e1328ba222794755d4afde012e0fcffc557f2b229da9763b4dfdc5fe7a4fd4dd

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2024, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241027-fx5btsvfrj
SHA256 e1328ba222794755d4afde012e0fcffc557f2b229da9763b4dfdc5fe7a4fd4dd
MD5 4a2a4b1516ef0cf27a2be905cc35e25b
SHA1 f8f3bcec798ae1ec31436660673ce5040ef6900b
SHA512 b70fd50510ef830770beb641deb5a5876fd83a730c9f81f2c15fbe2c86329e8c8e1d22f3809a9661605c6b2ad21d16e6f5717aafee1d8915aeb5ef90fdb5d801
SSDEEP 12288:RqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Tf:RqDEvCTbMWu7rQYlBQcBiT6rprG8abf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4148	taskkill.exe
4088	taskkill.exe
4324	taskkill.exe
3456	taskkill.exe
4076	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1744	file.exe
1744	file.exe
1744	file.exe
1744	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3456	taskkill.exe
Token: SeDebugPrivilege	4076	taskkill.exe
Token: SeDebugPrivilege	4148	taskkill.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeDebugPrivilege	4324	taskkill.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
1744	file.exe
1744	file.exe
1744	file.exe
1744	file.exe
1744	file.exe
1744	file.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
1744	file.exe
1744	file.exe
1744	file.exe
1744	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
1744	file.exe
1744	file.exe
1744	file.exe
1744	file.exe
1744	file.exe
1744	file.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
1744	file.exe
1744	file.exe
1744	file.exe
1744	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4988	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3456	1744	file.exe	83
PID 1744 wrote to memory of 3456	1744	file.exe	83
PID 1744 wrote to memory of 3456	1744	file.exe	83
PID 1744 wrote to memory of 4076	1744	file.exe	90
PID 1744 wrote to memory of 4076	1744	file.exe	90
PID 1744 wrote to memory of 4076	1744	file.exe	90
PID 1744 wrote to memory of 4148	1744	file.exe	92
PID 1744 wrote to memory of 4148	1744	file.exe	92
PID 1744 wrote to memory of 4148	1744	file.exe	92
PID 1744 wrote to memory of 4088	1744	file.exe	94
PID 1744 wrote to memory of 4088	1744	file.exe	94
PID 1744 wrote to memory of 4088	1744	file.exe	94
PID 1744 wrote to memory of 4324	1744	file.exe	96
PID 1744 wrote to memory of 4324	1744	file.exe	96
PID 1744 wrote to memory of 4324	1744	file.exe	96
PID 1744 wrote to memory of 2184	1744	file.exe	98
PID 1744 wrote to memory of 2184	1744	file.exe	98
PID 2184 wrote to memory of 4988	2184	firefox.exe	99
PID 2184 wrote to memory of 4988	2184	firefox.exe	99
PID 2184 wrote to memory of 4988	2184	firefox.exe	99
PID 2184 wrote to memory of 4988	2184	firefox.exe	99
PID 2184 wrote to memory of 4988	2184	firefox.exe	99
PID 2184 wrote to memory of 4988	2184	firefox.exe	99
PID 2184 wrote to memory of 4988	2184	firefox.exe	99
PID 2184 wrote to memory of 4988	2184	firefox.exe	99
PID 2184 wrote to memory of 4988	2184	firefox.exe	99
PID 2184 wrote to memory of 4988	2184	firefox.exe	99
PID 2184 wrote to memory of 4988	2184	firefox.exe	99
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100
PID 4988 wrote to memory of 1512	4988	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b5455e9-e7a1-4292-9ef9-344dfa4ced4e} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" gpu
      4⤵
      PID:1512
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05212ced-b5e7-4388-86c7-dd6b0798409c} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" socket
      4⤵
      PID:1880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3048 -childID 1 -isForBrowser -prefsHandle 3040 -prefMapHandle 2760 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf87667d-2b20-4515-8257-3b2c99887115} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
      4⤵
      PID:3560
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3028 -childID 2 -isForBrowser -prefsHandle 3948 -prefMapHandle 3944 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d558513-a785-4172-a5e2-ad9c9dc05b3e} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
      4⤵
      PID:4972
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4652 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4592 -prefMapHandle 4672 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9691e0a3-237d-4868-8325-253ba2514ec9} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" utility
      4⤵
      Checks processor information in registry
      PID:3920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5408 -childID 3 -isForBrowser -prefsHandle 5392 -prefMapHandle 5400 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b96b3ab-b8bc-455e-b176-205a809896bf} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
      4⤵
      PID:3376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 4 -isForBrowser -prefsHandle 5620 -prefMapHandle 5616 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d5616d4-2421-4399-933c-418a28e4cf9f} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
      4⤵
      PID:3412
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 5 -isForBrowser -prefsHandle 5764 -prefMapHandle 5388 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {faafb9d3-9647-462c-9ca8-c4b4e8f7d7e6} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
      4⤵
      PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\activity-stream.discovery_stream.json
Size 30KB
SHA256 56140bd94c289f2cb82154a26ed44937b15921ad28007113c67de6ed032ce0bd
MD5 9886e704c1edbca485bcdfcfb33d0d3f
SHA1 021edb52d04dd26f52550cf20ae19f281d5e4628
SHA512 fb8a342eb03d0ace75de9136f5a6f4c83265a5a25d12e549e75612a02990943ebfcf62c2dc19248bbc9d53628ea443e68f8fa023969c72b3b5f0e26521eb64dc
SSDEEP 384:ZOgHJxz/PgakRWJL3goLl95EwyauEFAFqDEBpFZF0WgAbOAb5Gp7H:lxL6qL3/p9rydMoqwBTD0WBv5GZH
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 73a6c755e4ad319bda4d47cf51cc46f5ae01be0cb71ec8481de2736720480014
MD5 cb6c7186b0dae88c6693ff1b91d38fe3
SHA1 719ce8b908b47a2461f4bb6d6f7a51f6c4b8ca64
SHA512 944213825532803e5afb300be53b00716ddcf1f8fd19bc7478dbdc0084fed16d46fe12b789398598d305074af40e13ae6a0817b0e55196a141812b8a0e66a97e
SSDEEP 384:H/w5Iu9fiGLm4pUipHLFoCr/E8HPJyD3VonFcP+AWRMACqIs:8Bi8mCUipHLGCr/E8Rg3V/+hRMFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin
Size 7KB
SHA256 77f04dfd0df8e8486f46b0e05953783b66cc4dab248445a8d4d6f85fba3dfdf4
MD5 05ad691189a68763b773adc047219499
SHA1 b0957e4c876b0e80f3c603d81602a3a8a387d023
SHA512 14869e416b9b38a760745bd78c8f98e87552fdeb60eadec06c33159fec8f493de2fc07fbe7d956bf632f93a7fa5e512c6311069a041da0303c8be4c0dff6e19e
SSDEEP 24:5uB1ongu1xgRbrhpR5cOSZuhMZrbFsh2F3LF5WusJblLKqfb:75o59cOkebVKqfb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin
Size 13KB
SHA256 1ed3c7551b3aca9a1ffc017cfd623f5827a296d7f6211d140d6d63306eaf0ba9
MD5 40914e0ab16a4437e6abb9d93f0388f5
SHA1 1a870ca0c84deffcef34db6b0d5e2b649f04edf1
SHA512 fc88313ac27da3fdfddfed7d2e613dbf739b4976567a11ba6502a4548689e34eb0bb1845bb3f5962943aa5193ef014ef33a922cd008b1006f3b3d17b067314e9
SSDEEP 96:U5oHebVKwb6ebOJwbIpebvpf+wb0b8bqgbgz0bTbPb:U5wu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 b9c9a4fa8a61d99e821634e201c31cb5152d08e47981e1d0380e937506330355
MD5 78e35c728209da1bb3687b91e9a8cce3
SHA1 bfa34d875f1e72bb5d7e6ec068d4e0ea9f65a5fc
SHA512 4e746b4203c72a3f0cf1a3384d1066095af7360914a65f89cf61fc0c0cdfe7908ba849518ed90e506b27f4f98bbd532ef46cc50fc398ac0b9358112dbec66656
SSDEEP 96:xSMF9ZbkW6ShmYePP/PrWZ9PiEQaD4/5Fl66JozGzgClKtmSS:xrvZboSh9wPC/PU5/66JozGzgCl6mSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 b80a855520fc02cd611a9470d44c391c24b92ebe0b7acc8ae8275d7061683a54
MD5 a9b0de1465a004808d73beed75c8e888
SHA1 b8f3a3aff86f161914eac605a64a4bc6677e33c8
SHA512 1ee05a40f9515b43954b64b152262a40593ddd54a4c476edf6cf7a6ccd469b3faba7b8079dc0fa78d4f765eb98f951f6d31919714a34aaf7701eb031ec523dbe
SSDEEP 384:IboEm4PzEYGX+D1DLLfDbRb3VU5/66JozGzgC1bM:A9AYJJDLLfDbRb3VU8Em
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 c6acfcacf40ff18a0886d27e50ee3ff03b8bdc38b1f57dcadae4f1dee23b3975
MD5 71676f4a68052db6b22ae51396d3ef35
SHA1 219d37c767cbbfd9c0844421412964d54015f141
SHA512 6c4d2d67c7ca6f552b896901575771412ef15b83abd5d6886b6e416b975ea18dfffca3e1d51a28660b5bc5567221372ccd7c135830de6f64bfe84952c9165143
SSDEEP 384:ZEYGX+D1DLLfDbRb3iboEVPSU5/66JozGzgC1bM:SYJJDLLfDbRb3GdaU8Em
MD5 SHA1 SHA512 SSDEEP

Submit Download

3922a9e9-a08e-4e1a-8fc1-d29a2088923a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\3922a9e9-a08e-4e1a-8fc1-d29a2088923a
Size 671B
SHA256 828634d0de0b2b0cc4f6d015100087447d85c032a2157e0fe1b5198d04a68b2c
MD5 5b288e7f617f091cf81030ff6b4bc822
SHA1 e6e7a9894d262d09db9cb7faa7888c3b14b0c588
SHA512 e8fa64281cb485a873c5943dbf924df88eb12f62e1ef7ee6beacf373bb53b3f47aa37881003f5d68b46018e17f7b83e00d2eec405dc72becd9ae29e0dab7afa5
MD5 SHA1 SHA512

Submit Download

c5251bd1-3015-40f3-9b98-c30b70471173

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\c5251bd1-3015-40f3-9b98-c30b70471173
Size 26KB
SHA256 7369c34c3d5d053021fe61cf3843ba833899538f5995fa428c8ab48207289591
MD5 1d4c852896b916fd16882ed1bd18bf5d
SHA1 628b28b3c018f89e4d22480ad2d27c8522c5ee40
SHA512 3d592960327f07771779ae0c659a7febe564ef39d99918fecb05db3ed5bfb6782b3e3c02a0baa5f1288f215dc6f8edf508010d9fbc6ae3b0174831ffefc89968
SSDEEP 192:CvmcBb5kK213cz5OAjtXnj2RR7gBz1X9hB2bU9tZOkWtBemxLgFezF2aTnAPjiwf:Cvm7wT96R05XrYrPXzCy8M6b6l7i6sv
MD5 SHA1 SHA512 SSDEEP

Submit Download

c94f10e7-6e0b-4b1e-8b5f-e43f5559dbe0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\c94f10e7-6e0b-4b1e-8b5f-e43f5559dbe0
Size 982B
SHA256 324053bc39e2fe597e1f5c279ec131823192c6e0444acfcd1608f1f90d0a1944
MD5 8935d62a575333ebd6aeab684020fab8
SHA1 e72cf4234d8ce6f06ec5680420df1867d54b5555
SHA512 aa3d30fb4119130098b366dd9ebe810d161ff51bb444a4ffab03dd968a37fbf5a6ecd0c30e4adba9c83b58b9155d416d8bced31cdd15beccb82686e28edc46ca
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js
Size 16KB
SHA256 d8f79218986378e7e0f856d93a5a5b75c343729095f93f8a0693a9cbbc6e5a40
MD5 e915dce2df89dc026ed9eefcde47e88e
SHA1 0339955d88d0737f0a5c7d51b3ac2299fe9aa1c0
SHA512 df80e333cffd9119c6108396fd464458de8c9a2d841e9a51eaec962806f6aca91222edef88274116df0f877c6e3e81015e6b3dd5da6a3f6aacf76dfdbc270766
SSDEEP 192:buGynkR+fpW0jExnTd3Wut5ftx8VGVTtBsZ1O3SaXM+3xniBw8Hwj7vsO:CpLExtWuMV8BY1euwB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js
Size 12KB
SHA256 1b39c8150013599d9973e81c4042374504c1c2fccfca2aa2d23e8af44d74dcbd
MD5 85d8e60784763daaa515fead29307858
SHA1 ea6cd060a7562b7ca19f6ee27966b4bef6e9494e
SHA512 90b35f71eccfd276c9882fc42ac3203778e70903df5333b6a27c938eeb6f9788b158273f9e9dd4c945ce5a15ce66e18b102b6a9f10888be13a3fcefb9d4f6ad0
SSDEEP 192:buG5nkR+fMW0jExnTd3Wut5ftx8VGVTtBsZ1O3SaXo3xZBw8H+:CusExtWuMV8BY1tJwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js
Size 10KB
SHA256 2b39205977680cfa0b1f7b2377dd229bbbd8c068d77633d1484f4f1d235b22e9
MD5 90e167a2998e7c81c08c62ce4fa794c0
SHA1 128f875672cf60141be71a752448d3095001dcb0
SHA512 a9d6f2d3918b38af7866dd9f700f6305a52c4e8986ca140daccb24f00ee7dcc25225f72e376c4bc0b1af1b92c39e71710cc5a9c9ec5dc463070871492093c8a7
SSDEEP 192:duG5nkR+fMbdFs/uI4gYcU8BtD8JJCddLMy1Zzw3baX73xXBw8VS:UuisWuYgUJJ6My1ZzBDw1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js
Size 11KB
SHA256 f5095770fc10c04c4e456f1526e5d0f4f747beadf34b4e59b39ecc4884d69f38
MD5 ca14ef4c2603eaa19968c6f53f05106f
SHA1 f7efd91fa9547601228afb5ed013222d2f50f012
SHA512 6b33b910f2e3c528168b650e168d82327f27a036ee19ac55598918079825670fe3600f6adc3e993aaced5c2a31db5312c174be5a7bb49b92a4cf6fe5a100cf54
SSDEEP 192:duG5nkR+fMW0jExnTd3Wut5ftx8VGVTtBsZ1O3SaXo3xXBw8HS:UusExtWuMV8BY1tDwX
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.1MB
SHA256 5ffd05ffebbe632b4a125684f3c9bdf3174767a11dbe8838ade9fe4f3320ac50
MD5 59fd35640790caf48d82f92993bd8557
SHA1 99da9558b4ca6a5953b57de3fcb7da9501ac8b89
SHA512 4cf4706ac473a18fd82753bd54bced0d73567097323045cf3633d42036a1c7b9544b02115a98b47f91c3d5ceebe242eaa848ad882306f2d2f683ca4eef79bacd
SSDEEP 6144:r7rIUjn393z3m3P3I6oTHP9yE+dk7xXmUdUcjNA/elxZmz0PrY1rvJHCaxPSeHN9:JR+y7xXjW6XK3aY5oI+A
MD5 SHA1 SHA512 SSDEEP

Submit Download