a44d411681fe0c2488f8b1933e13049c9564f4cb1f2940e5cfed1908068aaa96

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2024, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 901KB
Sample241118-payefa1mdr
SHA256 a44d411681fe0c2488f8b1933e13049c9564f4cb1f2940e5cfed1908068aaa96
MD5 ba6b36f33bdcdba751b6955c246a091b
SHA1 78177f114ef0baddfa8b01ae0ad553b63e8ff1c4
SHA512 695e4b1f233a40bf0b8636b05a9ba1efc79235735b5b6f7638e8b8da519038b44d22b5894d8671c560f3fa8725946343cf62a09afaa6774390296c89935ce2fb
SSDEEP 12288:fqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga7TF:fqDEvCTbMWu7rQYlBQcBiT6rprG8a/F
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4724	taskkill.exe
3144	taskkill.exe
4492	taskkill.exe
5072	taskkill.exe
4760	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1592	file.exe
1592	file.exe
1592	file.exe
1592	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	taskkill.exe
Token: SeDebugPrivilege	3144	taskkill.exe
Token: SeDebugPrivilege	4492	taskkill.exe
Token: SeDebugPrivilege	5072	taskkill.exe
Token: SeDebugPrivilege	4760	taskkill.exe
Token: SeDebugPrivilege	1432	firefox.exe
Token: SeDebugPrivilege	1432	firefox.exe
Token: SeDebugPrivilege	1432	firefox.exe
Token: SeDebugPrivilege	1432	firefox.exe
Token: SeDebugPrivilege	1432	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
1592	file.exe
1592	file.exe
1592	file.exe
1592	file.exe
1592	file.exe
1592	file.exe
1592	file.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1592	file.exe
1592	file.exe
1592	file.exe
1592	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
1592	file.exe
1592	file.exe
1592	file.exe
1592	file.exe
1592	file.exe
1592	file.exe
1592	file.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1592	file.exe
1592	file.exe
1592	file.exe
1592	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1432	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 4724	1592	file.exe	84
PID 1592 wrote to memory of 4724	1592	file.exe	84
PID 1592 wrote to memory of 4724	1592	file.exe	84
PID 1592 wrote to memory of 3144	1592	file.exe	91
PID 1592 wrote to memory of 3144	1592	file.exe	91
PID 1592 wrote to memory of 3144	1592	file.exe	91
PID 1592 wrote to memory of 4492	1592	file.exe	93
PID 1592 wrote to memory of 4492	1592	file.exe	93
PID 1592 wrote to memory of 4492	1592	file.exe	93
PID 1592 wrote to memory of 5072	1592	file.exe	95
PID 1592 wrote to memory of 5072	1592	file.exe	95
PID 1592 wrote to memory of 5072	1592	file.exe	95
PID 1592 wrote to memory of 4760	1592	file.exe	98
PID 1592 wrote to memory of 4760	1592	file.exe	98
PID 1592 wrote to memory of 4760	1592	file.exe	98
PID 1592 wrote to memory of 1308	1592	file.exe	101
PID 1592 wrote to memory of 1308	1592	file.exe	101
PID 1308 wrote to memory of 1432	1308	firefox.exe	102
PID 1308 wrote to memory of 1432	1308	firefox.exe	102
PID 1308 wrote to memory of 1432	1308	firefox.exe	102
PID 1308 wrote to memory of 1432	1308	firefox.exe	102
PID 1308 wrote to memory of 1432	1308	firefox.exe	102
PID 1308 wrote to memory of 1432	1308	firefox.exe	102
PID 1308 wrote to memory of 1432	1308	firefox.exe	102
PID 1308 wrote to memory of 1432	1308	firefox.exe	102
PID 1308 wrote to memory of 1432	1308	firefox.exe	102
PID 1308 wrote to memory of 1432	1308	firefox.exe	102
PID 1308 wrote to memory of 1432	1308	firefox.exe	102
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103
PID 1432 wrote to memory of 2748	1432	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8ada490-f5a9-4049-9076-d8185d9419ef} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" gpu
      4⤵
      PID:2748
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2477e92d-0989-4542-a15a-f1133bb891ad} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" socket
      4⤵
      PID:2968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2804 -childID 1 -isForBrowser -prefsHandle 3088 -prefMapHandle 3068 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eae5759e-e39e-44b9-8649-ebfa73196cd3} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" tab
      4⤵
      PID:4508
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3928 -childID 2 -isForBrowser -prefsHandle 3932 -prefMapHandle 3924 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca2e2e55-8b2f-43ca-9c4d-e10e0d8e94ad} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" tab
      4⤵
      PID:1072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4776 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4812 -prefMapHandle 4808 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8805b9cf-01b1-4dd4-b84f-ad3db066611b} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" utility
      4⤵
      Checks processor information in registry
      PID:2216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5376 -childID 3 -isForBrowser -prefsHandle 5428 -prefMapHandle 5424 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74c25eda-cc42-4649-b92e-d947911e5412} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" tab
      4⤵
      PID:5984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 4 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {154ec464-b6a8-4060-986e-a16109b8587b} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" tab
      4⤵
      PID:5996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5792 -childID 5 -isForBrowser -prefsHandle 5712 -prefMapHandle 5716 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95246368-54f6-43c4-9f79-429383a6074d} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" tab
      4⤵
      PID:6012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json
Size 19KB
SHA256 c74c55c72f6d4f47ec9260aee8e1b90cc62465e8739e74715e0c4e642e34acc1
MD5 1c8427d9ee8407520f49929dc2948894
SHA1 815c2d31286f861ab98712c65038bb6996e4110a
SHA512 9f0c5a4dc88ea538011874e596c568b54773a157e24deac959cb65f1ac09563d0f0b2e3bbb282195012e6a250f2060752271aaf4a6c68724c6cb5edf92c366b8
SSDEEP 192:z1rdOA221EQrH8zTa+Ti7PTcr3IlRjuHXgi7qbOjgyxQArbzAem8m8E6N3PAo0Z3:v97TR6H6k7wPONfFtMHDHbOyaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 e4cd4b81db3eaa061db17426c2f4002bb610abd74f77d21680bb11c21b104d74
MD5 e5f4586d920ba2c0cf7dc1711516295a
SHA1 dbf205ae352180ed87bd3867898360f4e26e781b
SHA512 ec1d3cbc7231cbfc7950471a9bc2568e1372be960518401f5a62f2eb59f8a60f0d4221df3a7ccd81523d6c9aa6867ea0795cc301d4f1aa0d3245d13be8003cc3
SSDEEP 384:HfNIu9fiGLm4pU4A+Q+4IYKgH4Zv+3yPrIVy8eEGe:llBi8mCU4xQ+4INy4ZcyzIVy85
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Size 6KB
SHA256 e5a48bc28e415c01dc963e0a118dd26582e759751335c37ce7c770b6102cb6b9
MD5 d86fdfcb88e0cb0d1fe72006ad9721b4
SHA1 66882475b39be91fc50bbacb404909d9076fa26c
SHA512 9b7c74a687ff12976c02d58253f3d7014c026a5873e1bc5790068d90b9ded5fa9a17c4c30ec933116c5782bb5688eccf635aae4d9f0af4a197f7e58ab7ba008d
SSDEEP 6:gNe0gidpq88gidydgidyHK/y3RTHgidpqs7HgidBgidvi/y:ggQpB8gQWgQyH2yeQphMQSQvOy
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Size 8KB
SHA256 03e3666b687ba7eb0512457f909b9f52af2a12bf81769bf52bfaaabe78990b42
MD5 aa35bfecc16a089272d64b70c6edb032
SHA1 bfc76dac1c226a2a14135b26ab74e8c32654b566
SHA512 d996a801151818684e69f3d8d681ac6221000548bd9c77de2ca08a739ed17d09523886050570ec1b682fda7abac8cd3381c9d59142cb691125c13d59948568f5
SSDEEP 24:5uB1oDHFFsh2F3LF5sJblLKgbdgu1xgRb+uhMZn1pR5cOasJbF0Jgb:fH7ebVKgbd5oO19cOaebOJgb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Size 18KB
SHA256 3291ee4df505aaaf18d3bb12cacb500aca9725b8950677b6745c21d95f3812af
MD5 15789bc6f3d30258ae8730c67386f60a
SHA1 f229a87ad7a04ca33e74a58af11f0be55e70d8ae
SHA512 40a223a4e1de4ac78d1aac809dcb3f1d6dc74f85d46b641a78c8f2cbaa3a7a9eeed698d137c7dc29af508c005380bf75433238087571b67495dff9e13a10ed97
SSDEEP 96:3ebVKgbd5oOyebOJgbHpebvpf+lbubmbbgbgzxbKbSbEbKbabSb:k5nu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 11fd4770bdf33d651fd0d4278c5860203a8c21978ed9f53eee29ebdb0f7341f9
MD5 93c6e8e58652b9666d237da2de353eca
SHA1 826a4c05b854b12417b8c466b0236dd1ce25ca1c
SHA512 fbde87e70b2986edeaaa20d9cddb7b4094aae2c4f74b619afcef4fece78f1ee907f043f742332a684592826c3fc11eaab852a63c7b0c56b0d89866471b76ceb8
SSDEEP 96:NSMF9ZbkW6ShmAVPP/PrWZ322QS1FWAFl66JozGzgClKtmSSM:NrvZboSh1JPCt9p/66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 f4dadf77510b09b2a4cf16de102fbd9b9f3d554b1361841fb804f258419d2873
MD5 e4867c17c4530103a1d8d1ec3f920b9a
SHA1 7b7f89e8c2b75b4a4f222ec952f61247fa0a236c
SHA512 1e0a71d82e3b8b1165a22ecb0deffe408118e5a070ca15d7cbb1cbc1942863dbf243c15f8927f2b07e2fad74d603b530d55593d48bcb45b38267ecaacc6310da
SSDEEP 384:lboH46HPlV5XRtoYGfg1D7hzPb6bwMH/66JozGzgC1bM:Vqb5fGfiD7hzPb6bwMCEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 a5722475dbbff46ce1a409708cad6795d0654f5ac217d565e41ad2d7dfde0cd7
MD5 b097bc8cec0893d5dd3daea17243640d
SHA1 ab0892245907e44dae339699692e4eb8ab398298
SHA512 070d0b83f8c0cc0d9bccb82d6b475255dba15503f8ce8866d96a7977fd3850f2eb2690af06b861f281d380f205b75d14d1a735781aaceb3f63826421e023d7ec
SSDEEP 384:gV5XRtoYGfg1D7hzPb6bwDboY6HPGH/66JozGzgC1bM:85fGfiD7hzPb6bw3KuCEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ad473e59-ac27-4972-8b5e-2d4eeea174ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\ad473e59-ac27-4972-8b5e-2d4eeea174ba
Size 28KB
SHA256 c23d773127d97560ae024e8604d8e6841a4399ae457231bfb80b10fc25a5b88e
MD5 4738260168a72f381964a0655bbb5569
SHA1 87dc02992526e62a5431b21a6df3feceda737b94
SHA512 bb5288f45d001c30d68387674c98e62f342ce15918819e4b3f89750367f15a89d7e79bce5085ba785d7f88cd419bda80b23d626b310638a31b8bce827456389f
SSDEEP 384:UkD4nchG0gEvCCH2XFg2/ijUb1AKKzcDd:pDThGLEvCk27ijS
MD5 SHA1 SHA512 SSDEEP

Submit Download

c6d57e8d-c64f-4582-be90-049b67bd5742

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\c6d57e8d-c64f-4582-be90-049b67bd5742
Size 982B
SHA256 b43a3bc394ef89f7d95d4ea52abf27655fe000b3aff37a070a7a79ff586e41b7
MD5 a95102847ce554cda961ccb6f2b1e251
SHA1 022e2885a97e1f78933d0a3a9c19116f6cf2a6a4
SHA512 5e6ac311111efdd07796b0df025868fcea6d40cf589cd6d6ece1f9194e49ccb5f6aed62ef6a1eb91cb992b59f2dba5463b21dc046ea2bee872eb359728d6ea5f
MD5 SHA1 SHA512

Submit Download

e282a09b-825b-4b66-90cc-89d5e2266868

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\e282a09b-825b-4b66-90cc-89d5e2266868
Size 671B
SHA256 ca998c1544657b394a165ae810f708cc8d0157c44b6c62f81a765a13c37dcebc
MD5 584d7bcc12d75b904dd396bfa9fcf9c2
SHA1 726ac364e3e740db7a9b0847a4d232daf55fd38d
SHA512 af16fd206e0094f3a24216dc3b5544e593ff90cec01a659d33d734fa6b88eeb99ba07916f962231bff6dde2b468c6e34b97cec415e9182bde65f15757a7a567c
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
Size 12KB
SHA256 291cd2debc709f823c25418b3068a57b39ef188729f71cebb1420f27b6211f6f
MD5 bc07a0b4266c0ce4b4fd336a8dc4a4ae
SHA1 69163a0a1faf0c0f7af7df9bd2e819cb01e35a9e
SHA512 16d4ec16a3fa43aa5bd6036c6e89aa395d52c74d2b3783f1c69360ac3fcf15095cbee40ca9068313692825a0aa6fbb3aee504713699adae1d5d0687974d671a7
SSDEEP 192:95nxlR1fq9kyNYfENFQtO444ddty1S63IaXej1Bw8Hv:ZdwYcNDuy1CDwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
Size 16KB
SHA256 e1a7f40785cf98a757b192543e37061d3119472ccfaa18fa588ff8ffed058a87
MD5 89f2eb74b75f77de41b805d26af3a3af
SHA1 ed20c8dd0fa2c883c55da718aa247430f9f78280
SHA512 6dbb6a3a0c3dd23fd1974e27a1d76972ba841127524c4449193a2dad90f700cfb7335d06d49e76fd30cfe63204c2cbb0e0dbfad7fff48907b8cc821a14ecff38
SSDEEP 192:9enxlR1fX9kyNYfENFQtO444ddty1S63IaXa+jMiBw8Ha11Opv:GdrYcNDuy1/7wVS
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
Size 11KB
SHA256 2e46189d385f137769ceb8ff6bdfa3e1e115f3ca23470cc8c8b6ffd9274d5c95
MD5 7942b7eb9b0f44839b32ee0e2e128fff
SHA1 f5bc2f5e8969ece3f2381e18e3e2c31fcf2e0fdb
SHA512 56a0d5359c7e00024fc4ed1c71b26c97a491f7f8c1fced4ecf66afb5e086a2829d770dd8d72898cbf06d0db5c29230a23c55ca79c88a7f6e75b64746b8ebc51e
SSDEEP 192:S5nxlR1fqIU/DxnMd3QW+YtBUNtPVdtOoV1I0G5KaXJjABw8VX:wdgDx8QW+YtMOoEawQ
MD5 SHA1 SHA512 SSDEEP

Submit Download