a87c0f18e15e7b1a8b13354f2107c3d6b1e60da88a5bb196319fa2d7087619bd

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 897KB
Sample241009-e7nw6a1hkc
SHA256 a87c0f18e15e7b1a8b13354f2107c3d6b1e60da88a5bb196319fa2d7087619bd
MD5 787198c3296e8495382a16e38dcd2cc9
SHA1 64647dcf4d7df0ca054e72a6eba2d62bd5be9d3c
SHA512 df760d7ee602b2cf03d7055812dda63625939bd5803cd7c14d90872d1eb4d3208343c323409c47154308cc4824b295ecdb2bc095b77efee5ff5e15e1bfe28efb
SSDEEP 12288:/qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaxTk:/qDEvCTbMWu7rQYlBQcBiT6rprG8aFk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4976	taskkill.exe
3260	taskkill.exe
5048	taskkill.exe
2980	taskkill.exe
3596	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2472	file.exe
2472	file.exe
2472	file.exe
2472	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	taskkill.exe
Token: SeDebugPrivilege	5048	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	3596	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe
Token: SeDebugPrivilege	1452	firefox.exe
Token: SeDebugPrivilege	1452	firefox.exe
Token: SeDebugPrivilege	1452	firefox.exe
Token: SeDebugPrivilege	1452	firefox.exe
Token: SeDebugPrivilege	1452	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
2472	file.exe
2472	file.exe
2472	file.exe
2472	file.exe
2472	file.exe
2472	file.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
2472	file.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
2472	file.exe
2472	file.exe
2472	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2472	file.exe
2472	file.exe
2472	file.exe
2472	file.exe
2472	file.exe
2472	file.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
2472	file.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
2472	file.exe
2472	file.exe
2472	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1452	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 3260	2472	file.exe	84
PID 2472 wrote to memory of 3260	2472	file.exe	84
PID 2472 wrote to memory of 3260	2472	file.exe	84
PID 2472 wrote to memory of 5048	2472	file.exe	89
PID 2472 wrote to memory of 5048	2472	file.exe	89
PID 2472 wrote to memory of 5048	2472	file.exe	89
PID 2472 wrote to memory of 2980	2472	file.exe	91
PID 2472 wrote to memory of 2980	2472	file.exe	91
PID 2472 wrote to memory of 2980	2472	file.exe	91
PID 2472 wrote to memory of 3596	2472	file.exe	93
PID 2472 wrote to memory of 3596	2472	file.exe	93
PID 2472 wrote to memory of 3596	2472	file.exe	93
PID 2472 wrote to memory of 4976	2472	file.exe	95
PID 2472 wrote to memory of 4976	2472	file.exe	95
PID 2472 wrote to memory of 4976	2472	file.exe	95
PID 2472 wrote to memory of 4624	2472	file.exe	97
PID 2472 wrote to memory of 4624	2472	file.exe	97
PID 4624 wrote to memory of 1452	4624	firefox.exe	98
PID 4624 wrote to memory of 1452	4624	firefox.exe	98
PID 4624 wrote to memory of 1452	4624	firefox.exe	98
PID 4624 wrote to memory of 1452	4624	firefox.exe	98
PID 4624 wrote to memory of 1452	4624	firefox.exe	98
PID 4624 wrote to memory of 1452	4624	firefox.exe	98
PID 4624 wrote to memory of 1452	4624	firefox.exe	98
PID 4624 wrote to memory of 1452	4624	firefox.exe	98
PID 4624 wrote to memory of 1452	4624	firefox.exe	98
PID 4624 wrote to memory of 1452	4624	firefox.exe	98
PID 4624 wrote to memory of 1452	4624	firefox.exe	98
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99
PID 1452 wrote to memory of 4568	1452	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3260
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5048
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4976
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc16986f-4957-41c7-9abc-5eb9f92cc2c5} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" gpu
      4⤵
      PID:4568
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9a35402-5775-4287-95a2-9050449596cc} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" socket
      4⤵
      PID:732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3336 -childID 1 -isForBrowser -prefsHandle 3328 -prefMapHandle 3324 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71f15120-002f-40c5-adfe-fc35221d4fbd} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" tab
      4⤵
      PID:2924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4072 -childID 2 -isForBrowser -prefsHandle 4056 -prefMapHandle 4064 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f55556aa-3e9f-4642-8b11-0ed073a790b5} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" tab
      4⤵
      PID:4260
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4788 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4780 -prefMapHandle 4776 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12c189b5-52df-4df0-8f19-718b27a201fa} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" utility
      4⤵
      Checks processor information in registry
      PID:3860
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5276 -childID 3 -isForBrowser -prefsHandle 5360 -prefMapHandle 5284 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9966d484-9fbd-4450-a23c-8cc8faf6eb87} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" tab
      4⤵
      PID:3596
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5480 -childID 4 -isForBrowser -prefsHandle 5488 -prefMapHandle 5268 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90858ef0-47c9-4c93-b88e-533992842b4b} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" tab
      4⤵
      PID:2968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 5 -isForBrowser -prefsHandle 5748 -prefMapHandle 5744 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63372219-272e-4257-ae08-b2d31469da52} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" tab
      4⤵
      PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json.tmp
Size 19KB
SHA256 e03789c857c7b9bad52b190bed239760008099db6b462177a02192099f1a4344
MD5 e1af8a1769f2d516e4940b2609965384
SHA1 92207a40afd02135f7e0a9d05580a2f17780e506
SHA512 d5a2a5497007df3a87b3058fa615b41041a2046afb66c0f8210a76392717dd53b062136a82c77e910f3cbfd8662ca0602128733a8d063fd8fef1992288b00a37
SSDEEP 384:KfdYYntW7UMe0X5eGe0ANiLpUVRvB6tgyaE:KfiYnt/Me0dUVRJ6tgyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 05747987ba8af8cd6e3f84dcf6ad088cd9e274a8297fb23f3fc6a8574805c3ee
MD5 d3440bc125c54279f3140cbcf63eb05a
SHA1 64ac8b54bb3ab5e32aa48547c46d048dae0707cb
SHA512 48a9eb11d961f3285875ab77cd58846e63906f218060dfa8f6b72b9ce0169259efb30d8d2151315c2b02d45c7bc7c106cc648996e1ac33b8f05725e0a4c996e9
SSDEEP 384:H7C9Du9fiGLm4pUspHLFoCr/E8HPJyD3VonFcP+AWRMACPFkFn:bbBi8mCUspHLGCr/E8Rg3V/+hRMFg
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Size 11KB
SHA256 0b7c5f97cb9e756d4c88b607f35210b3caf1e3ac8cf9a032009300b96c60bdf3
MD5 caf3bded057629c25f5fd3e828007cfb
SHA1 9747365e8b6c89d5dc6e6e735e01a9562960b584
SHA512 31d75615f05fd1fa18c3656c7e111ec603501165d537af9d5cfbdcb49069686e956d4a6a0e6970194182774293c50586ce9547d2a916c7e457b4178e82b8bae2
SSDEEP 96:O+5o9rqebVKzQbGebOJzQbfpebvpf+QLQbQbrLQb:75lv6ufX
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Size 18KB
SHA256 175e5b1ac8eee932463deba59297db3c5770a1b5160bf6ba2730bf414605cec1
MD5 3eab2e7c6b93ef0ee44a0b5ee86aa774
SHA1 d50420ce78b32fc0269b4056bdc8a959e0d84f3f
SHA512 c6e2e83332069c68ed2bbd99f4d10e194e4128d895fda6711b3b5ae16be89b94af11a787fa5ee6ad60a5ebdf4a26b6da25538601bc3785d23386d4fba3e9740f
SSDEEP 96:q+5o9rqebVKzQbGebOJzQbfpebvpf+aQbXb/kQbZgbgzeLQb/bzkQbvbbkQbSLD:/5lvGuTPfLLtL9
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4fa3980c7f3d3f55e1d29daaf95bd33f670bbc9d82c1fb86bb4f04f2cad453c9
MD5 fc566350ccd976e67dc95b265768b0dd
SHA1 0f06ba381a894a4be645831c3902a4831f8255f7
SHA512 c1dbc67e2e67cc0ce492db252821d577c0c8ff8315550f8ea671b3cf42ed7dddaf0e9b1d8a34ddff5cb292834ee548615630915ce6edf204aeecff81e883888a
SSDEEP 96:cNQ4qtofFl66JozGzgClKtmSSS1B3SMF9ZbkW6rBBMhmyGPP/PhxBWP:y/66JozGzgCl6mSServZboPMhXoPDgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 6258734f638ce032213b025a2a74998355d23bb43bc936c6da5e44d432335366
MD5 62715fc1e5d6aa15cadadd86c940f191
SHA1 1ce7e4219e5591b0274907892436030798e2e518
SHA512 f9471c582c632a622b49e1087dbaf75bd9621fa48542c557f0cda719c28de067c0f5cad4f309b88b7fbc9d54e37bcf35f474d0f70843bfaee871767d2baeb9aa
SSDEEP 384:n/66JozGzgC1blMx0KjC4yDinZ3bEbXxboEpwP/:iEQxzCdDinZ3bEbXBGX
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 fc012b5c72517373f85f1df1c07b944153dffcf483c92fd342658d4feacbb10d
MD5 8936cb9f4108dab3b22d453cbfcc917c
SHA1 5e1ea78ac05598e1d324ec7a9df9d59b75ba3eb1
SHA512 0376383ead9a8eed80541f5c126e6d44b15cca608be84306efdb9439e2bc9ec6080fc3e1161cb769dd12d75cf194cb2f7998e745107605d7ef575b96b9760305
SSDEEP 384:dboGwP6/66JozGzgC1blMx0KjC4yDinZ3bEbXL:de/EQxzCdDinZ3bEbXL
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 0b6501c0cf8432a54358e5b08fe88295ce8d683d38698af364c205d8e9d88081
MD5 ea27adf5832ace726193302974d30b93
SHA1 07d0d061cf2c0d7ffbf2f7614f04df9bbfd90587
SHA512 7e1f3b17ce940bae2157429c5998244d14eda80f5d25ca307c31ed46398dc5ecce4c9684be0a80f05ad62c40bfe725896569be99ff022e8c8ee922dcbaa2ecc2
SSDEEP 96:nNQ4qtofFl66JozGzgClKtmSS9SMF9ZbkW6ShmyGPP/PhxBW:n/66JozGzgCl6mSS9rvZboShXoPDg
MD5 SHA1 SHA512 SSDEEP

Submit Download

0a8de5b7-4c22-40a4-8316-03a95b5a72b2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\0a8de5b7-4c22-40a4-8316-03a95b5a72b2
Size 982B
SHA256 7f634b36f82d44121c205ff9477368e5887f2e35d1d0f5c955f05f6053fc6c28
MD5 718ef4ee61a7b3a709f14981244c582d
SHA1 1119bf0a0454a4e971b13f8db441bc2c3e8b1983
SHA512 504e0e3ec998143d800c736dc2acda54591f4aefa8053813656e3803f609295909569aec2e94b962c3b808d85e6565e4dd8ab89659f898c2212154c6347edb92
MD5 SHA1 SHA512

Submit Download

8bccc1ea-32b3-4498-9436-16c3b6afbca6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\8bccc1ea-32b3-4498-9436-16c3b6afbca6
Size 671B
SHA256 0661b3fc88e61fdb035086d1ea6d43f63eafaeca2ff602ce3223150b03e7dd99
MD5 028bbbc2dd0374e444d65ef7a0bcc17d
SHA1 be18253cbb1fbb3ab4addd613274ccd489f6182b
SHA512 0982c0517bca66834b8f81de484858b6beefea501382b3667079e4bae36ef2fb090a20607e71c9da959cf267d9e9027483e7ca8ab07ed8c37ece6bde8d4f4500
MD5 SHA1 SHA512

Submit Download

d4585549-62d3-42be-8527-dc1cc965f323

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\d4585549-62d3-42be-8527-dc1cc965f323
Size 23KB
SHA256 ddf6ffc41091cbdc877f2d10cc9957b7aeda27cd2ecac6f63fb199a6878d6d0d
MD5 3bc1187eeaafca939b2d925290ed3741
SHA1 be47218618e1109f4d8d2b4983640a861219aee8
SHA512 2e8135c883ece8f674dad48369f6cbc47ee05a002892028c76d4433bd660ea7df1ff034234e23881306cd1e8e508ec53acc1d5ebd87567f316bd96a32a4d810a
SSDEEP 192:QKrsTMJr3n6laD7IJtcyDBlzezx7FLSjHMulZExvYvseoYdlTMpb4b6VVcI7QHCo:Q9+Ycozel75SLzlOqAoj1tbC2
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
Size 12KB
SHA256 cc90e2568abb87d23bdc86a79f53044fe3da7a2a58ceba7074732cedea346930
MD5 5c76d3fa57ca155e1b56898e574f9ccc
SHA1 0efb2aca9b3b587fde94a36cf3c6ef8e1dbcf5a1
SHA512 b6a51fb22d7b3d9b3ac55561da6f4bf2aeb6c1f7b508bb888193da40e5193dd56f1b5fad222c2706b836481171417c9ab477d5c7d40464149fd0a02945395e1a
SSDEEP 192:GB5nSRKfE6I3Xdxndd3SW+aIbMTtI7VUtSVDi4aXcKDvbcBw8Huqv:GvUndxvSW+HBgSV7KDv+wda
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
Size 15KB
SHA256 0fbfac62f50e8c3b60f786d54d3cb512d3b0166dab41925ccda3df7fd3c1ded9
MD5 4cc5c82f2dec1e6b083d005dd210f7e6
SHA1 adb581f0f6ece7f4e74188112d9d100840990a33
SHA512 edad014d199a06eca8cf84c97af5ed7bcf708739d0523bda959d7d88bcac50dd6a6e0e3f2ff969be1537bfdd2ed4929da46e0421d726adf4205714354d345cfe
SSDEEP 192:GBinSRKfJ6I3Xdxndd3SW+aIbMTtI7VUtSVDi4aXc2+DvbaiBw8Hu5BN6JZ:GqDndxvSW+HBgSV7XDvNwdrA
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js
Size 10KB
SHA256 3419cd49e0b3a03c21ceb52a3ef269c4fe491a9dadf0ff7a3820308c9da4e841
MD5 21c2c28db7acfb44b8049b796a924542
SHA1 db00331e7c38bc75033f571858446d81ca42c274
SHA512 05ba22ad435537372c69f86cb37bad9a42d48b4ae70b752bc366b872baa0909409419b950cbd247d411aeda5160ba37c825ddbfc6ff2c7e970e02f53160547e0
SSDEEP 192:RB5nSRKfElLPts/uI4gYcU8BtD8JJCddLMy1Zzw3WaXqDvbrBw8V6:RvisWuYgUJJ6My1ZzRDvJwV
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.1MB
SHA256 ba2e26944db9cf6f8988684f4157df1ef19ac6aa5c7432b0c7e784e74952fca5
MD5 335c3ad0e9a0f653aaac4a3fbda65b52
SHA1 fc82e8ece29d4bbdb3dbe60bd827d4c28b4184bf
SHA512 ec5c5886ccd122912da87a56a77c097d4761e9c154f7f061792e48fefd4118b5e607c50bc6973514d31bd4b8a4b208872d5a447567f5225aaea989193e540ba8
SSDEEP 6144:r7rSs35333z3m3j3BTH9A4wJFNZTTpqVUxar0UVbf3BgErZmz0Pu/elGtUYeHN1Y:SA4wJFN9w+YVbfSEFU8qHm
MD5 SHA1 SHA512 SSDEEP

Submit Download