Analysis
- max time kernel
133s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
25/10/2024, 02:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 898KB
- Sample241025-defveatfmn
- SHA256 054c586eec5767c6ebab30c217b5b91a061b705ef75740b8449cd68bed47df39
- MD5 4237dc911607c252913c1aaa104b0a00
- SHA1 df404d3dc9270c874a22bf18fefaa912da437caf
- SHA512 0b513bf72f56cb526b1a276e32840207743ae59a45c9f7ac80d54618b1e10908967b0858de1315bb9aac91ea52946ed27d220fa9ba2b05e8666c6cd3acef66ed
- SSDEEP 12288:mqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Tf:mqDEvCTbMWu7rQYlBQcBiT6rprG8abf
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Kills process with taskkill 5 IoCs
pid Process 2436 taskkill.exe 2404 taskkill.exe 1948 taskkill.exe 3568 taskkill.exe 3056 taskkill.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings firefox.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 436 file.exe 436 file.exe 436 file.exe 436 file.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1948 taskkill.exe Token: SeDebugPrivilege 3568 taskkill.exe Token: SeDebugPrivilege 3056 taskkill.exe Token: SeDebugPrivilege 2436 taskkill.exe Token: SeDebugPrivilege 2404 taskkill.exe Token: SeDebugPrivilege 212 firefox.exe Token: SeDebugPrivilege 212 firefox.exe Token: SeDebugPrivilege 212 firefox.exe Token: SeDebugPrivilege 212 firefox.exe Token: SeDebugPrivilege 212 firefox.exe - Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 436 file.exe 436 file.exe 436 file.exe 436 file.exe 436 file.exe 436 file.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 436 file.exe 436 file.exe 436 file.exe 436 file.exe - Suspicious use of SendNotifyMessage 30 IoCs
pid Process 436 file.exe 436 file.exe 436 file.exe 436 file.exe 436 file.exe 436 file.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 212 firefox.exe 436 file.exe 436 file.exe 436 file.exe 436 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 212 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 436 wrote to memory of 1948 436 file.exe 86 PID 436 wrote to memory of 1948 436 file.exe 86 PID 436 wrote to memory of 1948 436 file.exe 86 PID 436 wrote to memory of 3568 436 file.exe 92 PID 436 wrote to memory of 3568 436 file.exe 92 PID 436 wrote to memory of 3568 436 file.exe 92 PID 436 wrote to memory of 3056 436 file.exe 94 PID 436 wrote to memory of 3056 436 file.exe 94 PID 436 wrote to memory of 3056 436 file.exe 94 PID 436 wrote to memory of 2436 436 file.exe 96 PID 436 wrote to memory of 2436 436 file.exe 96 PID 436 wrote to memory of 2436 436 file.exe 96 PID 436 wrote to memory of 2404 436 file.exe 100 PID 436 wrote to memory of 2404 436 file.exe 100 PID 436 wrote to memory of 2404 436 file.exe 100 PID 436 wrote to memory of 4808 436 file.exe 102 PID 436 wrote to memory of 4808 436 file.exe 102 PID 4808 wrote to memory of 212 4808 firefox.exe 103 PID 4808 wrote to memory of 212 4808 firefox.exe 103 PID 4808 wrote to memory of 212 4808 firefox.exe 103 PID 4808 wrote to memory of 212 4808 firefox.exe 103 PID 4808 wrote to memory of 212 4808 firefox.exe 103 PID 4808 wrote to memory of 212 4808 firefox.exe 103 PID 4808 wrote to memory of 212 4808 firefox.exe 103 PID 4808 wrote to memory of 212 4808 firefox.exe 103 PID 4808 wrote to memory of 212 4808 firefox.exe 103 PID 4808 wrote to memory of 212 4808 firefox.exe 103 PID 4808 wrote to memory of 212 4808 firefox.exe 103 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 PID 212 wrote to memory of 4596 212 firefox.exe 104 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking2⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2ccddcb-9390-4e4b-95d0-b465731c1adb} 212 "\\.\pipe\gecko-crash-server-pipe.212" gpu4⤵PID:4596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3f435fc-ef28-49ad-8e51-a9490fa9aff1} 212 "\\.\pipe\gecko-crash-server-pipe.212" socket4⤵PID:3856
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2680 -childID 1 -isForBrowser -prefsHandle 3264 -prefMapHandle 3020 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d9833cf-ba1a-42a5-886c-36cbc2d44d02} 212 "\\.\pipe\gecko-crash-server-pipe.212" tab4⤵PID:2180
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4136 -childID 2 -isForBrowser -prefsHandle 3984 -prefMapHandle 4016 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6545b382-0701-4a38-901e-e36482f2aa8d} 212 "\\.\pipe\gecko-crash-server-pipe.212" tab4⤵PID:3240
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4592 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4744 -prefMapHandle 4728 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91e42b80-0119-499e-828c-695360e63ec4} 212 "\\.\pipe\gecko-crash-server-pipe.212" utility4⤵
- Checks processor information in registry
PID:3900
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5116 -childID 3 -isForBrowser -prefsHandle 5112 -prefMapHandle 5060 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55e90e2d-2be7-463a-af4f-3807df0974d2} 212 "\\.\pipe\gecko-crash-server-pipe.212" tab4⤵PID:5628
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5260 -childID 4 -isForBrowser -prefsHandle 5268 -prefMapHandle 5272 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25ef8cb0-45b9-4d2f-b925-94e9a3790be4} 212 "\\.\pipe\gecko-crash-server-pipe.212" tab4⤵PID:5640
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 5 -isForBrowser -prefsHandle 5464 -prefMapHandle 5468 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d75eab0-dae7-432c-9a6d-40dd37b21e9a} 212 "\\.\pipe\gecko-crash-server-pipe.212" tab4⤵PID:5652
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json
- Size 31KB
- SHA256 0287f4f65bc91a456804fe586a22122d02e5e7d91dfb9c068de5fc855672d74e
- MD5 91a5e55aad4ee67a0d447f67f883cf28
- SHA1 b532daebbe72bc6aa6d3d0c150bf6c27bcb37984
- SHA512 bba605ca558fe44c2fe0ee9401f93ec35318831ec32afefa894b5407152b9529829ca0cdc3b262f792c9adcedf167ce26478c5b039500abd828c7a2cd74915d0
- SSDEEP 768:cM5Mvr9nX0wWgPJZqo5DydIt6aUSJN2j2ykmHLn:1+vrRj/PJ15+0dQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
- Size 13KB
- SHA256 3f5004cdb6fee44339cefe694bad80604b8413a2446f93efc83d82067e67c4e3
- MD5 f84c5a1605d0b6c5f2ac609d96bbb451
- SHA1 0c79c42b994e7d17c47fb9f02b038cc0c819936d
- SHA512 dac1808aedf76b984f050bd6cd76db1a68e79b2832afb097bb5c47e1d5e55d4a25b03862f7ee26392492b5ab5bf4453c5d1b4b800b8b4df778610b594217b9ee
- SSDEEP 384:H/w5Iu9fiGLm4pUqpHLFoCr/E8HPJyD3VonFcP+AWRMAC4RGR0:8Bi8mCUqpHLGCr/E8Rg3V/+hRMFi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
- Size 8KB
- SHA256 f5a15f263dc2f5e2d5277b5decaa693b2739a96cd5d7f217d9a4b6d888708551
- MD5 0a8e40390d7dc600046ca39014af3288
- SHA1 1b22806ee20fab1a2c14f72b940a38fbdb15a2b2
- SHA512 74fb32218e8899fb94f3c911a8dcbf69f149b95de05187abd67e72ced9b249d3d89631290e8ed2690b6c532ed34280bbe3ea7bd71bc61d4b2eda769204e19472
- SSDEEP 24:5uB1oaCgu1xgRbFAYpR5cOT2uhMZMRFsh2F3LFJsJblLKpbqsJbF0J0lb:H5oJ99cOThebVKpbqebOJYb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
- Size 13KB
- SHA256 044d6bdee42f3f6160da113f5d422ebd08f42816767204cf0bc3abd71d1a43e2
- MD5 a1233fcd11942d11c034c97998ae1a1c
- SHA1 25aa67d1d3d91e630634f9d59f30906f8ece1e3c
- SHA512 080ca9ac777635b7867fa8484bdb54a44340c32483846a7d051d285ffd01afe458411bcc8869e5396c64a54f7710a5ae440b6b2dc7333c104672c5480a8a09bc
- SSDEEP 96:H5ofebVKpbqebOJYbYpebvpf+YbtbZbHgbgzlbqbib:H5Pu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
- Size 20KB
- SHA256 a55064332481d6791d1e93f3a1329127e82b0abaf3c28ee9ec0aeca401041284
- MD5 b8cfed80a79cfa932c8ef909da3f9e77
- SHA1 a04b0d0f1a6de5a3df9f605e754209d7e316b311
- SHA512 d017af227f38feb7dda091e981cd3d0b4e5688b4d878f0bd895cab3a060bc17cccb3416305076f5cf78928a34e22fdc24b7ce0d436b29411896aa550c591ea06
- SSDEEP 384:e1l1hlMP/hPoG33kNMU1s+bHbybObwbQbsbzbKbMeiSoSOGldvj2AboSb/66Jozr:e1lGPpPoG33kNMU1s+bHbybObwbQbsbt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
- Size 22KB
- SHA256 1b38337c8cde63c0aed7346f634da347f8bfb3bbb98e55f7d2d60553a2e7794e
- MD5 65138669d0698612cc1f0eb1debd4f82
- SHA1 befb355af37f527a248693067479367d73e8faf3
- SHA512 7d63bbbd167eab7d5398ac725900ef9c2a9e79bf34f46dc22d57d358ec4c80723f694133ee96552df5f5cf71c76cf1696e376b579f276e456569a2882cda1c94
- SSDEEP 384:wbopOPL1l1hlMP/hPoG33kNMU1s+bHbybObwbQbsbzbKbMeiSoSOGldvj2C/66Jq:4rT1lGPpPoG33kNMU1s+bHbybObwbQbE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
- Size 22KB
- SHA256 1c33d808d9643d1c1cef6e7279369bd3ed4c9d0c2ed16b8ca15baaf25271817a
- MD5 2d042548061199b9853605ceafe94602
- SHA1 197855bcf3c8a00cac704f8dd34867ede4b5d240
- SHA512 eec44944e1d3ea53e291d016bc0efa22bdb68aeb76ccc35ad9a113e52ce8d28d47f0a54f7a6604755913d0cb894cb1e9e71dd72a3e25bd3a565e2e45bb888aa6
- SSDEEP 384:o1l1hlMP/hPoG33kNMU1s+bHbybObwbQbsbzbKbMeiSoSOGldvj2C/66JozGzgCT:o1lGPpPoG33kNMU1s+bHbybObwbQbsbY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
- Size 25KB
- SHA256 a750aa966b4b02ad3e837efa5f36f01870522f857c607c2ae6bafa3b14971996
- MD5 f32a39c9e20d9dc61c2c7296a05d480c
- SHA1 feabefe853581d927084f2e9ec3b159b6bec062b
- SHA512 f9eb92f8738211d8b8dd1712cc9ae0affe0470cc48bb984d2b3ca16476987970580cabe2e2f2f0722e895361f46863e4451aca98a525d4bc7f4762caf2695b38
- SSDEEP 768:P5laTcDoGWWkNMU1nYbHbybGb/bQbsbzbKbVxhZhmoKTgC5Em:P5wTLxhZhmoKTn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
- Size 25KB
- SHA256 6215a150b5f8d94e1f78d2f96eb7c0ff7b9dffa81c222119db9756a85076ceef
- MD5 2d3a97c83285231a09a78e25759b3d17
- SHA1 5b30e7cbb082c170630195c2e6877960edf1650a
- SHA512 2ab2bd325904f7bc717f5687789680021287d74097235dea013618d8e868bd8f8d2b4577c1a1c44b713d68710278c98d86600874a62e3cbadd76021fe7f74801
- SSDEEP 768:kEMas5laTcDoGWWkNMU1nYbHbybGb/bQbsbzbKbVxhZhmoKTX:u5wTLxhZhmoKTX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\955e932b-17c8-4b68-9d82-66af02220b92
- Size 659B
- SHA256 40a4c94b0429bb507e579787a5598fb5fb85fb32a71d0695c719be33a048b6ae
- MD5 5fe7eba15270be2537165b59100c7ce9
- SHA1 8220cbaae5e6542c9917909b1f1c07016e7dd13b
- SHA512 21d3100e591234305d4489ed070449c3eafd7857e970a902b5e4d33683949a8251617e3e3ab8481cd2c00a0e009170222ecfffcf3a35c0392cf1ffe08ab63b8a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\d0963fc8-4975-48ec-9db5-e0ae4635185b
- Size 982B
- SHA256 9e5068586d27f92fe9aa63be721df2b95d9b4396d7d2ae592de8e3d25800b2d1
- MD5 cf0c13a3ab574f547b13729a6f86b0fd
- SHA1 c71135f34d4856a82481e33cb2276b2d1d7a29b4
- SHA512 93e509dc87353ab75aceed6ca8415f768b8f1655ba6982af489e783123b50a55f094633f91c4cf7f64245ff9fdac10a733fc6ccfcf42d7e9efd95433358efbe2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
- Size 13KB
- SHA256 0fd1744d70c42f462a58b8baabbcff08db542839479046d16bbec1291429a2f4
- MD5 b4cbed462cd97928ae5b056c4a049db2
- SHA1 a832378a6d15ef4f0a2ef71de2607d2184e58fff
- SHA512 721fda619e2ce7efef6f155c052f2d4dbfd036f815d3c49c6376e04e893377feda6706536a4b95c0513bb5550af842a3a50d58fc456ee0c4314902b6b121be37
- SSDEEP 192:h5nHRUfUT6cXTxnyd3CN78UHJtV5V59tdoV1I0E5VMaXtn2nABw8HShk:2UjxKC5/vdo+9w5k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
- Size 16KB
- SHA256 c6ac15d63447a8c8644d2e092ba21090c970e0c473d489917bbcde95daafab6d
- MD5 0dc78eb6c273f9837a66348a3cd35c2a
- SHA1 d51c4084acf5c084e3c78bf62b34ca866d50b215
- SHA512 94901bf08403c63437e95ea56cf550849a09a4c38184219872768de3337398fbde67e966e6fb4ef027ac7883514628af85a48699b332ab29dae06ef182c86f85
- SSDEEP 192:hKnHRUfKT6cXTxnyd3CN78UHJtV5V59tdoV1I0E5VMaXtJ+2n1iBw8HShm/v5aQ:X+jxKC5/vdojfw5w5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
- Size 11KB
- SHA256 6e8ac540271dcd32cc0ee612b93b576a611fa16af3735d5b2ab3120d46cab7b7
- MD5 9c3982074abb06667aedb56d212a998e
- SHA1 4f7511333358762b237c7f3daf63b49ee380eb56
- SHA512 e73cf80cf02bd8c4ae8a3902a3ca9f7d2497f844050cfe0eddbacb46efc965d31783251343f278f618682463957428f19a45ddada1c718f019d8271d3a7251f2
- SSDEEP 192:S5nHRUfU3Gob3psxnHd3LtVNUnNt+8+V0tDsS3TaXD2nSBw8HX:ZiuxxLtuzDqFw6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 952KB
- SHA256 42710b6308badd606f9d8bd90c7b7c2e9d4a763b83ff0073d9228b60fb3c44db
- MD5 e7864f1e259507d8d8e5b43ca040b071
- SHA1 0b91029661fbcd7c093a2fa710b34ee490acce48
- SHA512 a5cf339cad2a22685e992e8dfde31ead0db23f6ee07b550d3ef643549dfd1ce7c49f187166dba6a5ffb5741452c59de5a60bd4ea6417bdb87aa2613e32bafe96
- SSDEEP 6144:4q7rSAt3e3B393z3YTHLPAU+VU4jr9iL9UzRbtugXNeHN1HmcH11HZZmz0Pu/elL:4ePAU++4jxiL2tT9pbZ4k4V
- MD5 SHA1 SHA512 SSDEEP