c0ed8bdc7fcd7ded18863e44ec4ae44e806d54622bb693c6e820e75a2b34154b

Analysis

max time kernel
19s
max time network
152s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
745bfa44e72a8002c6adf26d9575c6bf.exe
Size 89KB
Sample240713-cdtt7stalf
SHA256 c0ed8bdc7fcd7ded18863e44ec4ae44e806d54622bb693c6e820e75a2b34154b
MD5 745bfa44e72a8002c6adf26d9575c6bf
SHA1 526a54c027bc7628435209c823b81f93bbefd961
SHA512 d70ca3065bbfb620dfe39ec268f694681a24ed4a204fd866ca4bf5fd54da4a0809ea2c6b2093242e915e3f17537190bb5b3ce8f0fe70b0155383d9db51543c2c
SSDEEP 1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfGxMeQgT3Oq:Hq6+ouCpk2mpcWJ0r+QNTBfGDT1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2436	chrome.exe
2436	chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeDebugPrivilege	3032	firefox.exe
Token: SeDebugPrivilege	3032	firefox.exe
Token: SeDebugPrivilege	3032	firefox.exe
Token: SeDebugPrivilege	3032	firefox.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe
Token: SeShutdownPrivilege	2436	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
3032	firefox.exe
3032	firefox.exe
3032	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2968	2376	745bfa44e72a8002c6adf26d9575c6bf.exe	30
PID 2376 wrote to memory of 2968	2376	745bfa44e72a8002c6adf26d9575c6bf.exe	30
PID 2376 wrote to memory of 2968	2376	745bfa44e72a8002c6adf26d9575c6bf.exe	30
PID 2376 wrote to memory of 2968	2376	745bfa44e72a8002c6adf26d9575c6bf.exe	30
PID 2968 wrote to memory of 2436	2968	cmd.exe	32
PID 2968 wrote to memory of 2436	2968	cmd.exe	32
PID 2968 wrote to memory of 2436	2968	cmd.exe	32
PID 2968 wrote to memory of 2264	2968	cmd.exe	33
PID 2968 wrote to memory of 2264	2968	cmd.exe	33
PID 2968 wrote to memory of 2264	2968	cmd.exe	33
PID 2264 wrote to memory of 3032	2264	firefox.exe	34
PID 2264 wrote to memory of 3032	2264	firefox.exe	34
PID 2264 wrote to memory of 3032	2264	firefox.exe	34
PID 2264 wrote to memory of 3032	2264	firefox.exe	34
PID 2264 wrote to memory of 3032	2264	firefox.exe	34
PID 2264 wrote to memory of 3032	2264	firefox.exe	34
PID 2264 wrote to memory of 3032	2264	firefox.exe	34
PID 2264 wrote to memory of 3032	2264	firefox.exe	34
PID 2264 wrote to memory of 3032	2264	firefox.exe	34
PID 2264 wrote to memory of 3032	2264	firefox.exe	34
PID 2264 wrote to memory of 3032	2264	firefox.exe	34
PID 2264 wrote to memory of 3032	2264	firefox.exe	34
PID 2436 wrote to memory of 2776	2436	chrome.exe	35
PID 2436 wrote to memory of 2776	2436	chrome.exe	35
PID 2436 wrote to memory of 2776	2436	chrome.exe	35
PID 3032 wrote to memory of 2548	3032	firefox.exe	36
PID 3032 wrote to memory of 2548	3032	firefox.exe	36
PID 3032 wrote to memory of 2548	3032	firefox.exe	36
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37
PID 3032 wrote to memory of 2328	3032	firefox.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\745bfa44e72a8002c6adf26d9575c6bf.exe
"C:\Users\Admin\AppData\Local\Temp\745bfa44e72a8002c6adf26d9575c6bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1FEF.tmp\1FF0.tmp\1FF1.bat C:\Users\Admin\AppData\Local\Temp\745bfa44e72a8002c6adf26d9575c6bf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef75e9758,0x7fef75e9768,0x7fef75e9778
      4⤵
      PID:2776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1844,i,2712384261955539994,3272196146589237581,131072 /prefetch:2
      4⤵
      PID:2912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1388 --field-trial-handle=1844,i,2712384261955539994,3272196146589237581,131072 /prefetch:8
      4⤵
      PID:2304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1492 --field-trial-handle=1844,i,2712384261955539994,3272196146589237581,131072 /prefetch:8
      4⤵
      PID:996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2300 --field-trial-handle=1844,i,2712384261955539994,3272196146589237581,131072 /prefetch:1
      4⤵
      PID:2076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1844,i,2712384261955539994,3272196146589237581,131072 /prefetch:1
      4⤵
      PID:2012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3040 --field-trial-handle=1844,i,2712384261955539994,3272196146589237581,131072 /prefetch:1
      4⤵
      PID:2740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2068 --field-trial-handle=1844,i,2712384261955539994,3272196146589237581,131072 /prefetch:2
      4⤵
      PID:1776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3032.0.1737217708\540437947" -parentBuildID 20221007134813 -prefsHandle 1244 -prefMapHandle 1232 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5c6e2ce-06dc-404f-9f73-5a4e9bc44c74} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" 1320 4108d58 gpu
        5⤵
        
        PID:2548
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3032.1.975800425\39545844" -parentBuildID 20221007134813 -prefsHandle 1524 -prefMapHandle 1520 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {584e8a69-9d35-4106-ba1f-4bdf79532fec} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" 1536 41d0158 socket
        5⤵
        
        PID:2328
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3032.2.272481959\728196862" -childID 1 -isForBrowser -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 760 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98129045-c0f5-45b7-bf13-693172ac2e96} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" 2132 d64758 tab
        5⤵
        
        PID:1472
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3032.3.1848445855\639785174" -childID 2 -isForBrowser -prefsHandle 2740 -prefMapHandle 2736 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 760 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3acb1e7-e1e4-4d69-8c90-fc51d6f7d253} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" 2752 1c4e9858 tab
        5⤵
        
        PID:892
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3032.4.1992014373\275600098" -childID 3 -isForBrowser -prefsHandle 3968 -prefMapHandle 3960 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 760 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1e915b7-bb6a-4073-9d43-3a1791b5884b} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" 3952 1f97ab58 tab
        5⤵
        
        PID:3248
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3032.5.373442981\466534822" -childID 4 -isForBrowser -prefsHandle 4068 -prefMapHandle 4072 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 760 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc385933-5d0b-4a19-a4fc-06d1b4124139} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" 4056 1fe71258 tab
        5⤵
        
        PID:3256
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3032.6.1500688850\411540087" -childID 5 -isForBrowser -prefsHandle 4236 -prefMapHandle 4240 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 760 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8d1490b-8425-4e1c-80ca-392a65cbf040} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" 4224 1fe72158 tab
        5⤵
        
        PID:3264

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2003a58cdf85244a869a69bf9681d7e28a1c1c2279f357678387d0b537112c8c
MD5 0f00b99c9322cdc4af0cc9ba70394447
SHA1 fba1a13c0477699019ad20f795d2992599aff23f
SHA512 b16ecc6958503fa347b26130fab4b77846193d46e2581ef2dc2fcf7237b61a7bd7ac267c7203f40360e59bf7ea2792ca133dff13080c69e526e48f74239fc8a7
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 d7e4f180cd13959ab6456c99887d44d451a74d2a27b33fcd72b99749a3a643ee
MD5 30b6e785a9ce8f13ca8b2a848207930a
SHA1 e9b32bb3c8a0f5da105c9edf5cf1b98c1cfb59cd
SHA512 285133b4f4e61454ea974803d93c7b31f1525c1c52a9f7461905a7f5b5c15c87bfb42ae7bbcb536475c81eef3b2c062b27d413cfdfb693486db7c7c3b6df28a9
SSDEEP 96:KwO6wIKI18d8iZeiGoT+y7Di+6MsmdeXvkL1EO9yfjV39:K3IG88Gi+yy+FykLyb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 4c588bdac522a83a56c77cf4294240ef58fe8b5dc82a5715f9170ea75bde21c2
MD5 afe142d67e30adfe1c717ec68a737e42
SHA1 b128b840304fcc670323a596ef875e4ac574f773
SHA512 888cfc15f22573963f8a881663b1d0039bbae35687f0fc808a1a758b4d92ebea6c44e5c23fbeb70a1c861dc94f7818a50d9054a5549f2bc524f62781fd1b9d0e
SSDEEP 96:KwO6wIKI18d8iZeiGoT+y7Di+6MsmdeXvkL1YIO9yfjV39:K3IG88Gi+yy+FykLpb
MD5 SHA1 SHA512 SSDEEP

Submit Download

000007.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
Size 16B
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
MD5 SHA1 SHA512

Submit Download

1FF1.bat

Path C:\Users\Admin\AppData\Local\Temp\1FEF.tmp\1FF0.tmp\1FF1.bat
Size 2KB
SHA256 a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698
MD5 de9423d9c334ba3dba7dc874aa7dbc28
SHA1 bf38b137b8d780b3d6d62aee03c9d3f73770d638
SHA512 63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401
MD5 SHA1 SHA512

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\datareporting\glean\db\data.safe.bin
Size 9KB
SHA256 5c742300ca2fbc88dd0c4fb72a2668b7a9f61240e40372837d6381e97add7f80
MD5 b66877ecf3a8092ce072a3ec1d2aa7b0
SHA1 3fbb261dd40248348c415200e07fbe54775d34b7
SHA512 c6eca718bec7c424ca141a203780ac10e88959cea5c01a2de935f9ac1a21c970b8b3a6e9bcdd0d1c02df3c8b8bd2fb87570af4a941ab97bb73dc03ad2aa758b9
SSDEEP 192:A2vTbtHJ5oXLiH8jP4yvADK2pQCSEb4bVbyb/bjbib6jbBbSgfSkojfMdq3F:FbtHJT8jP4yvADK2pQCFb4bVbyb/bjbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

b6a774dd-d88b-46c5-b518-2d32b7837b6a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\datareporting\glean\pending_pings\b6a774dd-d88b-46c5-b518-2d32b7837b6a
Size 733B
SHA256 7ade67219562f54fd7efbf131b59c3d0e14bc82ee37b4860c5a5cbdce789dbd9
MD5 7f02c3bea6e605c7d2eec76dbb53e608
SHA1 2e0f57c52a48d21f9e9da1e3918f9320d3592954
SHA512 afe78023bb909e9adc7aa13b7fb948b60b468aea7be0c5580d4d84080680550f9c8c7e843ade3e70e766373225513adabc3c946526028fc4acac6ed8de9ad6f2
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\prefs-1.js
Size 7KB
SHA256 ec6c70e6b9b47c96be55464ca6d6b2ad94bf55a20746a5628c65d15ed6cd6980
MD5 553623e7ddfc5db696ed2a1d2e8d9e65
SHA1 4d5df3f91ac103457d49e0c3a9e13220d29e4bd2
SHA512 d8f7f382127baff7626ef65599943199305e64b648f2f3b7dc0ca6022a540ad9aae1006efa5ea1b055e914e4c51ff10623d867a3a61e68ae334d15a7df176fbb
SSDEEP 96:xH485nUTeqGq8CdwcSeOTzS7PXAnpjBHDZnpGizBw8H2D:95nIRDdwcSehPXI7GizBw8HQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\prefs-1.js
Size 7KB
SHA256 594e6493708606454ac97a4b0b14ccaaede6da7430e33a43d073f0850afeee5b
MD5 5eb6359179953311b6a3420968830049
SHA1 dd84674d88f1603a4d03506d9677cd1432b2b293
SHA512 40a3843cfe5f55833095e347c80ee81fff127e841cae4e2f797381325b75d6fb84264e6a4496c22a3013beed559d37cc932379a48649ecca6b0fdf624dbeb06d
SSDEEP 96:xH48snUTeqGq8CdwcSeOTzS7PXAnpjBHDZnpGiNRBw8H23y:9snIRDdwcSehPXI7GiNRBw8Hp
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\prefs.js
Size 6KB
SHA256 54ca1e8a71d72c7b64d6840cfdbf114e58f3235dcf7e5009db76a57ed5dffe29
MD5 c53790c34f6015c8a4910b373aaf2e42
SHA1 6586fc3df80de4ca1ffdc0292b2ec923a7f5115b
SHA512 30e0ba19b3667f543702cf50288b6933a2f3212246d9f2ba64cf4cee725c71ac78f4f70870eb71f55dddf6b0b6ac54907225c38995b1ad9d269104f87110f802
SSDEEP 96:xHY85nUTeqGq8CdwcSeOTzS7PXAnpjBHDZnpGiMBw8H2D:95nIRDdwcSehPXI7GiMBw8HQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\prefs.js
Size 6KB
SHA256 55c7d05ca98842b593b1b3cc4b418f34788e9e87d93017e0c04930530e2b1a00
MD5 5ea9e4f071b142daedefc93506539258
SHA1 6f1acd3abae4adefd0a56142da10da008e788f55
SHA512 03766ac409701315fc2a41124b2b66ce8b5425432fc53a393f7a20968b0ad0eeb173de7663715800db5df88f44e6480e6965e7480f2a367731015904b8fd182e
SSDEEP 96:xHY85nUTeqGq8CdwOReOTzSjPXAnpjlHDZnpGidBw8V2D:95nIRDdwOReJPXw7GidBw8VQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 300f5cfdd1641716554dc070f84145b13584fa96621e9146a0d508e0954287bc
MD5 b859f29a0f1d093647e566a782c942f2
SHA1 7d5712482a1cdb463aa55ba5b13ac766c50cc3ee
SHA512 bd846520a3a5b3778785f9e06c3d976400ce3c226d6d80971e98fcd361869c1fb1c7571446540bd5e8fa204017505d363f5f45c80568720d4599a3ff74e5f622
SSDEEP 96:6z2XYK0fInxRl+lEGJF7GtFM7k0zf8W8Qge3ZwS20X8vQL/R:WMYVczUCiFAFM7kcuemgXn9
MD5 SHA1 SHA512 SSDEEP

Submit Download