Overview

overview

4

Static

static

1

download.jpg

windows10-1703-x64

4

Resubmissions

02/07/2024, 16:16

240702-traf6a1blg4

02/07/2024, 16:07

240702-tkq6bsvbqm10

Analysis

  • max time kernel
    381s
  • max time network
    379s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/07/2024, 16:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    download.jpg
  • Size 10KB
  • Sample240702-traf6a1blg
  • SHA256 fecbf15e41c3e54ffae04b2a6b39ec748a185f85b8c7a6407a329e6959e9317f
  • MD5 SHA1 SHA512 SSDEEP
Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 11 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 3 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 49 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\download.jpg
    1⤵
      PID:1844
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3596
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4844
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4872
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.0.2045178889\1581963649" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1744 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ce27eff-97b7-471f-8701-9eea23300fb4} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 1828 2a2956d4058 gpu
          3⤵
            PID:656
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.1.575706423\1098966597" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22240ade-5621-48d9-83a9-112e6e935171} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 2184 2a29560a258 socket
            3⤵
              PID:1952
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.2.1361380426\849169112" -childID 1 -isForBrowser -prefsHandle 2768 -prefMapHandle 2744 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb3b6bba-674c-418c-be6c-45d2c6bd39f6} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 2672 2a29969d058 tab
              3⤵
                PID:2504
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.3.1941307956\1279121525" -childID 2 -isForBrowser -prefsHandle 3504 -prefMapHandle 3500 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {469ed792-d8e3-4547-ace9-58aa1cd1b82e} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 3516 2a283162558 tab
                3⤵
                  PID:3116
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.4.1904261263\656281836" -childID 3 -isForBrowser -prefsHandle 4356 -prefMapHandle 4352 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {94fc02cf-b01e-4faa-840b-2dbc5233df83} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 4368 2a29b4a5b58 tab
                  3⤵
                    PID:1516
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.5.2001475916\264786842" -childID 4 -isForBrowser -prefsHandle 4712 -prefMapHandle 4840 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e7e1fb3-a276-404c-aed9-1d374a70e963} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 4800 2a29bced858 tab
                    3⤵
                      PID:1844
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.6.1894302046\1080732036" -childID 5 -isForBrowser -prefsHandle 5012 -prefMapHandle 5016 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {398134b6-f5d8-4d6a-aa52-8a6fec5a7a4a} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 5004 2a29bcede58 tab
                      3⤵
                        PID:4912
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.7.253755030\350667306" -childID 6 -isForBrowser -prefsHandle 5196 -prefMapHandle 5200 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff210f33-cdee-408e-8bd2-d0d2693c061c} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 5188 2a29bceed58 tab
                        3⤵
                          PID:4700
                    • C:\Windows\system32\taskmgr.exe
                      "C:\Windows\system32\taskmgr.exe" /4
                      1⤵
                      • Drops file in Windows directory
                      • Checks SCSI registry key(s)
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:3640
                      • C:\Windows\system32\resmon.exe
                        "C:\Windows\system32\resmon.exe"
                        2⤵
                          PID:348
                          • C:\Windows\System32\perfmon.exe
                            "C:\Windows\System32\perfmon.exe" /res
                            3⤵
                            • Checks processor information in registry
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4684
                      • C:\Windows\system32\taskmgr.exe
                        "C:\Windows\system32\taskmgr.exe" /4
                        1⤵
                          PID:5324
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:5368
                          • C:\Windows\System32\klist.exe
                            "C:\Windows\System32\klist.exe"
                            1⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5412
                          • C:\Windows\System32\klist.exe
                            "C:\Windows\System32\klist.exe"
                            1⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5460
                          • C:\Windows\System32\ksdydr.exe
                            "C:\Windows\System32\ksdydr.exe"
                            1⤵
                              PID:5508
                            • C:\Windows\System32\ksdydr.exe
                              "C:\Windows\System32\ksdydr.exe"
                              1⤵
                                PID:5552
                              • C:\Windows\system32\OpenWith.exe
                                C:\Windows\system32\OpenWith.exe -Embedding
                                1⤵
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:5644
                                • C:\Windows\system32\NOTEPAD.EXE
                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\79a0bc87-9289-4828-b86b-d22cf35d208a\3950266016.pri
                                  2⤵
                                    PID:5708
                                • C:\Windows\system32\mspaint.exe
                                  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\download.jpg" /ForceBootstrapPaint3D
                                  1⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5860
                                • C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
                                  "C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3816
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                  1⤵
                                  • Drops file in Windows directory
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3640
                                • C:\Windows\system32\browser_broker.exe
                                  C:\Windows\system32\browser_broker.exe -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  PID:5732
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1324
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Drops file in Windows directory
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3192
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Drops file in Windows directory
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:712
                                • C:\Windows\system32\NOTEPAD.EXE
                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                  1⤵
                                  • Opens file in notepad (likely ransom note)
                                  PID:4448
                                • C:\Windows\system32\OpenWith.exe
                                  C:\Windows\system32\OpenWith.exe -Embedding
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5680
                                  • C:\Windows\system32\NOTEPAD.EXE
                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\026d1a02-fa0e-4291-9639-232e7cae9f72.tmp
                                    2⤵
                                      PID:5640
                                  • C:\Windows\system32\NOTEPAD.EXE
                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
                                    1⤵
                                    • Opens file in notepad (likely ransom note)
                                    PID:5492
                                  • C:\Windows\system32\NOTEPAD.EXE
                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\jusched.log
                                    1⤵
                                    • Opens file in notepad (likely ransom note)
                                    PID:5548
                                  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                                    1⤵
                                    • Drops file in Windows directory
                                    • Enumerates system info in registry
                                    • Modifies Internet Explorer settings
                                    • Modifies registry class
                                    • Suspicious use of SetWindowsHookEx
                                    PID:372
                                  • C:\Windows\system32\taskmgr.exe
                                    "C:\Windows\system32\taskmgr.exe" /4
                                    1⤵
                                    • Drops file in Windows directory
                                    • Checks SCSI registry key(s)
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5624
                                  • C:\Windows\System32\iexpress.exe
                                    "C:\Windows\System32\iexpress.exe"
                                    1⤵
                                      PID:5452
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
                                      1⤵
                                      • Checks processor information in registry
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5360

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          iconcache_idx.db
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                          • Size 14KB
                                          • SHA256 e4fbc3b1334f59edd413505dea5ba7c69506e3b530936fcc1032dc054b0a56f6
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          715946058.pri
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PRICache\1601268389\715946058.pri
                                          • Size 171KB
                                          • SHA256 8ccddf0c77743a42067782bc7782321330406a752f58fb15fb1cd446e1ef0ee4
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          2290032291.pri
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PRICache\4183903823\2290032291.pri
                                          • Size 2KB
                                          • SHA256 5be5216ae1d0aed64986299528f4d4fe629067d5f4097b8e4b9d1c6bcf4f3086
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          12953
                                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\12953
                                          • Size 11KB
                                          • SHA256 4f62f2e2182aeb9ba1fff951dbb328fb15ce2ad3a2621f750e478d8f62368142
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
                                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
                                          • Size 13KB
                                          • SHA256 41d1d0314faaf58b4dcb0d6ffc568bedeae7858a94d4b8532a85e493bdf62f8e
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Projects.json
                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
                                          • Size 237B
                                          • SHA256 80a4e68a1b2f91729091dc912484978e354992af337c3e4156c9510e61810ef5
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          cloudCommunitySettings.json
                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json
                                          • Size 2KB
                                          • SHA256 cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          ~DF86359FD0988C9851.TMP
                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF86359FD0988C9851.TMP
                                          • Size 16KB
                                          • SHA256 722806574b5cf0a5b95017336d255101729d67468e12b0adac2d2942b5217fb0
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          tmpaddon
                                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                          • Size 442KB
                                          • SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          tmpaddon-1
                                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                          • Size 8.0MB
                                          • SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          6824f4a902c78fbd.customDestinations-ms
                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                          • Size 5KB
                                          • SHA256 4f82f2d624684d7e92f38afb2dc48ba44be147ab07a333176909c27548715b09
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          data.safe.bin
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin
                                          • Size 2KB
                                          • SHA256 930267d47affdfdb42858614fe5dc8b28a3ad99d030f20e6a3448aab1e99299e
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          15d198da-c108-454a-b80e-969199318cff
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\15d198da-c108-454a-b80e-969199318cff
                                          • Size 746B
                                          • SHA256 a013ca8eeab8d366e7eeab0b8f445ff453e30e88acc6b701893733f6393c4d00
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          e2f61dd4-fe10-4398-91c8-b0be76a7449e
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\e2f61dd4-fe10-4398-91c8-b0be76a7449e
                                          • Size 10KB
                                          • SHA256 fb2293abec46c65c9ebcc1fc4db3a0c7d5817500e001a01cb5ae171a8ddaa1f0
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          gmpopenh264.dll
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                                          • Size 997KB
                                          • SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          gmpopenh264.info
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                                          • Size 116B
                                          • SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          LICENSE.txt
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                                          • Size 479B
                                          • SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          manifest.json
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                                          • Size 372B
                                          • SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          widevinecdm.dll
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                                          • Size 11.8MB
                                          • SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          widevinecdm.dll.lib
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                                          • Size 1KB
                                          • SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          widevinecdm.dll.sig
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                                          • Size 1KB
                                          • SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          prefs-1.js
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
                                          • Size 7KB
                                          • SHA256 ff110cc68e2f80c5b8e0a77fa44f209dd708037cd3eaf10f37d2a94fbf3c9534
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          prefs-1.js
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
                                          • Size 6KB
                                          • SHA256 a2f57f46a59496305dee6c997626548fa3f2ede39420e2d5e87ec3c381e7bb7c
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          prefs.js
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js
                                          • Size 6KB
                                          • SHA256 7216ef13063b985590d2c3c922cfb3529702790e0c426bfaf54a839d9f98a1ab
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          prefs.js
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js
                                          • Size 6KB
                                          • SHA256 a071e9bae1dfec2be7bbd6567a3f35bb694e32d0bb8d92e2fa560fd02be7d106
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          recovery.jsonlz4
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                                          • Size 1KB
                                          • SHA256 38b7c5c02c0c8cba714d8f5e06ecdcedda70b7d84877bd76605b686ad2c9f337
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          3870112724rsegmnoittet-es.sqlite
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                          • Size 8.0MB
                                          • SHA256 d013ff6ca645fc743a207a15189dbec30a6a5ea80fa47765ecf8b03f4fca6eda
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          3870112724rsegmnoittet-es.sqlite
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                          • Size 584KB
                                          • SHA256 71a39e120b76315dd041c47bf73ffad9581b948e6834043df803fad8df1d7e28
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          3870112724rsegmnoittet-es.sqlite
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                          • Size 184KB
                                          • SHA256 8f426b4be5e3440fa14d37480f018b7dc3d1a547b0e91c2fbfc6e31d9054a359
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          memory/372-299-0x000002848A320000-0x000002848A420000-memory.dmp
                                          Download

                                          memory/372-304-0x000002848AB20000-0x000002848AB40000-memory.dmp
                                          Download

                                          memory/372-325-0x000002848ACA0000-0x000002848ACC0000-memory.dmp
                                          Download

                                          memory/712-261-0x000001854A040000-0x000001854A042000-memory.dmp
                                          Download

                                          memory/712-259-0x000001854A470000-0x000001854A570000-memory.dmp
                                          Download

                                          memory/712-266-0x000001854A090000-0x000001854A092000-memory.dmp
                                          Download

                                          memory/712-264-0x000001854A070000-0x000001854A072000-memory.dmp
                                          Download

                                          memory/3192-253-0x000001B033DC0000-0x000001B033EC0000-memory.dmp
                                          Download

                                          memory/3640-225-0x000001DC17A30000-0x000001DC17A40000-memory.dmp
                                          Download

                                          memory/3640-208-0x000001DC17920000-0x000001DC17930000-memory.dmp
                                          Download

                                          memory/3640-243-0x000001DC14E50000-0x000001DC14E52000-memory.dmp
                                          Download

                                          memory/3640-286-0x000001DC14EA0000-0x000001DC14EA1000-memory.dmp
                                          Download

                                          memory/3640-283-0x000001DC14EE0000-0x000001DC14EE2000-memory.dmp
                                          Download

                                          memory/3640-290-0x000001DC14E40000-0x000001DC14E41000-memory.dmp
                                          Download