b8e3cbfd6d722e1554e0298e813364923aa110ff8a974efed6145f8152002bd0

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241029-cl9wdsshkp
SHA256 b8e3cbfd6d722e1554e0298e813364923aa110ff8a974efed6145f8152002bd0
MD5 6d68e932a3016f908c8db34e0c9f8a1a
SHA1 7ad79f1601a91275764fcc3977278c013bd94812
SHA512 76ec99241252a0fc2ca18bd725c2103184c8cf6c4039b75323d263e0df013413acb110b64a5d993945f58a821fd65bfd3e71f6e14a6415f55ed45e76cbcbfc17
SSDEEP 12288:ZqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TE:ZqDEvCTbMWu7rQYlBQcBiT6rprG8abE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
388	taskkill.exe
3720	taskkill.exe
1084	taskkill.exe
2220	taskkill.exe
3768	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1956	file.exe
1956	file.exe
1956	file.exe
1956	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	3768	taskkill.exe
Token: SeDebugPrivilege	388	taskkill.exe
Token: SeDebugPrivilege	3720	taskkill.exe
Token: SeDebugPrivilege	1504	firefox.exe
Token: SeDebugPrivilege	1504	firefox.exe
Token: SeDebugPrivilege	1504	firefox.exe
Token: SeDebugPrivilege	1504	firefox.exe
Token: SeDebugPrivilege	1504	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
1956	file.exe
1956	file.exe
1956	file.exe
1956	file.exe
1956	file.exe
1956	file.exe
1956	file.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1956	file.exe
1956	file.exe
1956	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
1956	file.exe
1956	file.exe
1956	file.exe
1956	file.exe
1956	file.exe
1956	file.exe
1956	file.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1956	file.exe
1956	file.exe
1956	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1504	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1084	1956	file.exe	84
PID 1956 wrote to memory of 1084	1956	file.exe	84
PID 1956 wrote to memory of 1084	1956	file.exe	84
PID 1956 wrote to memory of 2220	1956	file.exe	91
PID 1956 wrote to memory of 2220	1956	file.exe	91
PID 1956 wrote to memory of 2220	1956	file.exe	91
PID 1956 wrote to memory of 3768	1956	file.exe	93
PID 1956 wrote to memory of 3768	1956	file.exe	93
PID 1956 wrote to memory of 3768	1956	file.exe	93
PID 1956 wrote to memory of 388	1956	file.exe	95
PID 1956 wrote to memory of 388	1956	file.exe	95
PID 1956 wrote to memory of 388	1956	file.exe	95
PID 1956 wrote to memory of 3720	1956	file.exe	97
PID 1956 wrote to memory of 3720	1956	file.exe	97
PID 1956 wrote to memory of 3720	1956	file.exe	97
PID 1956 wrote to memory of 5000	1956	file.exe	101
PID 1956 wrote to memory of 5000	1956	file.exe	101
PID 5000 wrote to memory of 1504	5000	firefox.exe	102
PID 5000 wrote to memory of 1504	5000	firefox.exe	102
PID 5000 wrote to memory of 1504	5000	firefox.exe	102
PID 5000 wrote to memory of 1504	5000	firefox.exe	102
PID 5000 wrote to memory of 1504	5000	firefox.exe	102
PID 5000 wrote to memory of 1504	5000	firefox.exe	102
PID 5000 wrote to memory of 1504	5000	firefox.exe	102
PID 5000 wrote to memory of 1504	5000	firefox.exe	102
PID 5000 wrote to memory of 1504	5000	firefox.exe	102
PID 5000 wrote to memory of 1504	5000	firefox.exe	102
PID 5000 wrote to memory of 1504	5000	firefox.exe	102
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103
PID 1504 wrote to memory of 4524	1504	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3768
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:388
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3720
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {131679ad-b2d3-4d80-aa0c-c165891bb885} 1504 "\\.\pipe\gecko-crash-server-pipe.1504" gpu
      4⤵
      PID:4524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb6b409c-7650-41fa-84a0-5dded3a99e6f} 1504 "\\.\pipe\gecko-crash-server-pipe.1504" socket
      4⤵
      PID:4964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3180 -childID 1 -isForBrowser -prefsHandle 3184 -prefMapHandle 1620 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6af4b2c3-9f32-4c85-918e-a5218613394f} 1504 "\\.\pipe\gecko-crash-server-pipe.1504" tab
      4⤵
      PID:3164
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3812 -childID 2 -isForBrowser -prefsHandle 3796 -prefMapHandle 3064 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {161a3530-61b2-4abc-94bc-3e2a65062433} 1504 "\\.\pipe\gecko-crash-server-pipe.1504" tab
      4⤵
      PID:3304
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4608 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4592 -prefMapHandle 4600 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c819ffa-d33d-498b-a33b-bd8e0792ab72} 1504 "\\.\pipe\gecko-crash-server-pipe.1504" utility
      4⤵
      Checks processor information in registry
      PID:4092
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 3 -isForBrowser -prefsHandle 5388 -prefMapHandle 3784 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56b86113-f6dc-46e2-b266-f45476ed2182} 1504 "\\.\pipe\gecko-crash-server-pipe.1504" tab
      4⤵
      PID:5676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5520 -childID 4 -isForBrowser -prefsHandle 5532 -prefMapHandle 5536 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5364df7b-c8b3-4263-b66b-059654df2f85} 1504 "\\.\pipe\gecko-crash-server-pipe.1504" tab
      4⤵
      PID:5688
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 5 -isForBrowser -prefsHandle 5756 -prefMapHandle 5760 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3cab51b-23a1-4d8a-9172-0045c0170403} 1504 "\\.\pipe\gecko-crash-server-pipe.1504" tab
      4⤵
      PID:5724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\activity-stream.discovery_stream.json
Size 34KB
SHA256 82d4367d245a8c3e05ef2d1d703d051a8800263936c1674d28ad03d897282e15
MD5 af89b6db3d8676aa66d935d4384cc89d
SHA1 a4ff669e0a4e5e576df9af87feef0396e398c260
SHA512 4bbe76c31cc637e120c3b364d84d431034ab4d2b744ec600081a17737d4c27532e0c67d5bf782ac4098aefc5c85f8cbeac26f41619d249327a1d845e6d1c6665
SSDEEP 768:CFq0dIuTjxKtyd2jZjE6RtYPNP3Y7oXTDU5:CF5VK8laYFgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 646ce7037821efb82f898ff9c35a54334c595d762aaafb24eca39ba89deca8fd
MD5 ce775c00f5d9b8dd38f57a78f272072b
SHA1 809f8bb1347b5a23b38650c0ffc2fc57ab993897
SHA512 a0fa50387b23437a46964c38f4850f7b8e25d85c6e10cc8efde02234ab71dccf343e0086bef6f7e8a217b93654814e5e3f7e960aa87eac33ce38dbd1ba9a25b8
SSDEEP 384:H/w5Iu9fiGLm4pUUA+Q+4IYKgH4Zv+3yPrIVy8eEJJ:8Bi8mCUUxQ+4INy4ZcyzIVy8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
Size 13KB
SHA256 e1be3c9d2ef90b948539635217c0f2acf3a364ad0609916c7a52f1a62f8f3f7d
MD5 d4b32ee468f1cd2ede6ebcdd0aaff6d4
SHA1 19067a39e80b14d30426024fa590d6f27cc6e6d5
SHA512 9624fac7cf21a1defdae9af72daede32fdbb846afd90bac294a235c0936a2f599cc568073e33451c868c1dfc54d3c2e5a6813c8fbd4475a4f34f9f07446abae4
SSDEEP 96:45oYebVK5bzebOJzbppebvpf+zbWbKbiCgbgzVbGbmb:45xu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
Size 18KB
SHA256 63763bbce6f5287e74655db65741c1f7cc31799185d5ff84a3526676ce78e581
MD5 d6e258e8d78cff5bd73e93066ac8298a
SHA1 05b2ddb35f141af299d750c831326e3679e4bf2e
SHA512 67b06d30065ff8d063b195d289cd60d60e7cc6a1ecd87314eb07a7b91292d9af0df54e6734e6a4f8736bcae17bb1466e3915cb428442ff4201aee66139dcb447
SSDEEP 96:A5oYebVK5bzebOJzbDpebvpf+9b1bBbiCgbgzVbGbmbobOb1b9b:A5Lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 c572fcfbc4daf51a4a9a0e0a640369fe9b6aa85b31c8d0bc70badb41228481c5
MD5 2356a8b1bd749efb69e65616afecd794
SHA1 b353878a1ef74aca8b52b57d2e8e41871d196732
SHA512 f24a5a175ed7988d25cc0f7567a621eba841db6eba076c50802fc5ba6edc8255768172fc0c176ea2400d62c1b047729a1ca4d07d1b990b2d10ad1f18639ca9a5
SSDEEP 384:HQboSKPpKO/66JozGzgC1b3LogvW4/ycVNPWGVyNNMUvg9bibsbIbIbRbjbxbobU:444EpRF/LvPWGVyNNMUvg9bibsbIbIbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 08574055ebfdf0a66771fece9c3b5529b21c686b0eeb0085be76e471cc127aee
MD5 0c2e7c67ff641d39f0b0365d5808748c
SHA1 299c5037396f8a82350617ebc04ae036dcc81062
SHA512 1e525fd2a28454fd2cf5bf26972bae223bce2d0b13328f2223fb5b1bda865b4f394a6b259d5946ab9053c3193fbd0654bad18114f698cb5197f9c4271cd11dbc
SSDEEP 384:tLogvW4/ycVNPWGVyNNMUvg9bibsbIbIbRbjbxbob8+l1sj4QKO/66JozGzgC1bl:tRF/LvPWGVyNNMUvg9bibsbIbIbRbjbl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 24KB
SHA256 f39e3617a956cf4c76aaaaca545eb49a7c42cd580eeaed43ee22982e46c33103
MD5 a62aebeb22c6ebf969723267061a1a07
SHA1 c745e7effada46971de99e35d87d345c7595f669
SHA512 589aacb6b5bb337fee3f091124b210312397482678b037bf5905f558431f7151bdaff1d15d70f58465813cd1c74a05a5c7a0485185e1cedc1453d1e8907bf2bc
SSDEEP 768:NIzIV5nDWGOWNNMUvQMbibsbub0bRbjbxbobmT+v0uT5Em:NoAT+v04
MD5 SHA1 SHA512 SSDEEP

Submit Download

12c48ea4-948b-4db2-93a2-2452673b980a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\12c48ea4-948b-4db2-93a2-2452673b980a
Size 982B
SHA256 088c5514bfe7dfc44dcf4c49886fafe01f09e4097c59739b47abf1d8b2239ca2
MD5 e22001c7d162e55b32ea5c6651823dd7
SHA1 0e5648c78f64fe5bec56488d478d3db4db2f0fad
SHA512 2bc05baad432bc18355141c17ac7f10b6d42828bd2daa8a67833029ce452d5d448b6df9a5413e2646913a274c32107f0a5e8b220e96d9c1aaf13069dc4e409f0
MD5 SHA1 SHA512

Submit Download

1ec2de31-dc67-4118-83f3-32ed066d6051

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\1ec2de31-dc67-4118-83f3-32ed066d6051
Size 659B
SHA256 b5f4f4d65fb59dfdb286536a3084287f1745bea27a9f1b1ac6e4c729e93e7913
MD5 e76314e07a4dd156bf4bc1aeb80af23e
SHA1 641e5f3636c14324fe775046ed4a629c455813ad
SHA512 294a29e021d5dd256fcf84e9cdb166e5e07f583b819c043de8449e6971c08cfa4eb63134a33529d01a3dc59c513257c811cf9b12a07d93f97e11a604f9d08c23
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
Size 16KB
SHA256 b7299b2dbfe61599859d208385e5e4b44de4ce102d8a76e3f2a9193dd7d114a9
MD5 835ef61e756a41c7c0980f8022504287
SHA1 1ec56fa3658549798ebb718da1345b6be97110a0
SHA512 7400c1dc8bf2bbe4a46712610a7c06edcb1ff1266d9517b75134ff3b7dcfc40a48197eca7ec8e30b157252020088c70f89ebaf0eae48a2e9f6d7e69762266cae
SSDEEP 192:JGnARLbfGUo+4MIfrxXEUwtSPNdgd9ZQHrA53GaXf+EVo5iBw8H0mzzn8q:5fa5zRf69ZQLw6EVXwrMH
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
Size 10KB
SHA256 6bba86b56e795ed755b19be8c451f99f21426bb607d8693a64140357526ea593
MD5 ed0d00bd054fdcd93c5948cc6a3ad64e
SHA1 0d1b1b1238fdd824ae2e9e7ce089a89168d304ca
SHA512 a49d9c0c91b411c6ac91d253c352b08badef2f8a93164ff732593791f8b92f29b7a24467d8e9a9666f259d6965d9c5a7047b27f2bbbfa17aa0cb39bfbdb4e15a
SSDEEP 192:Y5nARLbfXZzjs/uI4gYcU8BtD8JJCddLMy1Zzw3laXcYEVo8Bw8Vd:pJsWuYgUJJ6My1ZzREVfwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
Size 13KB
SHA256 22ffd7b03096e91828d60bfcd19467cc3641c0497c9631e207858224ae46237f
MD5 970ff732f4f5953762b3022f8ef544d6
SHA1 559e248a2d791e95805f3aa18639003f5faed3d8
SHA512 82a5ecb036ef4a34a4c15e4b353c9ac9a3e838669f622902545544dffa22b56c820d08e7c35715fa2e6145ad710ea95ad69ae80a99963a013a40ba75144e192c
SSDEEP 192:J5nARLbfXUo+4MIfrxXEUwtSPNdgd9ZQHrA53GaXFEVoFBw8H06F:Aca5zRf69ZQLwxEVgwr0
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
Size 11KB
SHA256 2cb26d6b557c48df661cdc7a117b332cdfce73580581109369b89b83990defd2
MD5 eecd6a751f4248060ce81b8408655109
SHA1 db959694376efc8ac579bbbd4f5e80052615fbad
SHA512 ba7216b103b96eb2b0a98227f22b9f7532b4c6b3d5be395bf5b14ed734695d4199d354d70675d25e95a60d0d8a58a0892c6a0afd15dac90f6791fe3ddfc060af
SSDEEP 192:Y5nARLbfXUo+4MIfrxXEUwtSPNdgd9ZQHrA53GaXFEVo8Bw8Hd:pca5zRf69ZQLwxEVfww
MD5 SHA1 SHA512 SSDEEP

Submit Download