d9749480b21a4d4c977133fe24b27a65a18955cda393d243c331e7d30c786b5c

Analysis

max time kernel
136s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2024, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241029-3q5ekssdnp
SHA256 d9749480b21a4d4c977133fe24b27a65a18955cda393d243c331e7d30c786b5c
MD5 bc172e909f941b88af9d0eb4fb0c16ff
SHA1 d5d4a9130808b2270b4945d84aef86de47f820ca
SHA512 52a31bb0273ce2000708c7a801a3b4f2bae07659f08b8afe8f01e94746e159aca3aaa6381c2f6f57f734c7b97f5da06bd36a548c5be52ae4ced8e9d3bbe17f53
SSDEEP 12288:6qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Tc:6qDEvCTbMWu7rQYlBQcBiT6rprG8abc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2476	taskkill.exe
4652	taskkill.exe
4288	taskkill.exe
4816	taskkill.exe
5096	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2948	file.exe
2948	file.exe
2948	file.exe
2948	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	4288	taskkill.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeDebugPrivilege	5096	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	2084	firefox.exe
Token: SeDebugPrivilege	2084	firefox.exe
Token: SeDebugPrivilege	2084	firefox.exe
Token: SeDebugPrivilege	2084	firefox.exe
Token: SeDebugPrivilege	2084	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
2948	file.exe
2948	file.exe
2948	file.exe
2948	file.exe
2948	file.exe
2948	file.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2948	file.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2948	file.exe
2948	file.exe
2948	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2948	file.exe
2948	file.exe
2948	file.exe
2948	file.exe
2948	file.exe
2948	file.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2948	file.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2948	file.exe
2948	file.exe
2948	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2084	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 4652	2948	file.exe	84
PID 2948 wrote to memory of 4652	2948	file.exe	84
PID 2948 wrote to memory of 4652	2948	file.exe	84
PID 2948 wrote to memory of 4288	2948	file.exe	92
PID 2948 wrote to memory of 4288	2948	file.exe	92
PID 2948 wrote to memory of 4288	2948	file.exe	92
PID 2948 wrote to memory of 4816	2948	file.exe	94
PID 2948 wrote to memory of 4816	2948	file.exe	94
PID 2948 wrote to memory of 4816	2948	file.exe	94
PID 2948 wrote to memory of 5096	2948	file.exe	96
PID 2948 wrote to memory of 5096	2948	file.exe	96
PID 2948 wrote to memory of 5096	2948	file.exe	96
PID 2948 wrote to memory of 2476	2948	file.exe	98
PID 2948 wrote to memory of 2476	2948	file.exe	98
PID 2948 wrote to memory of 2476	2948	file.exe	98
PID 2948 wrote to memory of 1384	2948	file.exe	100
PID 2948 wrote to memory of 1384	2948	file.exe	100
PID 1384 wrote to memory of 2084	1384	firefox.exe	101
PID 1384 wrote to memory of 2084	1384	firefox.exe	101
PID 1384 wrote to memory of 2084	1384	firefox.exe	101
PID 1384 wrote to memory of 2084	1384	firefox.exe	101
PID 1384 wrote to memory of 2084	1384	firefox.exe	101
PID 1384 wrote to memory of 2084	1384	firefox.exe	101
PID 1384 wrote to memory of 2084	1384	firefox.exe	101
PID 1384 wrote to memory of 2084	1384	firefox.exe	101
PID 1384 wrote to memory of 2084	1384	firefox.exe	101
PID 1384 wrote to memory of 2084	1384	firefox.exe	101
PID 1384 wrote to memory of 2084	1384	firefox.exe	101
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102
PID 2084 wrote to memory of 4136	2084	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4652
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4288
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1932 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b03caede-f85c-4d6b-845c-0f755d061131} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" gpu
      4⤵
      PID:4136
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80d5ee83-565c-4e70-a9c6-68303c0fd5f9} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" socket
      4⤵
      PID:3952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3308 -childID 1 -isForBrowser -prefsHandle 3320 -prefMapHandle 3316 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcbd34ca-6ce1-49ec-9c9c-16da5589991f} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" tab
      4⤵
      PID:488
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3720 -childID 2 -isForBrowser -prefsHandle 3028 -prefMapHandle 2852 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67e64506-83c5-44de-8949-19f98eee1192} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" tab
      4⤵
      PID:4436
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3712 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4332 -prefMapHandle 4320 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd45f1ea-ff65-4967-b7f5-7d45937d1c12} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" utility
      4⤵
      Checks processor information in registry
      PID:3000
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 3 -isForBrowser -prefsHandle 1400 -prefMapHandle 5412 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {146d63cb-c8b0-499c-aa13-8c798fc16cc1} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" tab
      4⤵
      PID:6012
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 4 -isForBrowser -prefsHandle 5572 -prefMapHandle 5580 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14693e75-25bc-4327-bb90-f10edecce538} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" tab
      4⤵
      PID:6072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -childID 5 -isForBrowser -prefsHandle 5704 -prefMapHandle 5708 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8bf57dd-f3bf-4a5e-8155-8246c2ba49bb} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" tab
      4⤵
      PID:6112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json
Size 24KB
SHA256 bb2795e305153ac66568ecc15fa092bd14d3c764a576bc3559bab40c7c24ebe0
MD5 a51967bc8701bd4cfb6240f4d2202823
SHA1 933179c9be4fe98b733eb9313e229bf269c412ac
SHA512 b55268d7e18f6be39f0306ed5f33d0f7662178041a0b8590a54431beac67f4d6e5ee64991afefe1b1474ace0c83a94bdb1922d108bfc6a3575896cd299d448ae
SSDEEP 384:a+jxeYQP+4l6Xf9igrsIwpkAhArtnKTEryaua7WI5kg3s3mn:uGff9igrsIwp1uNryda7WI5keSmn
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 cb061e1fc00ada36150f6f184c83798a98c0dce9e4e0c4d20f734606ba116e2e
MD5 fa926c8d4538dcb0725559ce19ccd94f
SHA1 d8f5cce090c5637ec09a6917e8bf5f8439a5c57b
SHA512 0564d03e61fb6da4337a8f41656b8a5e5355af8fd2e44eb3fb6cfb04ba696a46009bea2d695cd8021041cb075902ffd35e9669cb8b28d2fe1666ba5d7614dcea
SSDEEP 384:H/w5Iu9fiGLm4pUNA+Q+4IYKgH4Zv+3yPrIVy8eZqX:8Bi8mCUNxQ+4INy4ZcyzIVy8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 7KB
SHA256 fbf5d0590a8d39aafac88012de421cdb5b447b42bd806ea19e4a1f910c198e30
MD5 72c6584b209ba2e96eb746fb18a82ecd
SHA1 2fdff74d11153bfb8cf51bf0475139bfc551ed5a
SHA512 ef722af224ae6baf19ed822568aae5dc10c5cb4aa73bbeb155994e317b8eeaa94967d59051ba66c404a19ac5945be082b25be40cc822ad6c932b585af6f97e83
SSDEEP 24:5uB1olgu1xgRbipR5cOmuhMZf3Fsh2F3LFBsJblLK5b:h5oe9cO0xebVK5b
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 18KB
SHA256 93a774f690f69ac3cf923fcfc318037bd0e99368e5d2fffed7c8846a1444b925
MD5 97ec91d7a1613f05f086f314c52b1237
SHA1 1a42dee14946f1fb6cc9850e9fc37136627ce06f
SHA512 35f1b72e6f616ef0b2f1e19823c94e5e101d237b52209cd57d3367b2a893a82c418513f11216a946d824e3816ba8099dc2bc0dd7635dcc854e0d3addf48de757
SSDEEP 96:r5oxgebVK2bgebOJ2bXpebvpf+Vbqb2bfgbgzFbqbKbkbCbybPCb:r5Wju
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 10KB
SHA256 aa2233f0e86b0f8f8f6f21425624a4376ae94770d9c1051952ff5cff3970ecba
MD5 ea9d153bed4f1fbf71a70d4d34631080
SHA1 679eb221f1f76b2d7f866679bb35f0b5dfc7c201
SHA512 c32c78cfe8cfe884f6970b44522cc4a80e5fa1d7f7245c4d7b5e2787bc31bd881e4b5d992bf23b9a33cd46f09a797dc77d8097ef6f5fa75f09602c95a461f907
SSDEEP 48:r5oG9cOigebVK2bgebOJ2bGFpebvpf+2b:r5oxgebVK2bgebOJ2bapebvpf+2b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 de6a80e2f54bc52a4d2a84e23b93e06ed4006ad7b09e9ba63c918248194dc62b
MD5 a2eff32578ab4dc9fcea0888010bc1d8
SHA1 e83dd19bd36f6a8548a2af288747241dfc95e788
SHA512 4ac43e455fd80f18d7a7b13c8437a12222a23963fa363e03d9caf20bcb8bf0f894fc6519af70e5041ae0208286e6a731168bade890e51cefa566cef5c9a934ef
SSDEEP 96:6SMF9ZbkW6Shm2UjPP/PrWZ6Ouz9Fl66JozGzgClKtmSSM:6rvZboShirPCQx/66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 ea988d54cd311e237a53b299ac05bb510a407802b7bf4a6c458d2765cf172715
MD5 d36fd3803fd62e4edc6696ca27bf046e
SHA1 76617d6b34c4a9a664970ed1c089613303fd0ba1
SHA512 9b3bd8f42ad5197e255fa2a4a9b9df91fb1f986b15b472f4fb3eb15dd3f9360aeec868d09db532ad0f8622ac7d248f8b440260303fc1be1b378b9752e6334822
SSDEEP 384:nZ1UNmak/TDG2kIbPb4e2boW3PX/66JozGzgC1bM:Z1QkrDG2kIbPbjadKEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 09ee97dead45f7691a8cbb3f585f816330ee59c279d9f05c506f83fe20eaeab1
MD5 c5291f988606a63ff2060b1a044f0e37
SHA1 eb31908e750e1679df6c7e940661c1b3d69a7fa8
SHA512 924a97ccbac14c7580fb2edbb135c1622d0a1b4f77594fa852acf9ec28622024370832024aadfeb53f0c83017cadcd5532e0e4dac1851aa20aed22c48d9aea87
SSDEEP 384:uboW85PP/66JozGzgC1blZ1UNmak/TDG2kIbPb4eH:C0yEd1QkrDG2kIbPbjH
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 60d67aa2d2897fa5b6cab87d1c7a20337ed31935db51d5362b71e9b3be0812c8
MD5 931adf2e99839c146b76429ca6a390aa
SHA1 4c2ff66166f782d8d6849e5b8464e245cf5cae1a
SHA512 1663dbd247b5e15594c0a4b8b2d101f8b224cc277b12e6459c1e294794797683424abf19a2201b15f363fcca90566055f9d0c27a03adb92d26df2cfd97575930
SSDEEP 384:vboZ5PP/66JozGzgC1blZ1UNmak/TDG2kIbPb4eH:z0yEd1QkrDG2kIbPbjH
MD5 SHA1 SHA512 SSDEEP

Submit Download

a5b2c1b5-711d-4ace-8a07-01ff98177e94

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\a5b2c1b5-711d-4ace-8a07-01ff98177e94
Size 982B
SHA256 c06655534c782b20e7ee4111bed38341e3857559ae7d0e490959542210a5a26e
MD5 d665e0057c2536e585f1e427b807904d
SHA1 3305cd7fe9771ccf87f266d77dc6595ae0469ba6
SHA512 4884f5e8f134c9de4f8e5f543ad6daed417cac76c8e22c844d99f1531af2e9c951689d50f436cd24aa9b60837ab299e16d205a7ee2408df2944a82db96324d61
MD5 SHA1 SHA512

Submit Download

a71cc042-700c-4bc4-9710-f6b75906e505

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\a71cc042-700c-4bc4-9710-f6b75906e505
Size 25KB
SHA256 df9ee882de81ee980da902b58a45ee51638e5ebb95a14869f2e1086e67a216a0
MD5 a96cda16dab3cfbf6de16e04aab3e055
SHA1 1a5a098165269755ccc2c927cf52da0618ddfafb
SHA512 620d03517ca2be69ed5e29a0566de3c1772207689eb1f341b64f5d03d36353289b50b600caca7213d72fe43c8d9be33215c3fbbb7852c7dbef9e1b5976689546
SSDEEP 192:lthDaCLYDyTAIErCxkKn7nz/Cxc5RbRBMMyUW3CLg+LLe8PaIKjX6UparONSntWk:ltJndcHrWkS7nscfbRBtINeLazaRc0J
MD5 SHA1 SHA512 SSDEEP

Submit Download

ea90637d-a0fd-4a55-843c-3830a45a25f9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\ea90637d-a0fd-4a55-843c-3830a45a25f9
Size 671B
SHA256 433de0979e87fd48ba1440e296f096e6b274c3e4496821c26e17635cd289fdc0
MD5 54a850d80f125d13a82246aa6a915bf1
SHA1 724faa7cf5c865eaae70316dfd7234627ef46b67
SHA512 9014b991ee23f06b0c329bde16e291dc6b7b75f09036f1a2a08a874766c5f8363e025826bbc1aa7e2c8aa3cee85572b075d5a13aba47aa79120574cca89e1e7e
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 11KB
SHA256 4d10cb136f329d2cf6d017986c2d2ff4c4840e11530258ab34ffe6032c2180d7
MD5 37796dc0b78a6b10bf8c7e8ffff08bcd
SHA1 5023a8c5068eab664c7951b272ad64cfec46e6a2
SHA512 b161b30a250103a0472148d76cc857f2886f0b9ffcd73f958f73b66fdefe8ccb83e43b92a44b010608ce11a9b6777ff127f90eaa0db1e5d646b4d5844d86b914
SSDEEP 192:S5nHRUfU1IFS3bI4k0R+utG8gsddiq2V3UaXQ2nSBw8Hb:Zs3bu+gFJ0Fwa
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 12KB
SHA256 53f1b6b300fb41418c2fd14d6dd2499f7ce69e6eb5ef0e9f6de7382570a55ad2
MD5 18cb0eea05b1d77e538b5688afe7f43e
SHA1 72a835c3d69076ac7157bc64f246e453a4950855
SHA512 ebf08f44deb4afa8e893b19f8dd0d8c011309b632035d5446b37ebd63d3b6b57800ec55880c016f0a78d5345f749fa5bfeae3e11b9e1a6340a6ab38b10dedf87
SSDEEP 192:h5nHRUfU1IFS3bI4k0R+utG8gsddiq2V3UaXQ2nvBw8H6:2s3bu+gFJ0qwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 15KB
SHA256 eede8d4012fe16a6332d2fc8d2b4f0d158eb749b97e787823bca404618a742c5
MD5 a8ee9f540ffd62895120c7ea392a46bd
SHA1 f5af29f6d7ea5bf8e3bd019166de6764dd749401
SHA512 1fb177710f4878e7c6313270ea4cfe261795123212af3055d70e03bfaa00ed2f50820c0f194239926073465b6d4570fac8c0d57e8113150572f935e5726987ec
SSDEEP 192:hmnHRUf71IFS3bI4k0R+utG8gsddiq2V3UaXU+2nvBw8HKBdWFO:Lh3bu+gFJ5qwjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
Size 10KB
SHA256 21a2cb74399e7e57ccbf26a90d888fced08fd9f37805f11132d8a77016f2a8bc
MD5 59b56fc4cff957b14d33bcb7cf5f97bc
SHA1 0a9f54a0269ad08596941036d1153e8cd1ffdb5a
SHA512 add620576fc42eb3c4400c2e4270714af5f09a08eb8883023cf4082c4fde8cf84871a068ddfdee9a508b46cb3c3c5f22de35c67935cbcfb55e7e96d713a3fb6b
SSDEEP 192:S5nHRUfU3G5s/uI4gYcU8BtD8JJCddLMy1Zzw3gaXNI2nSBw8Vb:ZxsWuYgUJJ6My1Zz/Fww
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.8MB
SHA256 260c363a5252c57ba1f21cd9eb8aa00cf914fc7b35c5fb927dda6d14132ef08f
MD5 8ed6828a99d21a01682e3c713d66d585
SHA1 9a72a9764676c19302e2380be5a5677feb9cc445
SHA512 5d715f66df3abba673a11a5ef644e8e688c8acfdba5f59259904f69d347e933a2cfc4115ef9f3bc6bb63cee0db7580fe0e42d5afdb6e9dd7efdc4eda4a52a580
SSDEEP 49152:xcRC5OhmBNL520ybo8HA3aUyWxsBtkjxT0DezmcviKfKTiMSNVBm7+v7McZ30hbK:ec5
MD5 SHA1 SHA512 SSDEEP

Submit Download