e5fca9f7d4e548dcefb305cca3a69ead145c2917e56e2016099eeaba2117ff32

Analysis

max time kernel
131s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2024, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 900KB
Sample241123-dn17psxjds
SHA256 e5fca9f7d4e548dcefb305cca3a69ead145c2917e56e2016099eeaba2117ff32
MD5 8eb4ec0df45ae7c7fba0f660615f7bf5
SHA1 d4442af8c569012800bbfdf22b9885cb1073c496
SHA512 ba9d7444295c9277c628447b8ac5d05c1993f12ada11af1c5583ef5ba7d6231048a2a984a6c74597010db61dc520065be6831df3bbf56622de90c4df9dbb860e
SSDEEP 12288:oqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaCT0:oqDEvCTbMWu7rQYlBQcBiT6rprG8ai0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2644	taskkill.exe
3460	taskkill.exe
3800	taskkill.exe
3936	taskkill.exe
372	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1364	file.exe
1364	file.exe
1364	file.exe
1364	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	taskkill.exe
Token: SeDebugPrivilege	3460	taskkill.exe
Token: SeDebugPrivilege	3800	taskkill.exe
Token: SeDebugPrivilege	3936	taskkill.exe
Token: SeDebugPrivilege	372	taskkill.exe
Token: SeDebugPrivilege	1768	firefox.exe
Token: SeDebugPrivilege	1768	firefox.exe
Token: SeDebugPrivilege	1768	firefox.exe
Token: SeDebugPrivilege	1768	firefox.exe
Token: SeDebugPrivilege	1768	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
1364	file.exe
1364	file.exe
1364	file.exe
1364	file.exe
1364	file.exe
1364	file.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1364	file.exe
1364	file.exe
1364	file.exe
1364	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
1364	file.exe
1364	file.exe
1364	file.exe
1364	file.exe
1364	file.exe
1364	file.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1364	file.exe
1364	file.exe
1364	file.exe
1364	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1768	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2644	1364	file.exe	83
PID 1364 wrote to memory of 2644	1364	file.exe	83
PID 1364 wrote to memory of 2644	1364	file.exe	83
PID 1364 wrote to memory of 3460	1364	file.exe	86
PID 1364 wrote to memory of 3460	1364	file.exe	86
PID 1364 wrote to memory of 3460	1364	file.exe	86
PID 1364 wrote to memory of 3800	1364	file.exe	88
PID 1364 wrote to memory of 3800	1364	file.exe	88
PID 1364 wrote to memory of 3800	1364	file.exe	88
PID 1364 wrote to memory of 3936	1364	file.exe	90
PID 1364 wrote to memory of 3936	1364	file.exe	90
PID 1364 wrote to memory of 3936	1364	file.exe	90
PID 1364 wrote to memory of 372	1364	file.exe	93
PID 1364 wrote to memory of 372	1364	file.exe	93
PID 1364 wrote to memory of 372	1364	file.exe	93
PID 1364 wrote to memory of 5000	1364	file.exe	95
PID 1364 wrote to memory of 5000	1364	file.exe	95
PID 5000 wrote to memory of 1768	5000	firefox.exe	96
PID 5000 wrote to memory of 1768	5000	firefox.exe	96
PID 5000 wrote to memory of 1768	5000	firefox.exe	96
PID 5000 wrote to memory of 1768	5000	firefox.exe	96
PID 5000 wrote to memory of 1768	5000	firefox.exe	96
PID 5000 wrote to memory of 1768	5000	firefox.exe	96
PID 5000 wrote to memory of 1768	5000	firefox.exe	96
PID 5000 wrote to memory of 1768	5000	firefox.exe	96
PID 5000 wrote to memory of 1768	5000	firefox.exe	96
PID 5000 wrote to memory of 1768	5000	firefox.exe	96
PID 5000 wrote to memory of 1768	5000	firefox.exe	96
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97
PID 1768 wrote to memory of 3172	1768	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3800
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3936
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:372
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9d69409-ee12-4ace-a798-2c8aa3a1fa3a} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" gpu
      4⤵
      PID:3172
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2444 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e911d070-e0d1-4ea0-8e91-931bfbb17d9e} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" socket
      4⤵
      PID:1832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3228 -childID 1 -isForBrowser -prefsHandle 3296 -prefMapHandle 3008 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea122bf3-4234-4432-87c3-8b0c2e9880e0} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab
      4⤵
      PID:5100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3676 -childID 2 -isForBrowser -prefsHandle 3648 -prefMapHandle 3644 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35cfa1a7-06fb-446d-87dc-8a823f1f6a9b} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab
      4⤵
      PID:544
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4500 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4532 -prefMapHandle 4520 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56613159-e747-4707-8eb1-f4b39c53c4d3} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" utility
      4⤵
      Checks processor information in registry
      PID:1200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5224 -childID 3 -isForBrowser -prefsHandle 5208 -prefMapHandle 5212 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f2605b4-27ea-4e7e-848c-92e6ba18d69e} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab
      4⤵
      PID:1796
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5520 -childID 4 -isForBrowser -prefsHandle 5528 -prefMapHandle 5532 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0c82132-090a-4e0e-b233-c5bac6eb45e0} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab
      4⤵
      PID:4764
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5720 -childID 5 -isForBrowser -prefsHandle 5800 -prefMapHandle 5796 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea842874-703b-4e3e-b0f6-c86462ed2b66} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab
      4⤵
      PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\activity-stream.discovery_stream.json
Size 28KB
SHA256 12e3da57e5f5f68d183cbafb0fe2373c978b5065325059f329ff1297133ed60c
MD5 395dafc11775cae339e6a072a4f8c412
SHA1 b8e5a0318551d507509f8ccda2630a1f66fa5321
SHA512 da585eb04ac8f49ee637eac7c8d707dd3ce148ff73411656a46e0693d93862c0566e3c943bed5faa8f526e26c9cd9226edacd8f6b3ce4fc7b034f38787d4ff06
SSDEEP 384:ZYoYVFze6MPtyALwqyiUAyt+beVCITOkVCqw0/tayaumKjLJDL8nnG:ajH0NQ1FLik8N0VaydXxL8nnG
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 d6bd8406887e1cab5443579f8062b6d4ab42a096b7cf51eea48625a075ecc57d
MD5 199b6dba57b7990e9b734a0a76a23c54
SHA1 c4e14e773410484bb864fde6d4bacd1d334b4d99
SHA512 8ed5dd50a2f47b62befc60429830277299006db2b4cc6d8fb08193d28202fb0cb21796e5783e9127f550a04d73b40438c10bd97c6527fd77b7c40e8b846dba8d
SSDEEP 384:HfNIu9fiGLm4pUyA+Q+4IYKgH4Zv+3yPrIVy8eAphp9:llBi8mCUyxQ+4INy4ZcyzIVy85
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 6KB
SHA256 309519661b7538dd23a52c8f8afc663d1e2b3e7980014f6228419ff5eb226c45
MD5 39502861370a0cc096b3d15456b7b78b
SHA1 5f044dcbc4c9eb1f7aff17ab45116209cd62f2f9
SHA512 41c340a17749fa3833482167fc14e8191f99730b006a9b49ada1882f89b94246e1ee1b9a80098c408bf3a4d06f4beb20cfc916f0e3535d544a63db403d11e328
SSDEEP 6:gNe0gidpq88gidydgid0aiwfLZy2THgidpqs7HgidBgidw5wfLZy:ggQpB8gQWgQPftyJQphMQSQw2fty
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 8KB
SHA256 1dfc818013ab0fc9722b2fe862b6de8062e614d8025b77cc573b153f7c542a94
MD5 0880c6bdde151cb6a2c5c67e580b1d73
SHA1 bd4d4c7d0c04693a5398af732d62b253521aeb64
SHA512 023f99363afef58c1edba56864d3e469d77e9061ae265a0cdcaae24657f75bdc46110b4dda49e90c5011aaf7ff479963e2d478d31d48283e7c70b89095699a00
SSDEEP 24:5uB1oOsJblLKfbhFsh2F3LFouhMZKsJbF0JfbIgu1xgRbppR5cO:yebVKfb3ebOJfbI5o99cO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 10KB
SHA256 9400dd1787a38887fd839ef9990d203008dfe7f37b1ce3c7ad83b1673a7bcf4c
MD5 61028830875c4fd44428d980e7473c8f
SHA1 5d7a9408e602525eb85f96b0caaaaa45bd1bcc68
SHA512 67016f7a229211e126d41c160983498f97b445d6b46658867b8178906b6af977c5fe1332d23600f6f3dbe458c0ce150bd21a84910178864ae130f7ab57688ab2
SSDEEP 48:yebVKfb7ebOJfbI5oDq9cOJpebvpf+Qb:yebVKfb7ebOJfbI5ospebvpf+Qb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 18KB
SHA256 8cb925109194ab4d0f4bf338fe1714b59a4327f62a9bde027658953d50ed08d9
MD5 7d598e87f38bb11d29ca486f76386223
SHA1 127f97b58ed4c00bcc87f676247c4308683791f8
SHA512 5f24905cdf8675a14b81f580c1b5205d4ce70ee3f78b3f632ed0324b225ea3238714779373f91b1c9893804b47b187ef88d6c15e54835e19c41f4748c8818e38
SSDEEP 96:iebVKfb7ebOJfbI5o4pebvpf+cbMbSdbMgbgzGb5bZbCb+dbBbZb:t5Nurr
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 e51510c2e553ce3b404e0d2c6bd293ee946658434d859719b1a1825b735a3943
MD5 4db03962c6853e7e782e0993f9b7ca89
SHA1 2a557e82933f1dc522a06abbbdbc888c8c4dc07c
SHA512 4b4cffe2d0d0b00d438946b7b075a144dcf6c2c5f6dd938a1ae6cde8f582399d08379a19b07ea5f5bfbf92ea3d61e7e33a4146d2a37d1aec6e54f0c6a0e3600a
SSDEEP 384:gboSZPmwD9JNs7mk4h9pJRj1PGveXk93UfFvebmbMb4bFbhbpb5b1bJHBI2Fa7/m:IPr9JNxk4zPGveXk93UfFGbmbMb4bFbt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 193c73024cf2fe51168bc7805c9e5a6ac6a670364d5a9532a8be25494855f65f
MD5 f321b93dfa0518b40d82bd6b085c5d1c
SHA1 5d46b11bd692b1b003bac9388737957af7eb04be
SHA512 7f3a9b2f13a25d5321a0778512af19c91914e1a71f422e95ced20b4b225a2e32b07a5909575ed3e974c03b00a38e88878db1b579c63a6fa0a3d4c5bb54172d66
SSDEEP 768:3+pEIPT2iETDGvegk93UfRabmbMb8babhbpb5b1bvMlsN9d:CPTraMlsN9d
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 996aafad7a91c3ff7464eb82639b0c7cc1474fe13d4bc1462f3881416adc0b32
MD5 e9501dfbe541f1112a658b363f53d213
SHA1 cc10e759addb237af1d413d7d7caa6c23ceca85a
SHA512 bcc90d98363d7738c158e3d60de598ed5f29ca48b72d975aa284195170c940c4a4ca9d31eefe5b0af5d09ad159841efc0b7ef7d5a2cedaaff4079ff1e767adcf
SSDEEP 768:W+kPT2iETDGvegk93UfRabmbMb8babhbpb5b1bvMlsN9aEm:CPTraMlsN9G
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 e00ea314bbbba03cb3e2a44ff3d2372226d9288ec0b7c242ce9ce0b18c14d2df
MD5 05afb5be4526bcaf52776a79791fa97d
SHA1 55ca4fe63e67533ea0d81fd8596010a8f95691c3
SHA512 05702bced125031f11710504a6d1659635a2349dd395570c641bf2ffded77baa382bc8f5b9a69884dca17e0162cefe3faacb3fbd68539b0209f55f30a22765f6
SSDEEP 384:U/66JozGzgC1bgbox0PmwD9JNs7mk4h9pJRj1PGveXk93UfFvebmbMb4bFbhbpbM:xEKXr9JNxk4zPGveXk93UfFGbmbMb4b6
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 673557ffd18f3f3378b7d41ff358ad1e16992d5b56274b3253252eb807a6c0f0
MD5 a588c77aaedd840897b5b949049d35d2
SHA1 2b26acdffa812bcab7a48db847e7d1f102e7672f
SHA512 b749dc200b742a872468e87965ae7c8febb6019030b733f3df89663e63259f6462a9242d1d7154ec5855f9ce4490b0446e3f131db1ef781cac5d1d9b0060d659
SSDEEP 384:ZwD9JNs7mk4h9pJRj1PGveXk93UfFvebmbMb4bFbhbpb5b1bJHBI2FazboxjPK/m:09JNxk4zPGveXk93UfFGbmbMb4bFbhbR
MD5 SHA1 SHA512 SSDEEP

Submit Download

3e4ea322-ebac-43b5-84f4-ddba0d05ec9d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\3e4ea322-ebac-43b5-84f4-ddba0d05ec9d
Size 659B
SHA256 fc0cd5abf67f87f50c834c4ebd264093d2ef85170866fe790a9f24c41695e700
MD5 a396ba5465424eb776c8bd700ecd77d6
SHA1 4f8a3e0ff7bd34fb4532b9b3f96b185a99f717c9
SHA512 722cd6237b841d4e5b07aacbb0e2088dc0ad94a63d964b618612a722423694254e135c91ed6058f12115030e1e9ecb435a3c40790c6fbfa68117443d51b53e51
MD5 SHA1 SHA512

Submit Download

aabfd92d-cfb0-49bb-b785-96d3df10f59b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\aabfd92d-cfb0-49bb-b785-96d3df10f59b
Size 982B
SHA256 4b21c334807daeec1e8e49c1d7095d62ef845d90ef3b10c537b71e2e42a9615a
MD5 6ce2023912df22de10ee4ad66571c401
SHA1 deb2e1208926635267380e8af781d6b3db45bcf9
SHA512 0433396511bf5bff71e8907f6acf5a9581f1c9a5b5a16d0f653ef4d7ac53d926020c57aebe7e4045b160cc3705633054cdb586367963624483a85e3dc6378f06
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
Size 11KB
SHA256 0428515fa51f908d6299b1f698388eb7324dbe49fe190c9f3ee3976994d97f80
MD5 6b9b6edbeec76020b41d93d640b3aecf
SHA1 9eb54baa8de7de881fdbd5d7d28daceddf8c6e57
SHA512 7ac843512eb6c9b9841e25002d493cfd82200d6a73695428eecb9e474418add9318efcaaf1e871268a64d07e1684159b6930738cf034c594c5329f176e2cba38
SSDEEP 192:Lb5nYRof/Z4wQxnNd3Qd48d9CVit8gyuQaXTMmBw8Hnh5:LtxQx/QS8p8glTwah5
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
Size 15KB
SHA256 d14010a28cf3f955b2b263cd788ff732f535385b127935c25813ff15f542f48a
MD5 0acacdce2d0a799ce38e5470ae75b27a
SHA1 5e395724e27742829a9db474b38ad876d58bcdcf
SHA512 02e2fa8d7dd8995a6abe9c9be43a5bf3efa42314bb46018c235329054417032c0879f09b2c9ab6ac68a87d677795bf40f6ef5c4e35fb769a90a07001d561f83e
SSDEEP 192:LbSnYRof3Z4wQxnNd3Qd48d9CVit8gyuQaXV+MziBw8Hnh/Vl6Vi:LM5Qx/QS8p8gGLwahdT
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js
Size 10KB
SHA256 5bbb34202eb0bb2baf26fdc215c7235f1e691018b29922d69b49bade83f65d8c
MD5 c5021caa5e02c57a18911b314bc52b19
SHA1 16292ed2a4cb3957d020c86f416eec29de93f7ac
SHA512 4fc42931b192ab09a9490b0383919984d923c17d18e236fb2711cd54e6350906e7b20736b561723a4be4752307fd0bae9ff40ff4f0b3b82f55ae1ec0015201be
SSDEEP 192:Ob5nYRof/iXNhVofAHBtq8prddx9y1ZO436aXGzMSBw8H/:OtCVoIbpd9y1ZO3DwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js
Size 10KB
SHA256 7762cb49eced35ac353485203fc95ffe032be1bd5f128bd8fe8a18cea0e92c4d
MD5 121d7b08b72a2b94e1f858a6c72b7736
SHA1 432225ba4db98b623a36be4b3ff6ce7b420dc176
SHA512 b4d2e4614b378855b280d8f787a178af654699b0cfca96fbf465ee94941bc9649490060bbe0aee3713ff7b4c2baeef5de2d6a490c365a94c462d06e8f6e0e052
SSDEEP 192:Ob5nYRof/Z4wQxnNd3Qd48d9CVit8gyuQaXTMSBw8H/:OtxQx/QS8p8glDwW
MD5 SHA1 SHA512 SSDEEP

Submit Download