Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/09/2024, 23:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 901KB
- Sample240925-3h9z4axbme
- SHA256 808abc68357cc6cde0c04cafca74a8abf34280b792689fc6a4e48d5f5c0563d8
- MD5 60fec284793e70a42d72fde8e89267bb
- SHA1 e025af331a9a8d9d61136cb3ba9339c6f8128312
- SHA512 9ff971d89ee550530bb9877416c4a96230b046a088f49bef98c7e68f66f0d579084ed51ff7bd7b739c18869c54e6a926f0277c0fcd20dc77ade6bef74cfaf917
- SSDEEP 12288:gqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgauTL:gqDEvCTbMWu7rQYlBQcBiT6rprG8aWL
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings firefox.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 620 file.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2796 firefox.exe Token: SeDebugPrivilege 2796 firefox.exe Token: SeDebugPrivilege 2796 firefox.exe Token: SeDebugPrivilege 2796 firefox.exe Token: SeDebugPrivilege 2796 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 620 file.exe 620 file.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 620 file.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 620 file.exe 620 file.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 620 file.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 2796 firefox.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe 620 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2796 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 620 wrote to memory of 3912 620 file.exe 82 PID 620 wrote to memory of 3912 620 file.exe 82 PID 3912 wrote to memory of 2796 3912 firefox.exe 83 PID 3912 wrote to memory of 2796 3912 firefox.exe 83 PID 3912 wrote to memory of 2796 3912 firefox.exe 83 PID 3912 wrote to memory of 2796 3912 firefox.exe 83 PID 3912 wrote to memory of 2796 3912 firefox.exe 83 PID 3912 wrote to memory of 2796 3912 firefox.exe 83 PID 3912 wrote to memory of 2796 3912 firefox.exe 83 PID 3912 wrote to memory of 2796 3912 firefox.exe 83 PID 3912 wrote to memory of 2796 3912 firefox.exe 83 PID 3912 wrote to memory of 2796 3912 firefox.exe 83 PID 3912 wrote to memory of 2796 3912 firefox.exe 83 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 4836 2796 firefox.exe 84 PID 2796 wrote to memory of 2004 2796 firefox.exe 85 PID 2796 wrote to memory of 2004 2796 firefox.exe 85 PID 2796 wrote to memory of 2004 2796 firefox.exe 85 PID 2796 wrote to memory of 2004 2796 firefox.exe 85 PID 2796 wrote to memory of 2004 2796 firefox.exe 85 PID 2796 wrote to memory of 2004 2796 firefox.exe 85 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd2⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd6dc76d-d802-494a-bf74-93ed76989185} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" gpu4⤵PID:4836
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5397b7f-a344-4eeb-9cd3-b0445feb9952} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" socket4⤵PID:2004
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2980 -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 1660 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e86c637-a70c-4d36-9839-9c231d3fcee6} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" tab4⤵PID:4508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1556 -childID 2 -isForBrowser -prefsHandle 3700 -prefMapHandle 2704 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b26b5ecb-73b1-4fbd-a34f-d1efc858b4fe} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" tab4⤵PID:1400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4320 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4380 -prefMapHandle 4376 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1910e90f-62cb-444f-8777-8f565329b0c8} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" utility4⤵
- Checks processor information in registry
PID:1808
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5264 -childID 3 -isForBrowser -prefsHandle 5300 -prefMapHandle 1440 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d84cd24-40dc-4d79-8b97-29797ecf5845} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" tab4⤵PID:1948
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5528 -childID 4 -isForBrowser -prefsHandle 5444 -prefMapHandle 5324 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0a6edd1-b72c-4694-ad37-c7ac4e1b5fb7} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" tab4⤵PID:2256
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5648 -childID 5 -isForBrowser -prefsHandle 5728 -prefMapHandle 5724 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {429019c6-f77f-4113-9de4-8af25b8084de} 2796 "\\.\pipe\gecko-crash-server-pipe.2796" tab4⤵PID:4760
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\activity-stream.discovery_stream.json
- Size 31KB
- SHA256 c3bda6e03178cfb59d9bf7b40069548279238c460eb165b17dcaac2cb8f7a49b
- MD5 e7e727beea15339a395467328bd4312c
- SHA1 82d8e7f43b0ce511a0cdfc2dd74bbe49f6cf8c27
- SHA512 265202a5448ae38f368f5baa00dfbacc74a6869856f86e68e52294435fd2ace1a06a0da16fa2354440d3f617c1a5392b55796bcc99c01641abd2d9f5a2732814
- SSDEEP 768:Q2zviLO8XcKlKGRUT0AgydvWeiCuLrxamawxR35j6G:BzvMDXcKvRA7hWeirLrx5DRpjd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\22386449CA13D8975B935875780066C6EF52CE37
- Size 13KB
- SHA256 b4d420331b5f67bcf133055a706dce2a0cfc33b0207f3c2e70f534af69350526
- MD5 d3d816271fb80677391893be6ba14ccf
- SHA1 db11155a8d5c528fec5d3c996c9154b88a305f29
- SHA512 8694d585b912812f6ba8d103a6371b41597b60624ff16e927e19192ed3678e60a9af51f03c0284fb50e69b18f433137543bad45b1be62a30f2d69231af4117e9
- SSDEEP 384:HiWu9fiGLm4pUPpHLFoCr/E8HPJyD3VonFcP+AWRMACNj0:iBi8mCUPpHLGCr/E8Rg3V/+hRMF6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin
- Size 6KB
- SHA256 3161608a492b5bbf26865d620e174974b14ab5bd8b457de4b4bf1ad4fa085466
- MD5 fae7fd804e6161b38ccbb5bc248ade13
- SHA1 10f31af221dcf8763530caa6b1b906e20c56ac10
- SHA512 1c8318b321b804e2ce88ed062d49f61515511c9c31c000372fd8723663ed35b1f5a762f94175f2ec79986b6a3dd7fc9d0b2c02722ec8a02b0fe6b8de742eab88
- SSDEEP 6:2Ugidpq88gidydgidsJld9to5SDmHgidpqs7HgidBgidqYw9to:7gQpB8gQWgQKd9u5qQphMQSQtw9u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin
- Size 10KB
- SHA256 07f9f6d4a6b582d92f470cae4d7c83e3bc57d0431b8fc5d04cd5686c215894b1
- MD5 c638c3d3edbee84624c1737e55523d0e
- SHA1 8e6bf773123a4f0d91b7e67ffe45417eff66fdb9
- SHA512 5f315c45756c27f5555eeaf1751c428823d0a7ecf57d99b0b36d78b57b46213eda2374e14b599b5e94eed055776924fd8289dbebdbada8d692c794325052fc19
- SSDEEP 48:C+ebVKKbC5oNGSLebOJfhb89cOE2pebvpf+fKb:C+ebVKKbC5oUSLebOJJbapebvpf+yb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 fd50255e5a43f9c31899ffe96aad82720f915d7b83038ca680819822a2db7f3e
- MD5 3e620346e455572c03a14baea80743ad
- SHA1 4b268ad1992a2111356e9f8dbf5109d35565e252
- SHA512 adce2e275c33350895fb5ef6fe36f59d533bc8d4099cea1a23af7cdace20b91e564e33cc7b47d422142d937fab0de669088c45bbb618d47e10289d0f80991d8f
- SSDEEP 96:1SMF9ZbkW6ShmWnPP/PrWZAnQ55C0Fl66JozGzgClKtmSSM:1rvZboShvPPCx/66JozGzgCl6mSSM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 2eb3a098d206f5bbb4d32bcc204d0678d35f2e8ed162b207e4ae56a466ffc9c0
- MD5 f4c00498cbc0f347ee64004fa260dfa8
- SHA1 46f30f659903a902a51811f664efc429d40cf497
- SHA512 6a51aa15307302296752aa37a865382c20bd61f991065ca94b335d3c02268a3e139dab5f714e60a6439edba529520bdedd1e3a1fb60a4a8c2a47ae9a32c34f7b
- SSDEEP 96:c1BaSMF9ZbkW6rBB3hmgUnPP/PaxvWZAnQ55C0Fl66JozGzgClKtmSS:JrvZboP3h+PP0Ox/66JozGzgCl6mSS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 5c7626746b960c5341cda2b7f9eff05391497c6713b0a20843cad1065bd01d61
- MD5 11be98ce0069b3e9ec27da66274b2791
- SHA1 36ee328c4b272798690e41952fd54aba2ac599af
- SHA512 810deb979ed063b6d8cf3f316d4dfd42dab64bfd7ee22c65d161817b6d06e61593f6f01d1314e2ad00be2ac07a5e39bf37c63a81907110ffa8379e0a3837fc1a
- SSDEEP 96:AnQ55C0Fl66JozGzgClKtmSSiBaSMF9ZbkW6rBB3hmgUnPP/PhxkWv:X/66JozGzgCl6mSSjrvZboP3h+PPDfv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 466d1feba1f18524ac85ffea7a847a819bf559241aa11c53ac99047e7f2c30fe
- MD5 caca804ca242bfe9458d600cb575ca8c
- SHA1 f7b1e001b47e7101958a71163380c99a6d426206
- SHA512 428fb192fc0a53470a2dd82a673cd244b32bd812484e92127fa1966eafde50e0be6ee07916fd7a1b41303b890a329cba92edaf989228339ff6f7a0347cf5d285
- SSDEEP 384:ZnCCJGRiPDknbzb8bZqbo/FsPZ/66JozGzgC1bM:1PC+Dknbzb8bZ+9EEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\40426012-54a8-419e-a599-a1ab80367db8
- Size 27KB
- SHA256 76a87a39df00eb9820e50fa410019a4e27e66c8e83f852be8e6eba44d87e2f57
- MD5 86f9968b3030009d6a373f4e2e87adeb
- SHA1 ee51bbee273365f552fd5c969bb0001356dfcae0
- SHA512 7c6b2f645491fc3eaed486598a2f3c36929ab5ff1b883bcbd67c18fc63867fbe64528b53bd23b1183dd2adb1950da7962645c9227504c9d66853fa68f54d2a9c
- SSDEEP 192:2AdHblsLeHQ/XzWWs/kUc+5pOI0/LtzW1zj1+PdZnIBskc2x4kO4rvDPb1Rj8ujK:2AGcQilczLFPkma7icdvmbqnMT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\9a6bf9ee-46ba-4a03-9a06-6728a2a785cb
- Size 982B
- SHA256 89e94eae0e51ceb51a74e4fb35d149aac150e907d462bde5c00d6b75f7ea2e06
- MD5 80bee8c3a0ce00050b50ecf9fdf9bf9b
- SHA1 42dce59d9d795d177a0a7d57bf7d79d4a5946b7b
- SHA512 501d87763f8411172acfa000ee5588bff91a0c256d700dbd18db60d7983410b2d5e1e6537bcca697465422668bf5d781996b239d78b23e2eceb675de5a758fd2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\f6dc97e8-56ef-4749-a605-a020d1226ec7
- Size 671B
- SHA256 dfdbe1df5a809517a3fe67a7ea7332b26e6724d511d0727f2c857a6b1daefcf0
- MD5 4fa5bae6e57f4c35d6b9cbb8b576f530
- SHA1 1367b7b6717081ee16854579c923ec567a89f5f4
- SHA512 d81decc5e2584b8e5e82112e816ccdc9c75b2ab3dc0c6b405604e57d4fcc36930e749a7dbb8e4d7690fc521c686054b8a21742d2809f126cbd7fd79eb438681f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js
- Size 12KB
- SHA256 60e56236902d17c9bebdbcfecb8b86e3b3d21bbf57b524312b0bcd2f1b1a391c
- MD5 6b4bc12b712c91c409b6ff3b75da8158
- SHA1 0ec8ea2f57e8f4b8f7ffe9cbaf925f04c91fc6fd
- SHA512 0e46e41c3752e72d81f7566139f841dc6717e4fb80ed6aececb8a487521a276967cb5b6873eefe73bbf000f098b7ee4e45bd14ef9884c185de8e8f6551e5c4b6
- SSDEEP 192:H5nIROfYLYA7TZxn69hNhUDicdC8txnKZsGP0QaXf5nsSJBw8Hw:/4TZx69hNGvNtxKZelsswB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js
- Size 11KB
- SHA256 0f793e2dc87c4534fefffaf4dfc982429688e65ade81c300c4028dc5742a341e
- MD5 0b289dff8a1cfd897dd48a60f637518f
- SHA1 18ae393e3861e61f00c22a5b9af077007854bd35
- SHA512 d099796a60100d23b53c1b6fd15acb0fed532eaff9f76a2a30e006f66cd98535d1764012b215503a98730a2e5ecba55414fb10791496380e81838a017b5a6dfd
- SSDEEP 192:w5nIROfYLYA7TZxn69hNhUDicdC8txnKZsGP0QaXf5nsS5Bw8H+:s4TZx69hNGvNtxKZelsCwb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js
- Size 11KB
- SHA256 88a0c22a7d0ced2c673af07f6a8da07c9b1ba6ec0f24febd6d8d71d8afc92b50
- MD5 60b8e0290342fe7628e4f0ba084a90ed
- SHA1 1401f050644a4ee636b2947e2ad99b411860575b
- SHA512 7a1a7c463e2532e98506b3b98cafc01defb126f6bfea28bfcd934488c59b23b52017b1ddc1dd9e7f7db6c5c19ff31fbab53bac02b8a39d7cc0ea49018223fa2c
- SSDEEP 192:w5nIROfYLgADf5fStvvZDoncdWfstIDnjXT60daXcE5nsS5Bw8H+:sAf54vvicAWIDn6dlsCwb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 376KB
- SHA256 268e69f8b71019289f38aa11e55094d42d890f84a2ba1c5ae6c17e912a1fa04b
- MD5 a189f92d14d5ddb0fd5ca892254188b4
- SHA1 4bfaa34f1bf8141b7f135fe837fb38fdd60050f3
- SHA512 a3b1fb9df9d4eb7e612c0c2f523479e0b7eaa3c1eedd82be85172ad59bede077d23cac2c7d90026df0a09d254bb953fa50461c18932200b5df0c7c36629b123b
- SSDEEP 3072:LcHYiucHY3y3JNudUeH1LTUnDh9Mis6uaphb+Ma4tx1bwZzOZBY:LcH3uSY3y3veH6n1W6uafv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 960KB
- SHA256 f984ffb5cbebef7acde67e4495101f65e78467d35f1b779048e12622092f9054
- MD5 c81f7b2f3d9c8276aded918f501b2acd
- SHA1 92313a5007ae18b3ea49d147b43dd76041dc11d4
- SHA512 e414b853da0bddf2f4cf10ddc5d441890761a05589fa060cd657d38f6eb382687d61ecbadbc3379aefddcff678a706d6dc9d5f738c6e337b072bde62eda40628
- SSDEEP 6144:27rSUjn393z3m3P3aTHyjSH+K6Usav6UqoWUmz0Pu/elGkt/fZOeHN1HmcH11Hkp:jjSH+K/sg/qqk1BQfxI7
- MD5 SHA1 SHA512 SSDEEP