0ef919fa46014b42d020774865c504bb7dc3970e8a7824ade538f89c2995be53

Analysis

max time kernel
132s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 901KB
Sample241121-e5dneaybna
SHA256 0ef919fa46014b42d020774865c504bb7dc3970e8a7824ade538f89c2995be53
MD5 6cfda722c529b199480b5b85ca0652bf
SHA1 843543dd0acca321b60592f310f07d91ff24910a
SHA512 5572c71a3af3a5704e3bb18d3d27e2854e9c0a870c0bd267f4aae57049bc5cd06ca120517bfeb70736ab397947b9add0cfd3830bf39278111e5f6b2d84e8c943
SSDEEP 12288:BqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga+Tr:BqDEvCTbMWu7rQYlBQcBiT6rprG8amr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4016	taskkill.exe
4212	taskkill.exe
4508	taskkill.exe
2424	taskkill.exe
932	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2060	file.exe
2060	file.exe
2060	file.exe
2060	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	taskkill.exe
Token: SeDebugPrivilege	2424	taskkill.exe
Token: SeDebugPrivilege	932	taskkill.exe
Token: SeDebugPrivilege	4016	taskkill.exe
Token: SeDebugPrivilege	4212	taskkill.exe
Token: SeDebugPrivilege	5112	firefox.exe
Token: SeDebugPrivilege	5112	firefox.exe
Token: SeDebugPrivilege	5112	firefox.exe
Token: SeDebugPrivilege	5112	firefox.exe
Token: SeDebugPrivilege	5112	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
2060	file.exe
2060	file.exe
2060	file.exe
2060	file.exe
2060	file.exe
2060	file.exe
2060	file.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
2060	file.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
2060	file.exe
2060	file.exe
2060	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
2060	file.exe
2060	file.exe
2060	file.exe
2060	file.exe
2060	file.exe
2060	file.exe
2060	file.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
2060	file.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
2060	file.exe
2060	file.exe
2060	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5112	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4508	2060	file.exe	83
PID 2060 wrote to memory of 4508	2060	file.exe	83
PID 2060 wrote to memory of 4508	2060	file.exe	83
PID 2060 wrote to memory of 2424	2060	file.exe	86
PID 2060 wrote to memory of 2424	2060	file.exe	86
PID 2060 wrote to memory of 2424	2060	file.exe	86
PID 2060 wrote to memory of 932	2060	file.exe	88
PID 2060 wrote to memory of 932	2060	file.exe	88
PID 2060 wrote to memory of 932	2060	file.exe	88
PID 2060 wrote to memory of 4016	2060	file.exe	90
PID 2060 wrote to memory of 4016	2060	file.exe	90
PID 2060 wrote to memory of 4016	2060	file.exe	90
PID 2060 wrote to memory of 4212	2060	file.exe	92
PID 2060 wrote to memory of 4212	2060	file.exe	92
PID 2060 wrote to memory of 4212	2060	file.exe	92
PID 2060 wrote to memory of 4528	2060	file.exe	94
PID 2060 wrote to memory of 4528	2060	file.exe	94
PID 4528 wrote to memory of 5112	4528	firefox.exe	95
PID 4528 wrote to memory of 5112	4528	firefox.exe	95
PID 4528 wrote to memory of 5112	4528	firefox.exe	95
PID 4528 wrote to memory of 5112	4528	firefox.exe	95
PID 4528 wrote to memory of 5112	4528	firefox.exe	95
PID 4528 wrote to memory of 5112	4528	firefox.exe	95
PID 4528 wrote to memory of 5112	4528	firefox.exe	95
PID 4528 wrote to memory of 5112	4528	firefox.exe	95
PID 4528 wrote to memory of 5112	4528	firefox.exe	95
PID 4528 wrote to memory of 5112	4528	firefox.exe	95
PID 4528 wrote to memory of 5112	4528	firefox.exe	95
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96
PID 5112 wrote to memory of 4088	5112	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4508
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4016
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db382f87-771a-4ea7-b5e2-4547bf04e08b} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" gpu
      4⤵
      PID:4088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2400 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e5835e7-198a-4209-a9fd-96f92753ddb5} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" socket
      4⤵
      PID:4952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3032 -childID 1 -isForBrowser -prefsHandle 3092 -prefMapHandle 3148 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1100 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9a368a4-d845-45be-a5e0-d91092f93a59} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" tab
      4⤵
      PID:2928
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2744 -childID 2 -isForBrowser -prefsHandle 3636 -prefMapHandle 3616 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1100 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1262cec7-33cb-4cc0-aed4-2f627ce22da7} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" tab
      4⤵
      PID:1648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4836 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4828 -prefMapHandle 4824 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea27e5e6-c348-474f-9312-f157a3f6d426} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" utility
      4⤵
      Checks processor information in registry
      PID:4048
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5504 -childID 3 -isForBrowser -prefsHandle 5404 -prefMapHandle 5480 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1100 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7896277-6a42-4f09-b277-8d60e387dc30} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" tab
      4⤵
      PID:2784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 4 -isForBrowser -prefsHandle 5636 -prefMapHandle 5640 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1100 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99b0de9f-965f-4156-bbe4-9e7bdd8db4c8} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" tab
      4⤵
      PID:4564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5832 -childID 5 -isForBrowser -prefsHandle 5836 -prefMapHandle 5840 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1100 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ed82127-e7b0-4f78-a9cf-ffb0feefdd07} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" tab
      4⤵
      PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json
Size 27KB
SHA256 3ad640ba5f8205ab5df67fbca1ad1548c29149461008e881c6377f6b9a409eba
MD5 69b1fe8fc3a3813d4bee015343583960
SHA1 54ceb045865a85b998b0b949a6961ee38198a920
SHA512 eb65ecb309e9e0772569dc8772e18e9d9adc38c9d01c7c871de588a2004afe8ee1a980dc595a3d47540775ee780fc3be27a9d6dc42e8139d2a3d8cf82436a05a
SSDEEP 384:6MGXpw6J1zPtNrnsz3RHreYEHayauzl5Nl5FHMemYem7insm3smzG:6rXpPfKRLXydz/N/Fs7Y72nV3VzG
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 0f79263c87aaf94f6beaa185666070bc05155470f2aac0657963eacbbe7588de
MD5 aa46b980b4c676771cdf12082aa9a08f
SHA1 09918f4a81abc5017fe55a06dd0d1753f51451f3
SHA512 0646ccd8bb19c6fcb0c346e679a340a2f9701f97e91e5c31fd31d86e9a675487a3a0e052f470478a77c81e3e5d47091452a1d9535cb33e4c80bc663fa4202f8c
SSDEEP 384:HfNIu9fiGLm4pUJA+Q+4IYKgH4Zv+3yPrIVy8eNEd:llBi8mCUJxQ+4INy4ZcyzIVy85
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Size 10KB
SHA256 20013bc2aef6654695a72abf0dd2342b0b45a774b464713d1de19be02f8b3ae1
MD5 70a4088df903f94aed0b1bcf37ee785e
SHA1 d886bc0ca093b5264133d4688374ea49954b3ece
SHA512 ec39e3b928d578869cf00dc408cf04673fd4f03e832ac6bbd599536fdf21be7c2af17e7db3946c7b2ded10db0afc534461b501b1e52708dbb9d981addde07c99
SSDEEP 48:vlNYebVKSNebO5o8NdNz9cOvNgebOJSNebvpebvpf+SNeb:gebVKFbO5o7ebOJFbvpebvpf+Fb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Size 18KB
SHA256 afa5a182e66ff15a8899a96f85311e70da265d386ee3e3292fc8dab873b8009d
MD5 a734598f9ef02eb72df155c1b19fa736
SHA1 8929754cc5c77a830f7f37e51379e321e479fe39
SHA512 1ba7cbe34cd8bf1d177a14a0ad849285087dc19c57aac4493918c17f3ba482a3196c9ed09bd458525cc79b93bdb7a36282efb5993f99234e14e4b3e8a26cded2
SSDEEP 96:QebVKFbO5o7ebOJFb8pebvpf+QbTb3bxgbgzrbcRbQbfbbbZb9b:v5Tu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 50b212593a983f01416b2bd64c52a6f1f31110f766ef53fb34f88db53be0d63b
MD5 bd9f6c99fc204ab8a52fcb4b29c9f495
SHA1 ea94086c6def904bcf7530d9e0c980ddea3a8f5a
SHA512 4faf53aceabc85523f09dbbcf5dd2a0f3fd0c7745bf841c73388881e8b166cec97e35116bd6d0cdb0755055a73c481d7b97c22041eb2e1e3e027ef66f7c2c497
SSDEEP 96:cNQXPRP8PdFl66JozGzgClKtmSSXSMF9ZbkW6Shmo2PP/PrWI:E/66JozGzgCl6mSSXrvZboShh4PCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 b505f63eae742c6b4f7062e5c98c9e08ca9b9df076e9f937f7513e2bb436f04e
MD5 3680c59d2d134cef6b76aa9d7bbd9d4a
SHA1 840c91f948f2f09bff1b13f5ef267f043973c2ec
SHA512 ac617c5ee25cc31d6bacd838599f49eb51b092b091eb6319d5500e3e0f9ead34fea6b3dd81ef3611f99e620e03d9daa0604a4bd4301567944c0b8e64eb1a7204
SSDEEP 384:V/66JozGzgC1buboQH6Po4thYe6Oo9PDTKwTb5b0Y:IE8OLdoxDTKwTb5b0Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 c78480dc383d8f32a54f6f4f9d7a8bf928341fabe6cd412d4a5c36b84f95fb26
MD5 61d7bda936152c7ea2a6b721892c990d
SHA1 1950ae6b71fb2e87b561023bf34c0d3573ec5401
SHA512 6f2ab18eb9caa5d150d3a6fca21c105dc011844286b3644d2f27190e658eee05c79284ad0c1332429cae6f6be713b0b1853700ce8efdc8f7e193dc18f8f2001d
SSDEEP 384:E4thYe6Oo9PDTKwTb5b0PboY6P5/66JozGzgC1bM:3doxDTKwTb5b0TWkEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

145afe97-c23d-46a7-9d1b-5c2899a749d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\145afe97-c23d-46a7-9d1b-5c2899a749d7
Size 982B
SHA256 80f39499aa6412a06fb8ccc1131e647d260edff17927b277b22282c7105a34ec
MD5 d6f2a7fcb974d43c2ba63045be0b12bd
SHA1 2dd1935afaffb137eb6a42bf209a380fa2fd343c
SHA512 9a4fd4ae10d889e67a3c772eabfd775b10a80178ed236d8b6686de5f9f25fac3382864f509edec7c93515cd4c1bf279f12b4901a278dcb581852a0c6dcec97d0
MD5 SHA1 SHA512

Submit Download

9e7f002f-d74a-4f5a-8324-64e7da76a6b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\9e7f002f-d74a-4f5a-8324-64e7da76a6b8
Size 25KB
SHA256 b812e84d800c0319d23dceef204753d0887859d0604480fee690094eedbfe680
MD5 ee7d32ac45a141d91236224e3756a701
SHA1 1c544bc5fe571479707c80091df20e97c31f60ff
SHA512 7224cee69da4360f136cdc3d89faf19a16cc652ec730fe10cf0d9ecef4e79fd27c5be1b1d702e936e0524ea57c896451fa87f4c20ba0c860fdafd3c2a2b95411
SSDEEP 384:Y0mlV8KURSCRd8p7V9zaDg0K34vfFGulk:PsppE3KYFnK
MD5 SHA1 SHA512 SSDEEP

Submit Download

efd62910-53e3-4f1a-8e24-4b460ea11f20

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\efd62910-53e3-4f1a-8e24-4b460ea11f20
Size 671B
SHA256 c44c879023a8e61d64f409a34c26d24ca465e1703dedf84b109f460a96df5311
MD5 46ba47bc9feecad104e6092ee0b0a338
SHA1 f52092de7ce0c9c1b2639c15742ea88e919b8d0d
SHA512 d1d23e5a6073f5f6fca04cba0fcf6592d87efe3a960257562738e4348f0267de15f048147758c2d7592b47aa8b8b1b08e575053016b3463b98f5beffe64164f5
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
Size 12KB
SHA256 4c4d16e27eb1bb70f4f5d94d019523c7bbf59aeb9792886014c2180121432252
MD5 749e856933dc4619c61ed92c996ef6c3
SHA1 de3ff286a24d96537f367df5c2757c32d1fd4939
SHA512 9c00b925e4cf9b61420cb191d84d5415da712c495ce31071f05c230da8960758438216807add0872b79f389f59731d667f9f5745368fc39bb094afdb696b2a1e
SSDEEP 192:GB5nSRKfE0HTNGfpEUTtWlJddZy1SSFlaXqDvbMBw8H2W:GvnGB8jy1TxDvWwlW
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
Size 15KB
SHA256 d08ecaba2d416030bfdbcb61179fdaec0021e24ef7e2f6bb40ba5380721afb38
MD5 37fd023d5611b082b95b569f698803e9
SHA1 273c557e7d15453c8275155b6f9fd058fbc2f7ad
SHA512 e61a204b8f26b15810157f3641e7da9f297197a8c1d90d3fedca466409267bfa54ace69c95fbbd3dba35b52bd88e1b0146b130d175bbc3eadf2f0f6f15497859
SSDEEP 192:GB6nSRKf60HTNGfpEUTtWlJddZy1SSFlaXW+DvbSiBw8H2G5d6RJ:GCFGB8jy1T6Dvdwlqo
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js
Size 10KB
SHA256 88e22a9f2c9e9d42ab58c70cc34f10812449d37fafe5fb3ae4e59c2c4eabcf26
MD5 4c8b2a991c918baa935bbf3f7b10c8a2
SHA1 69ed6416eb236fc803b89e34b81daa23d0fa49ba
SHA512 c5cb7c5af10304ff7f8fccb9613e0a19ffa6df3fb764c6732d796027368604022c88dcab463aae762e1f724607efedbe372894c77359806882d50d7d0a720aac
SSDEEP 192:RB5nSRKfElL4C3psxnHd3LtVNUnNt+8+V0tDsS3GaXTJDvbrBw8Vi:RvouxxLtuzDvJDvJwx
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js
Size 10KB
SHA256 1369cbec667c6bf5bb7ce246903b7a15083d8e820e2591627227c1c4f0ea2313
MD5 adea5918ff45e8784251d27ad54e621c
SHA1 35a4b7151bb3ae5c3058ed7875cf3905a593ddf2
SHA512 7eacd39988eda6bd3d457c14661cea5908acfda686f57ce0bd6f9fb7a5e807d6cdfe667139326448abb7661e9c069c566eeab7eee4ac93428f6765a342ca18a8
SSDEEP 192:RB5nSRKfE0HTNGfpEUTtWlJddZy1SSFlaXqDvbrBw8Hi:RvnGB8jy1TxDvJwn
MD5 SHA1 SHA512 SSDEEP

Submit Download