Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
22/08/2024, 19:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target file.exe
- Size 1.2MB
- Sample240822-ya8d3stgpf
- SHA256 67bd90eb80c036b075fabeb6c3c147a89e940195cd457f792b828bdf97f00799
- MD5 7640ce67576dac290acad6c67b5f0f65
- SHA1 3365e4ed090e3da8bee85f614fd3011010cade69
- SHA512 e9212b1ac2e5d884440c605f18c9c764c870f402affc3a218c08cb95cbeddfa37844725f47e72e6dfa4bbbe8fa653dddaae4450b856abfa3102cf2909ba0c14b
- SSDEEP 24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8az2KP6cBDjvi/3KoyBlYZ:STvC/MTQYxsWR7az2m6cBDjq/3ES
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2320 firefox.exe Token: SeDebugPrivilege 2320 firefox.exe Token: SeDebugPrivilege 2320 firefox.exe Token: SeDebugPrivilege 2320 firefox.exe Token: SeDebugPrivilege 2320 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 2320 firefox.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe 3460 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2320 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3460 wrote to memory of 4036 3460 file.exe 90 PID 3460 wrote to memory of 4036 3460 file.exe 90 PID 4036 wrote to memory of 2320 4036 firefox.exe 92 PID 4036 wrote to memory of 2320 4036 firefox.exe 92 PID 4036 wrote to memory of 2320 4036 firefox.exe 92 PID 4036 wrote to memory of 2320 4036 firefox.exe 92 PID 4036 wrote to memory of 2320 4036 firefox.exe 92 PID 4036 wrote to memory of 2320 4036 firefox.exe 92 PID 4036 wrote to memory of 2320 4036 firefox.exe 92 PID 4036 wrote to memory of 2320 4036 firefox.exe 92 PID 4036 wrote to memory of 2320 4036 firefox.exe 92 PID 4036 wrote to memory of 2320 4036 firefox.exe 92 PID 4036 wrote to memory of 2320 4036 firefox.exe 92 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 4260 2320 firefox.exe 93 PID 2320 wrote to memory of 2240 2320 firefox.exe 95 PID 2320 wrote to memory of 2240 2320 firefox.exe 95 PID 2320 wrote to memory of 2240 2320 firefox.exe 95 PID 2320 wrote to memory of 2240 2320 firefox.exe 95 PID 2320 wrote to memory of 2240 2320 firefox.exe 95 PID 2320 wrote to memory of 2240 2320 firefox.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password2⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1936 -prefMapHandle 1928 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f18ddb0e-3d7a-455b-9dfe-4faa5bbeafa4} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" gpu4⤵PID:4260
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78c197fb-7199-4c27-920a-c1852627fb96} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" socket4⤵PID:2240
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3000 -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 3284 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52c8718a-e6a1-4add-8250-460e57e8f852} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" tab4⤵PID:1968
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3780 -childID 2 -isForBrowser -prefsHandle 3268 -prefMapHandle 2772 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6f94d4a-a0c3-454e-b17d-8d02ecdeca7e} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" tab4⤵PID:3676
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4544 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4500 -prefMapHandle 4496 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60fae3ec-1801-47f5-b7ed-23320c4675e3} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" utility4⤵
- Checks processor information in registry
PID:5368
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 3 -isForBrowser -prefsHandle 5308 -prefMapHandle 5212 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98d7d72d-e334-459c-97a2-e597071df02a} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" tab4⤵PID:2840
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5588 -childID 4 -isForBrowser -prefsHandle 5560 -prefMapHandle 5568 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6af9be70-bd18-4517-921a-220023b6519c} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" tab4⤵PID:3900
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5932 -childID 5 -isForBrowser -prefsHandle 5884 -prefMapHandle 5740 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d3fa802-c327-4562-acd3-4b7095c10897} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" tab4⤵PID:2524
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6120 -childID 6 -isForBrowser -prefsHandle 6128 -prefMapHandle 6132 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9e8430d-1e89-43d8-a612-7ff7e7bfb915} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" tab4⤵PID:3112
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\activity-stream.discovery_stream.json
- Size 36KB
- SHA256 b0f93cf041cab3beebbc7d28817a4f29164c10e89a9c25323d5bc598ab167f10
- MD5 bd01d856920ed9b5cb45ef0705618cbd
- SHA1 1e66e267fefc6b8271dc3cfc7776c28ef6c812b5
- SHA512 3b420f009dd666d8d51b0ef02b0c576151b8b5652d12980a7b6501a76ac10d12af2d52d63ddd7476ab28dcce50852fa5605e8f14d93f73562797f92898c0cd63
- SSDEEP 768:3emJg1KIR+mQMqwcotAmyd4CHOHwwtN3oRWt8Bl4t4qTaAFH:3emJsKyLqwcU6ukNB63
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
- Size 13KB
- SHA256 6846972933c65b4ef9e88e67146f7f5be63cc1b55212d8a10eaa5445314c57c2
- MD5 6a8df5f105161108e90ff7f2265f6355
- SHA1 a0736ff192ae1573a23aee20106e8224cca26394
- SHA512 f19eb2ec767a206757649754a6b5bae1cad24832fb9b69ab60d36914ce265a33f321c23dd465993bfe239444240a10a559c3412ab6f4db6a2ad75b633dd18600
- SSDEEP 384:H/Fu9fiGLm4pU0Zft2WlOX8lPLZZB7t0lpDIIm+E:IBi8mCU0ft2WAX8tzB7eD87
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin
- Size 11KB
- SHA256 3e5c9a122799b8aa4206341726567d6e75f88fefe49b4e782f4880dc62bf0098
- MD5 b39148de240e5e0c263683b116b7074e
- SHA1 cae59ac7b8bae026c42e88bbe59fb07c61a8655f
- SHA512 a19c1bc07925b927f5d6f83706985f92e629a98c049d6a593713f4ae3f5f08742e23d4a6394e44bc6b86ff86859063badaf7c18d1e4ffed50a8389c0557d0902
- SSDEEP 24:kuB1oPd9PFsh2F3LFB9x9agu1xgRbD9IpR5cO49XuhMZX9UmS9htK7hc9B+/9xrv:Czba5oVI9cO67UmA7K7hOkltueFg6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 088bd87328fdd4b2e7e65f5277119fa2f7da7700f8ba53e0e1ef88d09b9afecf
- MD5 cbed2a92bde70b09d53ccb0faf009844
- SHA1 fab64cc14e91f019089790a136d4b1fa556237d0
- SHA512 c77b93a5161c7f86055a92ea52129f324db1a619bf5d34f9167f363691f7b7e95080e9280db8afdf622c17b2cd07d3f2f53aa3b747e31ccb4d87c04be3d6dce0
- SSDEEP 96:AnQPaGuFl66JozGzgClKtmSScSMF9ZbkW6ShmkGPP/PrWI:y/66JozGzgCl6mSScrvZboShhoPCI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 a7c8d5194c6a26a53a87d952cc80d11d1626777821abe112fa5555a36ecbe4fc
- MD5 cdd807e7800b21f0bc2a23c5b46296ea
- SHA1 9645f0f3de00a0432dfa70dc516ba9a5f937204f
- SHA512 ffd5b9ea333e56bb94f5ecb4fdc5d9b27c7c1b187f290b6afdd9b9eb6164b9179bedc943797e197f668354bc289f1cde3b506fdc802eb95391e4c558e5e9aa76
- SSDEEP 96:AnQPaGuFl66JozGzgClKtmSSiBhSMF9ZbkW6rBBChmyiGPP/PhxkW3:y/66JozGzgCl6mSSorvZboPChSoPDf3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 a129f1fbc287f4b0cb8f28cf3e766e6cd778860affe64d91251fc337fe4df632
- MD5 7518c486bf4f855ca8c20ac7ee2bff1f
- SHA1 226b23a45411f37678456a56a0cffc8f3d765a81
- SHA512 d268777f150810157ff50fe012d795117b34b9b952310eda6a8d90308255cf38f645fb66510e987935048cf723b717bcf04fcd0cb31611a23019c1dbdaaf322d
- SSDEEP 384:WboakhPj/66JozGzgC1bM16dtJbHhHDCGZGbCbGPvc:6g2EuSrtDCGZGbCbUvc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 8e8be302550a64ce987bfc54679e634c31c432e6ddd78060ab1f05e2465e50b2
- MD5 9b568ef819c9a3acc4cf0ed63896e58d
- SHA1 0c96dd04e2cb93c81f2c0011a9ab74bfc9aa0fcb
- SHA512 61ac220005322ce7e532506c5fd58754a7095204e9515559f10c64059c62c2b2371480d09a196620ac387c394a08df453023b7e5623a92df174d5f13f7184314
- SSDEEP 384:m16dtJbHhHDCGZGbCbGPvM/66JozGzgC1bBboBhP/:KSrtDCGZGbCbUvJEvYn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\39d748a0-8434-400b-8815-9401e6842d8a
- Size 982B
- SHA256 29f3c71ca17ec7f1524ac2286a2cda2c47db16beb0c36f9c07787abada336226
- MD5 cbeed6b19c1208589a13c2b029f11dcc
- SHA1 2e8426fc7b6e3cede1b4e900158f7f77ade6a04d
- SHA512 e26be402be04b4e9f848c9f3903e3fc8b167b0c903bc126a61c4a3e9f720da870c62c2f92d29f82c84164dc09963b1449a8bd1f017241c423b9a145e082c3d0a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\3cfccbcd-d65c-4f4c-9bea-42b7076f6414
- Size 27KB
- SHA256 1bc5707bf89893383ae0f7cbf4f6cfe1c6622c57c7b8736a60f97f2916f792f3
- MD5 c2f9f40586a89caf9d775a0029a4ab80
- SHA1 6e1356d12aca42b25163fb64c9899b9583c5b2b7
- SHA512 99c3887ca5e3f3541e099c4eb8bf1b4f28aea1bedcd28aded4df79a837ab0d7804adfc06fd411fb100974a9de9e00e18137d03811b58780de7fa266ff059427a
- SSDEEP 192:ynE/PuyP2yCuoVwnuW+EfTj4sJ0DokedAHzN1vVj18sv5YTEfN7EJpuk+kvoVgHR:y06yA1Zo4dKgRISlb7cMQ1fUJS4y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\82f45bed-d548-4707-8bd0-638962fb0e39
- Size 671B
- SHA256 1e7b0ea3e46e911b71945cf6c253947ba03217f36900ef6419f3afd13519117d
- MD5 e35d705f084910e4d39e7d5faefa1345
- SHA1 3497992f3e1f4b929c4b340dcf83c4d8fd3d5baf
- SHA512 3e5a544175756840b4ea6157e13be7e8ed20640fdc5cc36636501cd80dc5ef8002c7b4c9a6855dbecf1807fefd151afa94d0291d490776365f94c84b4e91b9df
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js
- Size 11KB
- SHA256 f69f4a93b535d3486440b0c729cd0cf402a711cbe473f890cab2a8ffa7a14a7f
- MD5 f4d0d9b18c38687ba49383c4664a41f3
- SHA1 26f77fd830d7f8b5bad5cd69d708d8ee26c657b9
- SHA512 dcfef2014554b3f7f969a203109f1ea1cac6e396a02866c2690503e4af56d79628d9a71085e472cc332df323ad16bde3855a14a59f3eba8b5b107d65caf99d58
- SSDEEP 192:w5nIROfYL660DzsWxn+TWD1bpcdiLxnrc7V1I0ZM60taXY5nsS5Bw8HT:sxQWx+yIExSfElsCwC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js
- Size 13KB
- SHA256 6d4072fa96de94e4320c2473b22468a1ad531e0d02c72c90b2fdd3e05155a20b
- MD5 086462a16cbbfaf2b5edc2d22b166bda
- SHA1 4113dcffee9d05d3f164301f1310952e587c6f64
- SHA512 c555e79b509822068831d2027eccba0008d37ac2fcd1c55c19f0e1dae1edbf3cf17a2945f4946603a4acd7bacfa16f5c0a035c2aff28540cb504481b1173d42c
- SSDEEP 192:H5nIROfYL660DzsWxn+TWD1bpcdiLxnrc7V1I0ZM60taXY5nsSpBw8HUh:/xQWx+yIExSfElsYw3h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js
- Size 11KB
- SHA256 4d41bcdf30c97f8866cff3abe2eab6f6518922967f1725dc4fb603d56bf6b5c5
- MD5 3c94f5ea5f35f21fd1c60e350e39cf84
- SHA1 5790db36b981f46fad3552fbe8adeeab5b890841
- SHA512 927e67f5f94cb5576b853e91dfac86448eeeec6fbd07816861f697662ced8555b404beef732fa64263387d1e82106974c99fcec1f902b8064b829583d391b4d6
- SSDEEP 192:w5nIROfYLfeiVVuXMaZxnK5QyJcdYzxnjEQHrE60maXb5nsS5Bw8VT:sAV4xZxK5NWSxoQLf0lsCwU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 1.5MB
- SHA256 a5040fb15acfe605c3ca712aa63d722c7f2d618941483e6d0ae8d666899e3b9a
- MD5 2ca8c1891c3de77aaa4fb621a71f9d89
- SHA1 28fa553e5923f3573d4de3f3cebe8ffe27ceed33
- SHA512 c415d2ad2de871e00b41a198e082cd61eb25b9963c3420fc6d17e19fe09e64faf0457c66643af1cbecabead22561c30c5590a3c31afc88dbfafeb03b4aa376fb
- SSDEEP 6144:xBEqv3rsbVTHk0BSlVnbUXlqU0xNE77dfgIPi/ZiIPu/elTZmzcm393z3m3z3R+J:p0klVnwXp0A/JIjBxDtrmCJLjdsT
- MD5 SHA1 SHA512 SSDEEP