PID:2316
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3096 -childID 1 -isForBrowser -prefsHandle 3088 -prefMapHandle 3084 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77aabce5-f5f3-4c3e-94b1-fd049ed658dd} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab4⤵PID:2448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3624 -childID 2 -isForBrowser -prefsHandle 3708 -prefMapHandle 4012 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c48c66c8-90e9-41a9-96f9-619b15e220fc} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab4⤵PID:3268
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4784 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4820 -prefMapHandle 4796 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a105005-cf55-4540-a933-cfeb7bdc3d4a} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" utility4⤵
- Checks processor information in registry
PID:5360
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -childID 3 -isForBrowser -prefsHandle 5400 -prefMapHandle 5260 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88423f12-2512-46c8-8f1f-a73d7161b1a1} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab4⤵PID:5336
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5628 -childID 4 -isForBrowser -prefsHandle 5636 -prefMapHandle 5640 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {843645d1-fc1d-462a-b3a9-5638cfb83055} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab4⤵PID:5300
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5824 -childID 5 -isForBrowser -prefsHandle 5904 -prefMapHandle 5900 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa0bc074-fce6-4627-8051-e95760952f7e} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab4⤵PID:5256
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yol9faaa.default-release\activity-stream.discovery_stream.json
- Size 23KB
- SHA256 5c573a55b339f73c815048ee6781313f33c7cdd22cfe7d3c14ceaa54e66fb97a
- MD5 ea13f3d62f9d39b8a30d66109080b5e4
- SHA1 d9d0ed896f3c2d1a8b354c99d2e9c47c5ff58693
- SHA512 6ed842474e1f12b2a36cc9aa0b996f318c7aef35418c399ae1d2d9c8cd0403c2e368800ef190e30b1d4dcfbeb3e9047de91a38a3a1c320a126fdef553fe4a07d
- SSDEEP 384:F9nwmjZXTeK+nnwNjC+ORjr+jcvyohB/iyauUmpCpvnC4MpMG:YI9TAnQCZXNCydJcv9+MG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yol9faaa.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 8c4f86ce98572190b7965449d5cef409ffc8c255d6a3993a654f5ccb102efca9
- MD5 66a0ac9988dc5fdd0367f550dcb4a634
- SHA1 07fcb56e061c1f49bf9ab4e2146eddadec619f63
- SHA512 688ef24901e5723d35aa407f9c89de87e2f20d1115ff9a5b2b136596fe43055517b4817cc9800b358e5bbe0879e7a7d62c466202d5655dcf1c54a7c0d3b3ccec
- SSDEEP 384:H485u9fiGLm4pU7ft2WlOX8lPLZZB7t0lpDIIN4C4l:nUBi8mCU7ft2WAX8tzB7eD8G7O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\AlternateServices.bin
- Size 8KB
- SHA256 3b27c240831de6f8686709a2a8971d4cfeb2a5f6954f36a857ba2bcd15440894
- MD5 74366a011df8fb804760263508b24022
- SHA1 ff9b0953027596d9564f0c80de80d21789a06f14
- SHA512 9316295ca8aed0e7a67bccf3c35d3c67070bf2fccd399edc73bdc2b29e8c77837418f8081c5e63ff17955fb557f3403312abd1f15e5ac35526c4e4681e5facc3
- SSDEEP 24:6uB1oQovfFsh2F3LFk1o8pR5cO/1oqgu1xgRb21oduhMZAo+psJbF0Jkftby5WKO:+Y9cOt5ocebOJMby5pebvpf+Mb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 8c6561f8a79a6bdfa9e54ec44ff2634ad64afc13f6d0248af81e603789d1c498
- MD5 45951555fd9992e8a686b1d6ae765c8e
- SHA1 1d0cebf32c6fff707d51116978599e7e9ce4208a
- SHA512 4931bf7c4e04facf866efba27d9c92361591c57347fb35cea16782ed3dd01772707fabb1673c7c979db848d9cfbfce727694868fcda88b733c728fbe395cd01b
- SSDEEP 96:rSMF9ZbkW6Shm/wPP/PrWZVnQRIN/Fl66JozGzgClKtmSSM:rrvZboSh+2PCr/66JozGzgCl6mSSM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 39e1cdcfa265d0f5dc935395871236c6bac99c198122ca4faa023e2a38148553
- MD5 6e8b1edc6877a906ee9153e39a3c472f
- SHA1 08d8d796fc996c920c8e2a99ec43f8f8f5c90da7
- SHA512 5b5166d6912223d7175fe11a2a7f4e47b3ad7ac2fdef4021f38b36acc68652009218f61e6e215e88c2d6ff0b929e2c2067570edf9a44a1a4aebb2958e17f6bea
- SSDEEP 96:c1BUSMF9ZbkW6rBBhhm/wPP/PhxYWrnQRIN/Fl66JozGzgClKtmSS:nrvZboPhh+2PD7//66JozGzgCl6mSS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\db\data.safe.tmp
- Size 16KB
- SHA256 4fbcae2bc95a8ca586e89f0a8b9cefaac29c952a4f0352df80550441f0f55702
- MD5 b156786c22919399208bfa4ab0f8fa73
- SHA1 41ea39d3831152a4200d6c19d0954e771d434ae2
- SHA512 9bc88b21c5b112b08f58f78a77eaa7372f1541db19a03fcce5e564d922f4ab44869202b94b5985e6fa8f35f14abd1a349d862ba72506e8d034a5922b31dace82
- SSDEEP 384:PKN1+pcZDE3rXbubqybopM2IPg/66JozGzgC1bM:CN+2DE3rXbubq2f1Em
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\pending_pings\4a02a208-0bf7-46b6-83c3-f99d8f294b59
- Size 982B
- SHA256 b5b45ed12618abdc96c81912c86bffd862a27e41de0ade162e526806633b7c77
- MD5 d3a628a5fc0db4bb43dc3fed83669489
- SHA1 47ef8011a2bcaaffe5019f5f0cf002abbaa78bfc
- SHA512 3fd09ef685295079d8ee067f36fca19d9b9ef1638eebef297dc2b9470e8f92750ef1efab535516a79eddbabd002da5e613f92458f431b799550c1e4744a57134
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\pending_pings\7fa556dc-f229-4531-83b2-bf233018c93d
- Size 671B
- SHA256 695e10fc5a8eb40b347e93609494df4429602118dd15d99741b388e43a014612
- MD5 81bb35312847d8178b03bd800a50da17
- SHA1 9a2949a379d6e96a9740e5d08293a3c4e074138e
- SHA512 106014e4630cf79a36a7b8ad355df4023e0c71a04e958edaf4dbc55c8cfe0f1fa40f50b2ce4c054d8497242e299aa9554753a4f50dd7c1331c73596c1651c7c5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\pending_pings\bffd0814-9aae-4938-8689-fffc8e07c096
- Size 26KB
- SHA256 5a36556b2fbbcaac9738057498cfd5577d4a37c52bff9076c4e9cd2f4776eb43
- MD5 c7d8a200a41a2519fb340429e663b9cc
- SHA1 860faa5a336a8fee68b9c771baa250610c0a3688
- SHA512 779aa55143da1ec78eba7654c725a826e5cacff6a91e7988033f31e518a04640bdf9dce0908c1d6173db69653bc66d9f45853a25bf7db1c39d53540455ce06f7
- SSDEEP 192:H+XkJSQwWnGqtesfyt27iV4MQMY+AnVikcl4RVRpD13cw5dvs4jhChbBLGgxrvhm:eNPvA0u1Vj6Otz/Ymai7/zOgc8wGgC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs-1.js
- Size 16KB
- SHA256 7404460aef5181d005f33862da0d577f2130ebe7eb831d01ab709dbca462f9ba
- MD5 101f11b1bdecc78f326cffa14d3fc97f
- SHA1 144e90f47dc3db576649b5d7b7aab9f73b8b3de4
- SHA512 d7adf14ac0d67323363af496bf51ece3911a68be5d15199d8cd9e69fc0f5e91f5a7f0ead7b4e6edb1e565545bd85227920be9d1c04a04e5ade7845845c3401a3
- SSDEEP 192:j2nJRxTffCvlmZQ35d3g9AzwcdYQ3Ldgdx1I0360qaX2+iyN5RLBw8H51973lWQ:STGYEg9G2U2Nwyd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs.js
- Size 8KB
- SHA256 9d512b629ef3bfc5a8ebc66d04597a82f8279b9ae6b8e86b290b4c25289f9c1c
- MD5 b07ebdde336863d81b3ce4e1ee0a8941
- SHA1 4bda1b07eb3c06475251c9e3f5dd3e21ccebcedc
- SHA512 39287ecb8b5f3b2e2d7f5706f585ea7db4909a9a3927e7851d810dec3b1492131edf02a701a5853df36c4ca0b0cde3157e2fb0434e89ea931e2796140efef831
- SSDEEP 192:X5nJRxTfvP2OD4cd6l60laXAiyN5RrBw8Vz:fT7D9AMINws
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs.js
- Size 11KB
- SHA256 440ea3895b453e8cab121ed18147c820d62d07c577a5ae074e4be6fed535d366
- MD5 72ba92fe7fe557da39067e60327f9e24
- SHA1 03dc0fae674492b24e981d2de58aa6612427f0b9
- SHA512 e6e19191afed1b6dc5b29c9ab40ac36e67ee4d427c79b2023fdcb7cb4b474dd8be6fc915efea7f28a7c2cc0090fe75f3f4f229b6bbde3a82b43ad8690733fbc8
- SSDEEP 192:X5nJRxTfvCvlmZQ35d3g9AzwcdYQ3Ldgdx1I0360qaXKiyN5RrBw8Hz:fTWYEg9G2U1NwK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs.js
- Size 13KB
- SHA256 400ed9efd84a08e24bbf3e65179098cce14efe0a25da0e0fb3560960b1f723c7
- MD5 51ac9c72c01697a37132a209c8052263
- SHA1 2634bfc14febf28a9799f2e719ef9b29bd41f983
- SHA512 34ef43ac2754ad850dcac4393eef4e52a65b9d4a7e2d41159f676d81f42dd29fb7b8ebc0115cedf73c6c09cf8c7f2343f8f7e4a207da74de8389cbd3c04b9fac
- SSDEEP 192:j5nJRxTfvCvlmZQ35d3g9AzwcdYQ3Ldgdx1I0360qaXKiyN5RXBw8H51/h:7TWYEg9G2U1pwu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 1.2MB
- SHA256 8c7aa9ce72d83332b5c202a8e957598de810b1d9331cd6ceb85a1405b47abc28
- MD5 3ac207a249b2e1e5775c71067218bb96
- SHA1 4cc6294788588ff38c5581aaa03bdaf53560e4b6
- SHA512 42fc55d0adf1364dd8cd03e8e6772186139b7a0d32d2091ab1bf9de9d715100df9be356f9039e7868eba5460421b014e0f162919064f0dda25251066540b98ad
- SSDEEP 6144:n7rSAx3S393z3m3wTHH6udZ9sPd/XUqP+kI5HUZ0N+mwUhVo1gladDSNMoBweHNn:iZ9sVsdD0GcmhhragfXCNJU
- MD5 SHA1 SHA512 SSDEEP