fc83d3aec4b43b001f402b2e0717e75a612aa63d584c4fa6440262fba22c5353

Analysis

max time kernel
130s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241014-jld72ssbpd
SHA256 fc83d3aec4b43b001f402b2e0717e75a612aa63d584c4fa6440262fba22c5353
MD5 e6629643e8305d91ff0457edb686f35c
SHA1 24977a57a4130edd8e82dfaa6de8f6cf2a2a9625
SHA512 02f7139d28d39f5f5b254377bd35c9285018bc595e9cb4b975fdc76b7ad42f34a47216fbd644d45a1c715a7f38e13ccf65b43952b49b00c6e58d6fc51f18831b
SSDEEP 12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TT:vqDEvCTbMWu7rQYlBQcBiT6rprG8abT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1560	taskkill.exe
3888	taskkill.exe
5036	taskkill.exe
3864	taskkill.exe
3968	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3660	file.exe
3660	file.exe
3660	file.exe
3660	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	3968	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	3888	taskkill.exe
Token: SeDebugPrivilege	3532	firefox.exe
Token: SeDebugPrivilege	3532	firefox.exe
Token: SeDebugPrivilege	3532	firefox.exe
Token: SeDebugPrivilege	3532	firefox.exe
Token: SeDebugPrivilege	3532	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
3660	file.exe
3660	file.exe
3660	file.exe
3660	file.exe
3660	file.exe
3660	file.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3660	file.exe
3660	file.exe
3660	file.exe
3660	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
3660	file.exe
3660	file.exe
3660	file.exe
3660	file.exe
3660	file.exe
3660	file.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3532	firefox.exe
3660	file.exe
3660	file.exe
3660	file.exe
3660	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3532	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 5036	3660	file.exe	85
PID 3660 wrote to memory of 5036	3660	file.exe	85
PID 3660 wrote to memory of 5036	3660	file.exe	85
PID 3660 wrote to memory of 3864	3660	file.exe	91
PID 3660 wrote to memory of 3864	3660	file.exe	91
PID 3660 wrote to memory of 3864	3660	file.exe	91
PID 3660 wrote to memory of 3968	3660	file.exe	93
PID 3660 wrote to memory of 3968	3660	file.exe	93
PID 3660 wrote to memory of 3968	3660	file.exe	93
PID 3660 wrote to memory of 1560	3660	file.exe	95
PID 3660 wrote to memory of 1560	3660	file.exe	95
PID 3660 wrote to memory of 1560	3660	file.exe	95
PID 3660 wrote to memory of 3888	3660	file.exe	97
PID 3660 wrote to memory of 3888	3660	file.exe	97
PID 3660 wrote to memory of 3888	3660	file.exe	97
PID 3660 wrote to memory of 4660	3660	file.exe	99
PID 3660 wrote to memory of 4660	3660	file.exe	99
PID 4660 wrote to memory of 3532	4660	firefox.exe	100
PID 4660 wrote to memory of 3532	4660	firefox.exe	100
PID 4660 wrote to memory of 3532	4660	firefox.exe	100
PID 4660 wrote to memory of 3532	4660	firefox.exe	100
PID 4660 wrote to memory of 3532	4660	firefox.exe	100
PID 4660 wrote to memory of 3532	4660	firefox.exe	100
PID 4660 wrote to memory of 3532	4660	firefox.exe	100
PID 4660 wrote to memory of 3532	4660	firefox.exe	100
PID 4660 wrote to memory of 3532	4660	firefox.exe	100
PID 4660 wrote to memory of 3532	4660	firefox.exe	100
PID 4660 wrote to memory of 3532	4660	firefox.exe	100
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101
PID 3532 wrote to memory of 1400	3532	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3864
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3888
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0507890d-f6fc-4ef6-be75-2f50d88b4aa2} 3532 "\\.\pipe\gecko-crash-server-pipe.3532" gpu
      4⤵
      PID:1400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2edea040-b69c-497c-b137-198d0f904c2d} 3532 "\\.\pipe\gecko-crash-server-pipe.3532" socket
      4⤵
      PID:1728
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3080 -childID 1 -isForBrowser -prefsHandle 3220 -prefMapHandle 2948 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce092719-0150-48c4-a935-233f7744ef0e} 3532 "\\.\pipe\gecko-crash-server-pipe.3532" tab
      4⤵
      PID:2232
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3684 -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb855415-22c6-4f4d-a415-08ad8883bfca} 3532 "\\.\pipe\gecko-crash-server-pipe.3532" tab
      4⤵
      PID:1736
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4840 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4836 -prefMapHandle 4832 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9fba8eb-c658-403b-b593-23f49327efa8} 3532 "\\.\pipe\gecko-crash-server-pipe.3532" utility
      4⤵
      Checks processor information in registry
      PID:4768
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 3 -isForBrowser -prefsHandle 5360 -prefMapHandle 5356 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b15bcf7a-f6e1-4922-baf0-5471d9b5a1ad} 3532 "\\.\pipe\gecko-crash-server-pipe.3532" tab
      4⤵
      PID:3356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5476 -childID 4 -isForBrowser -prefsHandle 5488 -prefMapHandle 5492 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51692c5c-b2b5-4fa6-a006-28024d1d4a64} 3532 "\\.\pipe\gecko-crash-server-pipe.3532" tab
      4⤵
      PID:1404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5696 -childID 5 -isForBrowser -prefsHandle 5712 -prefMapHandle 5708 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db34d706-2a89-46b1-8260-ce76e6e081f0} 3532 "\\.\pipe\gecko-crash-server-pipe.3532" tab
      4⤵
      PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\activity-stream.discovery_stream.json.tmp
Size 22KB
SHA256 01decb594bd0e4d7fbeeaab9d874d319649120aa6b5fa4077d45dde4833eac2e
MD5 91c5b9141e5585190760f1868ede970b
SHA1 a0172011d147c23240a14c6580d876a0d8fed023
SHA512 fae9f289bc5ce7b5d21c6c1ee915b13075203a8dad043aa627b84dd485d6e88192ac6afdbe72b6e48a8e9c23122a97c30c4d65d6bac6193087190ab0634930a2
SSDEEP 384:P1WuYjnYqR+ZF0DmeG50UNgemz5yOyauBhvhCM5:t2jnV+ZFD5RGXz5NydrZCM5
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 9ea91c34f1f3274f2a8b8243e9c3cf19f0eb82f9fbcaab42556de26cf5f58f1e
MD5 6d7517b1ee89014331832a830adaff3d
SHA1 dbc4b3f4a8290a2484618a5844100435d5a36207
SHA512 3c4ecf9ed404a30180e03263bd2521938c68c4b43fcdfdf09dadbebab97d038ad056cfba0258456708e7fe7755dd2b164d763dc9585ea41e6346b8fb217c8a86
SSDEEP 384:H7C9Du9fiGLm4pULpHLFoCr/E8HPJyD3VonFcP+AWRMACPFDFB:bbBi8mCULpHLGCr/E8Rg3V/+hRMF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

asrouter.ftl

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 7KB
SHA256 0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0
MD5 c460716b62456449360b23cf5663f275
SHA1 06573a83d88286153066bae7062cc9300e567d92
SHA512 476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30
SSDEEP 192:63/CCBm4CsBJumwOGmnOqiwpJibAKGb9CqwGV:OHPnIwyqwGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
Size 15KB
SHA256 7448f04d8af245a1d714780022ee7176ad2996d5c8e428d430d094129895ca4c
MD5 7be55dbb4fac6cc0455a5ba77f29e9d5
SHA1 941506bc66ecaae0469409184bf81bc67ec6f1fe
SHA512 9b9ec5a5bd2df32d4594f18d4a9505f075e7dc7fd00d29e6c6439d377bc29d6198bccc85d0a72482649a3900b7263fca9bbeb36ebeb33eb12e3861b5c48a30be
SSDEEP 96:D5oPebVKNbjdebOJNb7pebvpf+NbFbxbYgbgzybpb1b0bab:D5UDu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
Size 18KB
SHA256 0c3afd4d14b9059a745d4c485e0b22600df5cf7f08861573c2f28438e7784f04
MD5 b977c3cc54a89a7b5e74e2a00721dd18
SHA1 dc2bb1f98f0f160dd0ad543399b6a2cb03325dd2
SHA512 263613e3f40f9679472059756130ea24e95b3f5d4c56896abc6a5c4efafbb92133920ef77b451c381f9d1d333c46c8cad03d1efec7695daa36c116defa1421ee
SSDEEP 96:z5oPebVKNbjdebOJNbZpebvpf+jbFbxbYgbgzybpb1bVbdbUb0b:z5UBu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 cabeef50ac17fb7a33f440f813fe07afdbc460a52230d24979871c188b0dedb8
MD5 65bfb8a3833aa72c62879cfd6fffb351
SHA1 76eaae75567945b378e02d905a49430c5da30e8d
SHA512 21da2d3a24b93268c5037735267ad991c481cff4c500307848100b58039c37796cd10c17073a3f9e153d23d503db4235d66ed43957cace90b02d8ccb43e2e2b9
SSDEEP 96:zB1SMF9ZbkW6rBByhmN8VPP/P6xkWIpnQTJ+sFl66JozGzgClKtmSSM:/rvZboPyhG8JPUfj/66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 37be4db40fda0a109cf6a5ca1c392695eba930263585e18a7f02ef51ec625155
MD5 5d66647a85b0f556e60c302a26261849
SHA1 d9c87b706116b9d6d97cf37d2830733fa4f545ef
SHA512 b7a6620092d45edec50b0948fa0f2461e8601266e5a15e2dd4b862c2096129934be57cc5f6b8a0ad5a8cfbeda934b1ca4fa430516ec06e1027f754f05376f997
SSDEEP 384:ZrHxr62FXDacvhbpb6PcboKQPPH/66JozGzgC1bM:x02ZDacvhbpb6PUGaEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 0d1ff76ff2e2cdb2e206023ba7de5beed48adf615d2046c52ad96ef524906e9c
MD5 56fc21645196e12e33df09e183a0108e
SHA1 318a207baa446f932272cd0bba0cead1f8166295
SHA512 a1a1f8655421997d3bc05ac6e1ed5ad786e68112e5f559e3f88e4ec796ed6f8e503e19a4970255f1a50673fcd9605d24111cdc3bad9eef9ce52a5cc80841cdb8
SSDEEP 96:VpnQTJ+sFl66JozGzgClKtmSShSMF9ZbkW6ShmI8VPP/PrWI:s/66JozGzgCl6mSShrvZboSht8JPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

14e2de20-6ff8-453d-9a5d-846e6f97757a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\14e2de20-6ff8-453d-9a5d-846e6f97757a
Size 982B
SHA256 d9c7ff735b045d0a9167eeb091c998cf955dfc59824dcf1f6dedf795ea7e79ff
MD5 110400c64cc07f9f1a333b03f599983a
SHA1 8c40d5979a62c458989b3da62adbf0f6923ef9df
SHA512 4058aa1edc6875c00a189dacfad74f25d71103e38157eec8bda6bd9101f2d832bf9e26fb34719450d941fd4d68969d45ae71b701cdb53cc2b455b94bb3742d9d
MD5 SHA1 SHA512

Submit Download

6e948593-8af3-4c7b-9efa-442eb77ca56a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\6e948593-8af3-4c7b-9efa-442eb77ca56a
Size 671B
SHA256 286ea1a1d8ceec5c257140e69ce84117cd8f58dd01b59a373b8739c8120be65b
MD5 88f86eb721cbcb00639a511705f96204
SHA1 4be68df88048054582524595eded216052bc8bff
SHA512 231b945570e87fd85e94fd167a54a35c03c11637734c6e14a78cb75057bab3e0fe3a5b3d3286a0724c3993435208a053dc3a1cef85ea0f768b3c6dbc9e017295
MD5 SHA1 SHA512

Submit Download

a787efb0-221c-4a85-bdd3-4b66694a4b3f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\a787efb0-221c-4a85-bdd3-4b66694a4b3f
Size 27KB
SHA256 dc4b54462d69623787de92a55a4747ecfb4e86ad6d00bfef86a5fccf3ade0b3b
MD5 ae811ceb7575fbf7dfb47efdedee1731
SHA1 0c047441afce1b7f7ac1565ef8b0189b8c81629a
SHA512 90e1b163aae40829fc34c07e8ac5bb9102e254534804ab02d75ae16a191b64cd8c70f2d3cce0f2a5cf386d9cebd6b4b305eca9a16f9b42c9df91fdbd3b262bcb
SSDEEP 192:LHaKqemiBzrAML2irJBioDFMzHm5WA/qIIHKzxodRcaEfLpG7FoYD9HdW6OQbMS3:Lj3fVBCoCIZlodRcd87l7k+YzNopDz
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
Size 12KB
SHA256 a0dfde6e506484a2cdcc57d18afab0b1eb892a7868ac85a676e8466ee040697d
MD5 63d0f183da2026a67ed3e1f8b5f6bbbb
SHA1 eb68010d1b0516969e981ade214e27b816c16095
SHA512 1b0c34bf8a50bf10192ec38fb604b2856c106374292ac2b7e82f6e7957e80c1cd271fff2d049c04b907f1d6c8ee45f10f41afea92ffe6e102287ae550b9586fb
SSDEEP 192:J5nARLbfX4uV6HkXfOeEEyJU30tU8qIddby1Zzg31aX9EVoBBw8Hva3:AqHkXlLygMqMy1ZzREVswR3
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
Size 16KB
SHA256 3a57b345784893ad5c708fa746ff55f636d8ed1ec9cd0bad8147b05782bf223e
MD5 a4919d7f9ad6afc395ffa0dd102beab7
SHA1 eee77e0b7965ac5a0d53750a03c6bc863099b995
SHA512 9e923f3bd51f53965484176d4c736fb0fb0ba7b894fc7ef1dc325e86e81c08b179d6077f01929910b292288dc4c70ddf0e84c831ddc5bb9d1f428751e8705681
SSDEEP 192:JKnARLbfx4uV6HkXfOeEEyJU30tU8qIddby1Zzg31aXX+EVoViBw8HiugBJmdd:9MHkXlLygMqMy1ZzaEVzwjuY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
Size 10KB
SHA256 2305bbe40ed5de5d5f9372869139a4f35ca3a29cb9d54a6d377bf1857c2d7794
MD5 c28f966b0b7803bbbbaf7b039aef54a8
SHA1 db96f7c0c0ef1bb1d05dd3bdbe830f6f263947ea
SHA512 fc635f6e99c70a945a66212160543380f077f71c40fe09bf39f861d06147821aedb34defb0e8b4e046dd6818dada25cf1071e8c9a0a69ffd64f6b035faadb99e
SSDEEP 192:Y5nARLbfXZzTVofAHBtq8prddx9y1ZO43gaXl5EVo8Bw8V3:phVoIbpd9y1ZOC5EVfw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
Size 11KB
SHA256 37fbafc1228d0a3016adf0fd8c31f4936cb5d2d125637ec866dbab8e7add58f1
MD5 2c551bf8e82ea411366f3651d5f0959f
SHA1 e1c2cca3a6285d51f64b0436f9768b5149c8439d
SHA512 0fb13128dbd0622bd74f301d164c295c0892f4aee3cac50ce55efa1626b5e90571df7e349b2726528fce17f419d4de56250ea2d0043fcab6c2c96679a8cddebc
SSDEEP 192:Y5nARLbfX4uV6HkXfOeEEyJU30tU8qIddby1Zzg31aX9EVo8Bw8H3:pqHkXlLygMqMy1ZzREVfwu
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.2MB
SHA256 54c0161511bce9b6e0cd582cbfbf30a6c2a511a1b9f12c52cc9a290104cce313
MD5 37ef0ed07c788bbaad18f3ffd6d9d7c5
SHA1 a7cefea76abc6119a478593aa804308eceb8171b
SHA512 53ea9e148892a991a5448b28d5c0d09808b5dbe617c3236a1bfcc30fa1aae329e06cdbc41d3f197bb58a4bff113a93bcf925b4cbcb9de073ff68950cd428e0e2
SSDEEP 49152:bxcCC5ZhmB6L520yb6a2A3/UytVs3mjHMTkPpvr3RIPLBU9ek7GMcZ30hXBm7+vh:Zv
MD5 SHA1 SHA512 SSDEEP

Submit Download