Analysis
- max time kernel
126s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
02/12/2024, 00:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 900KB
- Sample241202-bbg7ys1lav
- SHA256 caeb8c4427dbf2bbd08b88bfdcf218b2b00d6967c5eb508b5bd90d7b8c7cfa39
- MD5 f0219b2d6256b5a9d76d27306405c8c5
- SHA1 a767f4cfc1500353a1cbca50039f693be3e175bb
- SHA512 470f52d9897ec05fee5dde7f6b5f732d0e86346df90a9360d3b0143345a7783ec213f66d5d6c31c555c519a582562bab26293d2bfc82ab89ad1c423be2997608
- SSDEEP 12288:BqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaOTQ:BqDEvCTbMWu7rQYlBQcBiT6rprG8a2Q
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Kills process with taskkill 5 IoCs
pid Process 3816 taskkill.exe 4232 taskkill.exe 4736 taskkill.exe 3704 taskkill.exe 3608 taskkill.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings firefox.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3592 file.exe 3592 file.exe 3592 file.exe 3592 file.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3704 taskkill.exe Token: SeDebugPrivilege 3608 taskkill.exe Token: SeDebugPrivilege 3816 taskkill.exe Token: SeDebugPrivilege 4232 taskkill.exe Token: SeDebugPrivilege 4736 taskkill.exe Token: SeDebugPrivilege 2924 firefox.exe Token: SeDebugPrivilege 2924 firefox.exe Token: SeDebugPrivilege 2924 firefox.exe Token: SeDebugPrivilege 2924 firefox.exe Token: SeDebugPrivilege 2924 firefox.exe - Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 3592 file.exe 3592 file.exe 3592 file.exe 3592 file.exe 3592 file.exe 3592 file.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 3592 file.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 3592 file.exe 3592 file.exe 3592 file.exe - Suspicious use of SendNotifyMessage 30 IoCs
pid Process 3592 file.exe 3592 file.exe 3592 file.exe 3592 file.exe 3592 file.exe 3592 file.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 3592 file.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 2924 firefox.exe 3592 file.exe 3592 file.exe 3592 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2924 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3592 wrote to memory of 3704 3592 file.exe 82 PID 3592 wrote to memory of 3704 3592 file.exe 82 PID 3592 wrote to memory of 3704 3592 file.exe 82 PID 3592 wrote to memory of 3608 3592 file.exe 85 PID 3592 wrote to memory of 3608 3592 file.exe 85 PID 3592 wrote to memory of 3608 3592 file.exe 85 PID 3592 wrote to memory of 3816 3592 file.exe 87 PID 3592 wrote to memory of 3816 3592 file.exe 87 PID 3592 wrote to memory of 3816 3592 file.exe 87 PID 3592 wrote to memory of 4232 3592 file.exe 89 PID 3592 wrote to memory of 4232 3592 file.exe 89 PID 3592 wrote to memory of 4232 3592 file.exe 89 PID 3592 wrote to memory of 4736 3592 file.exe 91 PID 3592 wrote to memory of 4736 3592 file.exe 91 PID 3592 wrote to memory of 4736 3592 file.exe 91 PID 3592 wrote to memory of 2440 3592 file.exe 93 PID 3592 wrote to memory of 2440 3592 file.exe 93 PID 2440 wrote to memory of 2924 2440 firefox.exe 94 PID 2440 wrote to memory of 2924 2440 firefox.exe 94 PID 2440 wrote to memory of 2924 2440 firefox.exe 94 PID 2440 wrote to memory of 2924 2440 firefox.exe 94 PID 2440 wrote to memory of 2924 2440 firefox.exe 94 PID 2440 wrote to memory of 2924 2440 firefox.exe 94 PID 2440 wrote to memory of 2924 2440 firefox.exe 94 PID 2440 wrote to memory of 2924 2440 firefox.exe 94 PID 2440 wrote to memory of 2924 2440 firefox.exe 94 PID 2440 wrote to memory of 2924 2440 firefox.exe 94 PID 2440 wrote to memory of 2924 2440 firefox.exe 94 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 PID 2924 wrote to memory of 4296 2924 firefox.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3704
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3608
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking2⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {704b699d-6f82-458b-95f1-f30758745cf9} 2924 "\\.\pipe\gecko-crash-server-pipe.2924" gpu4⤵PID:4296
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39d6527a-d318-4fd1-9e7a-e99c08e86df9} 2924 "\\.\pipe\gecko-crash-server-pipe.2924" socket4⤵PID:1832
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3076 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 2924 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ceaef48-939c-422b-89b8-68696b877bb8} 2924 "\\.\pipe\gecko-crash-server-pipe.2924" tab4⤵PID:1404
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4040 -childID 2 -isForBrowser -prefsHandle 1240 -prefMapHandle 2608 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bfb5074-1603-4819-a6da-368b864801e1} 2924 "\\.\pipe\gecko-crash-server-pipe.2924" tab4⤵PID:1968
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4732 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4708 -prefMapHandle 4700 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58ec62f3-9c1d-4323-bc8b-d3636897320e} 2924 "\\.\pipe\gecko-crash-server-pipe.2924" utility4⤵
- Checks processor information in registry
PID:3432
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5188 -childID 3 -isForBrowser -prefsHandle 5200 -prefMapHandle 5300 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44218936-8e15-49f3-8fb9-151ac763dde3} 2924 "\\.\pipe\gecko-crash-server-pipe.2924" tab4⤵PID:4696
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5344 -childID 4 -isForBrowser -prefsHandle 5464 -prefMapHandle 5472 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dae3ef3-6ba4-47fc-b78b-cf3cca466f53} 2924 "\\.\pipe\gecko-crash-server-pipe.2924" tab4⤵PID:800
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5728 -childID 5 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d0c95a4-929b-4983-8f6e-f32092fd5a0d} 2924 "\\.\pipe\gecko-crash-server-pipe.2924" tab4⤵PID:4316
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\activity-stream.discovery_stream.json
- Size 21KB
- SHA256 aaab9ccfa7789cef4dd29099670577a57e4b64ee232000784a86a44b3cf13be0
- MD5 0eff2a47848c299771eadd7bab48c50a
- SHA1 85d2ad2ce6c418ccfcf73a2dbb7699801828a832
- SHA512 3205718788fc4d5c338bc93883da77e3ee9b52739a49975e17f090d84626178cf1c0c015497443f406d41fff4783de41602b544f504df38ebe550f89847291a5
- SSDEEP 384:cz9TkUUO/VoeFZ2qLopXRujGCC4dNMpYtyauVG:0kUUgVoo2qEpXEjGL1uydVG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
- Size 13KB
- SHA256 960a4f127d35d0af6d0fd84f51a7263a23118e8bf7df26b026a982426daebde7
- MD5 0add4cc7836964b7a0d5d52b3a527206
- SHA1 c87fdbea17a9f2e86f50b741e505b34183931fc9
- SHA512 e2cd6acf5c6f3057f301196977f18ce2ee185b97818daa8e7c1730d39bf978d434d18cca935bf805d0ccd1fab00faec9b31b2385300113219158a8414dc658ae
- SSDEEP 384:HfNIu9fiGLm4pU2vA+Q+4IYKgH4Zv+3yPrIVy8e1GNG0:llBi8mCUexQ+4INy4ZcyzIVy8D40
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
- Size 13KB
- SHA256 3a112774f24a3631f51e31ac1d550154bc2ef9c0ab5cbab1c2b1923ffe391f32
- MD5 ac0b3cd0cfc997ba4751363be1350164
- SHA1 a9969fd3f5d126488f7fb8852c9d19e84f226e01
- SHA512 53a5046b96343eacc055b4ab38fe7399f31defd9bc85e47e12a8d84ae0bcc61497f75cedd9d89de7131b89fd3c971837423f0a3fb9bad31c140875969e988018
- SSDEEP 384:HFh1u9fiGLm4pU8A+Q+4IYKgH4Zv+3yPrIVy8eGG3Gh:IBi8mCU8xQ+4INy4ZcyzIVy8u2h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
- Size 10KB
- SHA256 25797e694e640297fc6800daded7c0e2b02b01bb28d51428fc5f7784773a6258
- MD5 80c5c5a8856a89985d2ea698617749f3
- SHA1 c8fb72233b785d8dcf2f337c423ec4a2daa00935
- SHA512 ca67ea02f5e58014a9cfb6d29b08d9ae3c27358789d3cf7bf6004f73bdacf87cf7eddfb0a564d5aceb62818573a8c40534f6df6240a8a6bbc6b0cc59df794987
- SSDEEP 48:FebVKEfbB55oGqebOJEfbv9cODTpebvpf+7fb:FebVKab/5o/ebOJab5pebvpf+bb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
- Size 22KB
- SHA256 a18dfdb31e09ce7df68eddb87792fb731643f5ba819f58da4266d0521dcd0d61
- MD5 b3e4a68d625a3055a076fb04c993f138
- SHA1 10e8c1bee291fd71d1ff9dc31948b21cd4738901
- SHA512 57ccc74da388759dc98c897433b691b16d35ba1cda8ffd04c7c52ec7ca94eca90b78f07a2b5e5c68603e4f51d3a027e2cfff265855272f65890c908fe9b969cb
- SSDEEP 384:P/66JozGzgC1b0boSTPuXBdvTSqBSm282fPzfPKPS89a8Evgqbsb58bHb6bmbR9E:qE6F+Bd7PBSgiPKPS89a8EvgqbsbibHk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
- Size 25KB
- SHA256 19a8e4a19859751e178fe8dda3ddd8f67ef14a43f5d0e50aec1a9e9ce6d29ad8
- MD5 bc734483f38805f8e3fae307afeb1778
- SHA1 da27605a178687d00fcb884c1baf5e873dd35acb
- SHA512 bb383e20d5abdc10228662bdcdcedc72e5bf1efff54cc571ccc08d7fa83cf105ab714a8420bd2c50d195d7f3b2fbb00e9df079515c307c3d1928707b0a4c6908
- SSDEEP 768:qWiXsZ9lSDKP0f9a8EvHabsbib5bBbmbXbzbkbgHynqa0E59u:qWicrlxHynqac
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
- Size 22KB
- SHA256 b514d6165f891a337611263b666cc78a080db4c4cb5985300ad8b571a41f0127
- MD5 8c4ffc9a30fe69db6036d260974dac48
- SHA1 971c463a2ba9fd3e4fb49a2df1a1082cc8d485cd
- SHA512 040791f002758ebca52ef6d84f60b7da1361209b742fd1249dea46684a360fd54fcfd5bed76d41f355916cf53228e0e37512e25af24541935c81a20cc03dc369
- SSDEEP 384:lXBdvTSqBSm282fPzfPKPS89a8Evgqbsb58bHb6bmbR9bzbkb9CVhvWFKVoMP/6d:JBd7PBSgiPKPS89a8EvgqbsbibHb6bms
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
- Size 25KB
- SHA256 26dd271cf84c4d5d498e0cfec8ee1e037430c24b84ceb4b1272ef554d37dcfd4
- MD5 facc9c3cda844d03cb8145169a3abf4d
- SHA1 8d5c66d6fce985509643bbe49e01fc86f1c4e9f4
- SHA512 7094ddd6edd6bc8c62c1e34088e182d50cd22d859d1aef489ab9872a10fe5f68fdf92aa7a49ff7f2b01fc23ca930a454340252d0c26239078af11a3cd4060aa1
- SSDEEP 768:qEeWiXsZ9lSDKP0f9a8EvHabsbib5bBbmbXbzbkbgHynqaadu:uWicrlxHynqaL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\3d6448c2-a4d4-43ae-b4c5-fd7078cea6ab
- Size 982B
- SHA256 ed14cf2daa5b58babf43182b15ec325c5b6dffa9195031bac69cda9a9f4e6581
- MD5 39e7420d489fe02968f4d8dc75b4e5fd
- SHA1 49172de472d3b6d974939ecc36299c7c86f3cdf6
- SHA512 36b27eec61ff2414bdabd790383cc4f167515cfc5d5609d9cb79542e64c24acd91b7558cf076636d5fcfaaec1b8be901ee584794bfca3eb5481ef2e87d7f3df8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\8cb90a91-0bb7-4981-898a-08b2928764ab
- Size 659B
- SHA256 038b9e108483838a8231ce10b5981665e22c47dc70859c08cfe258b22dd2e877
- MD5 816ef651baa7ef52cfdf949fe9d0e22d
- SHA1 52b14285440c23ccabaf43f9be1a2c70ae7d982f
- SHA512 7aff41567ab712191a3b233c1bf9bfe36d11d5db538cdc6ac9db4439f2b0479526cfaa3438c9ef2d702e6b8a32705a0b3c5b3d3a4a0799f8ef56f03f8c09828d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
- Size 11KB
- SHA256 53c7bc47ca1db7ecc1539020dcf35d2967412a2cac09054637e98f891e9d2c2c
- MD5 8102e991877b4c7c1b2d48fad53e2b2e
- SHA1 d7cf6a040615340a6c76c01469b467e838ff2787
- SHA512 d5f01ff59d946f41206650d40c70d121e402b3b1bdfe0fcff0db695c56fdb5e8ff0ee90cb5b885bb7b1f72ed94549fd8d7c6e2378ef9dfa5c89cb59905bb9291
- SSDEEP 192:y5nZRVpf2HRm3r0I4NCEXmMLd+hdDFG192aX0EVJJ3of6wWBw8HrwaXy6HZyH:KpbIDC8mQkPK5VLof6wUwuwaXy6HZyH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js
- Size 10KB
- SHA256 916375da5a1afe41c73fd2afa802eb1f8e5f5f4cd4649942fc0dd96d506a188e
- MD5 e8cd9e6f787ad9ed1384b4fe57624032
- SHA1 cb261484151b105f471fca57982a3a14fadb07dc
- SHA512 e59c72cf9224ca0cbfc98cc123b74663876362f7df3dbc1d846d978ff17634c4d46cba50f4745ea62da422146bbaeef74fdcde82e473be6e9d2eedc514f2ae6d
- SSDEEP 192:X5nZRVpf2DZmyPVofAHBtq8prddx9y1ZO43XaXoVJJ/Bw8Ha:HpfyPVoIbpd9y1ZOiVlw/
- MD5 SHA1 SHA512 SSDEEP