Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system - submitted
23/07/2024, 06:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240723-hcelsasgrk
- SHA256 0f788be571e15ca8cd5511d0a0531c9b33e6f1591b5da2db8ff27fe86284caee
- MD5 6a4efd07e99400a46ef3bfaf12a57c7b
- SHA1 d40f6ea47196fca87a5808980eaa76534e428262
- SHA512 53058b9a088deff1af469f1c2e1a5601622f34159f3ab04b60ecfc43b185ee94c7839b87d45fc980e1d6cc6e733137ae51ca1e073952cd3c963ac43bc4bac55e
- SSDEEP 24576:hqDEvCTbMWu7rQYlBQcBiT6rprG8aLk2Sbly7TWEPje:hTvC/MTQYxsWR7aLk2dW
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2852 firefox.exe Token: SeDebugPrivilege 2852 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2852 firefox.exe 2852 firefox.exe 2852 firefox.exe 2852 firefox.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2852 firefox.exe 2852 firefox.exe 2852 firefox.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe 2672 file.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2728 2672 file.exe 30 PID 2672 wrote to memory of 2728 2672 file.exe 30 PID 2672 wrote to memory of 2728 2672 file.exe 30 PID 2672 wrote to memory of 2728 2672 file.exe 30 PID 2728 wrote to memory of 2852 2728 firefox.exe 31 PID 2728 wrote to memory of 2852 2728 firefox.exe 31 PID 2728 wrote to memory of 2852 2728 firefox.exe 31 PID 2728 wrote to memory of 2852 2728 firefox.exe 31 PID 2728 wrote to memory of 2852 2728 firefox.exe 31 PID 2728 wrote to memory of 2852 2728 firefox.exe 31 PID 2728 wrote to memory of 2852 2728 firefox.exe 31 PID 2728 wrote to memory of 2852 2728 firefox.exe 31 PID 2728 wrote to memory of 2852 2728 firefox.exe 31 PID 2728 wrote to memory of 2852 2728 firefox.exe 31 PID 2728 wrote to memory of 2852 2728 firefox.exe 31 PID 2728 wrote to memory of 2852 2728 firefox.exe 31 PID 2852 wrote to memory of 2716 2852 firefox.exe 32 PID 2852 wrote to memory of 2716 2852 firefox.exe 32 PID 2852 wrote to memory of 2716 2852 firefox.exe 32 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 2644 2852 firefox.exe 33 PID 2852 wrote to memory of 1880 2852 firefox.exe 34 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.0.924603138\1455572589" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1228 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6acc249-df9c-4523-8670-3c28025cb12b} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 1312 44efe58 gpu4⤵PID:2716
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.1.616158281\1455444448" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ad8d259-ae67-4b39-a498-d7012fdc6d70} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 1516 42ee458 socket4⤵PID:2644
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.2.1807115158\279073567" -childID 1 -isForBrowser -prefsHandle 1976 -prefMapHandle 1972 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 656 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f35d01d1-28e0-498e-b832-14788b999313} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 1948 19388c58 tab4⤵PID:1880
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.3.203275480\129401871" -childID 2 -isForBrowser -prefsHandle 2852 -prefMapHandle 2848 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 656 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {634e9db3-8174-46d5-be04-9cd616d62eaf} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 2864 1cce2058 tab4⤵PID:332
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.4.1456880611\1439378047" -childID 3 -isForBrowser -prefsHandle 3712 -prefMapHandle 3708 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 656 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7abb456-195c-4ce6-948b-845027814a97} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 3168 1facff58 tab4⤵PID:1592
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.5.646181757\633938125" -childID 4 -isForBrowser -prefsHandle 3944 -prefMapHandle 3948 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 656 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48cf0233-2b0e-4b82-9be6-4433adaac5fc} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 3936 1fad0b58 tab4⤵PID:1604
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.6.1313326817\1025997581" -childID 5 -isForBrowser -prefsHandle 4116 -prefMapHandle 4120 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 656 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c9cbf8d-4f47-456b-8244-0b8b1d27e6a8} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 4104 20045058 tab4⤵PID:2688
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\activity-stream.discovery_stream.json.tmp
- Size 23KB
- SHA256 3ef1be39c52c4c589a0cd706d88c232b7b29577ee7b0885c8e3961379d17b744
- MD5 3bac3e88804e78858550888ebc4e26d0
- SHA1 da5bf9157af45068c99f1448c72d54808a7765cb
- SHA512 0808913e590651ae3892328a701205b77781c04140621be3a9920f39e6c1dd0b8465b024c8c136a4b9a0a16e093470e6aa825b937b3ab0d3fea42f05d84e9f27
- SSDEEP 384:r+1Z/HRXfakiTjAnbuycgIBAQGmjESd18VMvyaa:r+z/lik+0Ku0GIESUVMvy1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 442KB
- SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
- MD5 85430baed3398695717b0263807cf97c
- SHA1 fffbee923cea216f50fce5d54219a188a5100f41
- SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
- SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 8.0MB
- SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
- MD5 a01c5ecd6108350ae23d2cddf0e77c17
- SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
- SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
- SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\db\data.safe.bin
- Size 2KB
- SHA256 53ba3b748b0b1c4a7e81b87e24e8802f2217e4e172d01569f345ae0f2ac63964
- MD5 3f9c114f5810deedfe1633297947fee7
- SHA1 b2c7ce73cabd6b629783fe6d33c99fa357105c64
- SHA512 30a3bda47277304241d74d35022b68431a49f3702b0a8b3896630d06d25ee7db79d24011d53f9b7d5b4aa0ea6f667bb4f8bd7e41284aad90d11560be53389166
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\1771ba11-58b6-4fcb-b0ce-661c0e353fb1
- Size 745B
- SHA256 9926a3d4351ffed103bedc33effbe644f3cd8d8af12781d969c881f0e57a4ec2
- MD5 b43eaaab8c4d4a693daca4f1a5d69411
- SHA1 32094d413cf5903a76ee92381538c31e4072502b
- SHA512 174929796cbd0c2cceba8de89c54ebc081fa1c9f53dc13407bdf19e8e109ee5812c656a14aea92ca9368a97125836aeeb3dd4a797026fa46d6327a3a4ac14c62
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\8bc2d002-61c3-4803-b372-e57a5179c911
- Size 11KB
- SHA256 b9d7c0fa87da6217eebd56c6c6ae7e7f9df6e575bbe49c4831c0ae7c119da42b
- MD5 d406f64d9b2d64a34b527337cf0b28e6
- SHA1 2f94f594e0123d9597435359426d7370d81864ae
- SHA512 948cef13370d481770320a177e3e00a21c3660c4960a8eaeffc2f9428fba2db805101194023ed30b2bdffbac330c4b41a77ed78f32f9100bfff79ad8831717d6
- SSDEEP 192:iFGDBDSuim1UkyDEppsrtoQc8KPMhIVya1Z+JRp8MO3u0OE6c1bf8Uv4cu7kC8n:KMDfUhjN8n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
- Size 997KB
- SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
- MD5 fe3355639648c417e8307c6d051e3e37
- SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
- SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
- SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
- Size 116B
- SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
- MD5 3d33cdc0b3d281e67dd52e14435dd04f
- SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
- SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
- Size 479B
- SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
- MD5 49ddb419d96dceb9069018535fb2e2fc
- SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
- SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
- Size 372B
- SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
- MD5 8be33af717bb1b67fbd61c3f4b807e9e
- SHA1 7cf17656d174d951957ff36810e874a134dd49e0
- SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
- Size 11.8MB
- SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
- MD5 33bf7b0439480effb9fb212efce87b13
- SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
- SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
- SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
- Size 1KB
- SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
- MD5 688bed3676d2104e7f17ae1cd2c59404
- SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
- SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
- Size 1KB
- SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
- MD5 937326fead5fd401f6cca9118bd9ade9
- SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
- SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js
- Size 7KB
- SHA256 7157f47c3df3464ab29bbc51f1b773256ce9c9c4e4c5db02becd6bf810584b99
- MD5 44ec5adfa9eb2ecc1bf453398e251f0e
- SHA1 208c5ff1e07577eefadae083393c51b9ce8b262f
- SHA512 e73711eeaa3dda62d375b7994f34db57cd2a7a92ce0fe0cf59036457312f750a13ad8b749523bfa21e1d1c54a4603bab70ffebd01b5abff59f41a0d0113ad2f2
- SSDEEP 96:xHAc5nUTeqGqsd3AufeOTzS2PXAnpjyhH9OQ6kKGJPrRBw8HCP:Oc5nIRsd3AufeEPXp9ZHKGJPrRBw8H4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js
- Size 7KB
- SHA256 1b4d2d76beba5eb73005ab34ac95bfbf2c6a0f9f97eeb6828354c3e8114c9d73
- MD5 929acc93d19378291ce34fa6bb371b1e
- SHA1 9a7b1de309408cfede814cd7e0202fbe43cd26eb
- SHA512 c7dccede8f67c4bb5102ae0dff4aed7e6c040b10d5998a683b12a43f2b94dbfafbf4bb50d7b2d110013d8daea99e6955e9e17016f1b5b51e4819f6453a614d3f
- SSDEEP 96:xHAcOnUTeqGqsd3AufeOTzS2PXAnpjyhH9OQ6kKGJPrRBw8HCt:OcOnIRsd3AufeEPXp9ZHKGJPrRBw8H6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs.js
- Size 6KB
- SHA256 8687d075ad4dc83125884f4c6e06e89f7de6c3ddc70d0073332360c6ba7a43f7
- MD5 28fcbc414393b4b05582965886fc6737
- SHA1 e2b65274bb591fcb34b02821532e99b7128c16c6
- SHA512 c38c22732416814af85d86e00b0dfec6c4c44e724a2df9f7bf09d4772d971f60d003233ea4dba337fc7c1fdc49e012dae1bc37f88e78c1a0ecf22e34d0f5ff37
- SSDEEP 96:xHZc5nUTeqGqsd3mHeOTzSiPXAnpjRH9OQ6kKGdBw8VCP:Hc5nIRsd3mHe0PXc9ZHKGdBw8V4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 2c6e7cdfed60b1507d433a7faa11fefd23e427642348197f2a5c664250b119b7
- MD5 d404334323bb3344d4c6db78164687c8
- SHA1 27b6511df839ba9316f1c96e68c1bff66dc24c23
- SHA512 860ee5d768e51212709b93cd3fab8eb0d535b610716feba51e214343f94a77301905677815fdc4d2a2e6510642f16576e6f581ddaf02ce71110d063baf029c48
- SSDEEP 96:6zVA0fInxUlEGJF7GtFM7k0zf8W8Qge3ZwS20X8W1q:WZc+CiFAFM7kcuemgXJq
- MD5 SHA1 SHA512 SSDEEP