1457ee2189e67d3eafc73448c3ce28a65a04fb6fc33b4eb0b375a0b4d782b4bd

Analysis

max time kernel
135s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241101-cdtt7stpa1
SHA256 1457ee2189e67d3eafc73448c3ce28a65a04fb6fc33b4eb0b375a0b4d782b4bd
MD5 5bc8000bad12e3772eb6ede6573a1da4
SHA1 ed7f02861753af5e4a3601769e7696417667da88
SHA512 3adbb9834ff2009a52233788f5f9300edc83dee4fe6f32fd914a55858f8b97c6084d4cc90925ef0f965ad277c4cedbd448b1ee939f939dc218e1d5718507d0e8
SSDEEP 12288:fqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TL:fqDEvCTbMWu7rQYlBQcBiT6rprG8abL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2980	taskkill.exe
2864	taskkill.exe
1964	taskkill.exe
3972	taskkill.exe
3568	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3828	file.exe
3828	file.exe
3828	file.exe
3828	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	3972	taskkill.exe
Token: SeDebugPrivilege	3568	taskkill.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
3828	file.exe
3828	file.exe
3828	file.exe
3828	file.exe
3828	file.exe
3828	file.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3828	file.exe
3828	file.exe
3828	file.exe
3828	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
3828	file.exe
3828	file.exe
3828	file.exe
3828	file.exe
3828	file.exe
3828	file.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3828	file.exe
3828	file.exe
3828	file.exe
3828	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 2980	3828	file.exe	86
PID 3828 wrote to memory of 2980	3828	file.exe	86
PID 3828 wrote to memory of 2980	3828	file.exe	86
PID 3828 wrote to memory of 2864	3828	file.exe	93
PID 3828 wrote to memory of 2864	3828	file.exe	93
PID 3828 wrote to memory of 2864	3828	file.exe	93
PID 3828 wrote to memory of 1964	3828	file.exe	95
PID 3828 wrote to memory of 1964	3828	file.exe	95
PID 3828 wrote to memory of 1964	3828	file.exe	95
PID 3828 wrote to memory of 3972	3828	file.exe	97
PID 3828 wrote to memory of 3972	3828	file.exe	97
PID 3828 wrote to memory of 3972	3828	file.exe	97
PID 3828 wrote to memory of 3568	3828	file.exe	99
PID 3828 wrote to memory of 3568	3828	file.exe	99
PID 3828 wrote to memory of 3568	3828	file.exe	99
PID 3828 wrote to memory of 4936	3828	file.exe	101
PID 3828 wrote to memory of 4936	3828	file.exe	101
PID 4936 wrote to memory of 3068	4936	firefox.exe	102
PID 4936 wrote to memory of 3068	4936	firefox.exe	102
PID 4936 wrote to memory of 3068	4936	firefox.exe	102
PID 4936 wrote to memory of 3068	4936	firefox.exe	102
PID 4936 wrote to memory of 3068	4936	firefox.exe	102
PID 4936 wrote to memory of 3068	4936	firefox.exe	102
PID 4936 wrote to memory of 3068	4936	firefox.exe	102
PID 4936 wrote to memory of 3068	4936	firefox.exe	102
PID 4936 wrote to memory of 3068	4936	firefox.exe	102
PID 4936 wrote to memory of 3068	4936	firefox.exe	102
PID 4936 wrote to memory of 3068	4936	firefox.exe	102
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105
PID 3068 wrote to memory of 4668	3068	firefox.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad2371a6-a083-4a1e-a02d-b16e70990d9a} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" gpu
      4⤵
      PID:4668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2484 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2412 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f51d106-40cd-451e-8672-d1026021a79d} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" socket
      4⤵
      PID:5108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3064 -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 3052 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eca49e07-131a-4b9d-961d-933567faa6f5} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
      4⤵
      PID:2344
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3044 -childID 2 -isForBrowser -prefsHandle 3680 -prefMapHandle 3676 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36039e20-287a-4f9e-af87-d5c74364c251} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
      4⤵
      PID:4324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4628 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4620 -prefMapHandle 4616 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49670687-a037-4ec7-85d4-f0210f21dfcd} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" utility
      4⤵
      Checks processor information in registry
      PID:5204
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 3 -isForBrowser -prefsHandle 5288 -prefMapHandle 5284 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08ba5d7e-d313-4c14-bd99-4dd74a4018cd} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
      4⤵
      PID:5932
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 4 -isForBrowser -prefsHandle 5440 -prefMapHandle 5444 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82cf623c-216f-4024-b251-de7e7dbbfaa2} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
      4⤵
      PID:5944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5740 -childID 5 -isForBrowser -prefsHandle 5732 -prefMapHandle 5728 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57209a2d-a4a1-4fe1-998c-d596fe4a9348} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
      4⤵
      PID:5964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\activity-stream.discovery_stream.json
Size 21KB
SHA256 4d1a9f9f0ed3ce1bead108eb15dc70d8b3c380df48663352ab1532b96e3655f3
MD5 d964b5a928d25b22eb1720090c6ba714
SHA1 34c38736d00c84f20bfc77f297249d69125c019e
SHA512 1732942f7312ef73e93a8e0de78f94c734f639345eda2e3b0ef9d7ab73372c7e9a4a2824b16b59c5205e12b9a78a967d76d0f82103adf4d72123e150d99518f7
SSDEEP 384:vwQk/VpavCRZhnFSBtSqLF2W00APks+pU6eS3JyauYXFTXF3G:vwX9pPRn0BtVLF2W00uS7eSZydgh3G
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 7e82d09f8ae05b98fc33c36d7beca079c34b60f57dc4f05b9523e7364f71eb57
MD5 8b8de4bb276b12d4730f28efe4e81472
SHA1 dad58866bc8004bc8a972736e0aa6672e112f7b6
SHA512 a30c8aaa58d57ff60b4fd91b64bc9aab6e23c2b699156f28edd12ea66011a2b62e368e2b61c9d93f347dbdfef53f66913e4c563dac47cc7c5e85d47585b1bec4
SSDEEP 384:H/w5Iu9fiGLm4pU2A+Q+4IYKgH4Zv+3yPrIVy8el1o1B:8Bi8mCU2xQ+4INy4ZcyzIVy8N
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 7KB
SHA256 7a4e0b8ebd11bfefa0e99e7b144a0247b8b0ab3df60df4ef7842053494586796
MD5 f830b86751411094e6a501a23628c1e0
SHA1 9915e6f78cbd85861db162295877a2ab232b7ffb
SHA512 f99aed23e405c348564deb619a0ee77b9c0a7856937fc3e1294ba4d21d6b9bdb5b6dd6af2a656c5c5282ae95f1fe6ef724e0f25d1a32e131c2694c8ffe84d578
SSDEEP 24:5uB1oznregu1xgRbVvpR5cOuuhMZFFsh2F3LFmsJblLKYb:vre5oJv9cO5ebVKYb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 11KB
SHA256 b232866c8d4294f9c46ac188ab0da8158e0b7e100d3c96de68f969e82ae1ab22
MD5 21b86e3df7c351c95f1157704a8f68a9
SHA1 caf347b1a3e3c53941ac62181347ec49c4709466
SHA512 cf0220195a531cad2656595a4e56eccfb868f707bfc708379c1c0d252b5ba89148eb6f35ad77698781e32f2fe9071238fd7dd5b08163d3aafa050e6873eea840
SSDEEP 48:l5oy9cO3ebVKYbmebOJYb8pebvpf+YbibSb:l5oGebVKYbmebOJYb8pebvpf+YbibSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 18KB
SHA256 93eb21e4831cb8899d6f4e7b96d72a9247574bb1afada4ea38ebb2aaaeba0d64
MD5 c760d4d1f699b49a06c152bed48caa2b
SHA1 09f2ff28c0c4a7739a8f7adabcc9ea006a5d61a3
SHA512 205953ada0be8df225dd93e3ab125441c9dfed10f7292da1524df4978cdb5013977978da2db065250e9ce00f2937748871d58a14e45c78f046e9ff21c88fd387
SSDEEP 96:JH5oGebVKYbmebOJYbTpebvpf+pbibSbHgbgzNbGbebxCb2bWbs9b:V5OuwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 d8c6f9d028721a2b6f309ea7e124dc56350faaef919ca7bfcbc12d3580acde6f
MD5 25ad9e20cfe4256faf52ea4f393ae56b
SHA1 350219f9d451314e74f18fb3d89bfa99f3978c81
SHA512 964e9e384682018a91c5b0862e4697016fd7b1fb9e01fa85128e25d48578ecf1d97db54a93527fc1eecbd7224cf5be83da1c32e16a82eb45d67b2b5fc5bdda39
SSDEEP 384:CXqTv/gpQhINLKPdFXmPKMEf/6b4bCbnbvbKbe9bCbsbg6AjUdb3ck/66JozGzg4:CXqTvqQheLKPdFXmPKMEf/6b4bCbnbv3
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 9750736ee3760da8e0ce5192cf17d9317004ca01e93b3ee5739b5b67b20c4c05
MD5 d39d3e27a0a2a990af70fc9c7f2c6317
SHA1 2920c3343d4e0b5a9db8634b249849f023081102
SHA512 9525195a0cfcfcc18137107059a8174c939a04c5ba725cacb7f85fd56bed67e184b21cd5fdef594253730cf0484390ec26932cb6c425cee16a7becd3521470a5
SSDEEP 384:CXqTv/gpQhINLKPdFXmPKMEf/6b4bCbnbvbKbe9bCbsbg6AjUdb3ciboYRPF/660:CXqTvqQheLKPdFXmPKMEf/6b4bCbnbvO
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 23KB
SHA256 9295ddfe83fd055ae28cbf15a1dc3a6de15d3c0fe9d3d271ebc3a82941a7feaf
MD5 4f6a22d652c73d70a7730826537e94dd
SHA1 1b1d3a62058bcf27330e65b24ec5f68d6185b69a
SHA512 72bf08c8f13b357b417913e978dcdf6a2720379660d16d600255ecca43c9e5b047317d1d2f7c2ce4b41d000e73e48b93c65357623009f753e57772372b816942
SSDEEP 384:W/66JozGzgC1bEXqTv/gpQhINLKPdFXmPKMEf/6b4bCbnbvbKbe9bCbsbg6AjUdl:TE2XqTvqQheLKPdFXmPKMEf/6b4bCbnn
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 01c49065cf9cf048b3e7522e2b5873cfb954a79727ca5e1a8f8fc52150a24b3e
MD5 60b3eb1f412de939a7dc3dc905472ff3
SHA1 b6d869fc70a4c6715fcf591b784423fd9435f055
SHA512 f9cd9d6b47ef380d03f89842e3efbc1403537edd6f2c4c2751f59d28b8440fc8a307ffe7bf64c45c06aa11014b1569c5cb5e2ca5423194bc1e23c0ca155db1da
SSDEEP 768:TEDRUOfkhN3IDdFVmPKMEfxSb4bCbfb7bKb8bCbsbKyPO49Kd40:MRUOchN3OyPO49KF
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 0a8d7f34b1507c8caefdc5faa2d82095cf907d8aea09fd4ff025cde16aa701ab
MD5 fa770e568055f0ff66d2d9345dea6a8d
SHA1 cb21d930caab007bc2fdf30146e247197c711ae3
SHA512 f3ba10842a7081d142aad8fbd1d3eeff78b8f74a72135a89c5ea65eac7e18b3368bc81cae2459aa3c2c0f4c257968d091cb61075ea2fa4387546b51d8ece2e08
SSDEEP 768:Yw9EDRUOfkhN3IDdFVmPKMEfxSb4bCbfb7bKb8bCbsbKyPO49KW:ERUOchN3OyPO49KW
MD5 SHA1 SHA512 SSDEEP

Submit Download

462e2846-6cda-4a52-bbd6-0dd82a961839

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\462e2846-6cda-4a52-bbd6-0dd82a961839
Size 982B
SHA256 371d1094c44ff943615df36f458ca7ef4824c898f15c94c8c2bd234869bd4bd1
MD5 8a240985c10c10e88d44def1304b8a1e
SHA1 2552bb49376969c255952ccc1fe6b94bff6bb55d
SHA512 3527c3b0367dc49c2d9473e19e7ccc2f792ccb1010c98a7086e96212513f1c1c418f683006278aa506eb719a1613a1a08c77c9cce9c6cac39c864df3aa18d297
MD5 SHA1 SHA512

Submit Download

d48d61f5-f15d-4a7b-969c-6857ff46b22d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\d48d61f5-f15d-4a7b-969c-6857ff46b22d
Size 659B
SHA256 e5adb20801f9131db2e4af49eded36c9b54f8f68b198382af26792c4ea455a51
MD5 7e0b230a23619a34c3bee7781b9e8ed7
SHA1 2a1cd7d6ec8fd5714027ff4e1c721e0cc5605c38
SHA512 a0ad1bcb1dd0ec8db301a970bb19cccafc2af8d22a2b93b6f83912fe2516328a64b7ac69c6bb9a839e8b8075c249dc9571f7b1879ec7339b1ac6b3eb92882082
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
Size 12KB
SHA256 6643fa822bf5c8ea6ac209060fe13cb80ed4dfaca24ccd9221beea862a8648d7
MD5 3da4ebed4e5a3775e84c9427461c9658
SHA1 fa4dd2956988ff370549209a989670c64b713c62
SHA512 e59e655ef6758d353b3e58024fa17c2bbadf73b0f10d39b90aa4f7216f3f38f587997c97aec2df1853f306e94b97c3f6f0841e251d4c039076cd0dbab6b89045
SSDEEP 192:Lb5nYRof/TPNwguI4c2RtK82Msdd5y1Z9A3jaXLMjlNX8KBw8Hu:LtZwgu22z2Mmy1Z9tqlNX8YwX
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
Size 16KB
SHA256 b65403d94cace40c3e67ab817c2719793e1612486b423d11190d8f05ae31d873
MD5 cbc83e1b3de7a7ff1352821fed456c0d
SHA1 a375b4a87c316910286d6edf2a9bf2579734f2cf
SHA512 1b6faf09caf52ffec1b50c5d16b431b7377dfab7a78f04cba419b69156c2a1788463f0092bb18a9f412f02bb3e20c996770d91ee3839b46088c0a83144c0e269
SSDEEP 192:LbinYRof1TPNwguI4c2RtK82Msdd5y1Z9A3jaXN+MjlNX5fiBw8HbjXxiF:L8Pwgu22z2Mmy1Z9eqlNX5IwQc
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js
Size 11KB
SHA256 c042598b4a2700d870889a2a746959b48d10fb9a519690ddcb4df2736e843237
MD5 95ade89881e81cc719c43bf9b0dbf304
SHA1 7f3bcac85537dd05566b9083f3b7cb9465bad358
SHA512 c6d57f03f79e9627e104d32668ec0f792ccfd8e916123c7bdbf443438ffbec61e75ed022605732f7abb9afc607d81772f375be87b77106cd7e55f491cb35dbd8
SSDEEP 192:Ob5nYRof/iXNA3psxnHd3LtVNUnNt+8+V0tDsS3waXw1MSBw8H8:OtnuxxLtuzDODw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.1MB
SHA256 465863ed67072a43520ea6986ffbd14d72724666f9158e02380ec55b3f725862
MD5 4a945eac15b75290dae07363b0544696
SHA1 f465e2bde92f4a812030872a4467e1fb348fe301
SHA512 1052403dac9f4b970c535bf1680bd223c155bedcbd934c131a5bcf90e2c10395527be9233430264c927e31ceef7a177a98ee11a4419313029b8b3b91ba5cc047
SSDEEP 6144:U7rST3K393z3m3FTHLymqajZnIstxUdUYRta2Jth8teDseHN1HmcH11HMZmz0Pux:TymZjZnIstSWYhZ3evK3td7
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.2MB
SHA256 f5e8e4cbb3b8b25acef986c5f04cfb4c26895da7ba22dac6783eddeef6e2ea0a
MD5 cb03aedfa9d7ee1e0d6598a8e25c6921
SHA1 3df1180be908d29f740c0f625b443ec5ba56996f
SHA512 7fc63668027f5eb80f80e85cfbaf9d7905e84feac8a15a78943022877b572efc26596ecdbe86e2ee04865edb24b98b9655453fb016fcf28739a7555e8920488f
SSDEEP 12288:3JA2bWkn9JB6hlVtdzER2kDDmrp5Fr4npEI:5Hb1BelVHzERbOrVc
MD5 SHA1 SHA512 SSDEEP

Submit Download