c091df1ec87ea92bfdb567f160c6aa8d671f4faa4677241b90ef643809f7371a

Analysis

max time kernel
131s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2024, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 948KB
Sample241204-ftprzatkds
SHA256 c091df1ec87ea92bfdb567f160c6aa8d671f4faa4677241b90ef643809f7371a
MD5 ef8e3392bb8ffc787b197ad4e207cb39
SHA1 3de9ca935b50ae854b07aaed53892c0bc8edc392
SHA512 674eb52b343e92c2edcd8ee39e6ebb976a173db3da92c387622e52e2b8b7c582af8b017d65fa513df383b9781b833c1ecd05a431297ba1e946b4e3fbc16944fd
SSDEEP 24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8am2la:sTvC/MTQYxsWR7am2l
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2728	taskkill.exe
4344	taskkill.exe
4132	taskkill.exe
4432	taskkill.exe
3124	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4836	file.exe
4836	file.exe
4836	file.exe
4836	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	4132	taskkill.exe
Token: SeDebugPrivilege	3124	taskkill.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	4344	taskkill.exe
Token: SeDebugPrivilege	4400	firefox.exe
Token: SeDebugPrivilege	4400	firefox.exe
Token: SeDebugPrivilege	4400	firefox.exe
Token: SeDebugPrivilege	4400	firefox.exe
Token: SeDebugPrivilege	4400	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4836	file.exe
4836	file.exe
4836	file.exe
4836	file.exe
4836	file.exe
4836	file.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4836	file.exe
4836	file.exe
4836	file.exe
4836	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
4836	file.exe
4836	file.exe
4836	file.exe
4836	file.exe
4836	file.exe
4836	file.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4836	file.exe
4836	file.exe
4836	file.exe
4836	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4400	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4432	4836	file.exe	83
PID 4836 wrote to memory of 4432	4836	file.exe	83
PID 4836 wrote to memory of 4432	4836	file.exe	83
PID 4836 wrote to memory of 4132	4836	file.exe	86
PID 4836 wrote to memory of 4132	4836	file.exe	86
PID 4836 wrote to memory of 4132	4836	file.exe	86
PID 4836 wrote to memory of 3124	4836	file.exe	89
PID 4836 wrote to memory of 3124	4836	file.exe	89
PID 4836 wrote to memory of 3124	4836	file.exe	89
PID 4836 wrote to memory of 2728	4836	file.exe	91
PID 4836 wrote to memory of 2728	4836	file.exe	91
PID 4836 wrote to memory of 2728	4836	file.exe	91
PID 4836 wrote to memory of 4344	4836	file.exe	93
PID 4836 wrote to memory of 4344	4836	file.exe	93
PID 4836 wrote to memory of 4344	4836	file.exe	93
PID 4836 wrote to memory of 1440	4836	file.exe	95
PID 4836 wrote to memory of 1440	4836	file.exe	95
PID 1440 wrote to memory of 4400	1440	firefox.exe	96
PID 1440 wrote to memory of 4400	1440	firefox.exe	96
PID 1440 wrote to memory of 4400	1440	firefox.exe	96
PID 1440 wrote to memory of 4400	1440	firefox.exe	96
PID 1440 wrote to memory of 4400	1440	firefox.exe	96
PID 1440 wrote to memory of 4400	1440	firefox.exe	96
PID 1440 wrote to memory of 4400	1440	firefox.exe	96
PID 1440 wrote to memory of 4400	1440	firefox.exe	96
PID 1440 wrote to memory of 4400	1440	firefox.exe	96
PID 1440 wrote to memory of 4400	1440	firefox.exe	96
PID 1440 wrote to memory of 4400	1440	firefox.exe	96
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97
PID 4400 wrote to memory of 4576	4400	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3124
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {daf16487-c6bb-4e04-95ca-bf38aadd7af7} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" gpu
      4⤵
      PID:4576
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78a490fa-2cb7-4ea9-9fbc-f6866f63e091} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" socket
      4⤵
      PID:3436
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2836 -childID 1 -isForBrowser -prefsHandle 3248 -prefMapHandle 2860 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cb2b854-2442-4bd3-bc4f-8555398059e4} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" tab
      4⤵
      PID:3680
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3848 -childID 2 -isForBrowser -prefsHandle 3840 -prefMapHandle 3836 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {faceda15-10e5-4f77-82be-770d8f63da30} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" tab
      4⤵
      PID:4360
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4480 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4556 -prefMapHandle 4420 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b63495ab-48f7-4c27-8aae-da3d025dcbf9} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" utility
      4⤵
      Checks processor information in registry
      PID:1784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5480 -childID 3 -isForBrowser -prefsHandle 5492 -prefMapHandle 5488 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eeda94dd-e4a2-475f-b6b7-293ec720f0ce} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" tab
      4⤵
      PID:1360
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5612 -childID 4 -isForBrowser -prefsHandle 5620 -prefMapHandle 5624 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99209331-2121-446c-aa14-6f4faf254249} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" tab
      4⤵
      PID:1316
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5812 -childID 5 -isForBrowser -prefsHandle 5820 -prefMapHandle 5824 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81309fa9-8b00-456b-a6e9-f7008158de41} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" tab
      4⤵
      PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 86f2a90730308500c8295e4245bfa161499c3befa7f212a80c1120c84bf9d9b3
MD5 416a8c02c0376b3a2f86a5c95523099d
SHA1 9d2dbdbeb34378adffca44570416d52f8098c743
SHA512 cff2adb1731a730bb145a049dbd3614f4cf2cc83e37bea9675a7a3321e5b032dfd532c60fcfe7b2b924b73ec364c1eafaec6c567fee942957eebf8a9a43973ba
SSDEEP 384:HfNIu9fiGLm4pUVA+Q+4IYKgH4Zv+3yPrIVy8e/i6ih:llBi8mCUVxQ+4INy4ZcyzIVy8xZh
MD5 SHA1 SHA512 SSDEEP

Submit Download

92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Size 13KB
SHA256 a5c7999d15b61a8d974fdb39dcf793f37d38b9f2eadad63ed97ee51959c242b1
MD5 f08e9e87e078a6246b06ef595f759146
SHA1 9835836471d22414656bbfc57534198373fbb2d3
SHA512 c62be77d1d268396610797dff7bb917ba90a8ae3ef56939fb302ee52e4665c5d347a58805c7790e80b1b2514c5467e2e91b32a2db38571df809b719817ce0ebf
SSDEEP 384:HFh1u9fiGLm4pUpA+Q+4IYKgH4Zv+3yPrIVy8eBiUi9:IBi8mCUpxQ+4INy4ZcyzIVy8Lv9
MD5 SHA1 SHA512 SSDEEP

Submit Download

asrouter.ftl

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 6KB
SHA256 9a2cc0f658cedf09d595b56e502ce3ca5d166008c762341ebd75e3c592e1b800
MD5 ace991e0c3a6aa58e524c909bcbffefe
SHA1 fd2a3d0474ad409f27c1b3d6aea8974fb1c4e71b
SHA512 eafedf984cb9dd33a919e9f209463d1a0810aec6c172af191032e9ac16f6a23c84c471db4cbda526a0b0976b275a0121ac25fca55f697810b601ba96cc021035
SSDEEP 6:gNe0gidpq88gidydgid0aiwfLZyyURTHgidpqs7HgidBgidwQWiwfLZy:ggQpB8gQWgQPfty3OQphMQSQwD7fty
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 8KB
SHA256 86c4457fc9ef3c13ba1d5bfc88b0aa1ff7451a4f85448d512c13ccb5d9f51738
MD5 c4da9105be8c42d2b0d572ec2be6a27d
SHA1 e56703f69f9f4b594fb5ec967b8817c52afc2604
SHA512 c7025f82d975764f3ec23322ff38694cf7000349b2c89908c5d4d5735ff2461fc44acd57c455a67d50e9fbfce90b8f4ac9a81b35645e34273918b0cc1a00065e
SSDEEP 24:5uB1o1sJblLKObEsJbF0JOb5uhMZYxgu1xgRb8WKsJblxWKf+QbtpR5cO:JebVKObEebOJObI5owpebvpf+Qbt9cO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 18KB
SHA256 7f79b0bcc3834bebefb3a3bc814b4927dd2962e1e3959c3ea88a0d3be8d728ec
MD5 9ded597de38e778b41f1e8c2932ff8b2
SHA1 e6b3ec30d814f62cb5993530c9f8a3fdffd61b04
SHA512 92366d8a8ab2f7c11c7fc623d133400cb553a7de43dfd26004860adf7cbf4f4e0c64ac21946337b1dc9da0cb3b132e9616806b3bbd7df185d9e8b6457b4882a7
SSDEEP 96:1ebVKObEebOJObU5oMpebvpf+QbkbcbkgbgzebQbYbObAbZbtb:R5Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 12KB
SHA256 a752d9a6f85ab7b8c608c48d65463c207d30310e6d53f45962008d2c803aab7f
MD5 d0ba7e7e1bc5de22ecf459f124a7279d
SHA1 d1d3b720a1aa0aabce2128acff5d2adee2707372
SHA512 2bb9ce8755e7c4701796f664be83c1bca25fcd0359bf924cd83c92aa1204a4600702cb89e411ab72f84144fa9b6a32cfab1736f13c12e4811ce49e773931f0ca
SSDEEP 96:JebVKObEebOJObU5o9pebvpf+LbxbRbkgbgzeb:95cu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ef2fe3ba32990ef73504f71cbd09b3473f7d02672791a6c4a388d17177185cb8
MD5 1e85466a882c81b10af072f8e91bbf0a
SHA1 c74831c19e60b72e9d45c45a524d71bdf2ddd0cb
SHA512 b1d9a123d85bf26a4dbbd8a6cac46e7483828bcfe1cebe9ae1a5476322324df6c963afed51feb18f4753f0ab8c0d46cc979b2e9362032a0db7f6bec8d91e9aaa
SSDEEP 96:SBjbPySMF9ZbkW6rBBKahmWWMdE8EP/PrxxkWRxKuTLNFl66JozGzgClKtmSSb:vrvZboPfh16lPHfb/66JozGzgCl6mSSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 d7f2f7542fa7aff0dfb8ad553bf30d256188466d3210e4f9804a71b4ce4e6148
MD5 cc47086e6e12f1061e9ac0d37c114d1c
SHA1 37c606b37d308985a6e7ef38863b5ef05fef8a92
SHA512 26d43927880196c7fe3cdc6b55b27c2ae0ea9c7c15eab41a80042099422136786c2a7a6f4cb6afc67572ba4424bfaa8602ee5171337b993a9ba7176f907d5040
SSDEEP 96:DxQQ9lfFl66JozGzgClKtmSS5SMF9ZbkW6ShmIAPP/PrWI:f/66JozGzgCl6mSS5rvZboShRmPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 a46eb0d3e9743b9d56300c818e7fb117ad0b549088a2cc1fb2322668938576f6
MD5 47e04b89a8fc171ed904df590cc0e976
SHA1 1f9922a504755c5cc97fc692dfb693e202af0f01
SHA512 4908edfc30a386bd76db169f61b898450139ee6c6cb0726d937d010c1a8a9940c1062db4913656d389acb40400ba3d1a4478b30c42820b36fcc9180a1c4bf119
SSDEEP 96:ESMF9ZbkW6ShmIAPP/PrWZ8xQQ9lfFl66JozGzgClKtmSSrWI:ErvZboShRmPCK/66JozGzgCl6mSSCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 c7ad7c215fd4074dffab9c4d53db82c89b8735e871e92b21c16efcd85304d187
MD5 530318e1183dd5744ab0a7c6270f8a13
SHA1 80a5eb9229ce9d5dd9302769cb4c48ad9bd6e346
SHA512 98d109eb04f6c7c02e9cac179ff95973c3c0c8d31713d73e3db95a1d9786c16ef54c8fb7961b4255cb2fbb603862b3806fb2f2e83783650651b5840087654709
SSDEEP 384:2boS7CPo/66JozGzgC1buYiW2uZ9xyDvYt6bCbIm:aEtE3is4DvYt6bCbIm
MD5 SHA1 SHA512 SSDEEP

Submit Download

2eb46bf6-9f02-4be1-9a45-d3f26d3c9cc4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\2eb46bf6-9f02-4be1-9a45-d3f26d3c9cc4
Size 671B
SHA256 5e1739eb6cb9a6afd67ef4ccc3959d94605cdf891c8854cbf31feb494d9ae5e0
MD5 2d145387b8cfc0b2cc27d173bb015f60
SHA1 1d322d0671aa8ebdb368f6da75ac6f07ca8f8181
SHA512 c666878e202673c0d13e9d72f93dcaf8aa0b00af09d518fbe0f76b69f6478694594de12c0434c936b7496135afd7fad5ca8cd0c937199a38d1987a225046d716
MD5 SHA1 SHA512

Submit Download

3a0ac699-2c7f-4728-ab69-c21faaf763b1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\3a0ac699-2c7f-4728-ab69-c21faaf763b1
Size 29KB
SHA256 3de8fd09ce80876241a6d032f58b96963b51226d60f3bd6a147d05ab222671eb
MD5 fc400f96b32524f9b678c11cdac5fa55
SHA1 e9cb6f920bbff6e59203b92bf2a2811eab24bd34
SHA512 6833c5d4a32dc19fbd6257f16890a83eb4bb76038029160210fa6c2d96fe3724e2f13c0768ebfdfc00c3ba17cbeb6893a7ca2d291f9663aac4c1a56539b5cca7
SSDEEP 384:nKpNqC8iclRfFSvWIbogMPl2N6qiPACT2yL:nFgWgMdgidX
MD5 SHA1 SHA512 SSDEEP

Submit Download

62e96e88-d7a6-466f-b2c0-32b89ab101c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\62e96e88-d7a6-466f-b2c0-32b89ab101c4
Size 982B
SHA256 72102648f55f83adecea7bfc54ce143e67a0429f43944afc60e1d10678e64aa9
MD5 635048e595cac34e766efa5ea5a3ebd2
SHA1 0f435900199ec6ffcc152e7d91039aa257679044
SHA512 01677521e4227361153d897d88e7db8d57b8f6fc522bdb4f5922bc1b09dda8c0ca3e74be9464c59a49fc5f847b5055a377bef0ed15a2a876388e2eea15f5071a
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
Size 10KB
SHA256 6b259b8586dadcae91d11ab8db840d7fbc3554a3e272662cd8fd4837b715753d
MD5 c18bbefc0860efd50b0cbc6ecfa6abd1
SHA1 0d893e769de267b2738358b0f41c285b2e988514
SHA512 da1db770c911573b8ddeae72ffb462b5875895ab054579e7378560563ca48dc17fe4243574e9a6f30dd3cc56c15e6bb3bc9d0cb1860cf3fb6e0d37c3e31d8ab7
SSDEEP 192:Ob5nYRof/iXN5z9/xnFd3J5I8qd7Q6VhtUgS0iFaXkMSBw8Hy:OtSVx3J5YVUg2Dw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
Size 15KB
SHA256 2ece2cfee95379ba52552b2b498da8a3a078a755e5a80725b255d9a8a9196bd8
MD5 eb9ba8b05763712ed7fff8c1a6c7ca24
SHA1 acf82d4a1297264e89b064ba042fa9f7ca198766
SHA512 01b864c79d564a73a647214430ce40e76c2e259a4738e520ffb4db4256a5c0567fc94e7d45d6883e011cd23f2f93a387d5eb807d00c2ccad5f8215e66d240a6e
SSDEEP 192:LbWnYRofHpV5z9/xnFd3J5I8qd7Q6VhtUgS0iFaXo+MNiBw8HSr3xOL:LolVx3J5YVUgrdwTe
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js
Size 11KB
SHA256 2189828876ac78ab20101b80e0dd276c5e69dd4c757007b1c19845f6f8a659d5
MD5 1955ad81cc828f59ad03ea3b819f0857
SHA1 e7ea88e3b784a11e24a0587921e35439a69fc087
SHA512 ef101ec7dca5b76e7e49029ad97ffa8f75fc11bfbc16713a8b02f495420e00e91e025b9f2f8bdea8c31b62f4a1a9a539727f11087909a86ea4224dad75cbfefe
SSDEEP 192:Lb5nYRof/pV5z9/xnFd3J5I8qd7Q6VhtUgS0iFaXkMVBw8Hs:LtdVx3J5YVUg2QwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js
Size 10KB
SHA256 0ece9031b86110ff2cd38472cb6c815e4a1281f88da4c88e78283142ddc98269
MD5 99cb3ae8f3560f105df51958bcad80d7
SHA1 e85c0519f7c168ae4454cee107fae42db07a5581
SHA512 5b0923026c7df6f707e83140e25b3ebee59c7550ed0e888a74de2fe5dca12c8086d4e75933b1e0b979736599fd968fd2a42c2a3d9925af090d2c8830ac5a158d
SSDEEP 192:Ob5nYRof/pV5z9/xnFd3J5I8qd7Q6VhtUgS0iFaXkMSBw8Hy:OtdVx3J5YVUg2Dw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.0MB
SHA256 dc939411c99b40c64335b389c546568732425cff79812c3f8a7951edc0f6a328
MD5 9b796eb6e0842127c9b6962055552ff2
SHA1 0d5dd3bef07787a4865ecafb759994ba4f5ff3d9
SHA512 ea01e02c4db6e60eb1dd629afc46269187d6696cf45e74125ddcf00c86070fc6cf751de3cb23eeeeb82f78dc9936cbf95f11f5866d833744de5eb2823c0d5d1e
SSDEEP 6144:NB4rQg3K393z3m3x1HS5JCKJXUU3hyfOzRU3zGbCN4QL3+VcHaeHN1HWTHMZmz0W:v5ThN38WW3p5UpEYkBU2B9xaX+w2Tp6
MD5 SHA1 SHA512 SSDEEP

Submit Download