Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
18/09/2024, 04:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 897KB
- Sample240918-e1yg1stank
- SHA256 42e8ce343d9a07cf8a2eff627495a7c1c7ac0183af6196da6469b9a0f32313f7
- MD5 16ae763ffef5c93b67b81ded1b78e5ab
- SHA1 5379fb2583c8214772d10f5353270d316324cf42
- SHA512 3fc85a4b232c0ea6c5a753b43558114e953a6e7ebe9c73b7c3f6a84398010f4240c12a6c62929526e0124f298d0aecc148c34e0b87f9c10d9afcc707eeda7294
- SSDEEP 12288:rqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga2TJ:rqDEvCTbMWu7rQYlBQcBiT6rprG8aOJ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings firefox.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1596 file.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4560 firefox.exe Token: SeDebugPrivilege 4560 firefox.exe Token: SeDebugPrivilege 4560 firefox.exe Token: SeDebugPrivilege 4560 firefox.exe Token: SeDebugPrivilege 4560 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1596 file.exe 1596 file.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 1596 file.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1596 file.exe 1596 file.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 1596 file.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe 1596 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4560 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1596 wrote to memory of 2920 1596 file.exe 84 PID 1596 wrote to memory of 2920 1596 file.exe 84 PID 2920 wrote to memory of 4560 2920 firefox.exe 85 PID 2920 wrote to memory of 4560 2920 firefox.exe 85 PID 2920 wrote to memory of 4560 2920 firefox.exe 85 PID 2920 wrote to memory of 4560 2920 firefox.exe 85 PID 2920 wrote to memory of 4560 2920 firefox.exe 85 PID 2920 wrote to memory of 4560 2920 firefox.exe 85 PID 2920 wrote to memory of 4560 2920 firefox.exe 85 PID 2920 wrote to memory of 4560 2920 firefox.exe 85 PID 2920 wrote to memory of 4560 2920 firefox.exe 85 PID 2920 wrote to memory of 4560 2920 firefox.exe 85 PID 2920 wrote to memory of 4560 2920 firefox.exe 85 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 4208 4560 firefox.exe 86 PID 4560 wrote to memory of 3304 4560 firefox.exe 87 PID 4560 wrote to memory of 3304 4560 firefox.exe 87 PID 4560 wrote to memory of 3304 4560 firefox.exe 87 PID 4560 wrote to memory of 3304 4560 firefox.exe 87 PID 4560 wrote to memory of 3304 4560 firefox.exe 87 PID 4560 wrote to memory of 3304 4560 firefox.exe 87 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1932 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dc6a1d0-173a-4eb9-8cef-1eb0107a4678} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" gpu4⤵PID:4208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2448 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30aac004-0d81-456c-8697-23178e08919c} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" socket4⤵PID:3304
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3028 -childID 1 -isForBrowser -prefsHandle 3340 -prefMapHandle 3032 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1128 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9f10118-52fc-45ce-93b3-da392ac790b3} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab4⤵PID:3556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3632 -childID 2 -isForBrowser -prefsHandle 3356 -prefMapHandle 3616 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1128 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {586e826b-3261-47a5-8d2b-4cb1bf5b8c37} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab4⤵PID:4516
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4676 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4388 -prefMapHandle 4340 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67c28339-dddb-41fb-9317-8a240e7748fd} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" utility4⤵
- Checks processor information in registry
PID:1864
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5344 -childID 3 -isForBrowser -prefsHandle 5308 -prefMapHandle 5304 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1128 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {349bd9e1-cf24-4919-aaaf-4df214a4f518} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab4⤵PID:4564
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5484 -childID 4 -isForBrowser -prefsHandle 5296 -prefMapHandle 5284 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1128 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a5701aa-27fb-4f7f-83dd-c5c86f70ec80} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab4⤵PID:64
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5740 -childID 5 -isForBrowser -prefsHandle 5660 -prefMapHandle 5664 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1128 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {703bb508-881a-4aed-a9ad-0a065e23bcba} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab4⤵PID:4672
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\activity-stream.discovery_stream.json
- Size 31KB
- SHA256 b6fd761a2336dfd5421b74260385ea210edec7b056e0bf77d30533c8aea909bc
- MD5 ca4bde64e761246ac8e4b69823c5773a
- SHA1 b1419169f0fd739978ee1e086cd1117d70a12d96
- SHA512 7b4fcab2969b71ae15c229660811347b8f600f914ece484170658c00e8fc6df07a83311e6840c95cf4860538d13be408b4e324a602993c1263c7653d1d1d8636
- SSDEEP 768:Li5SeVvAwbXrUEXpydvW+Fi2ALbdt3SkaD:L2KAXrUEXIhWnU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\entries\22386449CA13D8975B935875780066C6EF52CE37
- Size 13KB
- SHA256 cb2f6e506eb29fbc55d6733e3c45df43349937682829284c2433df8e13263e93
- MD5 ea882750db28b82efdb37911f35d54b7
- SHA1 132ffb7297f02b5635f49c4b86194f41702a881c
- SHA512 7ea5486b7bc35b7faf81d6ad4c0947fb3801f8f1271e279e783f41517aa0783de3f4ca58917588c4c57fd11a3d4cf138d7ca76b2e8780bf1706f4513baff4f3c
- SSDEEP 384:HiWu9fiGLm4pUhpHLFoCr/E8HPJyD3VonFcP+AWRMACjHe:iBi8mCUhpHLGCr/E8Rg3V/+hRMFq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin
- Size 6KB
- SHA256 57ffffd6a714cad5d79346ec9b876cc3f43f8dbe328843f1a06badbbc9e86139
- MD5 53f904a527b416e5da44a70c3e64e93c
- SHA1 37b346e7595a72669b8ddb6864c25c4aa347a4d0
- SHA512 fdb0ce63847770e657957757cd8f5a2fb5f0701370023f8a44cae36163ae31a3c9b9f355d002f9a9e6185e547efdaa8b21d063fb6bb6b171e7e4380c78844af7
- SSDEEP 6:r+ngidpq88gidydgids+9KzhkRmHgidpqs7HgidBgidgzE49K:r+gQpB8gQWgQF9KCRQphMQSQUE49K
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin
- Size 8KB
- SHA256 3ad509f7613376634e5bcb19206fcc93ad8272d8b8363955db6b7b39461c93a2
- MD5 179975401c7f1c7a38919706ce5e386c
- SHA1 608b645a6eca03f39c778c5776cff48ef505e1ae
- SHA512 c6d71e09620ccf66fde0c9cfb0eb47cdc02899f4ed7c57a0817dd8e9afc8b494b8989b32f8de7789ec74e39ee3c2881cf14f5cfa342f49477a1e953a383ee2fd
- SSDEEP 24:ruB1oC9MRuhMZjBFsh2F3LFngu1xgRbrsJbF0JMibNWKsJblxWKf+MibLJbFsib:+M15oXebOJvbNpebvpf+vbFbFb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin
- Size 11KB
- SHA256 0f7d811e1cd437a9ba35fd8935c17920f61dfaddd45285c999c4f523dc435dce
- MD5 8097ee40e287ffd36e81eea084bcdaef
- SHA1 88f04430d43a571971ecce5051580f0e49aa363d
- SHA512 9e64165215216919e09204e05f8adec5d121f582b2e31f8c140415f1adf7564320ff2de9291dd4b533cb834039a6fddd70455877d38c5537d4027cb0d3a25e49
- SSDEEP 96:+i5oXebOJvbNpebvpf+vbibibkgbgzGb:t5Yu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 b3d24d278fe5d1aebcbc840e996bd377b6c93cb146df55a82b19698064fff57a
- MD5 ef83b95b185bd29abec8fbafc61fa876
- SHA1 afbccbf021a6d2794d9b212bdf46eb5a0bac2dd2
- SHA512 68c88f43d55ab73e56a78d70af97cf0487b42fa4f65a7f2dd486f7604ea8eb2abd6c9a5f0d14f1917394ba091239c4d6c2a3f6446a4c12c1d8b5debda526f123
- SSDEEP 96:eSMF9ZbkW6ShmMOPP/PrWZYgKQNb8cFl66JozGzgClKtmSSM:ervZboShhAPC5/66JozGzgCl6mSSM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 d5cb5d3e29bc52656235c3f73c4743ce2137e9b6cec68a63fa7237b641afd839
- MD5 f89d601e29e052aceecffcf441d6f03b
- SHA1 53f88cf617670fd0e5ddac100a8560e0c5db43c9
- SHA512 c0c5a14194dbc82f7620650a0ee828a4a50cfeeb285cc9468353adde9efdddce858d22fe1c59d92407855c3fa584773e965a98024f466bc918bac23ac80f7f58
- SSDEEP 96:YgKQNb8cFl66JozGzgClKtmSSDB0SMF9ZbkW6rBBlhmjOPP/PrWI:b/66JozGzgCl6mSServZboPlhkAPCI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 e51a976ec19c9895823b0ff29d6b1ec9a86c5f3432cc611d31fd10e9d4fdc840
- MD5 4c480e5ab3d43cefe78b00061c4a9691
- SHA1 354e1993b0be06043e68086d2b2925f089c7b0b7
- SHA512 cf68153bc4b417a56a97afd39ea00884568bdef7308b3ca525e6c7a683eb018b428102dec25277eb0acfdf93084ef1e5579caefc59b0fb0ccc78d74f14dfd589
- SSDEEP 384:vbod5jPFfs1iJcsDKMvBb+bst/66JozGzgC1bM:z893XDKMvBb+bsgEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\1d5068f2-fb38-4b6f-a4b1-d0d2bbb6bcf1
- Size 982B
- SHA256 b2bbe85f1d0b10b44796633f3c5d81d22bc73c892f8e4c54264aed86a5e07d77
- MD5 42ceae9504fdf7bc2929ab890be80d84
- SHA1 955415846ddcc1bed4f895a4ac96f2b4435776e7
- SHA512 c65a69f51e67539455f3630a781c05794c331ec10287466f7fd02e42c7e468aecdec391749b9f7ecc2064345bf63b5251c519ca69e09d2704bb07cbd58cd0aee
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\6a81b00f-42bb-44bc-8fb3-6e269986b867
- Size 27KB
- SHA256 78c67084558954b3f2dc9d84c183a358a6b2109a5298032197a8e681c8a8d86d
- MD5 2db6b77ad1039e9027538f819c385f56
- SHA1 de1c3309f9fef46ccd22e4ee9ff3c13cc11dfea4
- SHA512 3271aed9ea8c6f22b49dcf4eb96cc1ce722267699bccbdce6b4cddfe7ea4c1858e0a423117075c18de7fa1d0fe051d7b84aff3ebf015c789c68142f9eb326f55
- SSDEEP 192:FGaUj0KpuJyCXW3rGw7dzqOu8w6kRSDnm1j2xnIbNQom9T2GTyJj4TpbiaQbubGc:FwL4z+ibNVGW14jdW1bR6QSOHi2K
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\e11f3c56-fd55-4c26-991c-6a54ddd814c1
- Size 671B
- SHA256 c076efb8eb8b8bfe87b17b27e17794a6429fb585fc842527eeaef590ce2080b6
- MD5 cfe3c563f03624854ebc96511f1336e5
- SHA1 b6195610b14d4d6e19bcf94f4b905b7d96dbb639
- SHA512 63112aebdefdc6dcf481f4e4f681a5e33956b4a8913bdbee4b4b35833b792640183896fdda3394d5e9c96ecbe343c322143bf47c396b335c5e575937ba2f6edf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs-1.js
- Size 11KB
- SHA256 4bbce51e67806255cb644fed48a08d04501cd166ecafca888746ed8d06dbc21f
- MD5 b3aa8978861e5b00472da30b522fee84
- SHA1 7fbefb04e437a777ed106110c117a33304b997ca
- SHA512 94ed30a90543b64c680bb2a724f093a77d6068d28844b6b425c8c172eee34cf5107d6780fa54facede9acff813cb335d1e33195e09462b416ebf1fff1cd4b1e5
- SSDEEP 192:6i5nlROfwuFSTzxnHktJWcdw8LxnDly1Zuj02aX65tPBw8HT:EkTzxHktZvLxDly1ZWlw2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs-1.js
- Size 16KB
- SHA256 956408c6360465e3e3ef577098e96e4b1e1c91a10a20ececfe2fb3de07821379
- MD5 86afe3c008bbf429bc1e42d361a886da
- SHA1 8ed250b454a210e005f8a1e840aa4cdeb0116d03
- SHA512 ca1894f3821c7e68c9ae7ad43a1820d3dfc60248a881a90d4048a134e54f0e094cb3551a5b8fb0fc0ab0c494b6453888e05c008f8bec552c5012254fef59a7e3
- SSDEEP 192:6ianlROf4uFSTzxnHktJWcdw8LxnDly1Zuj02aXm+5thiBw8Hb7PpqQ:dsTzxHktZvLxDly1ZLiwwV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs-1.js
- Size 11KB
- SHA256 dff91eaeba72d49d71723d9cc9be0fc9254258226f3d48ee99936cc2c41f3322
- MD5 4384f7bb5e1c791130e8cb149b079b63
- SHA1 6aeff34842950cac62d3fdfde7193448143fcc24
- SHA512 13aa10fe5f9d6671f6517e2c985bcb10364d72fa8495cc6efc5249b724a15b78d34db6dec4cd910c791afefe5c79cb5b5c5c0c15be851bc5b7de1cc2660cd957
- SSDEEP 192:xi5nlROfwr/CsfYtv4Wcd+fSttkDnjXv60fYaX65tnBw8Hd:PHsiv4D84tkDnOAwlw4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs.js
- Size 11KB
- SHA256 31692f2dbdcd231d10d63bdb7dfafef0a1c18bee0425e742753ac16fc7ce7f7f
- MD5 dccdee73245b7f785412b7cc33a298e9
- SHA1 3d4356ca72be4d597206f7e0e8b972bed593c337
- SHA512 4aee0c67ab93e81cb5b72d00504fa1042b18659f72a4ddee01fa86d72ef7335d704599a71830dd99f63db0211055ddd7ac22543461554d8820fab5eac277f693
- SSDEEP 192:xi5nlROfwr/CsfYtv4Wcd+fSttkDnjXv60fYaXyJ5tnBw8Vd:PDsiv4D84tkDnOAUJlwm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 1.2MB
- SHA256 1eede1dee3b3014f45eb26c2aadb1f12bf1ed9b029b82b94896633420f15196f
- MD5 01bec38b82e03707c2eedefb9126debf
- SHA1 58aaba4c429d41041925552dcf91c6146ec31752
- SHA512 4ac36890042180c2dcc668e05702d0009f690f84279da90e593a2f01a89e737044dfff4241cfe9c4891b6f412452948b1358be871a43dcc565c70ffdf0f8416a
- SSDEEP 6144:TeSReHMuaBAAUlrJ7UfkUQg/Maqydb351cSG3Zmz0Pu/elv3K393z3m3eCy7VTHX:duaBAxlrJQfdQpaqCbxaud
- MD5 SHA1 SHA512 SSDEEP