Analysis
- max time kernel
146s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
01/12/2024, 02:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 900KB
- Sample241201-czpsdatnfx
- SHA256 12ad13ced35f5d6e2d72bda3e9b5ae9ecd878a89f1bf23b546c7c03272e6aa44
- MD5 50baad51f9e2989fcea4f3252e2988b5
- SHA1 9f263b9eff9e5b7dcb2d24d6c03665c539a44bde
- SHA512 5c72df3914f0368d3775db02487fec618f262df8bc2b9d7b0d34f96465aed6f18af5575ad52c8bec759bbd8cd4f2379dedf6f6926c9fdaf42a0ec3ddf823433c
- SSDEEP 12288:0qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaOTY:0qDEvCTbMWu7rQYlBQcBiT6rprG8a2Y
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe - Kills process with taskkill 5 IoCs
pid Process 4920 taskkill.exe 4768 taskkill.exe 4416 taskkill.exe 4296 taskkill.exe 2152 taskkill.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings firefox.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3060 file.exe 3060 file.exe 3060 file.exe 3060 file.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 4296 taskkill.exe Token: SeDebugPrivilege 2152 taskkill.exe Token: SeDebugPrivilege 4920 taskkill.exe Token: SeDebugPrivilege 4768 taskkill.exe Token: SeDebugPrivilege 4416 taskkill.exe Token: SeDebugPrivilege 2984 firefox.exe Token: SeDebugPrivilege 2984 firefox.exe Token: SeDebugPrivilege 2984 firefox.exe Token: SeDebugPrivilege 2984 firefox.exe Token: SeDebugPrivilege 2984 firefox.exe - Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 3060 file.exe 3060 file.exe 3060 file.exe 3060 file.exe 3060 file.exe 3060 file.exe 3060 file.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 3060 file.exe 3060 file.exe 3060 file.exe 3060 file.exe - Suspicious use of SendNotifyMessage 31 IoCs
pid Process 3060 file.exe 3060 file.exe 3060 file.exe 3060 file.exe 3060 file.exe 3060 file.exe 3060 file.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 3060 file.exe 3060 file.exe 3060 file.exe 3060 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2984 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 4296 3060 file.exe 83 PID 3060 wrote to memory of 4296 3060 file.exe 83 PID 3060 wrote to memory of 4296 3060 file.exe 83 PID 3060 wrote to memory of 2152 3060 file.exe 86 PID 3060 wrote to memory of 2152 3060 file.exe 86 PID 3060 wrote to memory of 2152 3060 file.exe 86 PID 3060 wrote to memory of 4920 3060 file.exe 88 PID 3060 wrote to memory of 4920 3060 file.exe 88 PID 3060 wrote to memory of 4920 3060 file.exe 88 PID 3060 wrote to memory of 4768 3060 file.exe 91 PID 3060 wrote to memory of 4768 3060 file.exe 91 PID 3060 wrote to memory of 4768 3060 file.exe 91 PID 3060 wrote to memory of 4416 3060 file.exe 93 PID 3060 wrote to memory of 4416 3060 file.exe 93 PID 3060 wrote to memory of 4416 3060 file.exe 93 PID 3060 wrote to memory of 1712 3060 file.exe 95 PID 3060 wrote to memory of 1712 3060 file.exe 95 PID 1712 wrote to memory of 2984 1712 firefox.exe 96 PID 1712 wrote to memory of 2984 1712 firefox.exe 96 PID 1712 wrote to memory of 2984 1712 firefox.exe 96 PID 1712 wrote to memory of 2984 1712 firefox.exe 96 PID 1712 wrote to memory of 2984 1712 firefox.exe 96 PID 1712 wrote to memory of 2984 1712 firefox.exe 96 PID 1712 wrote to memory of 2984 1712 firefox.exe 96 PID 1712 wrote to memory of 2984 1712 firefox.exe 96 PID 1712 wrote to memory of 2984 1712 firefox.exe 96 PID 1712 wrote to memory of 2984 1712 firefox.exe 96 PID 1712 wrote to memory of 2984 1712 firefox.exe 96 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 PID 2984 wrote to memory of 4796 2984 firefox.exe 97 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4296
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4920
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking2⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3bf4386-e404-4acb-832d-6673125c24ca} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" gpu4⤵PID:4796
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f7507e0-454c-482a-93cb-6f8715701ec3} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" socket4⤵PID:4228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3296 -childID 1 -isForBrowser -prefsHandle 3152 -prefMapHandle 3188 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bc5867d-8d91-4620-baaf-a7c902af8aaa} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" tab4⤵PID:3192
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3664 -childID 2 -isForBrowser -prefsHandle 3656 -prefMapHandle 3652 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6727c36-41d8-435d-a124-243388459678} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" tab4⤵PID:932
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4584 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4576 -prefMapHandle 4256 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d108a75-41ec-487a-80a5-db1aaa888fb8} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" utility4⤵
- Checks processor information in registry
PID:1420
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5212 -childID 3 -isForBrowser -prefsHandle 5240 -prefMapHandle 5232 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2287c9a-7015-4141-a431-922601fa4b97} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" tab4⤵PID:2304
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5376 -childID 4 -isForBrowser -prefsHandle 5384 -prefMapHandle 5388 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3a3612f-1644-4350-aaa6-645113e4e31e} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" tab4⤵PID:3928
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5456 -childID 5 -isForBrowser -prefsHandle 5548 -prefMapHandle 5552 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c27a0aab-e522-4fa2-afa2-88e97db8db62} 2984 "\\.\pipe\gecko-crash-server-pipe.2984" tab4⤵PID:5060
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json
- Size 19KB
- SHA256 6ded78e6c6694c247e7db34e115adc388c770058c505241812a62cc98696ce33
- MD5 19fbd666738976d2b2c315a6898848fe
- SHA1 b4a16456b1e76f6656a62dca581bc42fcda92096
- SHA512 1a9299d7ffbed8c194838298b400a4519bf52fd05fdfd994015d8f1eb444f6220f13063754cd2961db412b5679717ca7f9a3bb4ced12c7df7f109b3fe534b082
- SSDEEP 192:zqc3Fe83gOtnzy3fbR1Cw19kYruJTz69Di7409uif2W1IYv+yAHq/bXKFIoOUbI4:Xo2nuuWOYuvw0ebwBGFWX06FbY6z3yaE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\doomed\8392
- Size 16KB
- SHA256 af61990f280167f53001c261fa8439b248262adfdcd35e4395a13ad1bfb45c87
- MD5 8ddb302a2716ca44c6251b1ce6faf4a7
- SHA1 0ae63b84fc21edcc84b4654748689c098429ef9b
- SHA512 5ecd0fad3e0149b2213243a59e393189b13db9de53ddf2e86258793fa89dc6d557e11c2e8ecc8f0dd30655585d0cc8fea034a61bd043c89d669303b3a82790f2
- SSDEEP 384:IoZfnMe+fV7un3JLdg12WP43K3xy9M6jdg8HPJyD3VonFcP+AWRMAjzy:I6fnMf83JLqEKA9M6Zg8Rg3V/+hRMf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
- Size 13KB
- SHA256 05defcc7050091ba93b8bb9229698ce753514b0ed94d799a4f26eff3a34d9507
- MD5 ea46d0f4e34e1ef9a540892883620ccf
- SHA1 84ad44a885036148c17df2124c622632b3f3d26a
- SHA512 8e57e76e82cb78e97e13108b2774582fdf531e20e741655a4b84ef6bda4bf3bcd362ab0d48fcdeed8bff365198b51ced9c85eaec5a2b7439788fb2272f6509ee
- SSDEEP 384:HfNIu9fiGLm4pUEA+Q+4IYKgH4Zv+3yPrIVy8ew/e/y:llBi8mCUExQ+4INy4ZcyzIVy85sy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
- Size 13KB
- SHA256 4dc3d289f8f531b8c7d4df286fb2d05f49c3bd3928dc9f0d4ff3dd18c8b03ea8
- MD5 12c42d0218f4f4d10c3345816e5535ea
- SHA1 c8b6a1bafbbb3aa7ab5673e7d8c330677b58e5c2
- SHA512 e0ea87e89cba8f256fe2139cad9f2de0887c2c406105fdd4dd67d72c3c14494d20a23915c706374ba05d1e5e6a078847e3a05e1fd719f29fe3470f5dd26f591b
- SSDEEP 384:HFh1u9fiGLm4pUdA+Q+4IYKgH4Zv+3yPrIVy8ed/h/Q:IBi8mCUdxQ+4INy4ZcyzIVy8+JQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
- Size 18KB
- SHA256 002d7fd59be68bf95e9bc19fdf2eadbf28dea553dc4987df2e88f17ed37a00e6
- MD5 b73cddc65a31788a6404159ab9841a2c
- SHA1 5f30010d51004d70fa4a8b02e312d134486d9ddc
- SHA512 089ecc9687f3160925c44e2754cc3baa78bcd21bb63dcb362acfb2c7fef58d6df9c46c11db35d59d3708ef7a73726e3530cae071ca2a157626d8ae4f5859700d
- SSDEEP 96:2t5o6yebVKUbrSebOJobj2wpebvpf+9bGbibCNfgbgzSbabObMbmbIyfD7AbIb:Q53Tuhx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
- Size 11KB
- SHA256 f517f5896f26923635da5508923f2030afa9385bcf355dbe3084de6624115f9b
- MD5 657c3eacdcb35b9c3ca201f8835b0c9b
- SHA1 82e9b851afa14368b1064de1f4a1455a829e79a8
- SHA512 24b56231d04c153ac87d1a3368d161ad73bdd2ad51c6471d080321470f2d0da421e221845e7ddad7652f33637a99f65282670272cb7dd854479d3d6f1f5e5649
- SSDEEP 96:fY5o6yebVKUbrSebOJobEpebvpf+obhb5bCNfgbgzSbxbNb:w53ouw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
- Size 22KB
- SHA256 06bcf68e046e9f5ecec03a5cc3a042f7a03528b5c8b169f74ea878c6d5b5b676
- MD5 9ae5875507da766b662f89fa35d90bd6
- SHA1 6942c5b9e5d038dad360d338ea05d50d592254cd
- SHA512 191063de07c5d0e4416852a17bb5cfa774843ec03f9b993bb3bd18c9cd267d0957de88cb795db177cafc556f3c4c11997710faef5d9e76dab78a30dfcb14d058
- SSDEEP 384:ZE/66JozGzgC1bnIY0jIjOHjJhGPdV3nXpMUpv2xbcbObSbUbFbKb1b2bmbGxW+k:ZBEiT8OHjPGPdV3nXpMUpv2xbcbObSbx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
- Size 22KB
- SHA256 2415352e048d6b695a838bd3efea52067be76a03206e7bbb8bbcc9ae0c877f95
- MD5 24b74d5bd7a579f82145e8b21244d26a
- SHA1 9df715592b58cf8dff90af980d0dd0569c1146d0
- SHA512 5fec2eb891fbe22b453765e759f8797a37dcfb1b6a50e52136bd5584c1401f5af66ddc757e5b80cca8c7d6bd5fafa310544d42d6683371a00f0fa79699690831
- SSDEEP 384:tIY0jIjOHjJhGPdV3nXpMUpv2xbcbObSbUbFbKb1b2bmbGxW+Je0Ba1mE/66JozK:OT8OHjPGPdV3nXpMUpv2xbcbObSbUbF6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
- Size 23KB
- SHA256 31f57d115f51e37329b7ae133859647017eb461842eb436cac7886dbc37affac
- MD5 dabf88357cee687e84d797a6b709f0f8
- SHA1 0ad4dbb987a4021fa4994ffc9f41d50ac56cf31c
- SHA512 24757875e4395447c132acd0cba9d4a4b7ecd9b04ee33e76ee93e717127e91b4d9f1c5336bda327e022db8d5e44c4d47042ae2928a813b1dc66698612f0c84f6
- SSDEEP 384:6bou7PGE/66JozGzgC1bDxMmij7Bjo/DdVG9XpMUpvbXbcbObFb8bFbKb1b2bmbu:utOBEgpPNADdVG9XpMUpvbXbcbObFb8D
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
- Size 24KB
- SHA256 8b18e9b145de49e454a8b0b3eef8a12a2adf857cd260e59eda508ce6be2c9e2a
- MD5 f5101bca72646d9d122200a688721e0c
- SHA1 290e979d02119ab74dee94b629da376c703bcfd1
- SHA512 3b80c9ce0b297d463c0cba6c936117f0875b2b2f95edf61acca889507a601e4467cd4c27c26b1e40671283714a4ec5d32ab53c230caec0acab67d9d3e4a7e4fd
- SSDEEP 768:bG9pPNADdVG9XpMUpvbXbcbObFb8bFbKb1b2bmbF/WPSJBEm:YlNL/WPSJP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
- Size 24KB
- SHA256 e353a81bb8493a706844d5470e41c1bfb51c9d9f05f2139f3dd9c58ea9851bdd
- MD5 5b85561a55fb8fcaca18ad768bd31cfe
- SHA1 1cb946fa6d163b3a80d9fed6b5603ec7dae57770
- SHA512 faa2f216b59438ce9ea89f3d80759c7e4aae99b3fa1667c9247d62158a5dd54177993feaf99bffa4a4425002be15e2bf1fcd7e2892b30c3be7fd9222fa375866
- SSDEEP 768:ZBEKO9pPNADdVG9XpMUpvbXbcbObFb8bFbKb1b2bmbF/WPSS:ZolNL/WPSS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
- Size 24KB
- SHA256 1cb730818e0fb44871ee660a4f57b164ac725672d65c6d7c09e0b5152ef53f00
- MD5 497a891da012955d1bca23d175b6b15b
- SHA1 9a57635c93c792c598035ac0b22ac7bc304c98cb
- SHA512 1da7cd1f8a7e9f7b84c9bbc19d92e79f6106b1055c1f0acc74c4bee1df6e811536cb608d7a86914a482dcc82c415a8bac632fbc73e9c744e236af2a47bf3529d
- SSDEEP 768:UpPNADdVG9XpMUpvbXbcbObFb8bFbKb1b2bmbF/WPSmOEBEm:UlNL/WPSyP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\ea327ca1-d216-4961-b4a2-d533f3c74294
- Size 659B
- SHA256 e234b18f2c725c699fccec1fea744356def7295c9ee551ab7de1d97785bcaf98
- MD5 7d6075520990a4059162d8b2fe8e6cef
- SHA1 5c4b66bd584fb54180740323725a70df59166107
- SHA512 b5759385d23f5228ef7ac426a2381c725625a49c431b0cf9e560c280f448e6991ae2cdf04ba9d80cc5e1677b4d6ab2a9fc6a9edc1fab5eb14b5d2aa4c8ce7e39
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\fc6427f8-567e-4f0d-bd7d-a8ca953a5d76
- Size 982B
- SHA256 0a90967b2be0cba636d14f6b24907d464cdb44a340a7fc5c9c6c4e1968e21bf4
- MD5 05733df552769412a68544c3a5954c7d
- SHA1 9b9ec62a5e00cdcebd79a9bd205ce8df6b583ee9
- SHA512 4458513e927121a31e7741e4a6cad15ad290d0970dd3a6d4e106a4d9be3090204106cfd14c8dfc4c264e8f8f884d0d34eeba1f77eeec94c51219c5944a786419
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
- Size 11KB
- SHA256 323add9a59c0e5199afabf7ee7ae3115b48025dc0f324460756afd2cc4d38af0
- MD5 83abc914829bc7f88b0a44d6a1cb43cd
- SHA1 d52250c81d6020126f47e886a82b2d273d2b88fa
- SHA512 d6e7831b31c270f8ec743040b9bd573c2c22c60a2493b21ce2b1f6328e139656107c2cf8dcbf4f3cd9116fa2afae84067ae1638fc034e0d431f1187dc6cc8772
- SSDEEP 192:95nxlR1fqIUSfmgmdR30vddEy1SR/aXbjQBw8Hy:ZdP+NoMy1TawX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
- Size 12KB
- SHA256 628129c2511727a125ef6ed8f6199fea5dee7ba02fafac6995e61ef1655ab063
- MD5 500b2bdaec4137515697d44ee6085d32
- SHA1 e09f086a28a9cdb4fb182fa0a7d0be780320b0df
- SHA512 95a3078154e47e81e7833b68be6fafa7ce391bf3243d24e8fa52554066059b21cbae30a3333a852d969308b1350d600b2522afb4ea04dcaa9c0b29f6b1dc375d
- SSDEEP 192:9KnxlR1fgIUSfmgmdR30vddEy1SR/aXdjEiBw8HU:SdF+NoMy1FLwp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
- Size 10KB
- SHA256 3e87262d23f409cd7c11fd1ce378122836097b18c53cb6d69599f90eaa6b964e
- MD5 a3a431705409e45d5bf2c5ac38b7f99b
- SHA1 c117dd5dd59571f1a38ca476a03d3e9045fd7002
- SHA512 d5accec3581a9702bfeec85344fa8fc32681fd618c5fd3967e20f84ac9be5c65fcfa1e7888e91f721ca6b14af795d01e7ea32261987d3e7fca11db72b88f6950
- SSDEEP 192:S5nxlR1fqIUUVofAHBtq8prddx9y1ZO43GaXbjABw8Vm:wdjVoIbpd9y1ZO8awp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
- Size 10KB
- SHA256 2021c93cd12caa965a4161fa93eaae22b51feff7a0ad101660b7e0853b78a56b
- MD5 297288175af720cc72729c603e976c67
- SHA1 6afa2e8f08a8ed78587bb39775c5581708af1b28
- SHA512 47129dd874a405a4d626eacf2f900116a593902ce666fd3945545ac5a188ef1b53d3b264cef53e77f9993807ae39783b4ed07585e21478cd3958afc0804f621c
- SSDEEP 192:S5nxlR1fqIUpVofAHBtq8prddx9y1ZO43GaXbjABw8Hm:wdKVoIbpd9y1ZO8awL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
- Size 12KB
- SHA256 4d2fd49c267d538dd0170a50dfd9882e79a6796d6e95983f49dbbe39254497df
- MD5 0b97e974ea6eb0aa26367793b44ceff0
- SHA1 f936e963b5df24045c757f3ac826fcc6073ef26e
- SHA512 7ae7a29afc5979ef3d9f1944c3258e6835b79b791b6483038b4f6f21f2b10724d69e0108fd82db1bc7556675f770abe46387a3f20f6d7392b37711c0f5e0c981
- SSDEEP 192:9KnxlR1fqIUSfmgmdR30vddEy1SR/aXdjEiBw8Hd:SdP+NoMy1FLwM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 7cf795146e88dedd2f59122de43d719ff85f47339813a53b36b63f9620498ea4
- MD5 8a01c07edeb98b8e82b6ccd062a04384
- SHA1 b3613cf368bec3b1a147754249edd7ad00b2fe00
- SHA512 304af8998ba8639d7174ee6ebf61b9d85d7bcc5451cd8eae2f539570978f00a388ea144e3d1d1fde6f70d1bbdcadffd35f3f4307de5c2c894cac73683ae164a5
- SSDEEP 96:jd7U8EMJF7VbMZk0zf8W8Qge3ZwS2o7b8caMy:aRgF5MZkcuemJ
- MD5 SHA1 SHA512 SSDEEP