Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
18/09/2024, 12:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 897KB
- Sample240918-py23ja1eld
- SHA256 a57b2d3bbba7664e5c2e804b27d16f68b6cc2fc727b06d5f0d814c14ae41e9dd
- MD5 91969d4d045959174fc79bd0c4960ff5
- SHA1 02e63e86c98d27d9a8464da76ce941cec4a26301
- SHA512 e94bd9b0cb9e271f3eb83f0601c5d74faa202d18368e630e36a5ec7c7717bc8b48a5cea2728ea922271be81b074122f7dc01e1be52e00645e4c7126687de62fb
- SSDEEP 12288:aqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga2Tr:aqDEvCTbMWu7rQYlBQcBiT6rprG8aOr
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings firefox.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2844 file.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1964 firefox.exe Token: SeDebugPrivilege 1964 firefox.exe Token: SeDebugPrivilege 1964 firefox.exe Token: SeDebugPrivilege 1964 firefox.exe Token: SeDebugPrivilege 1964 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2844 file.exe 2844 file.exe 2844 file.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2844 file.exe 2844 file.exe 2844 file.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 1964 firefox.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe 2844 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1964 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2844 wrote to memory of 4304 2844 file.exe 82 PID 2844 wrote to memory of 4304 2844 file.exe 82 PID 4304 wrote to memory of 1964 4304 firefox.exe 83 PID 4304 wrote to memory of 1964 4304 firefox.exe 83 PID 4304 wrote to memory of 1964 4304 firefox.exe 83 PID 4304 wrote to memory of 1964 4304 firefox.exe 83 PID 4304 wrote to memory of 1964 4304 firefox.exe 83 PID 4304 wrote to memory of 1964 4304 firefox.exe 83 PID 4304 wrote to memory of 1964 4304 firefox.exe 83 PID 4304 wrote to memory of 1964 4304 firefox.exe 83 PID 4304 wrote to memory of 1964 4304 firefox.exe 83 PID 4304 wrote to memory of 1964 4304 firefox.exe 83 PID 4304 wrote to memory of 1964 4304 firefox.exe 83 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3444 1964 firefox.exe 84 PID 1964 wrote to memory of 3932 1964 firefox.exe 85 PID 1964 wrote to memory of 3932 1964 firefox.exe 85 PID 1964 wrote to memory of 3932 1964 firefox.exe 85 PID 1964 wrote to memory of 3932 1964 firefox.exe 85 PID 1964 wrote to memory of 3932 1964 firefox.exe 85 PID 1964 wrote to memory of 3932 1964 firefox.exe 85 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ecf1ed4-3537-4dda-a6be-f3881f09154e} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" gpu4⤵PID:3444
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d254334-7bf4-4019-8f4a-9d36b4abd817} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" socket4⤵PID:3932
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3500 -childID 1 -isForBrowser -prefsHandle 3100 -prefMapHandle 3096 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1000 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8476575-4fe1-4c04-a76c-93a57e2ff472} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" tab4⤵PID:3628
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3112 -childID 2 -isForBrowser -prefsHandle 3832 -prefMapHandle 3828 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1000 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b056420-cd1d-4f1d-a0ac-13708ae5630f} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" tab4⤵PID:4048
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4308 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4292 -prefMapHandle 4288 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c708adc4-f300-4076-9f8d-61964b104bf8} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" utility4⤵
- Checks processor information in registry
PID:2668
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5604 -childID 3 -isForBrowser -prefsHandle 5560 -prefMapHandle 5596 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1000 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecb15efa-48f7-4b48-a2d0-7bd16b0b1b58} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" tab4⤵PID:3352
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5732 -childID 4 -isForBrowser -prefsHandle 5740 -prefMapHandle 5744 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1000 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33535fc7-89f7-4d73-ab18-8bad8133b225} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" tab4⤵PID:752
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5924 -childID 5 -isForBrowser -prefsHandle 5932 -prefMapHandle 5936 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1000 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa3b39b8-bb58-47f9-acc3-fdddd8517939} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" tab4⤵PID:888
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json
- Size 31KB
- SHA256 57d0c7ccf17c59148bdc1855a1655961bd246a21b0667a56c291924653cd75a4
- MD5 ef7cd6711d35eeb868202e1729fa06a1
- SHA1 53ad91608167dbb56ea83a35f50529c19895b5ee
- SHA512 1991f1222693a7d3c9443ce07a3ae4ba4a24db7b9f6e00097162c8586e0ce27618b37ba865b3354086560b503291ac3ac876b9e3e7e35ebd801813432feab618
- SSDEEP 768:n4Fwb1OYSNGBtiXdcgydaBqBpuLrHBYBZqBTBCtBeBVG:nr1OYBtiXdc7mLrE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\22386449CA13D8975B935875780066C6EF52CE37
- Size 13KB
- SHA256 bf7417f4b9e2df1bce23c0ff30cb65985ba4b14927fe377640b957493543c5c7
- MD5 eb53bd00b010fc67e110c1dd5392626e
- SHA1 df6c7f42107e5da40e76f291717082dcd131a487
- SHA512 3e9f762b8a9da661b69e35a6d11963b8a221dfa8e6dc4631ada9b85f3555e5e5de28b5726999546f1cc3fe4f795ac4e3ff8e3c3d06f7d6f46bed6a8fde2cf337
- SSDEEP 384:HiWu9fiGLm4pUupHLFoCr/E8HPJyD3VonFcP+AWRMACf4R:iBi8mCUupHLGCr/E8Rg3V/+hRMF2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin
- Size 6KB
- SHA256 f19fc821e3866188feeb02277039f0c2c2175825a3c60bcf16a724a9afa8f7bc
- MD5 cf394036043e4e935a223fd358be8d55
- SHA1 f56bc75abd6652f2b2215aff673343e4ed06d70b
- SHA512 6700deaf23fd0177418091cbcdd5fb4150188baafc6b790eb9f5f91e0e5b7f2dea612044eed24fd0acc925a711bf986ab3792fa8478bd4b38e09e0090d52ee74
- SSDEEP 6:2Ugidpq88gidydgidsWd9StoLHgidpqs7HgidBgidF9Sto:7gQpB8gQWgQPd9SucQphMQSQF9Su
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin
- Size 8KB
- SHA256 880a3af761daca01c8a025fc51a2a70eec30d0eb7c4ca8560c05325ad3221c8b
- MD5 79ba434608eb03943c13400e9bdf0cf8
- SHA1 94c3aeb278f4a4ae2daf834b0904988adc24414f
- SHA512 38eb61ed604529e610e85cd468a1546ab2d4dcd6ff17ff0d55365f1b985293dbbbf21766a96f25c17ff529cbe34a13bae5d2c84a091818ba091bb0b484335c02
- SSDEEP 24:kuB1oG9SfFsh2F3LFagu1xgRbZFsJbF0JPbOuhMZOWpR5cOH0WKsJblxWKf+Pb:9T5otFebOJPbq9cOH0pebvpf+Pb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin
- Size 17KB
- SHA256 1f3de667c2ba7f6758fc3b7fa04ed1d0af876ee6c578bc77fe6f279c7878d74e
- MD5 b87c629415b7545bdc26220de065f252
- SHA1 69af0404de03d53bd235e65f581365b6f0336840
- SHA512 663aaa190258be2f7ede50ccf4fc998044ac423549638d99a9d24995147a0a4a143c29cd9b0214f2d15617b2ed2eb7ce1507533264c6dcaa8686741483d13d97
- SSDEEP 96:t5otFebOJPbqpebvpf+CbkbEbjgbgzlbwbob+bwbJbVb:t5/u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 55f32863f19fe59490bc7bf5001a73e307f2fd4275c16427508325125f229398
- MD5 4c1abf36712f7666997f4a4be3f8d156
- SHA1 319dede3750e433558d9a6c15ff08a9abeed3c55
- SHA512 a0e14c6bdc1067856c6232efadae96ab349e760d3ca55be12a4971a767715687f0d0d1ec7f7d8789b16ef4b6f6d8c6c02a5c8a89b0456455c6a0b786acc3148a
- SSDEEP 96:NSMF9ZbkW6ShmVtPP/PrWZssqQAgsWFl66JozGzgClKtmSS:NrvZboShExPCb/66JozGzgCl6mSS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 072ffe8a83d01964e18abb606df00ad4041bd990b74e0f7b4fba154eca03761a
- MD5 5fbc3556bda63c8efe51878c6eb7a6bc
- SHA1 88c80b4875075074510db22fc7ba23bba8fc2f7c
- SHA512 c784b0b19362bc309641b86daea71295355bcaa0a4bb3d0af4a293d83efb822e58c7fc80cbe19c74ecbdbf618f3352f7dfd8373ac0d04cdcfecd4a6927ca4c7a
- SSDEEP 96:9sqQAgsWFl66JozGzgClKtmSStBDSMF9ZbkW6rBBUhmjBtPP/PhxqWY:4/66JozGzgCl6mSSjrvZboPUh+xPDtY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 c590dc0305c8a3e39e06c7211d74754323f5500e50259a9de97d6294de47a436
- MD5 bd8b0b120f9588187f62f12bb4e9cc25
- SHA1 6883e50dd4d83daee23e01a09dc87b50d5717ec2
- SHA512 d6b118740af2e4be953235d52cb5c0bac34cc2b2d635a799728988b44b036857bf0be2d6943ab1327e04a7baeb2b9c45ec7d284e0b243a3c5e15c689133a929c
- SSDEEP 384:nTbGtYsjHDUsARbobtQbocSSPE/66JozGzgC1bM:TbmzbDUsARbobtYzZEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 bf5eefc543293a0d45982999661e242712cfa4072d218043ca4e83ace8b3e3c8
- MD5 62e3792ddf204a8a9c19fbbab7aaa9b5
- SHA1 8cae7c65eb8e45be8bc0198d7390b31487b24c63
- SHA512 dcf5ef5dafb5a3edd770369b3a60e94adc4345d7fb11ed343a3d22592c27ed2efc59f66f1625fd8e4da6afb1a78fb2b151e3da4c4ba63cb4c0d38005c98617be
- SSDEEP 384:p/66JozGzgC1blTbGtYsjHDUsARbobt1boZSPT:ME/bmzbDUsARbobtFLL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 08c989b46361547a06481c29fdd1cb5cc800b60e7b0bbb9eb9953dd5d9395b6b
- MD5 e5d15639514e8bce0aef49d79e256c2f
- SHA1 fdb6eee320e15aa0c530dce7492115f51d75e728
- SHA512 4e3e7094f6f82489431842e93b155afbb1e1c384b440937d89aefc91e8de0d8788952dee376b9caa36cf069b1665cf299306244b6a83cdfd994aa0bf4cb10bc5
- SSDEEP 96:ssqQAgsWFl66JozGzgClKtmSSiBDSMF9ZbkW6rBBUhmjtPP/PhxqWY:p/66JozGzgCl6mSSGrvZboPUhIxPDtY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\144d9b68-5362-415b-915a-5844b2b36095
- Size 982B
- SHA256 a89fe5736924ad88cb148505de863b8372df9cb114b75191bbd10f1caa0de355
- MD5 f2e2f16723a22f743e95c4f854590dc8
- SHA1 236aca69ffec3174a8fb1b8e9b5d45fbd60157a4
- SHA512 01849acc9829b1643b5742adafbc2bd5c400e058e0a50e714d9dab8981d6af699c64c6d1ce5f7848cc88f360287e43603fc15949841397f47b01dd7c45d7b22e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\96f8414c-03a5-40ce-ab15-902464c06003
- Size 671B
- SHA256 49437e699b192eb06ae7dd60a2f6be58bc35198222b855bea1badf6c958ea7fe
- MD5 e63a320a262c9489e4b42fd01ce958c4
- SHA1 730cec8e865e8482ecd90d53d166a123205fc869
- SHA512 a3d6ef924eab0725630b645751b712a7a165777e516364e28736eeabbaafd8719c4dc38b2790d1c7ab56a898a026b19a3ce7477d507729fde7c072c3c7a6cd4f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\fb41e2ae-e914-4c34-a3f4-e2d9528c64ee
- Size 26KB
- SHA256 0905845cabf883a2fa59a02112b87030d1368141dd4cc6d0dfd64e138c394432
- MD5 02d2f521b14bbbcf2af3b3933d761024
- SHA1 b945bed52110b6c71831dc70c25e17b66af31521
- SHA512 32ab47691a48974e22ffbe9e7436bd15d7b3a29264dd214c91c4b9852397ad541139c15244a0e62542d76d438a777c4294a3f94e008d86ea28256973d16805af
- SSDEEP 192:t2fyaEuKzAj7G5tbJsQ6me//XhyNJUTndq0dP9JzSc0Ju7XcuJhaaYjRedZM0DzL:t2fyaLKMjSTbiQOtndVdqc3cW+hhhrk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js
- Size 12KB
- SHA256 efae398c57ef1f1c7ccb116914c52520f50d4cb95f493bd534ddced9d0ad8d12
- MD5 1953346b0c962412d5c4b12443801370
- SHA1 1f47dd43d0a5cb6c9468c1abd776d5e9a45a64e4
- SHA512 f09318e63b9620db7ecc37e4122e979615669bd69ed25546ceafec4be74f1918eec4c66000057daa76825d94150625281ca26e5921a5a2a651db3daec5a88edd
- SSDEEP 192:Y5nPRsfDZcnPfjGtBMmR8cdHcfxoGtOOcYEcaXCpaBw8HL:/ePbEmmzOZoEOReOwg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js
- Size 15KB
- SHA256 97f53f3553b444997c18b7d04598972cdb8ed3274ab5cc2f885de5bd56a1a744
- MD5 df04356550a0ca4aae9fce459bfb4bc6
- SHA1 9924fe69447f80b03794227d96bc16600e65b289
- SHA512 f365432e25aaf34258ad3491a2f0931ea7a9dcbacf2d3ce589abea1da13951c05adb7ae06d0fad7b1dd11049f042cfe9de88248c97e4f5e6c3a59df9369631f2
- SSDEEP 192:YKnPRsfcZcnPfjGtBMmR8cdHcfxoGtOOcYEcaXu+pCiBw8Hh/PfEq:sDPbEmmzOZoEORDvwa7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js
- Size 10KB
- SHA256 e42af37994237a21da0ab8375e11c56a190f074d415912fa670e11f5c072acef
- MD5 1a26d5583dc325007f6ce763386af003
- SHA1 818a8bf80770147296716781b8e1c82c55f6c651
- SHA512 8a0b102b79bb6a568c3354e2b753d6285bc9757056c79582db0d3846ebb7f561da55b9c2efb1c09e924b3bcf5627f02753aaba6244d21ec2ecbf86853ce8c221
- SSDEEP 192:b5nPRsfDZcnPfjGtBMmR8cdHcfxoGtOOcYEcaXCp+Bw8Hf:4ePbEmmzOZoEOReyw6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js
- Size 11KB
- SHA256 bbaea046543305e698c172959b06f484ea5c7bb5ba8bbead39698cdf4146f513
- MD5 f06983caaa98bb891a424932c2f886d8
- SHA1 2013f9ffe17c949ac43b115cd7e3bdeabdfdded8
- SHA512 96c7fc2769f3f410c4ded80214953034a40470b725779dd4dc0c7ac54d74e0802123d777cd69528a387a4fdcd7f5e74c7a9d348c912eb988b2b500e82d7a628b
- SSDEEP 192:b5nPRsfD8hJBQf5fStvvZDoncdWfstIDnjXT60uaXGp+Bw8Hf:4+Qf54vvicAWIDn6pyw6
- MD5 SHA1 SHA512 SSDEEP