Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
23/07/2024, 06:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240723-hcelsasgrk
- SHA256 0f788be571e15ca8cd5511d0a0531c9b33e6f1591b5da2db8ff27fe86284caee
- MD5 6a4efd07e99400a46ef3bfaf12a57c7b
- SHA1 d40f6ea47196fca87a5808980eaa76534e428262
- SHA512 53058b9a088deff1af469f1c2e1a5601622f34159f3ab04b60ecfc43b185ee94c7839b87d45fc980e1d6cc6e733137ae51ca1e073952cd3c963ac43bc4bac55e
- SSDEEP 24576:hqDEvCTbMWu7rQYlBQcBiT6rprG8aLk2Sbly7TWEPje:hTvC/MTQYxsWR7aLk2dW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4896 firefox.exe Token: SeDebugPrivilege 4896 firefox.exe Token: SeDebugPrivilege 4896 firefox.exe Token: SeDebugPrivilege 4896 firefox.exe Token: SeDebugPrivilege 4896 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 4896 firefox.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe 3444 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4896 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3444 wrote to memory of 1184 3444 file.exe 91 PID 3444 wrote to memory of 1184 3444 file.exe 91 PID 1184 wrote to memory of 4896 1184 firefox.exe 93 PID 1184 wrote to memory of 4896 1184 firefox.exe 93 PID 1184 wrote to memory of 4896 1184 firefox.exe 93 PID 1184 wrote to memory of 4896 1184 firefox.exe 93 PID 1184 wrote to memory of 4896 1184 firefox.exe 93 PID 1184 wrote to memory of 4896 1184 firefox.exe 93 PID 1184 wrote to memory of 4896 1184 firefox.exe 93 PID 1184 wrote to memory of 4896 1184 firefox.exe 93 PID 1184 wrote to memory of 4896 1184 firefox.exe 93 PID 1184 wrote to memory of 4896 1184 firefox.exe 93 PID 1184 wrote to memory of 4896 1184 firefox.exe 93 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5056 4896 firefox.exe 94 PID 4896 wrote to memory of 5064 4896 firefox.exe 95 PID 4896 wrote to memory of 5064 4896 firefox.exe 95 PID 4896 wrote to memory of 5064 4896 firefox.exe 95 PID 4896 wrote to memory of 5064 4896 firefox.exe 95 PID 4896 wrote to memory of 5064 4896 firefox.exe 95 PID 4896 wrote to memory of 5064 4896 firefox.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae75385d-ff55-49d7-b9c7-316730003202} 4896 "\\.\pipe\gecko-crash-server-pipe.4896" gpu4⤵PID:5056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2368 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d9d84f8-d647-41af-a99e-f50d2f114d24} 4896 "\\.\pipe\gecko-crash-server-pipe.4896" socket4⤵PID:5064
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2732 -childID 1 -isForBrowser -prefsHandle 2864 -prefMapHandle 3160 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68fa705f-87bd-4899-9657-b0a596dc6d1c} 4896 "\\.\pipe\gecko-crash-server-pipe.4896" tab4⤵PID:1004
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3892 -childID 2 -isForBrowser -prefsHandle 3884 -prefMapHandle 3880 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46ecb9fd-8426-43bd-b0c7-3ac68aad4e53} 4896 "\\.\pipe\gecko-crash-server-pipe.4896" tab4⤵PID:2912
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4748 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4744 -prefMapHandle 4728 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {270c007b-c232-42f4-8742-76d8580b1336} 4896 "\\.\pipe\gecko-crash-server-pipe.4896" utility4⤵
- Checks processor information in registry
PID:5176
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5568 -childID 3 -isForBrowser -prefsHandle 5532 -prefMapHandle 5564 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d34af725-7bff-446e-95c2-8ed498adb39b} 4896 "\\.\pipe\gecko-crash-server-pipe.4896" tab4⤵PID:5020
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 4 -isForBrowser -prefsHandle 5524 -prefMapHandle 5548 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8853ad11-7857-4d54-a469-1867baa30d2c} 4896 "\\.\pipe\gecko-crash-server-pipe.4896" tab4⤵PID:3668
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5800 -childID 5 -isForBrowser -prefsHandle 5912 -prefMapHandle 5916 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58a09441-7cef-410b-9510-25ee252627e5} 4896 "\\.\pipe\gecko-crash-server-pipe.4896" tab4⤵PID:4040
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85t3rifc.default-release\activity-stream.discovery_stream.json
- Size 21KB
- SHA256 4ccf82cd67e834791442b7fddc22c55c35c6e2935f86ff9316992c36f0b46066
- MD5 cc8d125efbb8e2cfb2e136a340c6e9d9
- SHA1 8ab9f82aad20a74c095729019aa94920ff38912e
- SHA512 f02171437631d92ded7190b68b4b1a2e4431be0c9be635c5b6def636d49cab3ab1ed9110581378b4975bb276ef84c0318619c3b0e8afb883ba3e3ecb884ccc2a
- SSDEEP 384:2nav+Ij9XcpuJXZmjFRjJdlCl0GHe0yMTyauw/cn21Z:2RQjZIrVyU0yMTydeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85t3rifc.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
- Size 13KB
- SHA256 8845da6acd310e4e8e8b8bf47c0191bf7b3c98f8e53742f2dc5f8464d6792068
- MD5 c5ede93ceac1e98649fca9ddeaa91131
- SHA1 589a04eeef2841cf148e781d404d37f5b27928d9
- SHA512 dd9f4a9a9ade2386fd814dac33e44ee5770a2a4d1b324db969cef8bf712cba3aac224d22826977a3a505fec06169d315140f5d44d466e3505819d3c3d0149b6c
- SSDEEP 384:H485u9fiGLm4pU7ft2WlOX8lPLZZB7t0lpDII9V3V+:nUBi8mCU7ft2WAX8tzB7eD8yBc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\AlternateServices.bin
- Size 7KB
- SHA256 6cfb2e272b979c48ce9297ec560c90218c25ee0af70742cdcac11308d517e4cd
- MD5 f21d6e3a61b6882648d2e35fa2e95019
- SHA1 d0f627f27f16e4d70030303c6d3c90db8e6838ed
- SHA512 08c40e339dd218fc257b388554e296413229c8de5680c8bad3b4bd55ea2bebd004cbd51e60ce315c7d5614a5010755b853b10a156b089fbd0e0e3ee27124ee02
- SSDEEP 24:YuB1o1Cngu1xgRbpXnpR5cOBrgPuhMZCG7Fsh2F3LFkGn/sJbF0JkDlb:/5oZ9cOtgv/ebOJEb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\AlternateServices.bin
- Size 11KB
- SHA256 6232f7f412089aa77f67642f8443a853a6368371f08a0baf3b0fd2df6caeaa9a
- MD5 9efe9471d38c25926e9e166a7d806999
- SHA1 175996acd1df08a650c179512f44ca01e4ffcc26
- SHA512 46c10afcf3af941470d9cc4232fa72ec120bcb3479ee5fb7ec66c92e67def46c551ce1531b259cbc3d7845a08fce77b19b1b22cd18a3491d313014376d172b45
- SSDEEP 96:Rn5oUGebOJLb5pebvpf+LbJbBbQgbgzeb:p5Hwu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\AlternateServices.bin
- Size 12KB
- SHA256 b2c8066a92b6731ab4f8f222734d0ae22410d9538ed56af52a35d8477d0e63ad
- MD5 1552cabd557c0bb643e476c4f2ba4dfb
- SHA1 348375b6c3145edc1da8b3c192b6c51ba7f20afb
- SHA512 6db38bd21b0bd789c308512e49258a52c70a73d27d58aaa44f575e4a70cab176d3774d7b7e42af34ea683d3a07835c59c531bb1c5e9ade15a71db186e26aae0d
- SSDEEP 96:Rn5ofebOJLb5pebvpf+LbYbIblhgbgz5bsb8b:p5Yu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 26c256d0cfbeeecade51b442b630c7a4caac7d0f4016cff70ab061662aff9af0
- MD5 a4fc9877c09397e91c7b6f8e78fc45de
- SHA1 469b9f9e33c4b44df3c48e7e8a9f7faf5f76eb26
- SHA512 3735b3db9c4f133d19db18813a2a402a8a65a0050bc2a131e53962f5f1501e5f22d9f32de4147509b312bfc5fee9b84a54ab300c2c130cea86052d24c9166220
- SSDEEP 96:cSMF9ZbkW6ShmHKPP/PrWZt+QdWqFl66JozGzgClKtmSSM:crvZboShqcPCP/66JozGzgCl6mSSM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 8bfb15df2728b6110de8f245141a3ef2d5f2884bea548c1ef11c0ff7639c84f0
- MD5 a8e94af3f9bbc3f2288993fc542ef246
- SHA1 063eba47d74716cbf24709d48f433386c68900cc
- SHA512 dfdd4b76cc1ac4d68592f6f5a337a839b75a25005b983fa79affd52bead5f62e784a7be94f314bdd50cb109b1d080ab35c0c25306c8fa2a4dd5fb0cb131a0101
- SSDEEP 96:G+QdWqFl66JozGzgClKtmSSz1BKSMF9ZbkW6rBBLhmHKPP/PhxkW3:O/66JozGzgCl6mSSmrvZboPLhqcPDf3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 6c6e3395ee0eea7d64d2c4cb8e10aa79d8e28a2040455847429a310044c41fda
- MD5 3b25d3760800012643350feadc6c7e2c
- SHA1 58c1bc1994014e8ed56eef35da37dbafded7b489
- SHA512 a990852b70b74bd5213488225f0648d641859b7ae147a401e977c5eb77b059d638925f3fe633b7432c89de72ee1fe889a7aaf2e6edc95fd19d349ae7cc94eaab
- SSDEEP 192:O/66JozGzgCl6mSSLrvZboPLhccecPDf3:O/66JozGzgC1bhboj60Pr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 16KB
- SHA256 06f64862971dea05ce6da2ab935fd84431d385b9e609342bcd8b5955f8e96de6
- MD5 1aaddb14c594c819a10507353b5bd27d
- SHA1 73bb0cfbec65f12bf207e24ffc787366f18c3ed6
- SHA512 94b32b591c3366935178d023de81d06264b6fdc89fd7ec56f532efe5df5cecfd8012f804d40246e4c67abeb54b9cbafb7fed42619cfa8205f390fe41db323b0d
- SSDEEP 384:O/66JozGzgC1b9OlX7W5EDqc/UbMbFVbojURDPB:LESlK6Dqc/UbMbFlx5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\db\data.safe.tmp
- Size 16KB
- SHA256 951f0f97f5bf6f07aeae087e887588c8f95c06cbda35ce63c4c025e8b36498cc
- MD5 d60f5a344dca4418c841351b12e6799b
- SHA1 2b749a6a4ce919d89383ab913d59c09f3a8d7124
- SHA512 4e8d043cdd024ca649cb0d472960e1c894e3d112be7f261614f868c195d4c68859158b52b301276feccd2a9064465ad2e393e5f423e40643c46b2911ff4a0542
- SSDEEP 384:POlX7W5EDqc/UbMbFu/66JozGzgC1brbojiRDPB:WlK6Dqc/UbMbFrEBL5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\pending_pings\047be3f9-f7de-42fe-afa1-0f3bf866b9d0
- Size 26KB
- SHA256 9ca42e95900d24776201bbed8b1b988f69444144d59fc478fa5cde80864d808f
- MD5 ca8f2f3aca29b7e7f3b24c67c156a126
- SHA1 995f74daeaa0773dc1e3b0f1772490cc3bc07aac
- SHA512 0b0649a615a996943e069d63fc5018b6c3a0da66feebe2994a3df333e891751e6d43176bc33aef5bf7ead67657eb787669c9df8bd0ba51b748da70302a29b389
- SSDEEP 192:92EelVCgVprlwpnm49IKaVTmTMQh+1vtWktc6CsjC+acM/FQ7pFrRIxVVucSqU3w:oE8plQKxYRwS8ejDeGKvb6iiKClVkb4X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\pending_pings\41c54959-d09c-4426-aea8-edbfde441d2b
- Size 982B
- SHA256 baeafe83868b9ffc7ba56904d7304b454b5f7c5aaca34a3070bc5d2449764865
- MD5 ffe305d5ed09235327ff769b88c83cd7
- SHA1 124e0a0c0c11967a963365d73ea3b40817ae83c5
- SHA512 d3b42dbc28aaed9e3b6a8bf918a4215fd0217e7810ae383e176188893cf0703b461935a2af2642def70dbde6b676496834682f0f8454104c897d5182514c1718
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\datareporting\glean\pending_pings\9e522819-c058-4ece-8201-5a2cbb4a0bac
- Size 671B
- SHA256 1dbeaa8654611fa4ec4e780ca4806be9211d084145104bb54346072508379331
- MD5 a47bb9bcc60f729f1d0225d0a5eb42d3
- SHA1 5f86fb83d549d02989aeba04c4f642bd9c332d4f
- SHA512 6441ca7999889f46e6221c07cc7671fbebd418f54537af390d7514744ac4e7466203a89128294933490e859045e26e4362074f67fe217001dbf653a5ec699210
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs-1.js
- Size 12KB
- SHA256 63bc96263d4cf3b8145fa505593918ce97eff23b41c8c884d2a9f49d18b74ea0
- MD5 4d5b2d428c18a35a79463cf20e33f1b0
- SHA1 124166f16d7c568f92cd88fe8533a2b1641a0352
- SHA512 e0f205ad39c181afcc3e65a5da3317aef6aa1bd94efac7016369ac25ab2f7bd0bcaf289274e4fce363466fdf48ff4ff6719c0b11978993ea6635d168bc628351
- SSDEEP 192:G5n1RyQfMPu5xt3IWww4cdxIWR3QHr560laXt2mP0yIBw8H7z:3QZt3Fww93F1QLQ92mKwO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs-1.js
- Size 16KB
- SHA256 22ccdc0bbc873ac61ff5cd00369d3bd019faeea224bccda78bb1eb31dc86f381
- MD5 0dcc5735e69d2c4ad941a4a337cfa0fd
- SHA1 1df86b523ebfe53706892ef03b5ab12d7a4c7784
- SHA512 10e96d9d5a4e0e8d0da618d36b70003cd2182895442097c23c06e15144a6855c2b084963131d8788c789dd5f2261c9206593f554cf94e543164669dc98c43b6c
- SSDEEP 192:GCn1RyQf1Pu5xt3IWww4cdxIWR3QHr560laXH+2mP0yAiBw8HFz3le2:6Qat3Fww93F1QLQO2mPwAf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\prefs.js
- Size 8KB
- SHA256 8968e31450568ad059022963a8e7c72a136c766c751fc4bd1d0d24a460f2b738
- MD5 d8477e33718548f3996185f25410a82e
- SHA1 0767289d8e5067760d3cadf94b8e1c6b953f80de
- SHA512 da71f5dafda907988d60594e7f3040a5484cd7dbdf18bc4515bcf7cea1920985db4afd007bbd4a2a26f9a95c5a3ed011483b5fb93e2e069c874360eff8e99830
- SSDEEP 192:k5n1RyQfM1kVD4cd6l60maX12mP0yiBw8VT:9QND9AMq2mUw0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85t3rifc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 1.2MB
- SHA256 4195f40f89383e6fd1f07d382dbaf117326e0c392d0325036112df1d0458fd87
- MD5 be0122f98d7a3d3bd40435e599710dbd
- SHA1 5b4de8d0f9a264f169ee2b5f034ccf62137f3dba
- SHA512 cc6a0b31578becab4c3076ec020a9f96382f29a8ae5c7a98528714f4b88631a999a634f16624a51496971dc5e7a97a3522f8cb6ceb611ed14b83374bf989bb57
- SSDEEP 6144:H7rSq393h3k3m3oTHI7teeI3UGuKUOTdgwAHra5dM0gpc4wMLeHN1HmcH11HoZmr:R7t7HGOminH8wdnJ2/sm9iM
- MD5 SHA1 SHA512 SSDEEP