cf776bbf597fd168d07300d2d4cdee84cc8bc5eba243f839a855c413c9e4e30f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 897KB
Sample241008-q489gatbnd
SHA256 cf776bbf597fd168d07300d2d4cdee84cc8bc5eba243f839a855c413c9e4e30f
MD5 0df639c507d52170e5309d17c5d6b35c
SHA1 9844e4a886c79de8ff884d0056d37f3843c86214
SHA512 3965a1188cd22467e95ecb749bfda51e1c7f34b19d0abd03b30c03ed155565afd59d15b17f6daa96a916614b123c99cf787b4f16c3b766c91266e23bf3fd34d7
SSDEEP 12288:HqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga3TY:HqDEvCTbMWu7rQYlBQcBiT6rprG8ajY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2108	file.exe
2108	file.exe
2108	file.exe
2108	file.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3628	firefox.exe
Token: SeDebugPrivilege	3628	firefox.exe
Token: SeDebugPrivilege	3628	firefox.exe
Token: SeDebugPrivilege	3628	firefox.exe
Token: SeDebugPrivilege	3628	firefox.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2108	file.exe
2108	file.exe
2108	file.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
2108	file.exe
2108	file.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
2108	file.exe
2108	file.exe
2108	file.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
3628	firefox.exe
2108	file.exe
2108	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3628	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2264	2108	file.exe	84
PID 2108 wrote to memory of 2264	2108	file.exe	84
PID 2264 wrote to memory of 3628	2264	firefox.exe	85
PID 2264 wrote to memory of 3628	2264	firefox.exe	85
PID 2264 wrote to memory of 3628	2264	firefox.exe	85
PID 2264 wrote to memory of 3628	2264	firefox.exe	85
PID 2264 wrote to memory of 3628	2264	firefox.exe	85
PID 2264 wrote to memory of 3628	2264	firefox.exe	85
PID 2264 wrote to memory of 3628	2264	firefox.exe	85
PID 2264 wrote to memory of 3628	2264	firefox.exe	85
PID 2264 wrote to memory of 3628	2264	firefox.exe	85
PID 2264 wrote to memory of 3628	2264	firefox.exe	85
PID 2264 wrote to memory of 3628	2264	firefox.exe	85
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 116	3628	firefox.exe	86
PID 3628 wrote to memory of 2468	3628	firefox.exe	88
PID 3628 wrote to memory of 2468	3628	firefox.exe	88
PID 3628 wrote to memory of 2468	3628	firefox.exe	88
PID 3628 wrote to memory of 2468	3628	firefox.exe	88
PID 3628 wrote to memory of 2468	3628	firefox.exe	88
PID 3628 wrote to memory of 2468	3628	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3628
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b31a6630-ba04-4d7b-9a3d-0c266a7559ee} 3628 "\\.\pipe\gecko-crash-server-pipe.3628" gpu
      4⤵
      PID:116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {365ce26f-d458-4ac8-ad21-c2d16a072c39} 3628 "\\.\pipe\gecko-crash-server-pipe.3628" socket
      4⤵
      PID:2468
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3064 -childID 1 -isForBrowser -prefsHandle 3068 -prefMapHandle 3080 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe60a1b0-6ae9-4ec7-8c86-c2d5fd1be422} 3628 "\\.\pipe\gecko-crash-server-pipe.3628" tab
      4⤵
      PID:2296
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3844 -childID 2 -isForBrowser -prefsHandle 3828 -prefMapHandle 3824 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cfbb1dc-5b68-4221-a8cb-dd69abd535e0} 3628 "\\.\pipe\gecko-crash-server-pipe.3628" tab
      4⤵
      PID:4064
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4708 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4656 -prefMapHandle 4700 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f09e98e-267b-44ed-8e96-718967b099b3} 3628 "\\.\pipe\gecko-crash-server-pipe.3628" utility
      4⤵
      Checks processor information in registry
      PID:4408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5372 -childID 3 -isForBrowser -prefsHandle 5300 -prefMapHandle 5196 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79060b57-8cd3-45a4-b39d-7bb878f074ba} 3628 "\\.\pipe\gecko-crash-server-pipe.3628" tab
      4⤵
      PID:752
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 4 -isForBrowser -prefsHandle 5596 -prefMapHandle 5592 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fdd50be-41f5-4fed-b51f-23e3ac48fc68} 3628 "\\.\pipe\gecko-crash-server-pipe.3628" tab
      4⤵
      PID:5100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5728 -childID 5 -isForBrowser -prefsHandle 5808 -prefMapHandle 5804 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc6b5a58-b807-4e69-a03a-b58b03f8e7ca} 3628 "\\.\pipe\gecko-crash-server-pipe.3628" tab
      4⤵
      PID:4008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json.tmp
Size 19KB
SHA256 c6d5205b41daf197ce09f9b7dc4936683f8b1727a0c47a6d7658cb40d5f794ae
MD5 705bfc8597c0a4ab20bc0e075ec4671e
SHA1 2206d39cfec7cf42c38615ca94b73f56a05881ec
SHA512 8cfa09d1fe5de421bcbfc44d4a8f0600be3de7e4933e60d1eb6b842418f8faaa285e37f318626a73de9e7d75b1aedb1428fcf385758c2f1bd83c757e9460051f
SSDEEP 192:zquFe8r698cnzFRHw19WYraa3fRxkBi7qgOa9jf2BKFIowv+yrTP1ItbbvUwHqAp:XjcnHWgY1RY0tOB0WGkh2feji9ytyaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 d9f032744082ea43eb5ca6afb26738fbe81dc505f4db911ae06e94f98eae44e2
MD5 870d5587a4fc69bba07f941d395c7c88
SHA1 13498ac06dbcae0be1c6cf827f9ce93649779bfa
SHA512 1c76b20d8d555d3331bffc9ac8889236f8f5683ed9b9bae3f1e1b8644eb09f532ea4d57048f0628ee09deb7abd799911d59a6f47caeea18a0bb5f7dfdb9fe136
SSDEEP 384:H7C9Du9fiGLm4pU5pHLFoCr/E8HPJyD3VonFcP+AWRMACPFUqFn:bbBi8mCU5pHLGCr/E8Rg3V/+hRMF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Size 8KB
SHA256 63b63024dd26ffb2a2a6053133c47bb6131e7f3bd9ffbc4d7f0cbb074562bdad
MD5 415115e15d62d5e54b8766d1a2269d3b
SHA1 2421e8b75cd5fbd6370a0d8fcb1006a0a89cfb58
SHA512 fcc0fa5062350e3d495f30e99b1fdacffe401ccc65b54012713a096b6787bf9ad1ec72dd421a7d072404ad60ba63f0d937e89ba2bf1c5bbb441b03f669f34497
SSDEEP 24:5uB1ozzFsh2F3LF+0gu1xgRb5opR5cOBuhMZtsJblLKtibusJbF0Jtib:vK05oto9cOhebVKkbuebOJkb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Size 10KB
SHA256 a6f0617379617e8edd9bdc267b9dd8d54faffee7255b538cab9ee6296b21354e
MD5 c1ca6d7216ee3641591d1aee63852f47
SHA1 c1f072359e0176021009c99e4dfb81eae9762d12
SHA512 bfa294dd811bd61a516960598ddb605e0e0d6107d4f00c09d97fabf4009f7529e2ebcf89bcb38b237db2cd3e1bb14198cbe0cbe49213317fd7b5d3e0da36a4ad
SSDEEP 48:vW05oto9cOBebVKkbuebOJkbspebvpf+Yb:e05ooebVKkbuebOJkbspebvpf+Yb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 30bc10296ee5d0fac9f20d5dd5f40ae7b52037669f3c240cf4c27918d2ba336e
MD5 b6480a232ead65cdcba01422d761934a
SHA1 e549ec4aacbed045089e475c1cd6c98251074a32
SHA512 26e2919a1f2603cbf05ad890569fc4cc0ec8072abc6065014a9010d29e7513ac073d343dca3feaf400c80a6d055ddc5660cef9310a2057b5167482b6c2428654
SSDEEP 384:M/66JozGzgC1blmhOulbOD5G2Obkb9eXboy5fPd:JEShlKD5G2ObkbsrnV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 ec3163658b180f70e8df1a41e67574ffb7bea3ec286e390eb1538eed60f137a9
MD5 b4588a95fd8972d3e2f5766061472687
SHA1 c0bf76a4c383a0840d973e74d23b359b0fb02211
SHA512 e786fce7271c1fdd5f3141adfc49173db1ca38adc7c9a93bcbdf3e75d83460a064c7418432823e31b5f1405fa117ad70cac2aab85744b3e30241522bfcc626ec
SSDEEP 384:nmhOulbOD5G2Obkb9et/66JozGzgC1bMboyffPd:mhlKD5G2ObkbsgE6pV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 0765c50d1242bca71d977dd94deb5a108b37ca1c1fc45c6e5552e980ea2323b0
MD5 837e3d1ccc64789668c72c202c0586cc
SHA1 585ee9ed728c675e9a00dc87bf2c4c6c0e192f45
SHA512 5a746dd2c0b65ab4d3cf22bb36b1fa608b6fff8f04cd8c5c16db7f011af0179d6265749762362b58d5aa458156f341136916499c5cc979dfc395e99c6f691b8a
SSDEEP 96:nNQ0EGF+XFl66JozGzgClKtmSSASMF9ZbkW6ShmVnPP/PrWI:2bX/66JozGzgCl6mSSArvZboShcPPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

508941af-e02f-44df-a8b7-78f5026ffcb6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\508941af-e02f-44df-a8b7-78f5026ffcb6
Size 982B
SHA256 4dacc1bf49d68d5764f547ef2385df7bd3454cd28354af042b43f6cabc8f0020
MD5 878faf46d91001238f682eaaa9039c8c
SHA1 2174a8ac83a759dc368b0b53d6ca4231f7f7a070
SHA512 15c7f961896c3efd78ac3a4a0433704f69a08e0e083301afe0c8993e1d6dfe7c9c3ff7f685781e939a57c017891236d6eba303ffbcdbc97b58d7f851e775a940
MD5 SHA1 SHA512

Submit Download

6d896745-2816-4d87-bcf3-e44f69bff392

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\6d896745-2816-4d87-bcf3-e44f69bff392
Size 671B
SHA256 aaf46b7f6dbd61cb807c36827293442b7f940c9eb92ab8ff15473e30c1622826
MD5 7a49aa936c5a39a381ffd158037c5244
SHA1 df711f8b7760259f6fc9e6c56230fbf1a34f8856
SHA512 5425680f18084a082b8a99adfd4eb72c274109be4058c459eebdb21fa195d44230585a2625be00ea37ac71436a54e1571706e8d728330dad1d5d422651f875cd
MD5 SHA1 SHA512

Submit Download

9e83c70c-0b7c-4a26-acd7-6091a182c5b1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\9e83c70c-0b7c-4a26-acd7-6091a182c5b1
Size 25KB
SHA256 f8bc95aa39c5c910c8bc3dbeaec770b208185ffe5b30434dd617b3dfa6634c8d
MD5 f2794d2f1bb9733a18227e295e334e86
SHA1 489d0dd78d7e128364e1eb16467d2d822e737923
SHA512 dca60a3bdd722c7abe83fd5d13832f4e85a254e99bd9601343a922ea2a81b34660f0fb4d8320dea73adb6497504e8a26fad63f5befdcd0f794d6b3e8b5093f98
SSDEEP 384:eD3ruRRbHi768zc7aUlKO0FBUUhPtCqHE:Y3rEm+Uhkqk
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
Size 13KB
SHA256 1d4fede850d6489c1109e2c011b43206235ec79bf469498c5ddb204fcce472d8
MD5 ee48deebde59dd0bc0762ecd26282830
SHA1 cb5c5efd93c3dc8889648da0333819b9956674ff
SHA512 e1802e9f3699d20525f48a2b87384e351592e07909c9e13a430f564a884a44fa3eb6276d42d9535fb678fecc850463433ecec312e0c0ee98e36681134416d508
SSDEEP 384:GvYg61jVdo1y1Zzo4DvakMa9bw8GH7/g4SO3HyY3:Hbo12B+
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
Size 16KB
SHA256 6b3e075e60eec166d39ca5d8d79b1a8dad8a99df8d6a782e9319f7ebd85f2094
MD5 71b81b810a1b6f6f143509908637aae4
SHA1 fb0cc828fde148d06092d6ac040238bac0c2fe10
SHA512 7fc19ee113d121a4ee570de617a150f19d10b2e798a7ff0ce5b98a42e4ec19e815e4cf0bb10cd93e60a846f9511e723198a312a94e113c05a3aec511604a6af0
SSDEEP 384:GkB8ZVV8pXg61jVdo1y1ZzoFDvakManvN0wlfGQj2H7/LVg49waSO3H+xjoGuIWZ:Bbo12qW
MD5 SHA1 SHA512 SSDEEP

Submit Download