Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
24/09/2024, 13:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 900KB
- Sample240924-q89e2a1djc
- SHA256 a11d5ba1eb5d8d3d5b6e29caf6c4fa6c3a74a28b66fcf29ab46891d2ff9747b3
- MD5 5d8d57a3729cfbbaba4e3e60d6bef3d8
- SHA1 5c1c7352807360845a264980c17fa5dccf4a0498
- SHA512 7145ae65934de9d06b0a6813c4e542ed97cb7789beb28e34d492a732204bc312d2a0382e185875b8749911edde0dcbf22d83560f45e7399533ed3fe47425a8da
- SSDEEP 12288:eqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgagTe:eqDEvCTbMWu7rQYlBQcBiT6rprG8a4e
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings firefox.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4640 file.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2656 firefox.exe Token: SeDebugPrivilege 2656 firefox.exe Token: SeDebugPrivilege 2656 firefox.exe Token: SeDebugPrivilege 2656 firefox.exe Token: SeDebugPrivilege 2656 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4640 file.exe 4640 file.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 4640 file.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4640 file.exe 4640 file.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 4640 file.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 2656 firefox.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe 4640 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2656 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4640 wrote to memory of 4852 4640 file.exe 82 PID 4640 wrote to memory of 4852 4640 file.exe 82 PID 4852 wrote to memory of 2656 4852 firefox.exe 83 PID 4852 wrote to memory of 2656 4852 firefox.exe 83 PID 4852 wrote to memory of 2656 4852 firefox.exe 83 PID 4852 wrote to memory of 2656 4852 firefox.exe 83 PID 4852 wrote to memory of 2656 4852 firefox.exe 83 PID 4852 wrote to memory of 2656 4852 firefox.exe 83 PID 4852 wrote to memory of 2656 4852 firefox.exe 83 PID 4852 wrote to memory of 2656 4852 firefox.exe 83 PID 4852 wrote to memory of 2656 4852 firefox.exe 83 PID 4852 wrote to memory of 2656 4852 firefox.exe 83 PID 4852 wrote to memory of 2656 4852 firefox.exe 83 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 3060 2656 firefox.exe 84 PID 2656 wrote to memory of 2096 2656 firefox.exe 85 PID 2656 wrote to memory of 2096 2656 firefox.exe 85 PID 2656 wrote to memory of 2096 2656 firefox.exe 85 PID 2656 wrote to memory of 2096 2656 firefox.exe 85 PID 2656 wrote to memory of 2096 2656 firefox.exe 85 PID 2656 wrote to memory of 2096 2656 firefox.exe 85 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd2⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c181037-43dc-4294-b3ea-13bc76f72027} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" gpu4⤵PID:3060
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2384 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c53dfe7-e51b-48e9-bd8a-6cc3e8ada632} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" socket4⤵PID:2096
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2808 -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 3188 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cc51f3d-790f-421d-a930-f0ae2a695bb5} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab4⤵PID:4996
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3680 -childID 2 -isForBrowser -prefsHandle 3024 -prefMapHandle 3076 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2dd022d-9a5a-4104-b9e6-bfc0124533dc} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab4⤵PID:1180
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4692 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4640 -prefMapHandle 4660 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e3a0aa6-b728-45fd-aaac-ecaae74bbe00} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" utility4⤵
- Checks processor information in registry
PID:896
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5588 -childID 3 -isForBrowser -prefsHandle 5584 -prefMapHandle 5548 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac93d020-cb39-4786-bf7a-780d55da8146} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab4⤵PID:4556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5808 -childID 4 -isForBrowser -prefsHandle 5728 -prefMapHandle 5732 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12db00a1-cdc7-495b-ba4b-25f128dcce46} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab4⤵PID:3484
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5924 -childID 5 -isForBrowser -prefsHandle 6004 -prefMapHandle 6000 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84972895-716c-4ed8-bb11-060161ce909d} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab4⤵PID:3572
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\activity-stream.discovery_stream.json
- Size 31KB
- SHA256 6605b51e430642b3ec8d6b59ab570cfc5ced28cc4b8fc91333f2a1c8e87ef570
- MD5 28af56ae0da601b103579bb0e30c0010
- SHA1 eaf300e722b864305d26f19536de1b2bf16c7759
- SHA512 a37fe3c0f1a70bfe37b37898235f30a3329b19d83d515b68e2fa5526346c86018ecac20717e5dbaa9620f7889d89ab802df59df4cc7870550954777b84d9f1e1
- SSDEEP 384:otlauP+c16BSBKTuujOBxe4HfDuIVfxVPKPR92nqmpyaubfaflpYooPrvlLZ/QG:OaA5kq3ViPR8n/ydr8lfoPrvld/QG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\cache2\entries\22386449CA13D8975B935875780066C6EF52CE37
- Size 13KB
- SHA256 28c0e5124ff9c13acd427cb93d71a4367843af8d16cc93b933ee7d8acbea8a49
- MD5 9735aac84490cc2b025d8a16a95e69a0
- SHA1 1434f0a84af448355e32583e43a14a33c0639b09
- SHA512 c0a6bb9c337bff9b0b43b3ce88acb242e3b24e69b85c9bf838190f58406b155a297c6a5e29a5966aba116afadcef77caefef6955e30b92565276675241025d0d
- SSDEEP 384:HiWu9fiGLm4pU3pHLFoCr/E8HPJyD3VonFcP+AWRMACFbs:iBi8mCU3pHLGCr/E8Rg3V/+hRMFK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin
- Size 6KB
- SHA256 d9aa9eca3dd0b460900a17c1d297a4de8e511947100776242a7be1e1768d24d2
- MD5 5a6ed59ba7b0f29eeef8e2ec16fa76b7
- SHA1 00e518205a3f93ddc792f0cc609f635d016d234b
- SHA512 726802c461e461ded907b689ba7a4439ddcd485821f4767edc9e27c555a358f370900ff5503efb5fbceaf4006440e80ee1131fa26f2b46c35e5eba6f954f1f68
- SSDEEP 12:ZgQpB8gQWgQxxv90frw3EQphMQSQEG90frw:6uB1ogxv90fKEuhMZ+90f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin
- Size 10KB
- SHA256 2927d0711445b80a1bad158a322dc4854e5145e96ec92db116a236fce0fe5149
- MD5 f377b16f0ec0818807abc26517b40435
- SHA1 28a27fe0be2e8195394235a13ccdac4f919a12b3
- SHA512 c739b0b69551c6265ba31b2e6475bbda0bb9b7b211bea6dc7511322a3cb7a78714e71a0c065ac6cc4d65dd80691647080b3501e15d41a94695e9f66aa31ca9b5
- SSDEEP 96:901ebVKVbwebOJXubaDW5oZ3pebvpf+Xub:28RDW503uU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 bba580009c4e08c2c4fa55921d957436750118540c987b060e549df421b90805
- MD5 26f91f65595ce99a9c1679929c19ef9f
- SHA1 c15de1bcfc7e6ea55af563d68bdb9a0fb3a28b45
- SHA512 2a3acda4b21635031634507879ccc29485fde1c43530c96ce877eb163bca54a6478cd3a1be64155a8966ced53f0ecea0bbaa13f516baa985b4ed227ab5e656e1
- SSDEEP 96:wmSMF9ZbkW6ShmMFyPP/PrWZ5PhjRxR2RXiFl66JozGzgClKtmSSM:wmrvZboSh/0PC9NXYy/66JozGzgCl6mI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 c5e422a3f2acda30fbf5658c7d70d8bcca63b5210f237867a9e3fc26592cb631
- MD5 41ad8fd6e07a0c850eb2a07fba31f7e0
- SHA1 59d5a18e50c59150329cc0a036f1a741e4bae0d3
- SHA512 fcd741d834600d911e1fe2a220767f60670fd5f1993c9c18fab3b2342d9ea66aae0c25466c869927a084968bf5bd1f914d5e08a96f968ab127093820211b9993
- SSDEEP 192:8NXYy/66JozGzgCl6mSSrmrvZboPdWh8cF0PD7:m/66JozGzgC1bkbogCPP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 8bb81fa4137f36766b8e468c54e96bae7bee43b5ebd02248884ecf7f3d12e8e3
- MD5 d7c17f5d5c602b8b37f1d1c037ac1ae5
- SHA1 ac22fac879407c392023326886e22f9c2db5b9b8
- SHA512 a693b0c9f0bfc9089eb64e4abf9bed0b62e56aac59fc30f5636055d45a4cc188d089252d112450fdd0fc18ea0b5c38ca8432bc2c36d7d16e53d663774992fa2f
- SSDEEP 384:mskkgvUD54xsbAbc6/66JozGzgC1bzP6bogdsoCPlQ:/1gcD54xsbAbc3EpPuxCNQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\0ed9d87f-3c73-4b7b-a795-a78aabb67ac0
- Size 27KB
- SHA256 25bd4c17c4a7caffa94383198c785c6acd439a0ae26a9882c0cbfac5668675c5
- MD5 0f84c62136edb802a0f43d7431f80abe
- SHA1 b4f9b6497359d93ab1c01d5b039f79359c17fdea
- SHA512 1ad5aa0075599a8ff3f6bea52d6fcb73b05a8311dfba3cf0a200d3682a10b77c043d3bcfbe3f841f09dc509a603a9ce7ea8f368031f4b4e699dcdb68072a6ab7
- SSDEEP 192:Iusty/sMbeK6zxfs7EClT1QFRHBKwB2hyPsvCMbI0Z+aIg8sWLPMbQjhUHMopV8T:otyLbeK6lfsbl2dB2hFrCgv1TX97hOz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\9cd8e80d-3e1e-4662-b3ab-86a076756308
- Size 671B
- SHA256 f8c4caf0927b9f2b0e203c483b11306f7534f23bfdde59622cb1c4acbd63e5ec
- MD5 d44ba6ffde38b80fb43cedb0880d00a3
- SHA1 9d0aa142dcb658c6a6d3e882d7915b052f0bba41
- SHA512 61b217f6a3b0ad3ca7c2473bbd59ed43d78517735aa3a9535d4e070764d5aefbed54ecad562cb9be6f158caa75d10b77cd5b2254ba1d321b8b531bf30934f424
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\fffbd2f8-b1ad-4475-b37f-b9bdce90ef8a
- Size 982B
- SHA256 9cbd76de830119a02f5b7f19fcbbcc154a681ae3feea17b9b712e369a815d4d9
- MD5 dce5092bd0112e6ff1f97a84052734d6
- SHA1 dfea32ad86967b6f2c99d1740d57bf5cadf3037f
- SHA512 20bb9804610c1ba16f668916b12d8f3182412f56bc54384662524f43a5ad92a82ed2b0bcd0fd63028a88e14ce293de574a24aec3bb5433fcf42e4730079e007c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs-1.js
- Size 12KB
- SHA256 a560d64b222053d0ae33a41b6c6e64ef2072012c46f2e36ba76c4c9392ecf4b2
- MD5 02a86756da74a51e430bfb20b21f7ccc
- SHA1 ae0d7e7b9ee646a515d503003eb537eafee09da7
- SHA512 3c1501b3eeb443f0b7ba2b246ed4251e148902425bf2c02a03e6ee6a0c355de6245afd460cfd6a7aa84d7f7a034a99ddd7b0315a31d5e0d60b066fe65f1f42a7
- SSDEEP 192:d5nxRjfi6tFqmCxnnv5zfcdv8dxnrsGp0AaXz84rYmBw8Hrx:npAxnvKWdxr48Mww
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs.js
- Size 11KB
- SHA256 be5fcf2b6b3228349d87f4e71d488c3095fbda4cbf35611933e183b7f664fe0f
- MD5 1903d3a12526eb2d52f662eacbee5a5b
- SHA1 fa248b7191887b0605d0f88cfde1b859e827fc73
- SHA512 39f5426b327b28dd36ce6205abf9c665a8a9dab3c3e260baee4312c1371a55a457aa6c38ee262259c53f57c3599e9943d7f94c0d0d40b76526d7504564bff213
- SSDEEP 192:C5nxRjfi4TtLf8tv1R1zcdjrf+tPDnjXl60daXpZ84rYGBw8Vc:ktLmv1AxrUPDnYD8cwP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs.js
- Size 16KB
- SHA256 094b72b62191644dc3b24acedb9581ca1b143d247da9e284ca961466cde06f16
- MD5 e7e9b23d86f3346de3c0974da89a504c
- SHA1 1dc3cc8b317a712c14ddbe16dd68c75e1a61422e
- SHA512 bf5228bb3a4c1825aeaac55549f778333e5d1ee89340160629a5125cb4a61116128205bc500034434c525177d03ce6e0d43bf911998c51287f20b39b9cb260be
- SSDEEP 192:dSnxRjfi6tFqmCxnnv5zfcdv8dxnrsGp0AaX1+84rY2iBw8Hrcv/zgT:apAxnvKWdxrF8lwte
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs.js
- Size 11KB
- SHA256 b14f3c1e56a14efc98abd12696b723bcc3d1b6c9622db62e61cdb283bf0592de
- MD5 cab2e4335b60ba81ddaf483c95d233bb
- SHA1 41ee94fab8b64cb4fb2875871b4830dcedd6b029
- SHA512 f64c15022cb89515aafc6b8844a83e6d7a523bea1efd86016cd42655aa210d33b3b2182a2f57ea4d33b8b6ddb2966eb467c7637fb9abe80d211c456aa0028bc8
- SSDEEP 192:C5nxRjfi6tFqmCxnnv5zfcdv8dxnrsGp0AaXz84rYGBw8Hc:kpAxnvKWdxr48cwh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 368KB
- SHA256 e5157506ce78208b60d78755e8fd5cede3673e4601e54033664dca3965b9f563
- MD5 0858c817b1070f1e765c8dee383217fe
- SHA1 9d1359e988aaa08e5d0b1cc87cc0ad096fd5670e
- SHA512 fe874a9379bc8f922fcaf877c7410f51bdccba2bef6cdfa1b65d06d35bf5d89c21a4527cb9b26dd65d07779021128c63c699f2b2e424add08b22ef25807dc815
- SSDEEP 3072:9rcHaiucHY3y3JNudJeHoLTBnVD0Mis6uaihb+Ma4c6Y1dZzOZBY:9cHNuSY3y3+eH0npl6uaci
- MD5 SHA1 SHA512 SSDEEP