5b1f53dbf2a1d0629dcde01a18d09dfc259d016ad2a162fb979a40137828eb8f

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2024, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241024-zpaa9stfkc
SHA256 5b1f53dbf2a1d0629dcde01a18d09dfc259d016ad2a162fb979a40137828eb8f
MD5 3627ba3e88250f295c89aa79af3c54b7
SHA1 5844579b4bf883b2a985bade3334938b0e060adb
SHA512 61a554fda99fee95d1ebbfb9d6a3a1680026fe386ab07bc98f48c96c395db8c54b361e3af96dbda45f505a763719b6a643e840093b1246a9f425d2fa05969440
SSDEEP 12288:QqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarT+:QqDEvCTbMWu7rQYlBQcBiT6rprG8av+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4636	taskkill.exe
1200	taskkill.exe
4512	taskkill.exe
4788	taskkill.exe
3744	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2764	file.exe
2764	file.exe
2764	file.exe
2764	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	3744	taskkill.exe
Token: SeDebugPrivilege	4636	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	4512	taskkill.exe
Token: SeDebugPrivilege	1284	firefox.exe
Token: SeDebugPrivilege	1284	firefox.exe
Token: SeDebugPrivilege	1284	firefox.exe
Token: SeDebugPrivilege	1284	firefox.exe
Token: SeDebugPrivilege	1284	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
2764	file.exe
2764	file.exe
2764	file.exe
2764	file.exe
2764	file.exe
2764	file.exe
2764	file.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
2764	file.exe
2764	file.exe
2764	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2764	file.exe
2764	file.exe
2764	file.exe
2764	file.exe
2764	file.exe
2764	file.exe
2764	file.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
1284	firefox.exe
2764	file.exe
2764	file.exe
2764	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1284	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 4788	2764	file.exe	84
PID 2764 wrote to memory of 4788	2764	file.exe	84
PID 2764 wrote to memory of 4788	2764	file.exe	84
PID 2764 wrote to memory of 3744	2764	file.exe	90
PID 2764 wrote to memory of 3744	2764	file.exe	90
PID 2764 wrote to memory of 3744	2764	file.exe	90
PID 2764 wrote to memory of 4636	2764	file.exe	92
PID 2764 wrote to memory of 4636	2764	file.exe	92
PID 2764 wrote to memory of 4636	2764	file.exe	92
PID 2764 wrote to memory of 1200	2764	file.exe	94
PID 2764 wrote to memory of 1200	2764	file.exe	94
PID 2764 wrote to memory of 1200	2764	file.exe	94
PID 2764 wrote to memory of 4512	2764	file.exe	96
PID 2764 wrote to memory of 4512	2764	file.exe	96
PID 2764 wrote to memory of 4512	2764	file.exe	96
PID 2764 wrote to memory of 1820	2764	file.exe	98
PID 2764 wrote to memory of 1820	2764	file.exe	98
PID 1820 wrote to memory of 1284	1820	firefox.exe	99
PID 1820 wrote to memory of 1284	1820	firefox.exe	99
PID 1820 wrote to memory of 1284	1820	firefox.exe	99
PID 1820 wrote to memory of 1284	1820	firefox.exe	99
PID 1820 wrote to memory of 1284	1820	firefox.exe	99
PID 1820 wrote to memory of 1284	1820	firefox.exe	99
PID 1820 wrote to memory of 1284	1820	firefox.exe	99
PID 1820 wrote to memory of 1284	1820	firefox.exe	99
PID 1820 wrote to memory of 1284	1820	firefox.exe	99
PID 1820 wrote to memory of 1284	1820	firefox.exe	99
PID 1820 wrote to memory of 1284	1820	firefox.exe	99
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100
PID 1284 wrote to memory of 2700	1284	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3744
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a04e1806-1a03-4b50-bd9a-7c2b8ee0cf6c} 1284 "\\.\pipe\gecko-crash-server-pipe.1284" gpu
      4⤵
      PID:2700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2368 -prefMapHandle 2348 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72a8b740-5fe1-44b2-b560-796824450482} 1284 "\\.\pipe\gecko-crash-server-pipe.1284" socket
      4⤵
      PID:924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3240 -childID 1 -isForBrowser -prefsHandle 3300 -prefMapHandle 3296 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4aede565-5586-4b30-8d22-95535cf51a2d} 1284 "\\.\pipe\gecko-crash-server-pipe.1284" tab
      4⤵
      PID:4368
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3876 -childID 2 -isForBrowser -prefsHandle 3992 -prefMapHandle 3988 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd4d7341-847d-4fc3-be2b-8451ddef7776} 1284 "\\.\pipe\gecko-crash-server-pipe.1284" tab
      4⤵
      PID:5048
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4980 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4284 -prefMapHandle 4888 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1baccd00-d337-4d52-aa99-362074a99d19} 1284 "\\.\pipe\gecko-crash-server-pipe.1284" utility
      4⤵
      Checks processor information in registry
      PID:5532
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5268 -childID 3 -isForBrowser -prefsHandle 5388 -prefMapHandle 5372 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9cc9cb6-49ed-4e4e-a957-f8c967ec8492} 1284 "\\.\pipe\gecko-crash-server-pipe.1284" tab
      4⤵
      PID:6128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4876 -childID 4 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {587f1bc1-e22f-40fe-b47d-2ce24c1361c2} 1284 "\\.\pipe\gecko-crash-server-pipe.1284" tab
      4⤵
      PID:3900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -childID 5 -isForBrowser -prefsHandle 5704 -prefMapHandle 5708 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed621ce2-b70c-496e-a647-feec6dfed696} 1284 "\\.\pipe\gecko-crash-server-pipe.1284" tab
      4⤵
      PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json
Size 29KB
SHA256 511242b7b440900c2e572f5d8b49949da81d9548a236a6e78e91e498daa815f1
MD5 94ea6b55b2569d2531a898fb93f5ed18
SHA1 d69f694fcb6f136aed521a91a1341ceb47aaf67a
SHA512 7515b736afe98951729da0e9bece1bf23d1d2ec122ff188758724bf8101c1ae9b12a68330bfcd5433b5353831bdeae5db8241a1f20ac14c7b39092e0f32201d8
SSDEEP 768:eAZHLjLn41frGKkaWEK0mEQydxRnKVkm6U5:vhLY1znkaWgmgzFLVe
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 4f3eace6ca23f625c288f607fa807ceed32ee48881427dd91cc4d6948b049401
MD5 8ea77015a12a0cc112eb231b0ff0d352
SHA1 31b2b5efdf2c3227069ceaeed1b59e71a7222649
SHA512 f4ce19fb600aaa5e279f526f2cef7b5805d709dc3e31a3c614455a38586d7d5842c8d44f705994c1f53abc563f23fe587f0092acbe75ffd7e6e42bcf454a664b
SSDEEP 384:H/w5Iu9fiGLm4pUQpHLFoCr/E8HPJyD3VonFcP+AWRMACD7u:8Bi8mCUQpHLGCr/E8Rg3V/+hRMF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Size 10KB
SHA256 ecdaf423d8579df256af326e3ba8e4df4b9ec2acdfec75b5d1aa8c1074aa67c1
MD5 d08d7bcdc298e8fe33351b029b64fa43
SHA1 0be5233ffc845325b855f4e48b724bbba9180238
SHA512 af7b78fde3d83f4c25c06ee51b146a84af5133cdfd01632307c3f60daf36fa4d41beb850599f6a4c689756be6d0c00e0e090108c39208ea5d0b35e9bf8bcfde4
SSDEEP 48:fHT45oS9cOFYAebVKdbVvebOJdbeCpebvpf+db:fz45o+/ebVKdb9ebOJdbHpebvpf+db
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 4fa39a5d1eee41ffe073f42413a0b0bc4caf8bfe8cfcc0048797fae19f11cf12
MD5 ebf3863b49d2fb778468ae934ac67391
SHA1 617da8d3d0dfd91e50a5ac3a6e8d7a985a6bdb63
SHA512 026af3939d67f0789707aba594c3235e220ae8f14fac4530a9229644a2118852e774c0257009ba308a56361b78ca612e179ea82d3214d57e33974fce1d671381
SSDEEP 96:322QYYgGFl66JozGzgClKtmSSOSMF9ZbkW6Shm5RPP/PrWZ:3s/66JozGzgCl6mSSOrvZboShAlPC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 6ce1eeaa425578480f362c56d7cfe6c9d616281355c4229e4ceaff6834ace2a6
MD5 83d0cf27aa6b50ea7800dbee539d28f0
SHA1 140d93ecf831fced516ac58c726e37fcedcde947
SHA512 bf72763984f5ef411ab95ba5f04f6c20bb799fe102621829b474df7d1cfe85a9503ec78ac066ee922ff2abb0c5883da11904ba54a2fc17e1858e090f7cddda97
SSDEEP 384:tboLNIPgy7jcUZe/Dmw2fb/Mbxks/66JozGzgC1bM:Ndv7PZQDmw2fbUbxkpEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ce5640e81a1532677faf488b0c7cb3a6a781ee73dbafb99069ab3cf6d89fcdfa
MD5 43e24a5f7c904bd0b6782e5505d3a658
SHA1 ce9e81cb5e272c6cb4479af83fdc43f828405e12
SHA512 57bdf35e7e2fd402468d8b05fd4cff8bb1a04de6b0452b76d83be760e70fb4948af40d53c35e152ca477b2719521ff0a06305bc5859fd6068ff559cff5941028
SSDEEP 96:322QYYgGFl66JozGzgClKtmSStB6SMF9ZbkW6rBBzhmsRPP/PhxYW:3s/66JozGzgCl6mSSarvZboPzhLlPD7
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 ae8c1f29a09368b29691ccd30e979d0d0db2e95d6a7428264b60a1e0aab1f6b9
MD5 ec351a6032ab28f4ff0995d4bb7cffe4
SHA1 6914e3427ba4ad1fe600d54f2ad174a1d175ab71
SHA512 672e4c674cbb523022fec7e08caed3ef49e8511e7ad4fa97b3600843bfe9a5ee5376c6ead7cae3e8e09bbc31b255b52dcf004ab8ebeb1ebff6f95a7dc17a7547
SSDEEP 384:8bo5IPgy7jcUZe/Dmw2fb/Mbxks/66JozGzgC1bM:09v7PZQDmw2fbUbxkpEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

74263173-94a2-47cd-8ef3-6e594075d0c8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\74263173-94a2-47cd-8ef3-6e594075d0c8
Size 982B
SHA256 fccbc7a31dc7f89e8c266d57b4b614363c134fded0604abd8013821b0c2c7a1a
MD5 d6fd02cf2b53dc8c716b4096a8b8a729
SHA1 cb369859a1589b7e53a818e75f965a833b5d4e51
SHA512 e480895fac49d24b205a147e0a25b3472916042781f5ef1ed24cd715266827054ddc804552c197e663a37415bbf90e8e46e1e7e9d7b3576b7adb9ff9126e12b2
MD5 SHA1 SHA512

Submit Download

dce0d50a-1588-4ced-997c-d1e775d74b4c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\dce0d50a-1588-4ced-997c-d1e775d74b4c
Size 671B
SHA256 e607fe182998e51858a60ac66515105fede45e1048a188b00d179067442edc3a
MD5 0ba078bbace5bb709448032f97c86bbc
SHA1 d53cf74a8d57476b409ae1e0be49724f16ba8ed5
SHA512 2c57c8cfa0f0f21470d951de538987f2ce43713e908d5e37b60f5f7743b5afe78a69648999545b11a6f5fb7e17099f58ccb4cf6beeca3bda1faa581a3a19edb8
MD5 SHA1 SHA512

Submit Download

fc433808-9778-4e3c-af7b-2145f1f05681

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\fc433808-9778-4e3c-af7b-2145f1f05681
Size 28KB
SHA256 9ebbc356997d601e64bf6e09f8db18756eb16fe132b967ae87802400d43ae94a
MD5 8a06f77c29e623ec1f81bfeb658b8a8b
SHA1 250d8f8156ba4d87530e5df43b9a9ffc8f529054
SHA512 3d3f7b1b3eed189c011b9ef1860b5c5305c2f50ff5698e052bd6bba92f36147015620d0b3551118dd34a61051a6c9c2be251bb254e96cf1eb23699beb3610c4e
SSDEEP 192:ULXI944rgrsSybzdKrQlcWhS/+sQ2m9jwMq7RDnyjvg8cndldK4ui1B6YX9RMBQA:ULXIbcISybBKccrqn+b/WEbpy1pMxDs
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
Size 16KB
SHA256 4835e5b5910629bf2c8f699948e80f6eb4252b0648812ce66f87885c862616da
MD5 440a0c639cfa5ea7b21e8d36cf6faead
SHA1 d61d8b55ce7820ce5a1dab2168e2b88609b334bf
SHA512 2cff88c825dc40c7c5e9817cb7cf3e26138b9a3021d3ae297a013ee663509d4729221f49d72f9431ead452196ec2d3f475365f0bb0c58b50d0ff948d3ae101ec
SSDEEP 192:9unxlR1ffnv9MdCexnrd33QiUt2tj8kVwt/sZR3DaX4+jYiBw8H8aOLvHQN:Gdm4exlWd/YcPw1agI
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
Size 12KB
SHA256 75b5b1a6e8fd6672c73f449eb4f38685cd1edf812400037550f71e2854c3ca0e
MD5 a07c4178d9bd5d4e1ad3fd2c919bb799
SHA1 7ffeb280eed7ad42bb0c313932e325df3987c91d
SHA512 a1747aad7095533e13c08d01d731a17350278c0014b021310f3c34a00109c23e4601c6f1155ea71d7523467f57fff1198682d50502017c13e450a01c945e8765
SSDEEP 192:95nxlR1fqnv9MdCexnrd33QiUt2tj8kVwt/sZR3DaX0jQBw8H8a4:ZdJ4exlWd/YTqw1a4
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
Size 10KB
SHA256 52976f9147e498738df21f5901eb2f1fe6c4c1cbf538bc69ed1d0fb1ced36f69
MD5 c45bf5b04250c24d804048d69c8e4935
SHA1 3429414b09493bca3b928f49b4ff45f4c212e7a0
SHA512 099a299736580bfa6ec6a497941f374421fbafa1c425b91ef1ff6eeba05ab6adc00914a36f3cdb17ef40d2c4b7fc45d90711c1666259104428e33524984bdab4
SSDEEP 192:S5nxlR1fqIUis/uI4gYcU8BtD8JJCddLMy1Zzw3UaX0jABw8VD:wdRsWuYgUJJ6My1Zz9awM
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
Size 11KB
SHA256 e5e67662e3c7b6d52ea3a1a35bac82cb5ec96ed64854c50df6de779d4f27be5b
MD5 60fc505d7e76d29b246de30211a1d2d2
SHA1 947c696aaab31d880f5f9982f675dd71b8d7b706
SHA512 6b91d607544065edfcf43c3523d1d491a4fac18eb3fb3c7af6362662b32e98d3ee956d617783e5d5d34afa4f179def8ac571fceff9080f2e8eef2f440534fd6d
SSDEEP 192:S5nxlR1fqnv9MdCexnrd33QiUt2tj8kVwt/sZR3DaX0jABw8HD:wdJ4exlWd/YTawC
MD5 SHA1 SHA512 SSDEEP

Submit Download