a35069944cc3ff1e972bf3e24fac458b80e5c8309f715a05511b718f071c8340

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2024, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 947KB
Sample241202-e2hsyszkgt
SHA256 a35069944cc3ff1e972bf3e24fac458b80e5c8309f715a05511b718f071c8340
MD5 4d2c291c576657b3b0b86f07cd005633
SHA1 7f91837e1a92386db41e30ffbdb491ed3bee569d
SHA512 dfc0c7db1554e49c9088c206250d771a36fc7b4caeddea639830fa8f2dded300c09e1b31c8aef8adb1ad7c94e9d5b7ff067cffe9cbcfdfbfe29aead69bd4c3f6
SSDEEP 24576:rqDEvCTbMWu7rQYlBQcBiT6rprG8ah/m:rTvC/MTQYxsWR7ah/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1944	taskkill.exe
4520	taskkill.exe
1444	taskkill.exe
1528	taskkill.exe
1544	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	1944	taskkill.exe
Token: SeDebugPrivilege	4520	taskkill.exe
Token: SeDebugPrivilege	1444	taskkill.exe
Token: SeDebugPrivilege	1528	taskkill.exe
Token: SeDebugPrivilege	3632	firefox.exe
Token: SeDebugPrivilege	3632	firefox.exe
Token: SeDebugPrivilege	3632	firefox.exe
Token: SeDebugPrivilege	3632	firefox.exe
Token: SeDebugPrivilege	3632	firefox.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
3632	firefox.exe
4152	file.exe
4152	file.exe
4152	file.exe
4152	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3632	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 1544	4152	file.exe	83
PID 4152 wrote to memory of 1544	4152	file.exe	83
PID 4152 wrote to memory of 1544	4152	file.exe	83
PID 4152 wrote to memory of 1944	4152	file.exe	86
PID 4152 wrote to memory of 1944	4152	file.exe	86
PID 4152 wrote to memory of 1944	4152	file.exe	86
PID 4152 wrote to memory of 4520	4152	file.exe	88
PID 4152 wrote to memory of 4520	4152	file.exe	88
PID 4152 wrote to memory of 4520	4152	file.exe	88
PID 4152 wrote to memory of 1444	4152	file.exe	90
PID 4152 wrote to memory of 1444	4152	file.exe	90
PID 4152 wrote to memory of 1444	4152	file.exe	90
PID 4152 wrote to memory of 1528	4152	file.exe	93
PID 4152 wrote to memory of 1528	4152	file.exe	93
PID 4152 wrote to memory of 1528	4152	file.exe	93
PID 4152 wrote to memory of 2960	4152	file.exe	95
PID 4152 wrote to memory of 2960	4152	file.exe	95
PID 2960 wrote to memory of 3632	2960	firefox.exe	96
PID 2960 wrote to memory of 3632	2960	firefox.exe	96
PID 2960 wrote to memory of 3632	2960	firefox.exe	96
PID 2960 wrote to memory of 3632	2960	firefox.exe	96
PID 2960 wrote to memory of 3632	2960	firefox.exe	96
PID 2960 wrote to memory of 3632	2960	firefox.exe	96
PID 2960 wrote to memory of 3632	2960	firefox.exe	96
PID 2960 wrote to memory of 3632	2960	firefox.exe	96
PID 2960 wrote to memory of 3632	2960	firefox.exe	96
PID 2960 wrote to memory of 3632	2960	firefox.exe	96
PID 2960 wrote to memory of 3632	2960	firefox.exe	96
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97
PID 3632 wrote to memory of 4036	3632	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b570f976-7156-4183-aa5e-f5b955bc2e21} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" gpu
      4⤵
      PID:4036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {907ffd9e-2659-4c9d-b0ba-ccceab943925} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" socket
      4⤵
      PID:4576
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3124 -childID 1 -isForBrowser -prefsHandle 2952 -prefMapHandle 3108 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fa55cd1-b1d9-4baa-bc6e-89933864947f} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" tab
      4⤵
      PID:4048
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3628 -childID 2 -isForBrowser -prefsHandle 3640 -prefMapHandle 3636 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d89d8ec2-af32-4345-8b9c-cfbad0bcdec0} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" tab
      4⤵
      PID:3088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4824 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4820 -prefMapHandle 4728 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddb68ffc-54be-4055-9182-2e5e9f0453d7} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" utility
      4⤵
      Checks processor information in registry
      PID:4132
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5428 -childID 3 -isForBrowser -prefsHandle 5472 -prefMapHandle 5416 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c426888-3721-4847-85ff-7f9f12770f3a} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" tab
      4⤵
      PID:1948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5480 -childID 4 -isForBrowser -prefsHandle 5484 -prefMapHandle 5624 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db6e4572-6da1-4947-ac5c-2537da3c0131} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" tab
      4⤵
      PID:620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 5 -isForBrowser -prefsHandle 5756 -prefMapHandle 5768 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5155080f-9722-464b-acfb-0abebdba79fd} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" tab
      4⤵
      PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json.tmp
Size 27KB
SHA256 6a269352d406c7f7df8eb9b20f2ed34d07f991565caf71d742dd67c593b6bd12
MD5 d02eaca64ce934980a3bac17746dfa24
SHA1 ca8d4877e5ebb35de26e213c04e8d7b8c4e759f7
SHA512 1af22bb34c48d3ec792f8ab469a3b3eb85542a3e6f80675391676fd58068c458f2cfb9376b461cb4ff4a59251685e69f1c9801f9f37c0288fecb0f1741c54f67
SSDEEP 768:PJdOEYcJaSBFiNtarEwfMUPgydF3J7G5G:PTOEJHBa0fMUP70I
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 9c912aed0076609712e758943e861dd7302ecfcef310a01b2fe64fa996c3bf5f
MD5 2ecd41224518bbe04b5c969cd8747a79
SHA1 b1ddb14ed62f3203a525b004e75755750524da0c
SHA512 b807988b6907bf3c023695e60b4d19b5b698e9b109ddd556cfc6f31683b1d6b95cbfa22989c8a5f40ed4bd82a8268c627872d5ec016b8c9c15f1e49654ea45b8
SSDEEP 384:HfNIu9fiGLm4pUkA+Q+4IYKgH4Zv+3yPrIVy8eIjGGojGGM:llBi8mCUkxQ+4INy4ZcyzIVy8pmM
MD5 SHA1 SHA512 SSDEEP

Submit Download

92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Size 13KB
SHA256 622deba0cffc5231fd11882fe96050d2bf263cb83b1ed7849305fc2751750a8c
MD5 46a4689462a71a8adcb0c05767026a68
SHA1 933b08a3685c5a7d859cb63cfb2a3742b9da0801
SHA512 86c02ada93eb7aa7f3907b15da0e7b6dbf1b7912bfee142ec7e000f0ad6118699fd025cb5d72640aa7598aa987dd49a1799e9bae0c9e546f62c54ab4ea8126e0
SSDEEP 384:HFh1u9fiGLm4pU5A+Q+4IYKgH4Zv+3yPrIVy8eWGOGE:IBi8mCU5xQ+4INy4ZcyzIVy8C9E
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Size 10KB
SHA256 9fd3adee9afb1217eb6b3fea0be1dab324ce12227168905c47b915c529a84588
MD5 97b0e67b25bff9dc63aeb78f08fe31db
SHA1 cd0f069554881a5b97e5cac5d2541db426b60b95
SHA512 35ae0e3ab79abcfdf4333f7f18f8e47b53b6ed6834dd6a1c3fe0decb5be67e30bd706559ed48596f00e21120575528d09c05bd5b19e31dc330fa31855f0fc7e1
SSDEEP 48:vx5oDebVKXbG9cOiebOJXbNpebvpf+Xb:J5oDebVKXb/ebOJXbNpebvpf+Xb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 5f2dcd9e5df70741cf2a10ec76908ea65cdef0d366b65d6e182ce82fe27557eb
MD5 ca5c697e6abcdcecbb1495c6442f1151
SHA1 8c0d56fc16e5a5505e1f639679f996c5d17130d0
SHA512 1c109ceb915ff175b7abf3a5d2bcb796934eae692828fa3de88e7a18771b90fbaf2ad330428c8287aad50779e60b9776fee434e5b13250e9b41939dd85c9ef9a
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 9527da0f5e801f431312420e65becf8ac5b9665a3301948c0372bce81bb0eba5
MD5 35b8c4a279a44fb7327090f168d2c2cc
SHA1 51ac1d7af5e02fd4d4cb2c03c30e312b81a21254
SHA512 0dc18fde1713e61d693a1829c003f9c30f2e11eae6c6174e588567989fbe4b6ff3c4f2eb11fb294b01ed5e405055f2f8ca498f8db3c24bd67d83078f1417a594
SSDEEP 96:nNQz+QVFl66JozGzgClKtmSSySMF9ZbkW6ghmgVPP/PrWI:m/66JozGzgCl6mSSyrvZboghVJPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 e420ff765cf87fe7eb7436c13cfda445ed6c995f6dea75b7f8dde48cb7d014b8
MD5 1e61995942c287d277042b6b208b8f4b
SHA1 158dae201c1142131a868c209839f2dcf33d6a67
SHA512 d9891f1c19654c4ec67f5651af312c6dd83b2e63b5ea19101b42a95855430c76691c34c6c339417f9cc40ef242171698246f365c9b2c8942d335dbcbd0221a56
SSDEEP 384:gtJb4CUcDm/adbIbM7/66JozGzgC1bvjxbo9+xLPmi:4JpbDm/adbIbM2EBjBtLei
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a5d14c4762741d6d77679736e449e4957bb5914242cf1de20fdc9fff5c826099
MD5 aee2e9ab82ee156c79529546614fa74e
SHA1 cf7619f235183f548bdd56a6647c60360fae5710
SHA512 bb8fbd8629d8ebc1658db900f1ea2321683ebfc85f40b781f29c3075887975536862602665806692dd2f452b9d21b62849d1b50e3a638e6314073aa7ff4b2a3a
SSDEEP 96:c1BoSMF9ZbkW6rBB1hmgVPP/PhxnWBGNQz+QVFl66JozGzgClKtmSSM:DrvZboP1hVJPDWx/66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

82ba5390-c153-47a0-bad4-c3e52ac723ce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\82ba5390-c153-47a0-bad4-c3e52ac723ce
Size 982B
SHA256 2519f0805cf00d10f041ee0b18207c8e239e84b0c83167dee92f58af77347872
MD5 52fa8294a6c3429266381229eddd4c53
SHA1 1f0af8ad1608ced1957fe771c2bb0c9659384f87
SHA512 08142de37cf530cfbb1ccf161d4abb07ce45c4f36309a90d4c206c0b6f01a77c66b5d71cd8cf997ebab148b9d51310984da9280d1ebdea209781e156e7b7a03b
MD5 SHA1 SHA512

Submit Download

d0b14528-bd8d-4ed1-b53e-49d8bc10fedc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\d0b14528-bd8d-4ed1-b53e-49d8bc10fedc
Size 671B
SHA256 8b86d7d335b87d26aaa21ff36030f94d824d1033ec88371220d7a3fe2b7cbcda
MD5 5bbb5dbfde2075e0d3d69199693e7e55
SHA1 fe2884e324468400641d0eb0ac3392cd453f75be
SHA512 a68d8bbea01d118749f9b6281d1e7d76fe98b58c5e10fde669869b655f4b7eb611b735101de4dc0cd3e38b2017b69f3e3ce16e8a7ce0488ab289442397c8f4f8
MD5 SHA1 SHA512

Submit Download

f71ddb5c-a1bc-4573-a687-47bfadba04b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\f71ddb5c-a1bc-4573-a687-47bfadba04b6
Size 26KB
SHA256 7cdbdb2072f78e6a07dbdddfd64fcce6854b14ff5f78eb34c051d383164567d5
MD5 2ceb5a5d32a870776215a9afdbc30067
SHA1 1df26ac6079b90cc6b22c62fc9dd9de2f88ed22a
SHA512 505270f733d2d4e00f473ad5cc53622c4453cf802356cec623e419b07dd0747e17b5ecb7eac1bc31959e7616d51f2a56cc39c4a70a63e25148dc5ffbfa11d9f5
SSDEEP 192:p5ai2R7jXJuQOzxAbMDO/S5H0iP8bbXjjahko343H2rO8n4R8nmMz6itKAzaxoSn:p2R7rk1lAbMJHuvjeOieLnG8kmbivm
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
Size 12KB
SHA256 35efdad1a71799f5497de0716c92dd3a3f1f68eaff49e5dadae757ad5762b693
MD5 47692c43d82657a6dda8e973fd7f9c5f
SHA1 d5f23f8ad2023403cd23fa23597ad6d430ccf22a
SHA512 075d80a3b0f729777faa80f61c3dfff8f6e7168154c3d8c42136c32915c6385daa6b55a9a5ec17eb2dcabd7ce16f6de5291e2c838593e2b686e20d8e89281e1a
SSDEEP 384:GvSvxU5uoqg1rDvn4nqYkw69++2rfWS15:b5wuwrr4nqYy9++2rfWS15
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
Size 15KB
SHA256 26554006653157300274c7078ab886b002a8a87fc8290a45974cf5e685e08eef
MD5 7904af425cbffe6de370a0ebceab54e6
SHA1 1f357001ef4b834c543d712dcb6192d2fb887a93
SHA512 09bb807c964d9131a5ce6c24ad4564360ef2cb95d66e2d86532f9bd4e90ad997f1c407e25f21fe71ebee8638319f31e070c14a18bb7035f17459a0e827d32c1d
SSDEEP 384:GV4/M4wSO5vxU5uoqg1EDvn4nq2lbvwY529LaB++2awrvgftJBWSt0iL0THVT1AR:m4/M4wZ55wuwEr4nq2lbJ29LaB++2awa
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js
Size 11KB
SHA256 10e52cd5d2ec2b54a976e80798c75a15e09f8d86ae37f48703f34bae83eee1ee
MD5 11a9fed2ddcbb70d1a31892ec5c4321f
SHA1 4d5ab81256d117cdffefb6c364d9bccf905132e9
SHA512 88ed41f97fb59b214d956df24b8af85995402400120b0ee07131280f59ba289fe792b0884f29fe41f70ff2579f5ec0657e7d79e25d54093bfca8f5dc7a7f70ea
SSDEEP 192:RB5nSRKfElLjUDxnMd3QW+YtBUNtPVdtOoV1I0G5oaXPDvbrBw8VZ:RvrDx8QW+YtMOoUDvJw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js
Size 10KB
SHA256 e9e329b13aa90fab9c3cce179c8a1af8a6cda45f4a3fd8266d43f6f3481cc521
MD5 2776be371d2a00d63ad4e9eb680c6bd2
SHA1 95d4e04b5f977a5d3d75052393aca566e347af4c
SHA512 a65ca2c4f7e59cc8edf47f3ff1f59d6fa3bac4e7cca1dde626e627387643ab477eb26c68bc70eada7a3c59d23db3bab98f29b42601176aa715521814c05a5757
SSDEEP 192:RB5nSRKfETemvxnkd35yI8dqn7VZtqgykwy7aXeDvbrBw8HZ:RvSvxU5uoqg1rDvJwk
MD5 SHA1 SHA512 SSDEEP

Submit Download