0fb4defbcbeb71ef4e72d5c23a20d3245df51970d4853b09770ad9b310fa386e

Analysis

max time kernel
126s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2024, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 949KB
Sample241205-halmbaymhm
SHA256 0fb4defbcbeb71ef4e72d5c23a20d3245df51970d4853b09770ad9b310fa386e
MD5 24446188a72c828117e1e29423ccbdad
SHA1 03a22521280672cf588989701ed52cc4447738c5
SHA512 e89150ebb5988f095b4d0c8405bd6cf99007df932610ad65aa23d1f0c823037e8eef23f2f0a0d89da237d07983bc063f3e7ff89fdcb88c543865a6df81c09255
SSDEEP 24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8a+Iu9:yTvC/MTQYxsWR7a+I
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1580	taskkill.exe
2652	taskkill.exe
4300	taskkill.exe
2164	taskkill.exe
4492	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3620	file.exe
3620	file.exe
3620	file.exe
3620	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	4492	taskkill.exe
Token: SeDebugPrivilege	1580	taskkill.exe
Token: SeDebugPrivilege	2652	taskkill.exe
Token: SeDebugPrivilege	4300	taskkill.exe
Token: SeDebugPrivilege	528	firefox.exe
Token: SeDebugPrivilege	528	firefox.exe
Token: SeDebugPrivilege	528	firefox.exe
Token: SeDebugPrivilege	528	firefox.exe
Token: SeDebugPrivilege	528	firefox.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3620	file.exe
3620	file.exe
3620	file.exe
3620	file.exe
3620	file.exe
3620	file.exe
3620	file.exe
3620	file.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
3620	file.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
3620	file.exe
3620	file.exe
3620	file.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3620	file.exe
3620	file.exe
3620	file.exe
3620	file.exe
3620	file.exe
3620	file.exe
3620	file.exe
3620	file.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
3620	file.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
528	firefox.exe
3620	file.exe
3620	file.exe
3620	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
528	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 2164	3620	file.exe	83
PID 3620 wrote to memory of 2164	3620	file.exe	83
PID 3620 wrote to memory of 2164	3620	file.exe	83
PID 3620 wrote to memory of 4492	3620	file.exe	86
PID 3620 wrote to memory of 4492	3620	file.exe	86
PID 3620 wrote to memory of 4492	3620	file.exe	86
PID 3620 wrote to memory of 1580	3620	file.exe	88
PID 3620 wrote to memory of 1580	3620	file.exe	88
PID 3620 wrote to memory of 1580	3620	file.exe	88
PID 3620 wrote to memory of 2652	3620	file.exe	91
PID 3620 wrote to memory of 2652	3620	file.exe	91
PID 3620 wrote to memory of 2652	3620	file.exe	91
PID 3620 wrote to memory of 4300	3620	file.exe	93
PID 3620 wrote to memory of 4300	3620	file.exe	93
PID 3620 wrote to memory of 4300	3620	file.exe	93
PID 3620 wrote to memory of 3852	3620	file.exe	95
PID 3620 wrote to memory of 3852	3620	file.exe	95
PID 3852 wrote to memory of 528	3852	firefox.exe	96
PID 3852 wrote to memory of 528	3852	firefox.exe	96
PID 3852 wrote to memory of 528	3852	firefox.exe	96
PID 3852 wrote to memory of 528	3852	firefox.exe	96
PID 3852 wrote to memory of 528	3852	firefox.exe	96
PID 3852 wrote to memory of 528	3852	firefox.exe	96
PID 3852 wrote to memory of 528	3852	firefox.exe	96
PID 3852 wrote to memory of 528	3852	firefox.exe	96
PID 3852 wrote to memory of 528	3852	firefox.exe	96
PID 3852 wrote to memory of 528	3852	firefox.exe	96
PID 3852 wrote to memory of 528	3852	firefox.exe	96
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97
PID 528 wrote to memory of 4540	528	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:528
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f979c39-02d0-470e-95bf-40209246c1f3} 528 "\\.\pipe\gecko-crash-server-pipe.528" gpu
      4⤵
      PID:4540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6dab172b-ab64-4a1f-a36b-454a1cd00e2f} 528 "\\.\pipe\gecko-crash-server-pipe.528" socket
      4⤵
      PID:3252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3004 -childID 1 -isForBrowser -prefsHandle 3008 -prefMapHandle 3264 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09d17186-5c80-45d9-813e-e270e4840bc1} 528 "\\.\pipe\gecko-crash-server-pipe.528" tab
      4⤵
      PID:4008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3680 -childID 2 -isForBrowser -prefsHandle 3672 -prefMapHandle 3668 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce4c61c0-4853-4fc6-a813-b0e5b723cfe5} 528 "\\.\pipe\gecko-crash-server-pipe.528" tab
      4⤵
      PID:2592
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4448 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4460 -prefMapHandle 4468 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c383ee9-fbd5-4805-bc40-cd6672cf8909} 528 "\\.\pipe\gecko-crash-server-pipe.528" utility
      4⤵
      Checks processor information in registry
      PID:1736
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5068 -childID 3 -isForBrowser -prefsHandle 5060 -prefMapHandle 5056 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9d87b07-740d-4dbb-9def-acf41c1fcf39} 528 "\\.\pipe\gecko-crash-server-pipe.528" tab
      4⤵
      PID:4568
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 4 -isForBrowser -prefsHandle 5212 -prefMapHandle 5216 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52918b05-deeb-4817-b1d9-78ecd8663fff} 528 "\\.\pipe\gecko-crash-server-pipe.528" tab
      4⤵
      PID:3392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5400 -childID 5 -isForBrowser -prefsHandle 5408 -prefMapHandle 5412 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87275f31-1d5d-494e-9083-ee6cee1bc4ec} 528 "\\.\pipe\gecko-crash-server-pipe.528" tab
      4⤵
      PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json
Size 28KB
SHA256 e7451c56d5473ff6a8481fabe890cc807ee02a9d71c231274edac818e6aa2f48
MD5 aea915483d29cce1f4d6f5d6549243db
SHA1 dd13cae5915493fc092384a8cd12540e358ac9fd
SHA512 5b977e54d1473928ce83934060ee8e2b7d50d157a7818bc51079810adaf6d896fca4404084d52df0df0801313cb17b6a381e5dfb217440f9bbac9234875f2a57
SSDEEP 768:9bPpI1vJNyGd7LY//yi5vcG25ydc7LPBRQpQzC4kG:9KvJ96/A54W7jB+2+4X
MD5 SHA1 SHA512 SSDEEP

Submit Download

92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Size 13KB
SHA256 e7ae9a23ce08013abd7603f6507eb6b01ffeba79e77786e90daadaa5cc9d0b72
MD5 b257c11546918bd3dd2a42543b12acd2
SHA1 28b000cd556c48bfe6d837e0667a8fb10e76b4af
SHA512 863e494e079daca47079017d802801cdd00e4b0b3de596991cc2e9cb8f7e075aeeae50092f049616b813c9c4c4966bd4d1c6b72c70095f87e57e10768e958d46
SSDEEP 384:HFh1u9fiGLm4pUnA+Q+4IYKgH4Zv+3yPrIVy8eSC+CI:IBi8mCUnxQ+4INy4ZcyzIVy8yBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

asrouter.ftl

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 6KB
SHA256 ef0cb85921b80347aa30f9fc1e72589ae4ef615ed225e8a483fdaa58b4be827a
MD5 57d85827375b6fb4621ec8f7e9b76115
SHA1 6db283a24bed9b7e2eb49ab3ad368bf75d989803
SHA512 169e468491500a7faf09fbf6097db4dcdbe2cedd71e8c6b378761382e71b433119a2e400255a96b77739961c4358cf2924cf8e0d1e6366e279e6311d26adae44
SSDEEP 6:gNe0gidpq88gidydgid0WFxwmRTHgidpqs7HgidBgidWGxw:ggQpB8gQWgQgmOQphMQSQWL
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 10KB
SHA256 0338b9725436b5c3993184abffbca45e9e2fd86ea966652cd8a91f7aae170a8b
MD5 e14d4d827818d06c1759e40c31d87834
SHA1 46456f8605f072f121a3a9b5df30ed5837edad15
SHA512 4990a74057b2e33e0e3bcbf928c48defd6c15becfa4fb4caefda2090f4bcd2485de82b58daa62de9cba23495adf39ca19600df7fd4e7d41fa8fddca4b272f306
SSDEEP 24:5uB1o/sJblLKbAbAFsh2F3LFbDuhMZZhsJbF0JbAbhpR5cOOKgu1xgRbZisWKsJl:DebVKMbyebOJMbh9cO95o9pebvpf+Mb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 8cd3e031e65a0a7e209a11d06a2fe68325ec9bbd1fcdb570e21a936f555d2329
MD5 753a5604a1cc43ad2d6e3b7bb5a7ef34
SHA1 dd38873b1f840bfff8df52d50acb3c64a9261f49
SHA512 39889866f2c6948145199721561c43a06be21ec40e700f44ded7b5aafdf9a9400c51b3731693c9f47b5a6c4ea2890cd19c95b0ebc4ac87f8c3bac4047e2b689b
SSDEEP 96:8SMF9ZbkW6ShmrLPP/PrWZ6OQnCTFl66JozGzgClKtmSS:8rvZboShCjPCQg/66JozGzgCl6mSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 14KB
SHA256 7122722e4e098d207bd6c794851024cf91860e22138991274bc36ccac30dc0f8
MD5 4faa00fbd002612c255f5f4b97b24119
SHA1 7ff3327cd203e8642696440427160aa9a51e5c71
SHA512 62ac35316614cf311c68ddcfea83ba0207f07266d9be447d71dd55d40d78882b40aa0fe84e5fb4e179dd5eab8aa52ad4ef286dfe179f1c7baa12a272c442fec2
SSDEEP 384:ElEof+uQXDx4bbkbYblX/66JozGzgC1bZboTOPLL:FC7kDx4bbkbYblyEj3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 e71540a69f16b273f01dc9db9564d2e24d74a2858591c1e525752fe55ab16f68
MD5 f5ab39a6ad2ce6551d4e1c83ab9cc0e9
SHA1 0fa126c700845196e3b0ce60c098fa01b5387642
SHA512 15b01b3823e114d82ab178b25c1c27667f9082d6d43c783c3634d456cc0bbd7d90ce3c48d34e441bac6e5af09cc47aefc077e8e882bd876338ca9ead718a4366
SSDEEP 384:P/66JozGzgC1bLboTPsPq1lEof+uQXDx4bbkbYbl6:qExfrC7kDx4bbkbYbl6
MD5 SHA1 SHA512 SSDEEP

Submit Download

c152ccf1-705b-4f86-8a53-7d40fe6eff83

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\c152ccf1-705b-4f86-8a53-7d40fe6eff83
Size 671B
SHA256 13b682681dfba1dde0de1edbbca6ff987bbc860da6d6ef209fdcc23d537fdab0
MD5 aa6775398b7b174e6ff4b8e11f3ae48d
SHA1 4dd39558fcba998106edf2171cd35b47d8594c14
SHA512 eaef1137f3ffa2f76d856f0da5f3e2abd413512cbb5e4f66ff4c33c28b3fec380e15ff2b090e2dfbd7619854166d3ec2357777a2d260e639d6b0b8142a638a6f
MD5 SHA1 SHA512

Submit Download

d2ac6fd1-01d6-4c50-a4cf-0f05155e6f25

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\d2ac6fd1-01d6-4c50-a4cf-0f05155e6f25
Size 25KB
SHA256 bcd91d24a94547210a5c950b4abef612979bfd2af0914eb54bdd576cc7f70dea
MD5 408c6c21565848f3931975db5b64d344
SHA1 468214efb38c4e944ddff55d3578b87f2a73f065
SHA512 899b3cdaf99c80b088613f6d9ce62bf5dafe4c78f6a0186ee934cad045b7e8e683422304e85826d4aeb108085d738df08901e81d91e7d0bb9da67e23daa2c13b
SSDEEP 384:hveSRb/53GcaXY1tDemVy8V4KaRUMMxVj:ao1tzV3VRaOFz
MD5 SHA1 SHA512 SSDEEP

Submit Download

f0092518-7f71-4755-bff7-16fdb82564aa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\f0092518-7f71-4755-bff7-16fdb82564aa
Size 982B
SHA256 4778fc2890b31799faf3f4cc57746e0715a35f9924421dc4dc154c6b9fcb27e3
MD5 3183a8c36f3ca1fb23cd834e39d0c8b1
SHA1 2d3a2fb9bff08cdc4a29414151d4a1db4d295c1c
SHA512 d605c176a45e7847a9eae0694f4431f3a08a1c10f20b9fbc61d1be9d0911d0275fef35e0844df4b142f681655505309e4476d5748ca69c9da8b8aada43e4e63e
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 11KB
SHA256 4e8f713d7c93859e3584b793cd795a022ded47db582f8ba61fed5724202ba2d5
MD5 318f3b184d4f4645fd275cff482bbe69
SHA1 fc36dccc02e9cef1e023cba8a21bcd742306a18d
SHA512 0cefd2be25e70d4d9b9cf23a5aa8d643081bd49b6e0839f17ec28e5ca798ccc5a23775a0e9c23923160e1b17308fd883b58fb4b7bd140ff8a7f9de7253966adc
SSDEEP 192:h5nHRUfUbSOPdRI4PLM7dJnydu2hiFBhaXU2nuBw8Hb:2AP1La/ndvwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 15KB
SHA256 bf55ea7c811a3be0d85c4f49f1f121668738c4402be1dd9b717440d03ba68e28
MD5 c9aaaa6529469239df3b89ce947af9f4
SHA1 6afc6cdcbc1d20eb4fc068a6a3d5457f9c4411c2
SHA512 d884f65635a7d059c6b99f9f3e4f9fff41521672081896f84d7d1e920324205a46477baf6e259a054047cbd280dfa5ada065643f927ead7cc8e796fc8e3f09d1
SSDEEP 192:hSnHRUf0bSOPdRI4PLM7dJnydu2hiFBhaXY+2nXiBw8HN/H/MP:HwP1La/nu1wCW
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
Size 10KB
SHA256 80326da046df5e44a922c24b4a94afc9f9707410c3bde784b76e55cd7e0bdcd8
MD5 d8446acf44996d13fafa271247732417
SHA1 6d55f34ccbbaccea86e78537d62bdce5ee3f30e1
SHA512 2973df8026ca77c38926469790d0c72936ddce1488281828946f398b6d0c890591ec76d88b2b3c5da9874d6335b70ce2ae5fae8d55255fd497d75ac8824a6b1f
SSDEEP 192:S5nHRUfU3Gzus/uI4gYcU8BtD8JJCddLMy1Zzw3qaXw2nSBw8V1:ZisWuYgUJJ6My1ZzXFwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
Size 10KB
SHA256 a0e1dea3e6d960ea1b89eb99ce50cbebf5b84b52fb5cd2c06cdcdac11107c43c
MD5 3e00a8ca9c364e24191a401f248236f9
SHA1 e2bdaec45da7fd7f79d8c2f501c326989194af98
SHA512 021dbf083e051ed9693c4feea62f5f2b111eee6c7dd5fc51c0d03ccce35f58e936f76bd40e3dd49891d933b247688af2888fb4a429d65f82e2ec7aa1a295396b
SSDEEP 192:S5nHRUfUbSOPdRI4PLM7dJnydu2hiFBhaXU2nSBw8H1:ZAP1La/ndFwY
MD5 SHA1 SHA512 SSDEEP

Submit Download