80563829fbad0211a3ac8287c568bb00aca56abcd9afe8926e5523c07aacc864

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 900KB
Sample241018-w9f3rsscnf
SHA256 80563829fbad0211a3ac8287c568bb00aca56abcd9afe8926e5523c07aacc864
MD5 25e97577afbc9a5af367344e6c668d93
SHA1 2d44a06d4ffb89eefcefec7b6b8e095c47c153de
SHA512 01e920665e687c269bab01cc71b4cf37d188112db9ea6e5423e35ae4ea8e24509b1f25a03d8802b66e824b81f70467fd73bd1d9e267b4994649f064214c95507
SSDEEP 12288:yqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaVTj:yqDEvCTbMWu7rQYlBQcBiT6rprG8aBj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1748	taskkill.exe
4740	taskkill.exe
4352	taskkill.exe
2608	taskkill.exe
3736	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	taskkill.exe
Token: SeDebugPrivilege	1748	taskkill.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	2608	taskkill.exe
Token: SeDebugPrivilege	1592	firefox.exe
Token: SeDebugPrivilege	1592	firefox.exe
Token: SeDebugPrivilege	1592	firefox.exe
Token: SeDebugPrivilege	1592	firefox.exe
Token: SeDebugPrivilege	1592	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1592	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3736	4996	file.exe	84
PID 4996 wrote to memory of 3736	4996	file.exe	84
PID 4996 wrote to memory of 3736	4996	file.exe	84
PID 4996 wrote to memory of 1748	4996	file.exe	90
PID 4996 wrote to memory of 1748	4996	file.exe	90
PID 4996 wrote to memory of 1748	4996	file.exe	90
PID 4996 wrote to memory of 4740	4996	file.exe	92
PID 4996 wrote to memory of 4740	4996	file.exe	92
PID 4996 wrote to memory of 4740	4996	file.exe	92
PID 4996 wrote to memory of 4352	4996	file.exe	94
PID 4996 wrote to memory of 4352	4996	file.exe	94
PID 4996 wrote to memory of 4352	4996	file.exe	94
PID 4996 wrote to memory of 2608	4996	file.exe	96
PID 4996 wrote to memory of 2608	4996	file.exe	96
PID 4996 wrote to memory of 2608	4996	file.exe	96
PID 4996 wrote to memory of 3788	4996	file.exe	98
PID 4996 wrote to memory of 3788	4996	file.exe	98
PID 3788 wrote to memory of 1592	3788	firefox.exe	99
PID 3788 wrote to memory of 1592	3788	firefox.exe	99
PID 3788 wrote to memory of 1592	3788	firefox.exe	99
PID 3788 wrote to memory of 1592	3788	firefox.exe	99
PID 3788 wrote to memory of 1592	3788	firefox.exe	99
PID 3788 wrote to memory of 1592	3788	firefox.exe	99
PID 3788 wrote to memory of 1592	3788	firefox.exe	99
PID 3788 wrote to memory of 1592	3788	firefox.exe	99
PID 3788 wrote to memory of 1592	3788	firefox.exe	99
PID 3788 wrote to memory of 1592	3788	firefox.exe	99
PID 3788 wrote to memory of 1592	3788	firefox.exe	99
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101
PID 1592 wrote to memory of 1092	1592	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3736
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1748
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4740
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bdead77-0df0-477e-995e-657b441aeeaf} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" gpu
      4⤵
      PID:1092
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c99f16a-f382-4a84-9336-59a74f3c7d54} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" socket
      4⤵
      PID:684
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2924 -childID 1 -isForBrowser -prefsHandle 3296 -prefMapHandle 3320 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d7bafce-0c5f-4345-8f5e-e0ae696e5325} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
      4⤵
      PID:2068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3952 -childID 2 -isForBrowser -prefsHandle 3944 -prefMapHandle 3932 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6866203e-60b5-4bd3-88e9-cabe05c9d4ee} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
      4⤵
      PID:3284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4712 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4688 -prefMapHandle 4572 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e8a6f8e-9075-45ba-a965-8caccdc89e90} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" utility
      4⤵
      Checks processor information in registry
      PID:4280
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5288 -childID 3 -isForBrowser -prefsHandle 5284 -prefMapHandle 5268 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cf58037-b746-4460-a809-2bb434c2e4cd} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
      4⤵
      PID:5892
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 4 -isForBrowser -prefsHandle 5288 -prefMapHandle 5400 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f300ca53-771c-42c0-9b21-39a4c07deba9} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
      4⤵
      PID:5912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5804 -childID 5 -isForBrowser -prefsHandle 5712 -prefMapHandle 5564 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99d48ea2-d3ed-41a7-8008-bf1823e42681} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
      4⤵
      PID:5960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\activity-stream.discovery_stream.json
Size 28KB
SHA256 b106f0bbb65e469d820ed3910dcbb1115ad2c61ac22009571130f03aa7dcb6e9
MD5 bfcf6d36dceca4241de84b331dacba50
SHA1 96ba34d663580f719e8c1a2af3a6167b8d144dd5
SHA512 97729f61fc3598148d96d7fc76618ad427bc0f0cba96460eb0aac643d59bbb4acb89518087111dc1eb47539a92785122e01da89093350fe6d7cc8845659ea8ca
SSDEEP 384:UQI0YcTtoyAn9W8ts6zlAfKg4fYgyauyIV5fi7MEBfy7rIG5:M0YOcn9S6BAfxVgydXHfi7tBq7EG5
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 396f666dbbffef42ed04f95b0d677f0feb09141a31eb6fc2338622d05085d2f4
MD5 5c774d6e9c517e331c7254b623ff341d
SHA1 23369ce20d6d140f1127039cf92b7ba16d5c8175
SHA512 cbef4882d8765f01834662bed90b624cca09355aa534bb1363364ac93617c85b7c100ddcf2321624352b9f0dca0863f9e3c1635bd0165d1b5cc511975dae9510
SSDEEP 384:H7C9Du9fiGLm4pUtpHLFoCr/E8HPJyD3VonFcP+AWRMAC/zs:bbBi8mCUtpHLGCr/E8Rg3V/+hRMFI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin
Size 7KB
SHA256 515dc3b3d2e55faedd0100aed5679b6a2c8ba2d38edb0ccce76b27358f254894
MD5 4dcf44a0c33d2dcb269406230fd59c45
SHA1 755dabd3bee7073f621edb3e9526323e6fda2654
SHA512 d9f1d16e08725f41d7220e8331b66055997fee2a1e0a63c30a46bed6ef2c1abc9d16bc95683e66903e62401d0a73b2168b856ef0459dc307f34b89645e0aaf08
SSDEEP 24:5uB1oMgu1xgRbrjpR5cOS9ruhMZr2Fsh2F3LFYvsJblLKY6b:A5oL9cOsvebVKY6b
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin
Size 13KB
SHA256 57745d1f7f25052dbb9c54a3603ee6c720d24ebfd9c0b49a313883b9c272fdc5
MD5 5c2e183ffe70aef82e53cb8a6f9b5304
SHA1 ddf96e0144e7cd27874f60a7cc90c8d7a3db770c
SHA512 631094270571890634aa5e4b1752eae2fdaf91353f982d9b41b1a3ec8765e0050826778216530e01f5d86296508b74aa285ad9bac49f97132203483fa9f57bee
SSDEEP 96:Q5oLebVKkbaebOJkbHpebvpf+dbAbQbbbLbWgbgzUb:Q5zu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 1178feca1d8bd54d1b776c10682cac25167c73141e6eff705399a826af34d0e8
MD5 7630526ac064a0fd41bd0f5a109a1336
SHA1 9021bf54d76a535305b4abb0acfe04e48ba26cb6
SHA512 2c6559f571b26272ec0c0595765a2279380b60caf81d6403012f19c8a67d5b560c8376a4a8f5de09cf8265d7947a3c131b5ae8f9f399f75edcb3d9709a219c97
SSDEEP 384:5P/66JozGzgC1bdbolK3PfZFxHaR/NmdTDelbbbbbBi:5qEvfvZzdDelbbbbbBi
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 741759acc840bbf38f3c95f702f494d4fa42446f4dd98f2d493d2656e56b21a3
MD5 b2585a14d4440065e4c11c5d7437177a
SHA1 fe9ca74de08a5bfc90a6a81ed9e6e2f80d3f7b7e
SHA512 3cb99f851bab74013d721399c2ca7b9fb745f8c5177fd1b031dc57fd3004086908796a65b60ebd76809912b684c4724b9a17cae09311ff500c1459251d2bcc2c
SSDEEP 96:9PiEQi5aQFl66JozGzgClKtmSSJXSMF9ZbkW6ShmiaPP/PrWI:9PP/66JozGzgCl6mSSJXrvZboSh3MPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 e043164aac410ff8f4dfcfa163affddfd812ffdaa10e26f0a52de395bc338505
MD5 9753254ba47a41db8f63905d40d70316
SHA1 e277ac3a7e26c3ef54f5c059ab960883aeb325ca
SHA512 680fff3236dae09e1a47b48247b27b67a6e7202a712c8a18011d68e875c50148efc4c44fab6d5dec0bfe91401ccd79f4fdbe32bb16a03eabb1483e1a47ef5d23
SSDEEP 384:SboU3PUP/66JozGzgC1buZFxHaR/NmdTDelbbbbbBi:WfsqE0ZzdDelbbbbbBi
MD5 SHA1 SHA512 SSDEEP

Submit Download

38d9208e-a7e7-44ed-95ee-a9f5ca0f46ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\38d9208e-a7e7-44ed-95ee-a9f5ca0f46ef
Size 982B
SHA256 a6bb0be6315c4297a4a60fcc493e58f29d4e0f54ffaffce129634e9c4914f458
MD5 a01f555c0e8af47866416e0303955e82
SHA1 68d8eb95a874d5bee1c6224802a1298bb6134932
SHA512 eb84e3587da64bde31957d4351074eca03367a568264c9d57549ac5661458d4b8078f8e22b8388c94eb520d76c3ca16e35a15fc16804b4e7935bda1ed4af6309
MD5 SHA1 SHA512

Submit Download

d20bbca4-da96-4ea2-ac16-3524de10ff19

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\d20bbca4-da96-4ea2-ac16-3524de10ff19
Size 25KB
SHA256 998c3f41e96b2676d82c18c11956a00aaaa35f64e283378c3fdccccd6cdb2f57
MD5 15eb006802de52b05d6fbbd4d483f9c2
SHA1 f6fd44c40f708b252c8411bd40361a665a529fea
SHA512 7d7693ae1c5e92b8b3784768442eab7baf755d31167fbf8e6f001efeb1038d5fc369bf08f5c43592016cb358d3a9eee219148d643b187f432f2d18aca10fec37
SSDEEP 192:UpoujFrkczmjG3DXquYziYi/1Leb8Z9SmYQTcsBkPgHGN2VdPpJOzla3y7pIAFDW:UpfjFIcyK3Dapb2CepBy0+g6WUMhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6992d39-d743-4823-b241-c1574473eb66

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\f6992d39-d743-4823-b241-c1574473eb66
Size 671B
SHA256 1ecb53452e12cea274f9b4e3bc7299352d4d0abd0b9419e16dcca094fb4f68d4
MD5 11c8116ca79ee9e02d71b862fb42164f
SHA1 971c306a21f44c49b0b67186ebf77343e962d62c
SHA512 c08eb7c2260cf6a55b5af921fce2ddf3d53aeecdf403abd9fd8261ef1e94f561694712df3a79851669fa61eb35c5822fcef94d995ad825fc34a4dd7a0a654ffc
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js
Size 12KB
SHA256 0b7035a431b1d619c2266a852e0b9e5e0935f27a1f046fa4400f95c99b425918
MD5 9e2c5849aad58b74b25ae91e832dba1a
SHA1 8955f9607a16c36974a218729c60e3a9710217d6
SHA512 834c1ecffb4b65c45275fb72446ae37c3391d4df6b0783e18fff77f74ecea414b9ef693d22870e24c23ba73b974cdcad148a8b76fbea67c4c782919bde01407e
SSDEEP 192:buG5nkR+fMNgOLDjI4/jauwPtrV8F5ddMy1Zzq3rlaXY3x9Bw8HbX/:Cu6LX9G1IFCy1ZzOxw4P
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js
Size 16KB
SHA256 0480b7d6c798141fb22bb72ae4b1757d0a0e84d01ae42e35e0c2abdb501bcda0
MD5 ce888e79d444802c661aed2c434c791b
SHA1 a584627cba369eaecfeffffe1e157836272d2c54
SHA512 6704ff99d58044ede9ffcff28b9fb623f6261410da18cd24ac9e29f0ea893bcfe422651bef2be1dd615e6236f2555d91d550b0eb3fd9a7e39fed9f2420985225
SSDEEP 192:buG6nkR+fQNgOLDjI4/jauwPtrV8F5ddMy1Zzq3rlaX8+3xeiBw8HbXI7Xn4a:CB2LX9G1IFCy1ZzTfw4Kz
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js
Size 10KB
SHA256 7b18724a5b57a62e2dcc464618fcd668ec930bc0b93a8d32ed42f67bbedcf743
MD5 142e99140e4cffb4928abf6557ac434d
SHA1 aff5c9fd3bbba8609684bbe4915d692466264ebf
SHA512 cab304c5c561bead9e8c1fac50ca20a62ba881e6083786d41b2ed25b64e245b612f2a920909b9e430b2d01bc026dc75137b5dcd1c52e0372cebee247c7333a6a
SSDEEP 192:duG5nkR+fMbdiVVofAHBtq8prddx9y1ZO43aaXD3xXBw8V3:UudVoIbpd9y1ZOsDwo
MD5 SHA1 SHA512 SSDEEP

Submit Download