1033ce004d2c19d50ee1c486231f95dafe0da44ade7539504569a710fe28c12c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2024, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 900KB
Sample241124-jd367szpc1
SHA256 1033ce004d2c19d50ee1c486231f95dafe0da44ade7539504569a710fe28c12c
MD5 9f7cb01682d1fbe5fc35eb17e7900b4f
SHA1 8d96d54298af510bdf3504fc2c26f5e66555186f
SHA512 f5b5cf4c2b1ccb1a169a24c52ee6676770c80e71d1e615b7096260ec94ef8fcce4314720a13dad3c509c58cca7121e616d92bf044dda1816a90f3a6dc93ca0ab
SSDEEP 12288:zqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaxTA:zqDEvCTbMWu7rQYlBQcBiT6rprG8aFA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3832	taskkill.exe
1276	taskkill.exe
4992	taskkill.exe
2576	taskkill.exe
4540	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4224	file.exe
4224	file.exe
4224	file.exe
4224	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	taskkill.exe
Token: SeDebugPrivilege	3832	taskkill.exe
Token: SeDebugPrivilege	1276	taskkill.exe
Token: SeDebugPrivilege	4992	taskkill.exe
Token: SeDebugPrivilege	2576	taskkill.exe
Token: SeDebugPrivilege	1992	firefox.exe
Token: SeDebugPrivilege	1992	firefox.exe
Token: SeDebugPrivilege	1992	firefox.exe
Token: SeDebugPrivilege	1992	firefox.exe
Token: SeDebugPrivilege	1992	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4224	file.exe
4224	file.exe
4224	file.exe
4224	file.exe
4224	file.exe
4224	file.exe
4224	file.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
4224	file.exe
4224	file.exe
4224	file.exe
4224	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
4224	file.exe
4224	file.exe
4224	file.exe
4224	file.exe
4224	file.exe
4224	file.exe
4224	file.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
4224	file.exe
4224	file.exe
4224	file.exe
4224	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1992	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4540	4224	file.exe	83
PID 4224 wrote to memory of 4540	4224	file.exe	83
PID 4224 wrote to memory of 4540	4224	file.exe	83
PID 4224 wrote to memory of 3832	4224	file.exe	86
PID 4224 wrote to memory of 3832	4224	file.exe	86
PID 4224 wrote to memory of 3832	4224	file.exe	86
PID 4224 wrote to memory of 1276	4224	file.exe	88
PID 4224 wrote to memory of 1276	4224	file.exe	88
PID 4224 wrote to memory of 1276	4224	file.exe	88
PID 4224 wrote to memory of 4992	4224	file.exe	91
PID 4224 wrote to memory of 4992	4224	file.exe	91
PID 4224 wrote to memory of 4992	4224	file.exe	91
PID 4224 wrote to memory of 2576	4224	file.exe	93
PID 4224 wrote to memory of 2576	4224	file.exe	93
PID 4224 wrote to memory of 2576	4224	file.exe	93
PID 4224 wrote to memory of 4964	4224	file.exe	95
PID 4224 wrote to memory of 4964	4224	file.exe	95
PID 4964 wrote to memory of 1992	4964	firefox.exe	96
PID 4964 wrote to memory of 1992	4964	firefox.exe	96
PID 4964 wrote to memory of 1992	4964	firefox.exe	96
PID 4964 wrote to memory of 1992	4964	firefox.exe	96
PID 4964 wrote to memory of 1992	4964	firefox.exe	96
PID 4964 wrote to memory of 1992	4964	firefox.exe	96
PID 4964 wrote to memory of 1992	4964	firefox.exe	96
PID 4964 wrote to memory of 1992	4964	firefox.exe	96
PID 4964 wrote to memory of 1992	4964	firefox.exe	96
PID 4964 wrote to memory of 1992	4964	firefox.exe	96
PID 4964 wrote to memory of 1992	4964	firefox.exe	96
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97
PID 1992 wrote to memory of 1212	1992	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c20599a-dcd4-4e64-8615-ac0dd358f6d5} 1992 "\\.\pipe\gecko-crash-server-pipe.1992" gpu
      4⤵
      PID:1212
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a1de6e8-6ca7-4c07-8802-a5bf2b722823} 1992 "\\.\pipe\gecko-crash-server-pipe.1992" socket
      4⤵
      PID:4564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3044 -childID 1 -isForBrowser -prefsHandle 3064 -prefMapHandle 3084 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b502071-2e36-4c33-8097-9aaed33e507a} 1992 "\\.\pipe\gecko-crash-server-pipe.1992" tab
      4⤵
      PID:2864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3620 -childID 2 -isForBrowser -prefsHandle 4052 -prefMapHandle 4048 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cddedbb0-2c4f-44b8-a357-2ea0d3e63ed7} 1992 "\\.\pipe\gecko-crash-server-pipe.1992" tab
      4⤵
      PID:2692
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4740 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4712 -prefMapHandle 4788 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {388a702b-371c-4cbf-b291-e6841fdf62a4} 1992 "\\.\pipe\gecko-crash-server-pipe.1992" utility
      4⤵
      Checks processor information in registry
      PID:1496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 3 -isForBrowser -prefsHandle 5320 -prefMapHandle 5400 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22498ddf-4488-4cef-a569-a986aa5a3f7a} 1992 "\\.\pipe\gecko-crash-server-pipe.1992" tab
      4⤵
      PID:3964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5616 -childID 4 -isForBrowser -prefsHandle 5572 -prefMapHandle 5372 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13bbbf88-e00e-41a6-8d91-8657b0af357d} 1992 "\\.\pipe\gecko-crash-server-pipe.1992" tab
      4⤵
      PID:1604
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5868 -childID 5 -isForBrowser -prefsHandle 5788 -prefMapHandle 5792 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58c57b31-62a9-4341-bbe5-39e5ea6c5f29} 1992 "\\.\pipe\gecko-crash-server-pipe.1992" tab
      4⤵
      PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json
Size 27KB
SHA256 f30c1996e3f6c5719c4bf50f441263c48fc49534f3fb92276709bfa86843795e
MD5 17d9ef44026712ef5344f227406665d0
SHA1 098cb30844549de47ca2eba36c9eb930872fe227
SHA512 1b1b30c82cafc9219546beeb229bac5d1ff523c4d0ca7f5a3a5031bf68eb79cf129b9ff2561e02ee5a2a0dce164bfccfec71169dd55791356dccdcff874235ac
SSDEEP 768:mSBWF1ibWjhE2Gz8HFUqYlyduCUpiKg0OEG:mScEytd
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 8a5d995d3f27e07b188d96016fca47ad30fb8bf87330023af6cfde009294e19b
MD5 5b93ad86517a549c240cbcb7600583a8
SHA1 2fb6f7f320d2d7bb324f4f395dd7d70b5f1afe7c
SHA512 69cdb075e8a1e1c6ca841f02da8c363310fe4d3f43884fdb0ed2413555d9fbe8c0c43f6801ec163054a2f416b7283a9e554d4742843e4bcb99bf084078be8466
SSDEEP 384:HfNIu9fiGLm4pU1A+Q+4IYKgH4Zv+3yPrIVy8erKB:llBi8mCU1xQ+4INy4ZcyzIVy8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 8KB
SHA256 0518db239c5e808740b4e2afe6d837972e58c529cc1ac29f446c7cffcdd3b42c
MD5 a2136e570bdcc86dcb039857b39a87a8
SHA1 285b90d270d9462786cb50f7f011bc8710d205bf
SHA512 67a509a6edd48a0167bd4373ae6fec459bfe1ff385c479dc9c70eaa7c5991eccd6b209ab62a79d81a33d40e221ee2a11d3ed3671e579e0873bf22a52c0bac533
SSDEEP 24:5uB1oosJblLKhbzFsh2F3LFduhMZxwgu1xgRb+/sJbF0JebnpR5cO:sebVKhb+5oi/ebOJebn9cO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 18KB
SHA256 dc4acbd6b92a8aa6350c03fbc25879453e7886085d9cd58693a2c5ab8e27fbd5
MD5 89e497b26e8be1631a8226aee3821fc8
SHA1 38d382c31adb231cf64441d144689c26b13bb348
SHA512 13499e2fb51fdff2622dccc9d3021207ca808586d4c6262b371861a11b523ed5fa41640864b5da85f138228909b20c2b3850fbc7e7f0c737cf818798dd902690
SSDEEP 96:0ebVKhbOd5oiCebOJhb6pebvpf+ObWbSbYgbgz6bJbZbEbmbT6YZbfb:H5du
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 12KB
SHA256 12d298bf564d4e24526dda8069f30eb4502d562d2486c31a86cdaafb8cb8ff5d
MD5 e1e4d4b8f13286f2f9332ee97400db9c
SHA1 8dc1a456902cb340b8772d63b50b5669ed028c3a
SHA512 f25676dd84b5115288e31b575de864b65bbf3a5c40e96472511c1b0a23adaba03e896304f22f51353b5dc9374ce1aaafd6e038cfbe305ce6f9667cc628690a16
SSDEEP 96:sebVKhbOd5oiCebOJhbzpebvpf+hb1btbYgbgz6b:/5ou
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 eb7402b9eef544113e7f94242bba22e00f0b7c8a958ab3f8251879e24d79433d
MD5 c6541dd5186d6379929a077a8b621461
SHA1 6c6fb31164e33bce1edce4d046d8ce3893f130b1
SHA512 585cc7f22c09762ef8b8647c0e7b1378c7bdf5031ccc9f435fa8fd8c68a6143c0d97ebaa9067f2a56563bee8beef4db2115defac7a9bef840515e3dde1e64949
SSDEEP 96:6OQhjOI9Fl66JozGzgClKtmSSZSMF9ZbkW6ShmsxPP/PrWI:6x/66JozGzgCl6mSSZrvZboShpFPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 a49109c6c8273aff4a24ba53d7a4380cb1f04cea95262cbb1a64fce57a7d806b
MD5 3d542e86e5e99c1e05d6e4150b99e13f
SHA1 10f9cef9018e14327d0aec3ea0d87034409e9701
SHA512 8cbddfa3a90ac742dff0df5997cc7f49ccb6a4ab9f54ea1e48846ba133ff6cc879017e691ccdc57c80d232e4a4a42fabd92ea6e4136eaffeaa95e836d267a440
SSDEEP 384:Tbo1JCtP6/66JozGzgC1blgRzrWpw0qu44DiY2RbvbCw:nP/EsRf4z44DiY2RbvbCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8947107b1977aab57479d08f3c02451fa68a64a8c79224ce861db4e11d200dae
MD5 c70fd6fdf7a20eb9f18549b17a18868f
SHA1 cc52b51d178750942345a2ed0b588456f1ade1e8
SHA512 8e39c3b50a6df267654ac85a93c2438a2d0cf62ad402e910c4c6614791f2ed709ecafed62ae5df7466725a00c8ab90fef9cadf773a77492509b7ed9a56df9206
SSDEEP 96:6OQhjOI9Fl66JozGzgClKtmSSiBwSMF9ZbkW6rBB9hmqVxPP/PhxBW/:6x/66JozGzgCl6mSSlrvZboP9hfFPDg/
MD5 SHA1 SHA512 SSDEEP

Submit Download

13b8c2e8-1c71-4cea-8745-9fd06014eba5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\13b8c2e8-1c71-4cea-8745-9fd06014eba5
Size 671B
SHA256 5eb4e9761e8cc3a38762a33c0b5bd0b7f945ba04426e418bf6dee8a73ff25252
MD5 b718342a3ca14616e02a50525b4f9b48
SHA1 26e96c17a47484decc9ad259ecfde00fde68858e
SHA512 f86dc7d55040d7dd9583d4e899ddcdc497be4d0aa0ed4334c130af18ef6ae14507d3a1add62658363f6033b9d2be29ea531d737a363bb4fead5c80f00a75ff59
MD5 SHA1 SHA512

Submit Download

1fe99a5e-061b-495c-af3d-e4d83f5aa1c7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\1fe99a5e-061b-495c-af3d-e4d83f5aa1c7
Size 26KB
SHA256 f2f70e7c2fec13a748bcfee815950629093d5313f8623824594e2be3593c3f9a
MD5 125938acdab2dea81bc32d6796116852
SHA1 f8f7fa06b50b786fdef957d29047a60a63fc70e4
SHA512 bf99b18de1c914a76b2ad36692a32538898f3d8698a687066f2d9eed4bc90e8167622133ca071324e5da5ea8bb2905c311cc81ee2fb524be52c02f4f7e551910
SSDEEP 192:IuTL8T7UKoDROXvkP699ZDeFk2sJ6n0U4cmM+QuMRqjoCQxdxMV168ugprekG6k6:IGL8cRRXKrWnXUoWaYQrpoRS7lClncS
MD5 SHA1 SHA512 SSDEEP

Submit Download

90d452c5-db61-4a87-85df-6552727f3624

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\90d452c5-db61-4a87-85df-6552727f3624
Size 982B
SHA256 3f069be0ca0d4e256b7e27ae9567d7a35775932504d680d692e9d6c03c5d6bb5
MD5 0bcca56f8948dffe9fe973a5caeb7f63
SHA1 5d3f728f94a444b9a55d482d1be556cf599abdaa
SHA512 e83dd3baab9dd9c32d4b1ef012e16029ab8a60b302f7fab22bed2e4a15225757122360b311b32779ab392f6aec98bc2a33b5d18bfdc6000bd969a8b074ae4a35
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 11KB
SHA256 1f39641258a78d03482b0ab806b055a33d844dae60de85eaabbfd30ac1492fc4
MD5 5418f16a8b3e6a9e1bcea038342ddae8
SHA1 25cf47fd31b71194e71036c5fda073bb0c9d0178
SHA512 72cba42787887aa62368f7d35fb33e7410d8d0dd66d69bb332938bc1cb3e7374eb4a63ecc4336032ee07734ca7c806490e45883cd19c3944408589a1b16fa7ff
SSDEEP 192:h5nHRUfUqduyAI4WEW+dlkXddRy1SeoaXq2nmBw8Hq:2RAQl+IRy1GNwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 10KB
SHA256 0604f92cdd214c7a838d95e7778046f579027be3c7ba8d2ab78bff3ea1d59b5b
MD5 20d9d7e54bc157689c74dc49e5e49783
SHA1 0b4be667444751515d7e9deca75461649b842001
SHA512 9bac42a3aa915d979d659838a43b8346024aa698ec0713231cbc73828eb894baa99b5e8696919d22b5212ac62385fea5f274e3e04354653c557e99368f61c200
SSDEEP 192:S5nHRUfUqduyAI4WEW+dlkXddRy1SeoaXq2nSBw8Hd:ZRAQl+IRy1GFww
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 15KB
SHA256 29e1ee3135425a7f60ec89e0a26fa2d5070478c702c5dc6cb5af58b6bf538697
MD5 b802d8d96d6cf97ae5f95417b3c602aa
SHA1 538ba1774d45dd778537184bd71de41bef8208e7
SHA512 63fe034ba3e7532e3c321cbbb766a2f4e9f0e08153b96ee6fdfe6786545d87ab0193535f68b6ef500c8fe64609b0e711daa7db99bde3a7759c6830d2cc442863
SSDEEP 192:h6nHRUfNqduyAI4WEW+dlkXddRy1SeoaXW+2nxiBw8HwF1R6to:n6AQl+IRy1b3wxrJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
Size 10KB
SHA256 c54c3ff817179bf7b272ac930422cec019806dde161919f9d60caee3a220eaf4
MD5 7faa905067782f84647de79dc062bc7d
SHA1 5317a2a920ef1a1d8f1101f69338f28fac71f082
SHA512 d81c7d42ab642b0ea4983787365d0feba0396ccfa5128e0baaaf95e8b1ee413c5c5bbb0eeeb7cda90d85656bd7148e8006d11df36208b6d09f15f31d7e98575c
SSDEEP 192:S5nHRUfU3GNs/uI4gYcU8BtD8JJCddLMy1Zzw39KaXu2nSBw8Vd:ZlsWuYgUJJ6My1ZzrFwu
MD5 SHA1 SHA512 SSDEEP

Submit Download