Analysis
- max time kernel
126s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
05/12/2024, 17:33
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 949KB
- Sample241205-v4t7rsvjay
- SHA256 12f682be3ebf7eadeca00dc0a5932c26268ff16d47760b68b44afed4e385df4c
- MD5 607b571347184731f35542f8625a85dd
- SHA1 624b1a58c688cffcf2946b66c0100baca5b887fc
- SHA512 e885d78ec2c813e22c772ed99f09e68be16024334f867b8edacdbfbffbff527d2b02ccaf1df2f86b510bbc8e5a74d99298fec46a63a32c8678403067047d3194
- SSDEEP 24576:lqDEvCTbMWu7rQYlBQcBiT6rprG8a6ui:lTvC/MTQYxsWR7a6
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language file.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Kills process with taskkill 5 IoCs
pid Process 660 taskkill.exe 1400 taskkill.exe 4220 taskkill.exe 4840 taskkill.exe 4944 taskkill.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings firefox.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 660 taskkill.exe Token: SeDebugPrivilege 1400 taskkill.exe Token: SeDebugPrivilege 4220 taskkill.exe Token: SeDebugPrivilege 4840 taskkill.exe Token: SeDebugPrivilege 4944 taskkill.exe Token: SeDebugPrivilege 2724 firefox.exe Token: SeDebugPrivilege 2724 firefox.exe Token: SeDebugPrivilege 2724 firefox.exe Token: SeDebugPrivilege 2724 firefox.exe Token: SeDebugPrivilege 2724 firefox.exe - Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 2724 firefox.exe 4176 file.exe 4176 file.exe 4176 file.exe 4176 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2724 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4176 wrote to memory of 660 4176 file.exe 82 PID 4176 wrote to memory of 660 4176 file.exe 82 PID 4176 wrote to memory of 660 4176 file.exe 82 PID 4176 wrote to memory of 1400 4176 file.exe 85 PID 4176 wrote to memory of 1400 4176 file.exe 85 PID 4176 wrote to memory of 1400 4176 file.exe 85 PID 4176 wrote to memory of 4220 4176 file.exe 87 PID 4176 wrote to memory of 4220 4176 file.exe 87 PID 4176 wrote to memory of 4220 4176 file.exe 87 PID 4176 wrote to memory of 4840 4176 file.exe 89 PID 4176 wrote to memory of 4840 4176 file.exe 89 PID 4176 wrote to memory of 4840 4176 file.exe 89 PID 4176 wrote to memory of 4944 4176 file.exe 91 PID 4176 wrote to memory of 4944 4176 file.exe 91 PID 4176 wrote to memory of 4944 4176 file.exe 91 PID 4176 wrote to memory of 1524 4176 file.exe 93 PID 4176 wrote to memory of 1524 4176 file.exe 93 PID 1524 wrote to memory of 2724 1524 firefox.exe 94 PID 1524 wrote to memory of 2724 1524 firefox.exe 94 PID 1524 wrote to memory of 2724 1524 firefox.exe 94 PID 1524 wrote to memory of 2724 1524 firefox.exe 94 PID 1524 wrote to memory of 2724 1524 firefox.exe 94 PID 1524 wrote to memory of 2724 1524 firefox.exe 94 PID 1524 wrote to memory of 2724 1524 firefox.exe 94 PID 1524 wrote to memory of 2724 1524 firefox.exe 94 PID 1524 wrote to memory of 2724 1524 firefox.exe 94 PID 1524 wrote to memory of 2724 1524 firefox.exe 94 PID 1524 wrote to memory of 2724 1524 firefox.exe 94 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 PID 2724 wrote to memory of 4748 2724 firefox.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:660
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1400
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking2⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee092725-06ce-4f30-8f82-dc29f96185a7} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" gpu4⤵PID:4748
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd677a40-25d5-4d90-9dbe-8c3b5c3e597c} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" socket4⤵PID:324
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2904 -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 2996 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d913c40f-bff7-4760-9275-8410c49423fb} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" tab4⤵PID:3264
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3696 -childID 2 -isForBrowser -prefsHandle 3688 -prefMapHandle 3624 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee796443-02ab-479b-bd23-08d91eb0d506} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" tab4⤵PID:4784
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4940 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4964 -prefMapHandle 4960 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b15b2a9-8aea-4228-881a-17b201baa88d} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" utility4⤵
- Checks processor information in registry
PID:1228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5204 -childID 3 -isForBrowser -prefsHandle 5364 -prefMapHandle 5360 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b54c510-2fa1-4a4a-ae8c-3b5bfd367339} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" tab4⤵PID:636
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 4 -isForBrowser -prefsHandle 5520 -prefMapHandle 5368 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0641728a-e5ac-41b9-8bcc-13eceba0d77f} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" tab4⤵PID:2560
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5728 -childID 5 -isForBrowser -prefsHandle 5500 -prefMapHandle 4928 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4499cce-838b-4498-bcd8-13a3ee499626} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" tab4⤵PID:4136
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\activity-stream.discovery_stream.json
- Size 20KB
- SHA256 b3f3d4418ed1774d6d75e92d1fbbfae094d82bbdccea4820e7ffa5cfb6cedd5c
- MD5 4be4f6e0f6f55d2f03f362a480144bd7
- SHA1 b9b1337764ca37230ddfafcd54f18b5a00715758
- SHA512 87a9df4998314d5ce7f7b43d7aa0a550c356f016591914ffbf959024af94800c32afa11372eaf3ba74dbc785dcb29c51686f9b693196d386857bf5b8d32f4dcd
- SSDEEP 384:9rWpDWHY/x4rJIw5h5vnJmrvuKGd7/cnxkfHtHYtqTyaE:VWpDWHY/Oy85vnJmruKGd7bTyp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
- Size 13KB
- SHA256 68637c385ea0bcbffa9a489d0c50ff0545db9fca9289b2c75a8e7facb6e86ef7
- MD5 9fcd47a220554f543bb6405738f8e137
- SHA1 0ff869cacda2ab7832335e85756d370f44fc1f73
- SHA512 d26d700e405d5d827806fbfb11f6b02b854dd2aa3b8cbb6a876c6f847c35a55956a17c92b0147a362d2f9bb0b683ba30658c0b03f2151db49756acc04f7d5270
- SSDEEP 384:HFh1u9fiGLm4pUxYA+Q+4IYKgH4Zv+3yPrIVy8ejCeCp:IBi8mCUxYxQ+4INy4ZcyzIVy8Rhp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
- Size 15KB
- SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
- MD5 96c542dec016d9ec1ecc4dddfcbaac66
- SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
- SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
- SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
- Size 6KB
- SHA256 1d515744cefe3cb56bcc9eb2524071734bb816965acc25a3c975bfbc717dc4d2
- MD5 35ca0ea2edb0f099c8c6a7b48ddc6812
- SHA1 60c965c40188143b0d1754431303da2cf8943381
- SHA512 1dc7be9f1d8058414749a42a2e4da0bc964d1e1837bbcbfb25e6306c32061edefc4dbe4f368c25b012d97c6378daebab66b4af151ff3ee6ed18a9049d1c8540c
- SSDEEP 6:JO0gidpq88gidydgid88NngrG4THgidpqs7HgidBgidwBFn:RgQpB8gQWgQ8cuGTQphMQSQwP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
- Size 10KB
- SHA256 9f3f74fb778e1603fe6ec691623618c6707c89542dfe8e77e5c44e7baf0286dc
- MD5 662fe911d24d813c03a3ce0a4e220355
- SHA1 553aab68838d52a9c2af987fd2ad6c27158af68a
- SHA512 7f06c99d4fcfc7a8ebc6b9676cd205d8b4469a3a078adecc72f7cd5acb510ea146ff34b6692e96f617af0b56a7a6f90d5d2de4c0047de2a2ac5fcae3a41c4f17
- SSDEEP 48:sZebVKZbW5oW9cOuebOJZb/pebvpf+Zb:8ebVKZbW5obebOJZb/pebvpf+Zb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 028d7345f8b654974219f26b1ea501789bc129e4b50d79cc0bb7e9f23b92b823
- MD5 32a1a38ed483e93598886fb1e8d7fa37
- SHA1 0ef770bed694dd8504e000a1a92937cdbe4d3bce
- SHA512 fabcb10273cfe84ea17b49ee25473dfbcd8a53b36a724d2c1d4166bb0d73d7f026514841f4e06c78db2277631e1d1c164d3386f2a27c724b53c9e72aa248cd29
- SSDEEP 96:rJSMF9ZbkW6Yfhm3+PP/PrWZGpnQpWpLpYBpYFl66JozGzgClKtmSSnWZ:VrvZbowhmQPCi/66JozGzgCl6mSSW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 b7c6cf5e7e60b3bbb2a5e925651b4655df8601ece5abd387ae599c563e1dea15
- MD5 4ececb06ab039ef0d457bd75eceb251d
- SHA1 9c7a538b9f4213c64e0273914beb9f0ee2b77515
- SHA512 fedb5b179dbff09af0d22ac258229bb1d8beafb6e863ee12f9042ed05622659800730228c4861553a909d9f0d990ca69fa5c7afdb81056c66a3acdfc64e345c1
- SSDEEP 384:me5+kmXDCoAsb3bam/66JozGzgC1b6FyboZb8aPff:pTODCoAsb3baDE7y/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 a4d6d3870e84ea0eb9fbaef3a7d7d8a41fad336e82a214f944e20ae68acd7f07
- MD5 d15e1d2ea9007e5983fb643205cabf8d
- SHA1 3ea1fbb48d3c47b60310323cdadcf0392c8fc92d
- SHA512 675c12034ef7c5ec9b92bbc21619c8c0cf5d7e737ab58d226230650da4ced0e241441c7cdc0dcdf3a6a443297eca88844ff3282d92b39aa16d0c5dbdb323f926
- SSDEEP 384:ZFybol8aPfLe5+kmXDCoAsb3bam/66JozGzgC1bM:qqSTODCoAsb3baDEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
- Size 3KB
- SHA256 37923262bdc3d0a2a43820614a03689b708a7346260d090551b7c85046f32f3e
- MD5 724a96b214bd949bc64507edd163191f
- SHA1 7976cc3138668ec149a81930ce91121f0fe5d6eb
- SHA512 40474e1a77e140fc017035dbd684ca420356fb0be6a65f469487815a598efb767c78415ac3dbc71e7e1216a27678d08381c4613509768454f08ee297b612a011
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 d403dfa5bf8003bbcde349828773d66438a9d8ea6311fe6d01e02105de78a1b5
- MD5 65fb57595b478d5cc287109829c27681
- SHA1 69cf341fdc800da599ff03ceff1e0ea5a71ffe30
- SHA512 517f1c1df810132e19a47d09393fef7b24a6249685c92459676b9181fcfb47375f687017884d1d2a93d59ff9ddfd9a7b36c7353c47180e9961fc1768f46c1ae4
- SSDEEP 96:VpnQpWpLpYBpYFl66JozGzgClKtmSSS1BUJSMF9ZbkW6rBBtfhm3+PP/PhxnWBg:d/66JozGzgCl6mSS5rvZboPRhmQPDWq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\66c2d406-a332-450f-8e71-7fe6106a454e
- Size 982B
- SHA256 48fa14bfba12c4c8fb2e8d2a158147c423b370eb5935ca0580824aad68ac45ee
- MD5 f8781b87e638348a177c826b9b6b7495
- SHA1 8ad003c433bb12cb8d4388bd2c347add190dee5a
- SHA512 b267fd759669a260d6990bd504f5de94d69308ae0ead22be07c2a058b775a3659c6ca14c198fd51abf15781e00a7abbc7606b28230a4ca04b1ce00582395a467
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\8f5ef76c-97e4-4416-8ddf-51720bdd79d1
- Size 671B
- SHA256 373bb7ef5ae2ae0fc0f2e2abc945f855071b96b6f7bd1b77db3d77b193774c0e
- MD5 17fec8f2f7a9499364b0c49c89502b95
- SHA1 591f9540aaff53dfbbcfe0486b42fb16ef1080a3
- SHA512 1b5b91c14a0f7f15238df520d5a2fc10c3a469de5e40fce9b2572e8ce7763f5c801b83d5507ed0fb50378473bdb41912855ec7f6cda91dab0d1bc2d872b61c5b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\c9576895-29ae-4082-b4f2-500bc20997c3
- Size 25KB
- SHA256 a22a043ef5986af98d1d648667a789cf3bb988ff9c0a1b94b6ec483913f132da
- MD5 afa0f35c6c25f0b6af43e3564b21f866
- SHA1 337e1aa093dbe21a627ef3e44a915743a3a6b2de
- SHA512 d28ac90cdc2816811ce2e980d80bec21d5f1357079940f15fbabe921ea4540235161d00544321b968d61d6784d3e4368e6a1ad6a68db8ee11492c6ab3bd054bd
- SSDEEP 192:A00MI5eCLEkt85UxnPyLEvDTJczw/39cpAomvI6iNDmENbzhcjhJsM7dsp5ziYx5:zyBDE8Ym8yhnVPm49JVvGnsKrXK7Ese
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
- Size 10KB
- SHA256 f35d36d93d73fdf8b62753413f093020b3e26e1e021440423aefbbebcd8f7057
- MD5 a8bbef5ee623568cb5155051b1ca908f
- SHA1 aab1e5befe935cb5baac48d97555a27ac43c4ee0
- SHA512 c5c2e062799d170da7dbbef491c4d4846dcfc86137ef331a00f20c4950cf791eaf8114a261e97d665ba1a3f0cd6fea41e99232ff9f74e1e5595015bf40f6a507
- SSDEEP 192:Y5nARLbfXe6gHDI4g0RhUXtdmjpFdd8y1SJ7aXKEVo8Bw8HR:pIHDe0ROtCpmy1qEVfws
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
- Size 12KB
- SHA256 50b6a15488b6abffab61d2b9921a2e20d087a59a21c10a27be5b2cb047cc06b7
- MD5 ba64f3c28f5681b53e580b06b9f30c84
- SHA1 b9ae0bb372e8e53e6756021516748fa535c40244
- SHA512 254906426fc1b88ccf6f58b86d155cadd558cda29bc773a69677e7ca83f9165faa6bb31eb56747800bf817a17d1c23865cc097b412f70ff5aef4890f7b2bfafd
- SSDEEP 192:J5nARLbfXe6gHDI4g0RhUXtdmjpFdd8y1SJ7aXKEVoN8PjBw8H9LsNpyDX:AIHDe0ROtCpmy1qEVHwYp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
- Size 15KB
- SHA256 44c7d1ac5a6eedf4b263c50792b0c6bbb70aa5075e3caade3aa6af80375ca936
- MD5 95f75b89d2fd1ddce614f0a00c707597
- SHA1 e30b073fc8462fb7382609f1a743c7b37b4d009a
- SHA512 8336775d06806a4f6711d7acee59147a597c10cb698cb5068dfb4396d418b54bab2820f657ca9ea0de850490f6dd1720474397437f8a740a4c50e4a4793cc468
- SSDEEP 192:JSnARLbfPe6gHDI4g0RhUXtdmjpFdd8y1SJ7aX2+EVoN88le2iBw8H99qsz3WPfh:lAHDe0ROtCpmy13EVqe9wYp+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
- Size 10KB
- SHA256 329edac3cb1a7fa54c51fd0644795c372e33f2b5cc776576a61a51f8e6f5a4bc
- MD5 7767c02061ff19c271aa95fba8889a02
- SHA1 6e5e7d557dfcfc5d6e4dc812e88b767629809f9d
- SHA512 a43eba54f149a9829a86db83db5a6ade7f654d29be0c358816ff66c51040fdba4a7eff7e5a9be13dd703f4a5f8b8cbd4a375c9106e9f669e40a8ed5825aa6279
- SSDEEP 192:Y5nARLbfXZzQVofAHBtq8prddx9y1ZO43AaXkEVo8Bw8HR:peVoIbpd9y1ZOpEVfws
- MD5 SHA1 SHA512 SSDEEP