a1aed5eec034f30b4495d73244f92ad55b82004ebe7d5a99708ef850de68fe69

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 900KB
Sample241117-cwt8payjhx
SHA256 a1aed5eec034f30b4495d73244f92ad55b82004ebe7d5a99708ef850de68fe69
MD5 5088fec99324d682f547843d31486dc5
SHA1 88eddd57bc8bdfca17ad0fc363b1671299cb6383
SHA512 94b56ee485e0da2343c0d7b6edd4c4c72f2a6f0aedc6ca7a1294b02d84e7a4501607d81c153f262b6fac1fdb363438923551877606b5fc47893fa1294c2e8dd9
SSDEEP 12288:+qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga5Tz:+qDEvCTbMWu7rQYlBQcBiT6rprG8a9z
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3044	taskkill.exe
4924	taskkill.exe
1596	taskkill.exe
2636	taskkill.exe
1400	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3468	file.exe
3468	file.exe
3468	file.exe
3468	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	taskkill.exe
Token: SeDebugPrivilege	4924	taskkill.exe
Token: SeDebugPrivilege	1596	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	1400	taskkill.exe
Token: SeDebugPrivilege	4868	firefox.exe
Token: SeDebugPrivilege	4868	firefox.exe
Token: SeDebugPrivilege	4868	firefox.exe
Token: SeDebugPrivilege	4868	firefox.exe
Token: SeDebugPrivilege	4868	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
3468	file.exe
3468	file.exe
3468	file.exe
3468	file.exe
3468	file.exe
3468	file.exe
3468	file.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
3468	file.exe
3468	file.exe
3468	file.exe
3468	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
3468	file.exe
3468	file.exe
3468	file.exe
3468	file.exe
3468	file.exe
3468	file.exe
3468	file.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
3468	file.exe
3468	file.exe
3468	file.exe
3468	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4868	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 3044	3468	file.exe	83
PID 3468 wrote to memory of 3044	3468	file.exe	83
PID 3468 wrote to memory of 3044	3468	file.exe	83
PID 3468 wrote to memory of 4924	3468	file.exe	90
PID 3468 wrote to memory of 4924	3468	file.exe	90
PID 3468 wrote to memory of 4924	3468	file.exe	90
PID 3468 wrote to memory of 1596	3468	file.exe	92
PID 3468 wrote to memory of 1596	3468	file.exe	92
PID 3468 wrote to memory of 1596	3468	file.exe	92
PID 3468 wrote to memory of 2636	3468	file.exe	94
PID 3468 wrote to memory of 2636	3468	file.exe	94
PID 3468 wrote to memory of 2636	3468	file.exe	94
PID 3468 wrote to memory of 1400	3468	file.exe	96
PID 3468 wrote to memory of 1400	3468	file.exe	96
PID 3468 wrote to memory of 1400	3468	file.exe	96
PID 3468 wrote to memory of 1172	3468	file.exe	98
PID 3468 wrote to memory of 1172	3468	file.exe	98
PID 1172 wrote to memory of 4868	1172	firefox.exe	99
PID 1172 wrote to memory of 4868	1172	firefox.exe	99
PID 1172 wrote to memory of 4868	1172	firefox.exe	99
PID 1172 wrote to memory of 4868	1172	firefox.exe	99
PID 1172 wrote to memory of 4868	1172	firefox.exe	99
PID 1172 wrote to memory of 4868	1172	firefox.exe	99
PID 1172 wrote to memory of 4868	1172	firefox.exe	99
PID 1172 wrote to memory of 4868	1172	firefox.exe	99
PID 1172 wrote to memory of 4868	1172	firefox.exe	99
PID 1172 wrote to memory of 4868	1172	firefox.exe	99
PID 1172 wrote to memory of 4868	1172	firefox.exe	99
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101
PID 4868 wrote to memory of 2668	4868	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4924
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1400
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e5b7b18-897a-4779-a216-d613fc1043fc} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" gpu
      4⤵
      PID:2668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e12928fa-c44c-4e47-9cc8-050e59c09bb6} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" socket
      4⤵
      PID:1140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1584 -childID 1 -isForBrowser -prefsHandle 2808 -prefMapHandle 2804 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34fc0895-8893-473c-927c-b5b9d1f36087} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
      4⤵
      PID:2612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3124 -childID 2 -isForBrowser -prefsHandle 3668 -prefMapHandle 3664 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7e43b1c-460e-4611-8d16-2481cfcf19ff} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
      4⤵
      PID:1720
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4772 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4724 -prefMapHandle 4728 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {255d0be7-fd72-4475-a3be-7ed703d7dab7} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" utility
      4⤵
      Checks processor information in registry
      PID:5008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5140 -childID 3 -isForBrowser -prefsHandle 5132 -prefMapHandle 5124 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55ecd545-e78d-423b-8888-c428913d110a} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
      4⤵
      PID:4252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 4 -isForBrowser -prefsHandle 5312 -prefMapHandle 5316 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7f3fb75-bde5-4cb9-ab59-4d2898f11d49} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
      4⤵
      PID:5020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5504 -childID 5 -isForBrowser -prefsHandle 5540 -prefMapHandle 5544 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28535bc3-cab4-44a3-9e04-64b85d6cbdc2} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
      4⤵
      PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\activity-stream.discovery_stream.json
Size 22KB
SHA256 8dc3a38266a524e517608f673034bec523f17a75e7be218d2d1a4ef45ad4b045
MD5 ce0b5b25df1357f61132fde4cbe2cb79
SHA1 24d1f32885b4694e61a6cbf9b23f79d6c0f46619
SHA512 b454b3428e3858216ef5dcbd9da7381d091bcacef4c86620f0822266fd0e5d399c0ccfac37ea044541be55623c5e6acac8f7f499cee066ea09b31b39ea8c75fa
SSDEEP 384:cOm8aDxJl0jscWIq3nVXMUS6R9Q5yauJEBNnxznxj5:HmpzM4nVRSfydGBNlN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 f2e0345a288f6ac43b437abce86c93056a4bd55c02e307a1a1f09707700bbbec
MD5 62f57c4084d37cfdc60e8779f98f28a3
SHA1 783eb824c7fe0705bfe2ff3fd3fcc5eb98ce9e52
SHA512 8b6d981cb899a1fa71237acc5ceaef5a340999951ee9e8c74ae7a2eb75e59405441f81231ca220d122d7a40596561e6c062fde10ca822b4a2f84d235386fe087
SSDEEP 384:HfNIu9fiGLm4pUCA+Q+4IYKgH4Zv+3yPrIVy8eaxL:llBi8mCUCxQ+4INy4ZcyzIVy8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 8KB
SHA256 1ffe84fda2e5fe85a753566e8053a37f18d94c24d5023bd5f718993432d86566
MD5 4c1329195f7cba44b138b54fda6270d0
SHA1 7957f0151ea7a54f54fddfbc26310ff802dd145a
SHA512 ab4c7a7c3c3f65f610784838d678be2716a9312881050b58f0f66943339d7f3cfb1cb6c80e8da3127196b5482a99f1dff18f08d99bbe27ee3f316b15b84be264
SSDEEP 24:5uB1oRMxgu1xgRbfLsJblLKwbGuhMZk2Fsh2F3LFe0sJbF0Jwb+5pR5cO:1y5ovebVKwbSebOJwby9cO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 10KB
SHA256 3e7401ff7d0e343b8a7273578b1f27eba293ccf38f1c7941ef80d8a0c7e603c2
MD5 cb234c283a0a3304967d4bcb7cc94f25
SHA1 795fb5d6c7656f93be23064dfe404f88eac1af0c
SHA512 b719982a91154ae85f88291dd519d6fbd820d94877e80f42c90ba2bc87da4df3234e99084bacbeacb93b55fd363335ce3a4fc526badbf6a99e8a41a70c22c24d
SSDEEP 48:1y5ovebVKwbK3ebOJwbp9cOwypebvpf+Pb:M5ovebVKwbK3ebOJwbMypebvpf+Pb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 13KB
SHA256 9b025ac041467dbe9b01460d330a432d24867679dc696e2a4a26fd0362b0f4d4
MD5 148bd2c324560f11cc85b9094ea2af81
SHA1 5451934bfac1f57efe770974577aacfee9ac85b3
SHA512 6abbc68ed79fa89cc864b31c4e3ddf7f43fda65b7c3e43d9fe0ca7e75dc66e09c05404d65e500e1dd0d2e8d0d1b7eed54605b9a83a55b4ddd09f6632aaafdedc
SSDEEP 96:M5ovebVKwbqebOJwbMypebvpf+PbPb/bmgbgzcbobAb:M5Myu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.bin
Size 22KB
SHA256 6272abf1e67c8b8e65b2d53e7157f5b63dcfda267f971498bdfae369599a84a7
MD5 0ae2c51b60da4ec582a0914b3505ad96
SHA1 38fc3f3597e63e67dabd86d3459ff5ad2120e930
SHA512 fc723fa7127e4688c9c7d563a8071a53ede491d7916cb2d4804a3faad5743320525aa7cc43e352dc0d2a0f2c9725cc52cd871b4e5ef5593124656a8a1c4b3fee
SSDEEP 384:Nbo5oP23wUG3QROoUsP2v5MPt8UfZqbhbAbtb+b3b3bQbCbFALicZKyr/66JozGO:tpOAUG3yOo7P2v5MPt8UfZqbhbAbtb+T
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 fcd9616f8037f661b088aec23a4f418754db89a7b24fe298567ad8cb41eac96c
MD5 28b8210d410b4e0eacf095e7bf853cb4
SHA1 9b00627931baff85bb869041ea860080e10b0807
SHA512 5574e47b013cfee750b9d438d969f2f446df08f144b801a4f7928a80f51dfd080f1948ecf169363636840a8b919302b42ab523083e25105e4f349e35808c59ac
SSDEEP 384:v/66JozGzgC1bebo5WP23wUG3QROoUsP2v5MPt8UfZqbhbAbtb+b3b3bQbCbFALK:KEkdOAUG3yOo7P2v5MPt8UfZqbhbAbtu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 94cf78f2c39666307157580259393bf17808e904097bff97d2197a6274169875
MD5 87201ca7178e591f60c398e5898827a8
SHA1 b1efdc653652a9900f9923fc8781912478bb67b1
SHA512 145925d4579507acaab1b404324ea85a8bc189fd35f4f5c92ad79460f673ab7968a72cf997dd86760e439b526b1dc9714918e7b3ad48013afc1188702ba64a1a
SSDEEP 384:v/66JozGzgC1baboSoPa3wUG3QROoUsP2v5MPt8UfZqbhbAbtb+b3b3bQbCbFALK:KEsWSAUG3yOo7P2v5MPt8UfZqbhbAbtu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 3ea9279417ef828bbc2eee9e61b7facca1d22c13ade9dad97c6c5b09dd4fa5be
MD5 11a791a1eeb924c97429e4131d488a8a
SHA1 e532f922d8a001bc58cdf198fda1930d8775cc13
SHA512 c4bd3af8fdece51552657f9d7624285d9dd88461c03322751792db6f110a859f037a44f577ad0f0c5f6b241fe73893780f51a7547d8665b854e9fde9975f6aa6
SSDEEP 768:KEHfJpfvvAALD2vPWPt8UfTrbhbAbGbmb3b3bQbCbxz5Mmu:xpfvIAiz5Mmu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 8732ed98f628ecfa2abcda38016fa4e12bdcab430e897d5f6ff087f13993fa3e
MD5 99ed608aa66d99b5999c972ed5c710e8
SHA1 0247e62fb9318d73cb567b253c7ce747d0b06fe0
SHA512 291d1f47a4e1a5a8d3635157febfcbd21100e92deb0018905123cdd92495ad7b8a98212bdc17cc3341789c0e260717fa96c22264ae55ce6200737339a15d1c1d
SSDEEP 768:KpfvvAALD2vPWPt8UfTrbhbAbGbmb3b3bQbCbxz5MmmEufZ:KpfvIAiz5MmO
MD5 SHA1 SHA512 SSDEEP

Submit Download

0af602f0-eb9e-44a3-9a9b-1b7c5d716b85

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\0af602f0-eb9e-44a3-9a9b-1b7c5d716b85
Size 982B
SHA256 ec9b87917b33f3f6adb0f76e1d6e37fe2255f03f792213f8d5154eaf9a65ae55
MD5 968a439fdaa71d16aa44ffe52296adff
SHA1 73cf0ad3fe26775a3b268e1a4affc5b8088f54ae
SHA512 bd00ccce48ce5d6d5771267dc142c3ee19dd8eefd908ec2d4a1bcf07adc1d5cdf51b60bcb060aedb0acd45d414dc29d084fe292f33e17f967ce218c9471719ac
MD5 SHA1 SHA512

Submit Download

e84642b6-d5cc-4cc8-a51d-9954cd6f8ab4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\e84642b6-d5cc-4cc8-a51d-9954cd6f8ab4
Size 659B
SHA256 bfc2896ee4ac746f7e7eff14860480f1b60d2aa1afeb52e724eb5e139d8fe382
MD5 e0e87d210be75401c42ce2483e350031
SHA1 19e795f8ec2cd91cfa04021693a3464b2fed637f
SHA512 a18129fbd6c186ef1979dd62e3ad0210333e1bdce98af15352584f0174c8575f707c3638c7736061b3e1532aaef3de6b3902f6c6f6b36830b62d4919f58ba4fc
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
Size 12KB
SHA256 5fdf4cc2f547e3fd1d85ccc1a6904fa531f8408f4b64fceb1044bfdce484e48a
MD5 8e87267c603b8dbd1b9f1e3b2f25564f
SHA1 178c9857adc7c3011aceb386e42208322c0d769f
SHA512 ae4faec1d7869f938989c3e42a13937e9716ab501407c4b909ace660d8ec328e54a1f1eae57b7c2f8fbc63259e090ada8e206d7e6231f48ac89ed933bc99213f
SSDEEP 192:Lb5nYRof/ICH9VI4yCEtDqAdd2My1S73paXzfM9Bw8Hs:LtPVU2Iy1/f+wp
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
Size 15KB
SHA256 d9b62f033cc9a05c8a8031d431ada535c8996983ca089492ef1ada987d7140f0
MD5 d59214fa1a61b0fc37c238a7d4aa589d
SHA1 48e6f4fe8ba3323cbd660fb07d307e84f869e786
SHA512 6cf33e074737605a57508c3444b0f727d5abb3ef0f55ca72fd228479e86af8e8cdd28e7873652fc15dfc9773de824970dd88eb6665ecdd0141e24c20843faab8
SSDEEP 192:Lb6nYRofAICH9VI4yCEtDqAdd2My1S73paXzh+MiiBw8HlB1YPf:LkyVU2Iy1/gGwsK
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js
Size 10KB
SHA256 cbb518d79a2a5f370352b327c015f9cc23d2407a09d57812b41d394ba1789923
MD5 33fca04cfda96d671a9fc1cda04ec92b
SHA1 03d88cea19d93d47a82fcc0dc39089d7d5cbfd18
SHA512 e2df73491234ff57e1976b9353fe091416b5fe45e3ffc3309ca3c65991b952cdb0896317aaa8647a437a9dc1f8c25d45e675701661d0e584bfad9137197cdb1f
SSDEEP 192:Ob5nYRof/ICH9VI4yCEtDqAdd2My1S73paXzfMSBw8HI:OtPVU2Iy1/fDwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js
Size 10KB
SHA256 11512175219fc496fe01acf5b6934ad70a2d75fb3761c9368f64360ac9e5e121
MD5 5f9b31892811ce8d2a23610b1537f849
SHA1 1f793f0f3dc70370841915c97b86f2444def1856
SHA512 2e4572a3cebefd256f818bc8f90599bb529941d3f6ad5c66bd4fca447122798a0be8bf747ff1b6e71c99d2be0406f41868fcb6622275e59c77f438c68e0750ee
SSDEEP 192:Ob5nYRof/iXNHNVofAHBtq8prddx9y1ZO43HaXtMSBw8HI:OtqVoIbpd9y1ZOLDwt
MD5 SHA1 SHA512 SSDEEP

Submit Download