fd0244b173c7561ccd9356c1eefdacbecfaee8e44d8d11d3b82fe87eb36f7670

Analysis

max time kernel
125s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 08:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 897KB
Sample241009-j8egbsscmd
SHA256 fd0244b173c7561ccd9356c1eefdacbecfaee8e44d8d11d3b82fe87eb36f7670
MD5 9ecd2958d576d47aa4c7adff41395ebb
SHA1 64fe3fb44e05b641778e59dc97508693f2a9c02f
SHA512 e19c088199b781ed7a03dbd48369f3d337b5ac11d241c099376e30f23aeafe537d77158871710a2b7367b38d46004692d2ba54a628ec24b797cb830cadbe26d1
SSDEEP 12288:6qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaxTA:6qDEvCTbMWu7rQYlBQcBiT6rprG8aFA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4664	taskkill.exe
3044	taskkill.exe
4044	taskkill.exe
4756	taskkill.exe
3560	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3156	file.exe
3156	file.exe
3156	file.exe
3156	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4044	taskkill.exe
Token: SeDebugPrivilege	4756	taskkill.exe
Token: SeDebugPrivilege	3560	taskkill.exe
Token: SeDebugPrivilege	4664	taskkill.exe
Token: SeDebugPrivilege	3044	taskkill.exe
Token: SeDebugPrivilege	1908	firefox.exe
Token: SeDebugPrivilege	1908	firefox.exe
Token: SeDebugPrivilege	1908	firefox.exe
Token: SeDebugPrivilege	1908	firefox.exe
Token: SeDebugPrivilege	1908	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
3156	file.exe
3156	file.exe
3156	file.exe
3156	file.exe
3156	file.exe
3156	file.exe
3156	file.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
3156	file.exe
3156	file.exe
3156	file.exe
3156	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
3156	file.exe
3156	file.exe
3156	file.exe
3156	file.exe
3156	file.exe
3156	file.exe
3156	file.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
1908	firefox.exe
3156	file.exe
3156	file.exe
3156	file.exe
3156	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1908	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4044	3156	file.exe	85
PID 3156 wrote to memory of 4044	3156	file.exe	85
PID 3156 wrote to memory of 4044	3156	file.exe	85
PID 3156 wrote to memory of 4756	3156	file.exe	89
PID 3156 wrote to memory of 4756	3156	file.exe	89
PID 3156 wrote to memory of 4756	3156	file.exe	89
PID 3156 wrote to memory of 3560	3156	file.exe	91
PID 3156 wrote to memory of 3560	3156	file.exe	91
PID 3156 wrote to memory of 3560	3156	file.exe	91
PID 3156 wrote to memory of 4664	3156	file.exe	93
PID 3156 wrote to memory of 4664	3156	file.exe	93
PID 3156 wrote to memory of 4664	3156	file.exe	93
PID 3156 wrote to memory of 3044	3156	file.exe	95
PID 3156 wrote to memory of 3044	3156	file.exe	95
PID 3156 wrote to memory of 3044	3156	file.exe	95
PID 3156 wrote to memory of 4796	3156	file.exe	97
PID 3156 wrote to memory of 4796	3156	file.exe	97
PID 4796 wrote to memory of 1908	4796	firefox.exe	98
PID 4796 wrote to memory of 1908	4796	firefox.exe	98
PID 4796 wrote to memory of 1908	4796	firefox.exe	98
PID 4796 wrote to memory of 1908	4796	firefox.exe	98
PID 4796 wrote to memory of 1908	4796	firefox.exe	98
PID 4796 wrote to memory of 1908	4796	firefox.exe	98
PID 4796 wrote to memory of 1908	4796	firefox.exe	98
PID 4796 wrote to memory of 1908	4796	firefox.exe	98
PID 4796 wrote to memory of 1908	4796	firefox.exe	98
PID 4796 wrote to memory of 1908	4796	firefox.exe	98
PID 4796 wrote to memory of 1908	4796	firefox.exe	98
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99
PID 1908 wrote to memory of 2392	1908	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4044
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4756
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3560
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc80b44a-b875-4912-a88c-3bb7dabd6a4e} 1908 "\\.\pipe\gecko-crash-server-pipe.1908" gpu
      4⤵
      PID:2392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1aa338c9-66f0-441d-b5fc-8d189c3e8034} 1908 "\\.\pipe\gecko-crash-server-pipe.1908" socket
      4⤵
      PID:5004
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2760 -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 2956 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {414353cd-815d-43ad-b21e-16c7c9cf4f85} 1908 "\\.\pipe\gecko-crash-server-pipe.1908" tab
      4⤵
      PID:1488
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3992 -childID 2 -isForBrowser -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {168f7c64-42ad-4e0a-9bf3-7020a9fba67b} 1908 "\\.\pipe\gecko-crash-server-pipe.1908" tab
      4⤵
      PID:2244
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4772 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4764 -prefMapHandle 4744 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ed94b23-76ec-4674-8936-602025240a54} 1908 "\\.\pipe\gecko-crash-server-pipe.1908" utility
      4⤵
      Checks processor information in registry
      PID:4036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 3 -isForBrowser -prefsHandle 4680 -prefMapHandle 4764 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87d43c82-e9ad-40ac-8e9a-3a55c4041203} 1908 "\\.\pipe\gecko-crash-server-pipe.1908" tab
      4⤵
      PID:2452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5624 -childID 4 -isForBrowser -prefsHandle 5544 -prefMapHandle 5552 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f6e5220-b5e5-4062-a548-99c6a8854608} 1908 "\\.\pipe\gecko-crash-server-pipe.1908" tab
      4⤵
      PID:4564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5732 -childID 5 -isForBrowser -prefsHandle 5812 -prefMapHandle 5808 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58b26175-c510-40f8-9676-9c086f7aecb7} 1908 "\\.\pipe\gecko-crash-server-pipe.1908" tab
      4⤵
      PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json.tmp
Size 22KB
SHA256 2751497214c2e6f76cab4284f5529e41b9f9d1fabf6f9f69f2508dd7cffb9cd5
MD5 9e3de3e9a13e4e1e6f45586eef19646a
SHA1 a806eec755d7bda5cdfc267715bbd58395f7abf2
SHA512 86add6eb3ed5816dffd42465270bd84498fc579a89848dfe360cb6b8fec991c75c6d6a9995276a04dbe7e2ffc9a8d0c28aa60acca897100156dfffb23fb53108
SSDEEP 384:nmnLYGWbRe0Og0oD9G7TWWF9ZaoQ9yaujt1j1kG:nmnMGQeIa/v9ZJQ9ydnBkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 59234017ac29c8d7e9787c9e29cc7f8ca0ab1df97eb270111053a1c8fc133831
MD5 dac5f553980470957016861e1c3e68cd
SHA1 ad2d9185852ab610d17e667ec116ef6b879d26dc
SHA512 8c2b99381cd4512bfc1e7877510b540d32ebfb3779dc7e2adabe2482fa941e01e2970096d03be884278da318ff9b4bb55139a41c36e3f0d3f5fb00d06164bae0
SSDEEP 384:H7C9Du9fiGLm4pUFpHLFoCr/E8HPJyD3VonFcP+AWRMACPFJFR:bbBi8mCUFpHLGCr/E8Rg3V/+hRMFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

0EA2E1AC3653A248EDE38E975FF2A4ADDA308244

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\0EA2E1AC3653A248EDE38E975FF2A4ADDA308244
Size 480KB
SHA256 1e7076636475f7e51ad30efe5b836a14b2a16168aac588be93076029395cfce6
MD5 cef3184b395b196c44057d71a5b5a3ab
SHA1 42845e7ac210959f61a013ce6107fd2e3710ff28
SHA512 c53cefe38a1c6c9ef1702eae09e17a938cd67a8548f206617ddaa5c9257a59ea100d76ce1bc34b5fa273abd080aa20e78946b0d0c6380449b63484676ac669dd
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQl:fZrUPE5I1g9M6yyZ0AgYra4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-2

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-2
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Size 11KB
SHA256 f2e35b19c1a7cf67069bc5c0f849a5d6025e0d5bef385d6a6fb58f8fadddb75f
MD5 80710f360dec056c90cb5ba8971e235b
SHA1 af6614b1649a0e8ed29f661efb45502abc4e1587
SHA512 7761e9fc6aac2de544ff0f6dd5c9384ab635ffde649f08f95cc04c0663c1579842e6343dc289421b4ab5ebc2c9196e7c100e7d18e22c8e39b58c9d1af6c3f15c
SSDEEP 96:fnk5ooebVKmSxb9ebOJmSxbupebvpf+ExbPb9xb:M5U7nu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Size 18KB
SHA256 c2057de98413eef109e936ddc7cf894a059c7e4932943fa490b2e12841e4454c
MD5 b4e88adbf98797a6b16b9ac7b31c047a
SHA1 7438bd8c75cf2b47d42ae10fef0597abd1d5b103
SHA512 fd5f353eda4398a445c70e632512cdc1c038a04b271e839c1521c263dbe94c0d77416a6a1c10b371fbd0a2a37ee406f55d2bed074691aa056e129815d3089317
SSDEEP 96:Dk5oVmebVKmSxb9ebOJmSxb8pebvpf+T/SxbFbNMSxbZgbgzkSxbVb5MSxbcb5St:Y5Sl7tuq/bHHjB5B
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 0716bb64722ab0393d955a90a025c879768961da77c2ac86a8b9abac6b75206f
MD5 acc212d75878d96ca4c0a32ac7c2d775
SHA1 c97eb5b76ad8aa3a42fca522ed9899796c088b0c
SHA512 9f58be3f890dc158b1a44fe2a996068033f403cb70850635d02022ab0e18a1c4913693d81bf6b1dc44843f4d64ef53eee4590e5e7879f999e4d83f8da0cebda1
SSDEEP 96:RSMF9ZbkW6ShmMWPP/PrWZ322QYuEzFl66JozGzgClKtmSS:RrvZboShRYPCtv/66JozGzgCl6mSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 064f0ebc379506518567c083671fd2654a89527eb8c01942e5b23d6d902a173d
MD5 447df49e68a4379e8eeac2c5e838fccc
SHA1 2bd773acb93ebf757f79339c9a4b48803fd59654
SHA512 de4dc865e41d9d2f914c05e3133130a11e0c96a1aaafc912e170f6dcd0b8d3c6916cc72be6156b08653164f2cdaad76fc42a55900c49b2898702dfe767af1fd3
SSDEEP 384:YLYw5TppDH1bvbmboCbosFUP5v/66JozGzgC1bM:WvtPDH1bvbmbomChKEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

0aea2e6c-a0f1-4bcc-9d85-143b9ea911d8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\0aea2e6c-a0f1-4bcc-9d85-143b9ea911d8
Size 982B
SHA256 4082c64d4b71c1c6ad54821e428830a41cb01c7f72a97c563c93f1d52fed9046
MD5 3d870cdfb048f16d5a1cfd25dd75237b
SHA1 22247098488a84f67e6a4d99a8f8d87c6f4b6e71
SHA512 6be89362a99aee5046d6541d0876b71857def5d52c3cd01697afc279f7e8564319d636c7435a9ec72d55d615f714d95dc5a80d7052d8eab769b3c8dc98556177
MD5 SHA1 SHA512

Submit Download

4885e9b1-4346-42f7-9a10-6f52d110e9eb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\4885e9b1-4346-42f7-9a10-6f52d110e9eb
Size 28KB
SHA256 fd54ff73c034dcfb0284a50b17f5019dce643f9a3e7abdbae3ba9cb15b11c034
MD5 cff7b0c04c977bcf470928c3a25c0e5d
SHA1 63f453ccd8297e9160e7587fbd25de37571d4797
SHA512 6a016a0e888dd2bbeb54ace106cf62c9c848b4a67e8ead3d2c045333b311f2ed2eb343e7883ccc90f6a015bb21ae73a3872bffda767d8c7ad0123179f141694f
SSDEEP 384:ZxGyiashMiS8i0Rp5UqSlZd4Y2Yt9PINY:TGOqMiS8ih9ANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

c2cf36ef-0168-4ca6-8a38-f59d066f5ae5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\c2cf36ef-0168-4ca6-8a38-f59d066f5ae5
Size 671B
SHA256 3f7695f231b879d0818b7120af7ae197d6f36963eac9a92e054e3ee20f8da056
MD5 55c4aa84e470d320093d29a9cd6b74b9
SHA1 17e37a07fd79d1e0b71cb51ac848760cb6de504a
SHA512 fc0f7ac92ad7a897d2c61dabfece71bd70948db05442e41f4ea5871aa516f7a6f27f500e232c4ab16a327bc526ac348d54385618abc6ace9ab1263ed2743e72d
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

LICENSE.txt.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
Size 11KB
SHA256 c8a178098f044078c26cac31fe410cf1c85f6fdd02ff2748dd95a6575c67e29a
MD5 4f9047fcce8ff49627a6d67735881aec
SHA1 94396f705f2bc7d2a43ba044c160e6dbd442bedd
SHA512 22900577a332bb66b2e63663a134a83e81b6352194824df5b83cdd7337665fa4c06d0fe57558b60393edc953904f1b5c6c3af099d7562c07d65fc06ece5c0c0f
SSDEEP 192:95nxlR1fqFFf1I4R7XMXrltu8YlddUy1ZzQ3MaXkjGBw8HS7Z:ZdK1HrMXfY2y1ZzZgwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
Size 12KB
SHA256 5306cf025f5faafad2dc55c1b37c16328b4fe16f8c775e7500150f3221a988db
MD5 2a460bea54fc62159d08e681a7759fec
SHA1 3c515bf54979235394be59785628fc53adbc44f1
SHA512 4a4be8d9760bfa07a81de22c89a59f1734b0f7c5fbbdb7473eeb899ea093f97e048e28cf643eb07aedc5ba49d892c34beb4df231029e8d6e2e6843c5486205ca
SSDEEP 192:9KnxlR1fqFFf1I4R7XMXrltu8YlddUy1ZzQ3MaXkjGBw8HS7fs:qdK1HrMXfY2y1ZzZgwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
Size 14KB
SHA256 c89967aab90bd90da020c78b5d17b6cbfed1dbe0fb6b50aeb7c37f37557e3fbb
MD5 2cb0ca778abdd829c9bfd88402041e47
SHA1 2d05ab3e7e1012857e9f0f2f8fe310632ace7c94
SHA512 5f714633d6f1b9aa27b50882216f56467d1ca76f444f3c78c16937e2be19ca7682ebf4c2aa698e6484e397c1299dec6a41c825cf20471b1740fee025b9b200a0
SSDEEP 192:9KnxlR1f3EFFf1I4R7XMXrltu8YlddUy1ZzQ3MaXo+jGBw8HS7atEjD:qdU1HrMXfY2y1Zzygw2Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 968KB
SHA256 c7345f0c8cc8aec3dd8ff6e903ae433b402e90081e3b4ca64a433442c5e57412
MD5 53ae1c863d7fac58c0525f977c0e39ea
SHA1 97bb8e02368d99f442b7c1843e49ad6a692fbf58
SHA512 9c2a6211ceadc61bf398a6a048b12a6e420e263a0eb0c26c33fad1e98623b3c7744d035b125d3cac91e51a6b18b90d0861cd530bb91a8697dcb6e28b58a16593
SSDEEP 6144:+9PSm3K393z3m3JTHZaKShrtCJctUrIbUyTlr3DJEut9GeHN1HmcH11HyzZmz0Pz:aaKShp5mTa9EZ5z
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.1MB
SHA256 b423bb970b08dcdd90f786df30adb5c185e0ff51bac03febe4cce9403506b4ba
MD5 8173f697a431a79a4490ba9d8390940a
SHA1 1cceb2410718b33174cc72ed2fb064c48be32c23
SHA512 1e88059feb88a9490dacf39a31422c6c005245e15d7eb56422c8de6049813edb05c0065a81eff34b50417bbd8db1930ab69d232ffd3ae5b8c8db270565be3050
SSDEEP 6144:o9PSm3K393z3m3JTHuaK+hJdtCJcwUrYOUyilF3DJEft9GeHN1HmcH11HYZmz0Pm:zaK+hJ/5hSj9Er6ZirwPO
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.9MB
SHA256 bcfdc18307ad2b36921a612f1db4513d54930455d8045ab7ea5720be93d259de
MD5 bd430b363d624ac8973d390277385f17
SHA1 b7c41ef554fb1b0773be5e35d302c0a15ee5b2b2
SHA512 6554dcc7013152ebafa17296eaa52e25607e3b911a8feb3f56ff88a96a56b244d67c5fe7cd0b709efe2326b27d31884917a90f8981dc5d1e781f345e0deee0fd
SSDEEP 49152:qOQn8hMBD3i+ybOxTfFoxi88OWbV5jyc4ghz+pGUMS5Pf1xujaUBHQI5C15aK+0T:BP
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.9MB
SHA256 83582a8571977a4478ad1100acba01441784d3d85d43da9960fb121d5245f07b
MD5 2c8f1b2c0b86d904ebd54ceae2592c45
SHA1 ddb15fa22f308ace0cb47777510f7b232187554b
SHA512 90c8ca940048c3dfe9b4203389613da602525882182355fb7d5e132cd20a22f5c5039e5e1de8947b412d9845a87f83181d2869d407a2fc6558ae322adf610c39
SSDEEP 49152:L+C58hiDNezybOxnUIoxiNFd5TF/s3OZ/NUHQyod6fNKc5Pf1xujaUBHQI5C15aG:JP
MD5 SHA1 SHA512 SSDEEP

Submit Download