f6dc47d57da7bec7190d32e4140b861714fefc6ceac91faf1ae3d65eae141d5d

Analysis

max time kernel
126s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2024, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 901KB
Sample241122-ckj9caskcz
SHA256 f6dc47d57da7bec7190d32e4140b861714fefc6ceac91faf1ae3d65eae141d5d
MD5 6e6af329feb47e6d6dec9389429cfd07
SHA1 dfd44cfcabd9d5ae746ad4221e55302b89002b0a
SHA512 da9e894874433ae748912ad95dc0e92a9e9cb44f95755d2ba929355abd9de631fa9b4fddebd1647d655ca8c62cc7284c97a1d4de174ce47b3cd6ec5c51a5e157
SSDEEP 12288:1qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaRTW:1qDEvCTbMWu7rQYlBQcBiT6rprG8alW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2564	taskkill.exe
3224	taskkill.exe
2592	taskkill.exe
1916	taskkill.exe
1120	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4988	file.exe
4988	file.exe
4988	file.exe
4988	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	3224	taskkill.exe
Token: SeDebugPrivilege	2592	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	1120	taskkill.exe
Token: SeDebugPrivilege	532	firefox.exe
Token: SeDebugPrivilege	532	firefox.exe
Token: SeDebugPrivilege	532	firefox.exe
Token: SeDebugPrivilege	532	firefox.exe
Token: SeDebugPrivilege	532	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4988	file.exe
4988	file.exe
4988	file.exe
4988	file.exe
4988	file.exe
4988	file.exe
4988	file.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
4988	file.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
4988	file.exe
4988	file.exe
4988	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
4988	file.exe
4988	file.exe
4988	file.exe
4988	file.exe
4988	file.exe
4988	file.exe
4988	file.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
4988	file.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
532	firefox.exe
4988	file.exe
4988	file.exe
4988	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
532	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2564	4988	file.exe	83
PID 4988 wrote to memory of 2564	4988	file.exe	83
PID 4988 wrote to memory of 2564	4988	file.exe	83
PID 4988 wrote to memory of 3224	4988	file.exe	86
PID 4988 wrote to memory of 3224	4988	file.exe	86
PID 4988 wrote to memory of 3224	4988	file.exe	86
PID 4988 wrote to memory of 2592	4988	file.exe	88
PID 4988 wrote to memory of 2592	4988	file.exe	88
PID 4988 wrote to memory of 2592	4988	file.exe	88
PID 4988 wrote to memory of 1916	4988	file.exe	91
PID 4988 wrote to memory of 1916	4988	file.exe	91
PID 4988 wrote to memory of 1916	4988	file.exe	91
PID 4988 wrote to memory of 1120	4988	file.exe	93
PID 4988 wrote to memory of 1120	4988	file.exe	93
PID 4988 wrote to memory of 1120	4988	file.exe	93
PID 4988 wrote to memory of 4248	4988	file.exe	95
PID 4988 wrote to memory of 4248	4988	file.exe	95
PID 4248 wrote to memory of 532	4248	firefox.exe	96
PID 4248 wrote to memory of 532	4248	firefox.exe	96
PID 4248 wrote to memory of 532	4248	firefox.exe	96
PID 4248 wrote to memory of 532	4248	firefox.exe	96
PID 4248 wrote to memory of 532	4248	firefox.exe	96
PID 4248 wrote to memory of 532	4248	firefox.exe	96
PID 4248 wrote to memory of 532	4248	firefox.exe	96
PID 4248 wrote to memory of 532	4248	firefox.exe	96
PID 4248 wrote to memory of 532	4248	firefox.exe	96
PID 4248 wrote to memory of 532	4248	firefox.exe	96
PID 4248 wrote to memory of 532	4248	firefox.exe	96
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97
PID 532 wrote to memory of 2772	532	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3224
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:532
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5be0e46f-b17f-4bdd-a208-fc8edd5b74d9} 532 "\\.\pipe\gecko-crash-server-pipe.532" gpu
      4⤵
      PID:2772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2424 -prefMapHandle 2412 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2b1538d-49d2-4920-b84e-665b3365c3a5} 532 "\\.\pipe\gecko-crash-server-pipe.532" socket
      4⤵
      PID:2540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3288 -childID 1 -isForBrowser -prefsHandle 3268 -prefMapHandle 3276 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bea71e84-fe69-4434-af61-84c28adb8880} 532 "\\.\pipe\gecko-crash-server-pipe.532" tab
      4⤵
      PID:5036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2744 -childID 2 -isForBrowser -prefsHandle 3620 -prefMapHandle 3616 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1679f93c-d31e-4a8a-aef7-9d141382e602} 532 "\\.\pipe\gecko-crash-server-pipe.532" tab
      4⤵
      PID:5008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4684 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4676 -prefMapHandle 4672 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24d5ad8b-e88f-4131-ab23-6535f6edead1} 532 "\\.\pipe\gecko-crash-server-pipe.532" utility
      4⤵
      Checks processor information in registry
      PID:2592
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5136 -childID 3 -isForBrowser -prefsHandle 5216 -prefMapHandle 5252 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {505232a8-ff00-4522-ac87-c04269a33c2c} 532 "\\.\pipe\gecko-crash-server-pipe.532" tab
      4⤵
      PID:1196
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -childID 4 -isForBrowser -prefsHandle 5476 -prefMapHandle 5472 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8815a33b-8a6c-4abb-8a0c-7eb9ec556762} 532 "\\.\pipe\gecko-crash-server-pipe.532" tab
      4⤵
      PID:1656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5136 -childID 5 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61ba989f-264a-4d73-8329-e200112ac4ab} 532 "\\.\pipe\gecko-crash-server-pipe.532" tab
      4⤵
      PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json
Size 27KB
SHA256 45d99321b6ef4e8b9474ac586a536684bd5e596438861c0509dc479175eff516
MD5 5da5db28b8e7ca6a0f58097b4197a0ec
SHA1 8d747f5f34de3ed6b58fbcef275a6508fc94df1c
SHA512 151aa3049740b7ff20bbd78b5dc4f463bc61cdc3199e6a93522623d17636c7290deccf829a7fca70dc3c1737f020fe25de042a2f7aaa10669306dc609aae8f3b
SSDEEP 384:yJuD5svlXGE7uW5LYJ8scJ77tGr9CLpNtyaueS4IAq4IxTJ7gAHgA5wi8HT8H5G:guFklXHQALpNtydeT97cTf15sC5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 532e4e3e4a313765d7505db1d91004dd67b3818aa243436e949d33dd1132624c
MD5 3dc2fd0a718b278e522d349ce8c6fd4f
SHA1 f108a58876355c295b07d0d1f62b2e294ecbdb08
SHA512 d175825fbbcb62508138205cec114bf8705d0cc10a37552552b4341bdf66330bd19415974b145d73b64b04be3f8f6a90b4a483386f34977ad46456c8fb575fb3
SSDEEP 384:HfNIu9fiGLm4pUyA+Q+4IYKgH4Zv+3yPrIVy8eKMy:llBi8mCUyxQ+4INy4ZcyzIVy8l
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 6KB
SHA256 9e7706e358c35770b80b97531fbee3eded979da0d8e802286754cba6278c5527
MD5 649081ef3027db1fd6dde19be8c84828
SHA1 53121af2370b4bdcda8a4d290b9f3133af202d19
SHA512 a461bcbd48652863f376bad86c7c4b07a412846eaf61d575ed1e6ced54ab16c5d5adc53f1459000e96f6778855367be977a05a7881dbde92b2e40523882fe2b6
SSDEEP 6:gNe0gidpq88gidydgid0WFxw+OTHgidpqs7HgidBgid+efc5xw:ggQpB8gQWgQg+BQphMQSQ/0g
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 8KB
SHA256 d69a26de02f0116e856f4fea84bc2a4fa7e5ee6b829fdc44487e41b566dc7ee4
MD5 901c66b1ea96c6c4f4a15dbb1975350c
SHA1 1e54861ca784b1d1dec429ce01690526715be055
SHA512 b3288fbe2065127b500b37fdac7ff1217f0bbb4392759c7f72fa1e4566f6125139b6810c4d31270aa13fee9abc84cbed15dc164f9f04a3878137765e0065428d
SSDEEP 24:5uB1os3Fsh2F3LF/Wgu1xgRb1zBuhMZnpR5cOW8sJblLK/hbFsJbF0J/hb:H5otL9cOjebVKJbFebOJJb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 13KB
SHA256 72f3757ae7e06beedab562f9a368a3936d52885c49b96eb6adaf20348d279820
MD5 94a28b051c761c768f48bd4c8999c48f
SHA1 462894b0015e5ea16336df57b16a22295819c574
SHA512 19acc0d7f9460ca5f0de6717521722f7f7ad9ae859816923bb4a9bef832d0ae8c830940354cd5448ad06a85b2ea22ddf1596015a55c927823e5382381ef68a34
SSDEEP 96:H5oWebVKCbkebOJCbupebvpf+CbKb6babubs2gbgz5b:H5Zu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 16KB
SHA256 2cee032db7f9f6eac3c73e0d8dbdb30428668e01a684f0a4bbbb680e41ec8735
MD5 244ea4fd37cf647c1718ac16dff6b6a0
SHA1 1ca7e892f935c2ef5e045656478f2a6d511a41f5
SHA512 22ed9b613f8e40adbcfc1fbb435723d1655f16243701ca5f4ece5171b9c1dbccaec4f12efd93b48eb28beff8abede3f542ded9c926129fe843ea982dda898d4e
SSDEEP 96:H5o6ebVKCbkebOJCbetpebvpf+2bKb6babubs2gbgz5b0bGb:H5Bu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 024731184de740c455ad5c0687736fa803c5d4d2f9321661a18f47e31c433fdc
MD5 d0afbb832c9be8a817c448abc536d1d8
SHA1 edae2599cbec724d851cd280a004c606b4b1e051
SHA512 13ecc6af510a425cc65e642970778ddc8b77c8edc4f1278c9c0ec7167fda9b134ed2fc43e44696f5040de89d8b4731ed5c76229ce7467478d8a70b77fbef29ec
SSDEEP 384:G/66JozGzgC1bsboSpPcjXdZasC3VPbPf/I2nJH3U14ibxbBbZbObCbDbxbjbfcG:jEibEXdZ83tbPf/I2nJH3U14ibxbBbZP
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 4422c795a63b6b2c897dea1f4eac97b3812164be29a971fceac654846e29c0d7
MD5 b9a6b73cbb340ce99f6d7293d223419d
SHA1 b7f18dedef71ce3f1636961a6e4168e316ce1f7b
SHA512 b53b053ed93805acb12b408d81815f27abdb5b5b4316997861d00232dc5d878b3bd8cb71d1dd2b16503d9d0691323dfe3f990d5a8d5e1cc424cd52f7d1ba5051
SSDEEP 384:3jXdZasC3VPbPf/I2nJH3U14ibxbBbZbObCbDbxbjbfcZ7L7g2TE/66JozGzgC1s:zXdZ83tbPf/I2nJH3U14ibxbBbZbObCk
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 893084e55ad807bdff7977aba78e5b710cb5e3028cb4a26d604efb9d78143743
MD5 192ed22ee788daa6090b73ba410f55d9
SHA1 a0374c9dbc6c9c129e943f2db30a757837842e8b
SHA512 4d7328d8172c03ace49e1809efafeabb38832b75b11ae82bc52548ae998e71f46d6c0ef6d288cfe7ef78e6b8d6c5980b098c06863ac1ddea89d27f95e6bae591
SSDEEP 768:jEOMLS9sXtDf/D5JH3U1QbbxbBbIbNbCbDbxbjbDpWBhRs5Heg:9MLEsrpWBhRs51
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 d51edd3852f445c49960fa8b5335d949ad00d78435389a1e344786bd71d87a71
MD5 3a8557cee3292879e8e59aa95fb13bb0
SHA1 89237deb6a1e6d9a3d784f06d2b2c40f5622e37b
SHA512 cff8b4168de5d4c94c3fc781d8320d3320cd7c3db3e34292d57f4d66cc5ebb78e4af9c416ad922b39727e8424951da3c70835d069d80c33fb0adf37547b6e644
SSDEEP 768:jE4ekMLS9sXtDf/D5JH3U1QbbxbBbIbNbCbDbxbjbDpWBhRs5k:tMLEsrpWBhRs5k
MD5 SHA1 SHA512 SSDEEP

Submit Download

849f501c-077b-49af-adda-e54ff98b4050

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\849f501c-077b-49af-adda-e54ff98b4050
Size 982B
SHA256 d5ee7681c5afff2a74544f00974ebed6706024deccd998b08c920ed0c9ee04e7
MD5 a9d64685c9b23dc6d9d89d08952db8b9
SHA1 638ffd81792515a96725869b63324d14537d073a
SHA512 9bb52a9db015524088eb0e271584701f7d622f2735bc6ca31f0a96c9ab58acbd096a17191420426493ab25931dd2d5d7fc4946614d2e7d5227c5223101d8ade8
MD5 SHA1 SHA512

Submit Download

ebed138f-ad15-4512-a2d7-91300261ddc8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\ebed138f-ad15-4512-a2d7-91300261ddc8
Size 659B
SHA256 eeb7620ffe55d2bbf2da3bfd4dd02589c6e1e6452beb4a586fc8e65eb32a8876
MD5 05dddf17c75d0f81425734a1f818a59b
SHA1 be1aee53a9ebf9f30cac1f586f91c1ae444854e1
SHA512 54daba164c8959c6adcd192fa882bf59505e92c7aa11abbbf93bdc31fb269effc475c624a1dfb7a038feb2f029bf06fa2fe890166c55c6d0015931a8987c826f
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 11KB
SHA256 d4df878829c169c4ba97b7b15c4bf37f626f531d7ec7ad6a97ce9a85bb0d069f
MD5 8a85caf05be7c97d4d77d659467018e3
SHA1 6320e05866ae1b1f379c169123698e25d68acee6
SHA512 8ec362f2a303d48e7c81f8d1b71bc886dfcce0d42fd43df09f10840e04a228f18fef0381ab0e3b242bc1fbcc861adbcf615a8b42abd948ab5bc0be9606d5d538
SSDEEP 192:h5nHRUfU4cvKxnPd3yil5rdFRVxtmgBQmaXa2naBw8HG9:2mKx5yilpbmgTJwP
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 15KB
SHA256 d3724b347f30c493fe29bb56c33ba2ddbb6b818caa091719f92229d4e2084d58
MD5 918a35719fce959e7d313b92eff047a2
SHA1 8e1e0c0d9b82a87823f109440878b35461b92000
SHA512 d89c4b5ce2fb8e0040af8db8e1081acf83eb2ece21cc33eb92743ebd2db6d331f90baa2090122c8e89649c227024987286846f7b78ad81ea2a7e48ad6614fc83
SSDEEP 192:h+nHRUfY4cvKxnPd3yil5rdFRVxtmgBQmaXG+2nAiBw8HGrv3tOW:j6Kx5yilpbmgcWwdf
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
Size 11KB
SHA256 0504ee12237789a0e8e8b7b9b73a639936039c26e719779488d118710a1debc6
MD5 4ad493c6431ef1f7031be5ef80cc6247
SHA1 be72550ed163c595e3b4d2f3dda6dffdb44b02bc
SHA512 849fef6c64cd3005949c351429190fcf503965176b8a3cd12c7197adbe0c6b46b72683d786802e59a25cd2c4b2015e5ea59b01dd9f1ec0c683c1a791270ef445
SSDEEP 192:S5nHRUfU3GvDxnMd3QW+YtBUNtPVdtOoV1I0G5+aXy2nSBw8Vb:Z3Dx8QW+YtMOoDFwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
Size 10KB
SHA256 34b512f90160d5fc95d6707014a0146d7ef1866a4c57d82cb709121acef86880
MD5 dec3bfdb212ac65be7184bbdeb0eee5a
SHA1 f213b95ae5cfcb3ce6b537faace6d280d3f96867
SHA512 5b01dfee1f8a73c92f2a41f76b584a6a6ec5bb2442daef38985c54a5a58705d67b92d6382fcae4d432acd1a0a1987552c15c349c1335d4897a6384f538893b37
SSDEEP 192:S5nHRUfU4cvKxnPd3yil5rdFRVxtmgBQmaXy2nSBw8Hb:ZmKx5yilpbmgnFwO
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.5MB
SHA256 6914400e72ad6b239b2b8de3fd5b56a7229db5eb76e0e3040044c0cb05148a48
MD5 0796809e287981e48f2836782560d939
SHA1 1332c3fdf0d8cef092771df18ed7867f895126cc
SHA512 e2d873d98080c75d927a7210df743db4fe7bda1cdc04bbc60bd81576a2b0fd5f97edec20477bba50192aaaefb03dbb988db094d2d8dddfa0b8c4d563ee0de82b
SSDEEP 49152:TDMcVlJYbhCdO7rputzqkizSlp/14GXOwMDkSv14Dx1kAyyMcZ30hriSER1j6b0T:m6
MD5 SHA1 SHA512 SSDEEP

Submit Download