f8537e5844cce90e065d476053c9d8dcd8a8369102975ae3cdfd74d4644bb105

Analysis

max time kernel
127s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2025, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 944KB
Sample250207-slzy7awkby
SHA256 f8537e5844cce90e065d476053c9d8dcd8a8369102975ae3cdfd74d4644bb105
MD5 d1bf8e67a6a73aded20586aab5f29510
SHA1 a83f4fa3510333fe0223fa49df40275f6bcffb88
SHA512 e9be75c0e58e9bd634d55188e3d19b6bb8d0b8202b703c06a3570165710202ae3762abb564c042dfb038726851446e83876338550af851213aad02570d202f23
SSDEEP 24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8avrV:wTvC/MTQYxsWR7av
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	random.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
1844	taskkill.exe
1140	taskkill.exe
3500	taskkill.exe
2276	taskkill.exe
1036	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1384	random.exe
1384	random.exe
1384	random.exe
1384	random.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	3500	taskkill.exe
Token: SeDebugPrivilege	2276	taskkill.exe
Token: SeDebugPrivilege	1036	taskkill.exe
Token: SeDebugPrivilege	5020	firefox.exe
Token: SeDebugPrivilege	5020	firefox.exe
Token: SeDebugPrivilege	5020	firefox.exe
Token: SeDebugPrivilege	5020	firefox.exe
Token: SeDebugPrivilege	5020	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
1384	random.exe
1384	random.exe
1384	random.exe
1384	random.exe
1384	random.exe
1384	random.exe
1384	random.exe
1384	random.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
1384	random.exe
1384	random.exe
1384	random.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
1384	random.exe
1384	random.exe
1384	random.exe
1384	random.exe
1384	random.exe
1384	random.exe
1384	random.exe
1384	random.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
5020	firefox.exe
1384	random.exe
1384	random.exe
1384	random.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5020	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1844	1384	random.exe	85
PID 1384 wrote to memory of 1844	1384	random.exe	85
PID 1384 wrote to memory of 1844	1384	random.exe	85
PID 1384 wrote to memory of 1140	1384	random.exe	90
PID 1384 wrote to memory of 1140	1384	random.exe	90
PID 1384 wrote to memory of 1140	1384	random.exe	90
PID 1384 wrote to memory of 3500	1384	random.exe	92
PID 1384 wrote to memory of 3500	1384	random.exe	92
PID 1384 wrote to memory of 3500	1384	random.exe	92
PID 1384 wrote to memory of 2276	1384	random.exe	94
PID 1384 wrote to memory of 2276	1384	random.exe	94
PID 1384 wrote to memory of 2276	1384	random.exe	94
PID 1384 wrote to memory of 1036	1384	random.exe	96
PID 1384 wrote to memory of 1036	1384	random.exe	96
PID 1384 wrote to memory of 1036	1384	random.exe	96
PID 1384 wrote to memory of 4652	1384	random.exe	98
PID 1384 wrote to memory of 4652	1384	random.exe	98
PID 4652 wrote to memory of 5020	4652	firefox.exe	99
PID 4652 wrote to memory of 5020	4652	firefox.exe	99
PID 4652 wrote to memory of 5020	4652	firefox.exe	99
PID 4652 wrote to memory of 5020	4652	firefox.exe	99
PID 4652 wrote to memory of 5020	4652	firefox.exe	99
PID 4652 wrote to memory of 5020	4652	firefox.exe	99
PID 4652 wrote to memory of 5020	4652	firefox.exe	99
PID 4652 wrote to memory of 5020	4652	firefox.exe	99
PID 4652 wrote to memory of 5020	4652	firefox.exe	99
PID 4652 wrote to memory of 5020	4652	firefox.exe	99
PID 4652 wrote to memory of 5020	4652	firefox.exe	99
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100
PID 5020 wrote to memory of 920	5020	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1844
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 27196 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcc2147b-4acb-46ee-92bc-6a719b083989} 5020 "\\.\pipe\gecko-crash-server-pipe.5020" gpu
      4⤵
      PID:920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 28116 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {284e0a23-bcbe-4105-b957-9abd6c213a83} 5020 "\\.\pipe\gecko-crash-server-pipe.5020" socket
      4⤵
      PID:2424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3012 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3000 -prefsLen 22746 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {091fe41e-2765-4cac-8370-48baba00fa14} 5020 "\\.\pipe\gecko-crash-server-pipe.5020" tab
      4⤵
      PID:960
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3928 -childID 2 -isForBrowser -prefsHandle 1240 -prefMapHandle 3752 -prefsLen 32606 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e0357af-cc80-4959-be03-b8d3b7177c20} 5020 "\\.\pipe\gecko-crash-server-pipe.5020" tab
      4⤵
      PID:1572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4624 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4644 -prefMapHandle 4636 -prefsLen 32606 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b285018-1993-45da-8c91-f7b6f2b86018} 5020 "\\.\pipe\gecko-crash-server-pipe.5020" utility
      4⤵
      Checks processor information in registry
      PID:4372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5148 -childID 3 -isForBrowser -prefsHandle 5144 -prefMapHandle 5140 -prefsLen 27038 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad0cf37b-b244-455b-b077-2281a40dc186} 5020 "\\.\pipe\gecko-crash-server-pipe.5020" tab
      4⤵
      PID:2476
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5296 -childID 4 -isForBrowser -prefsHandle 5304 -prefMapHandle 5308 -prefsLen 27038 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61a3a627-1426-41fe-a094-11d227869b6f} 5020 "\\.\pipe\gecko-crash-server-pipe.5020" tab
      4⤵
      PID:2840
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 5 -isForBrowser -prefsHandle 5588 -prefMapHandle 5464 -prefsLen 27038 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2725f15-e3d3-4643-ac39-c918ee0543ba} 5020 "\\.\pipe\gecko-crash-server-pipe.5020" tab
      4⤵
      PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\activity-stream.discovery_stream.json
Size 25KB
SHA256 b9e33cd679901c560504210487958f796e514e5cf8414fb0d402b35fa9376958
MD5 09a6d26a873809a9c77d6d5a575e1a5c
SHA1 ec64d6ccb80dd08bc60d55771078808a9ddb9636
SHA512 ccfb29dcdbed69b523a819a2baaf0d4a6482a7f8d56a5317eb55058e9dd5c9eed3343c0f45b72171d6652af027c4284f59152ea30784ef813ed1b5d60e6ac5b2
SSDEEP 384:JqL++MMmIlc8zA9DLO1eNX2X+xh20BcyauQeXhtkcXDcgi:JgdeIlcUA9Di1eNXiL5ydQeXhpggi
MD5 SHA1 SHA512 SSDEEP

Submit Download

D18FB7DA89F8DD4E7A2C97703A1647E8C981D05A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\cache2\entries\D18FB7DA89F8DD4E7A2C97703A1647E8C981D05A
Size 13KB
SHA256 40ce0282b88a770f6a9fc46bafc18ead2d482a9ee869b8e588a838cea19b2198
MD5 2c2e9da1f441f5db869554befeb4cc17
SHA1 78d2dfe01e706f890a02abf4554e52fb33b94b71
SHA512 a74055408a5a7b93741f6f0bd62f1f6078c90afd4889df2964e2e6ab85deb350fd801d6002fdec667c621ee0201bd56342e6f8776eedfbfc91ecaea81a0fb41c
SSDEEP 192:HcepurcXz5RqvAcdRPSHXFCPD1Oo1nm07e8UCY/H9k7c3zA1G8BvaehOr1e0lpBS:HPcriO024Ynm07fx1ZB7t0lpDIID+B
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\AlternateServices.bin
Size 7KB
SHA256 00b55d2fc35091edcf25b6609be1e327e62666ff46e48bdde9bf0df3f314ecfe
MD5 c37f7cadd2b52dedab12e013e0a57746
SHA1 848e2ab6c3b31033fb7ea42c2d8b1117b03de95f
SHA512 8a552c71ad27adb206310d9c0abacc02ecfc5b5a344877059e3f8906ad4b09d09518ed71a93086dc60a247530d304d9370e79e2be73b52410b4326ebfc74ecc1
SSDEEP 24:1uB1oGFsh2F3LFZcgu1xgRbLlIpR5cOw9uhMZL9sJblLKDb:b5oVI9cOIebVKDb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\AlternateServices.bin
Size 12KB
SHA256 f76b7e5a661c1886e2013ecc66c1b28f7ba2930f183a8b34a6ea5450f85828f1
MD5 72c73564e60b8ff19c9a272c16a464aa
SHA1 c3a9820fbdf0f084ec0932f3b82dca54f2b9a80b
SHA512 9af1bb76850ab09e4025b17cb8b82c1d55b6a5e538259d8aab7f621e3e3860b25eb8fb0469e7de6eab5ce351593b432627f28e7ee1c9d868b919d21c54f6fecf
SSDEEP 96:Ns5oQebVKDbnebOJDbNpebvpf+DbFb1bKbeb:65Tu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\AlternateServices.bin
Size 17KB
SHA256 fafde209102686111c2cfa54c3c510cf936434da24bb8ac5f5c6d7999112eecd
MD5 1ef2925f48fab906581d5d41c89a7c39
SHA1 df6a56e3b24e4002b0ba679bde75bab48d57ba9d
SHA512 3a92a5e06697c6d97f2aae12ebfd17541aff69bcf7fd4220d60d9b3c6d87cce88b8c7273c8bb6b61af4d8b5353a0426fef1ed64110891e59fbc34e88c27722c4
SSDEEP 96:Rs5oQebVKDbnebOJDb5pebvpf+XbFb1bgbgbLgbgzhbyb+b:+5fu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 7eced2a8b69074e35377adc3f2762b303c7de5e40a77556fa2a21c9c3e36c972
MD5 cf827d76b92adacd99f385f1371c3251
SHA1 1ef069779257128d3ef3f6f594af2f6b673a9585
SHA512 3b9596302cf5b410352d03b7bfa5fe65f1e5498c0ea19d53cc7c3c6673344979a6cd705c8973ff72e3f7d8dae5476dee67eb4b463918f483f877dc5f15c06ffc
SSDEEP 384:hHQFsxz0vDMo93nbHbJsbobn/P8Aj/66JozGzgC1bM:9j8DMo93nbHbJEoUhEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 51801983dbcb488ccc2681affd07b44f8047770e55d0aa7ea6dab3a3691f0a02
MD5 0f8df640122e1911e6fe6cde2766f185
SHA1 da6e950ecdfa732f8e4fe38d1fc657cf921a8e7d
SHA512 47a8a1cfa81a67377ce19d9b4a85504a51722cbca1ffccd4744e2ca73b2fb761fe7fcf43a8406fb32942ce5bae02c9ebebc7740ecbd13563372db17e3d230978
SSDEEP 96:4QBeQnB5PFl66JozGzgClKtmSSeSMF9ZbkW6ShmNVPP/PrWZ:4Aj/66JozGzgCl6mSServZboShcJPC
MD5 SHA1 SHA512 SSDEEP

Submit Download

1e60cd27-a7ea-4fd2-91f1-44310c2a2a2d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\datareporting\glean\pending_pings\1e60cd27-a7ea-4fd2-91f1-44310c2a2a2d
Size 671B
SHA256 fff5b75d23d79b30b6b052d90d745c587c8dd624831b91cc458087aeb726e6ab
MD5 c1ede570b05d03713d7eb214a2429780
SHA1 1e22080081cfed09da8e92d6055fcf1c5866d05d
SHA512 837eca2f179cc398852dd9763ad42a81efed169fbafd840e28f73980f8f12bc866e2e943b8f0f2c0da76deb29e308f51c19832986de3390d37e2f096e6550ee2
MD5 SHA1 SHA512

Submit Download

779e9620-bd30-44c6-ae15-264663cf88fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\datareporting\glean\pending_pings\779e9620-bd30-44c6-ae15-264663cf88fa
Size 982B
SHA256 4f29c0d0279e9b8825a6cc4342392e16d5a24b0c77ea8ef8d9f9326d091b92fb
MD5 05aa4ff17e7ee540803e09db9198ec5e
SHA1 9a2a171307e1051f12573edb5162e272ec093c1f
SHA512 03a30ba58d7a1e5234969f1161a2f34348a8146c2a6fee7d93dca36ec42f470acb9cdb1e49faa0a2f742361efbde35665e06aff4b723e7752d2d1a4a8d307d02
MD5 SHA1 SHA512

Submit Download

acf0fc2d-91fe-48ed-9c44-f4f4536b5e10

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\datareporting\glean\pending_pings\acf0fc2d-91fe-48ed-9c44-f4f4536b5e10
Size 23KB
SHA256 046319f63713f94641c673826492c18030372df756398daf08cef3f812ed4930
MD5 b49d5f1c4e53393f2c2a2b244ed245c6
SHA1 24559509edd7fa297a670a810a84b3e8116f3e7f
SHA512 41b987dd2549774e78e9dbbca21c88300c94e73cad9ffb61c537a19bb8e99b310c46afa3c7b90f7014bf2c3d4d00108f8f532bab8009cd2c3b322adb16bf84ec
SSDEEP 192:b/U9rI76+j22rlFuzxEFGS7ADpCEiTrXbCRYxL/JitbNJxsJUzoTiOLC2OLUELxl:bcs6k22rlwlrS7ADsnrpuXXrajU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\prefs-1.js
Size 9KB
SHA256 170cfa9c3d3654471e320d14ea6480751baff5f9211d8329fd06e0206ce71136
MD5 f9a82180e5a9ca3be5aed3829a308763
SHA1 e488f115e13b36a80f8532d6c6205a34609e69b5
SHA512 a6722d96768a63b0b4bb02d8851396927b304c33e6a2bd0ea2edc9ce03c98107238b2a4492f12e13cff14a46e44b7aebc5569e1707682be217906463fd0de7f2
SSDEEP 192:V5nSRXfYwEIudRtshTk9RcdRRlI44aXrp7j64Bw8HU:q2lsJkYfTtLwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\prefs-1.js
Size 10KB
SHA256 2d2b68227f723a2fd87a63dd79243d553fe15fde38a1b095f3d11ddbb02b40fa
MD5 2edf8607b44d6c53530421e48586e4b2
SHA1 fd901b9176e51e1902ee3a61b0c282071e12604d
SHA512 733f152fb512d4451a375fc0a767dbc5ca07d95ce97baa12b357a0afb7a26987e08dccebfa49e416b4107f65c3907dde6f3c27051f1968f7d332ca3df2bedcb1
SSDEEP 192:U5nSRXfYYvhI/xFtvLKlYUIdJelYILCaX39Jp7j60Bw8He6:rXI/xHvLKlaAf9JtDwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\prefs-1.js
Size 11KB
SHA256 3f071ae026dd983c48b516680d507c13a25b912054aae8d9aaf27c00f0fdb4d9
MD5 62d5e3730cf5101620f87bcd261d6e0e
SHA1 b411b3d83743203f6a2a631c5efc3ee40d17cd89
SHA512 07cb40056f0c1c10c58ded2f5727d51925874224cb5aeb23daa0e2949c8e81d84e9517ad9d80e1fb7de5c73703f4b6f657a4d0b68d7d5714e101ff7918bbcca5
SSDEEP 192:UanSRXf5YvhI/xFtvLKlYUIdJelYILCaX39Jp7j60Bw8Heb9:UsI/xHvLKlaAf9JtDwt9
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\prefs.js
Size 9KB
SHA256 4de9c19f982eeba24b1bba6aa6f21d67b2b87b17d97716f419c0a47310f4711d
MD5 7b195857340952e08f6135f2275e75c3
SHA1 d3f687297704995a5dbe80c1b93d4de79bc63826
SHA512 a955b7420e9667acc3e6ebc3eca7bf6a59714fb7d668556825ab7ce4a0620d1631a000f9019b3075cc7ccc4a8b0accf94f18d1f5afd354159f520a9f1712ce66
SSDEEP 192:V5nSRXfYwERudRtshTk9RcdRRlI44aXrp7j64Bw8VU:qtlsJkYfTtLwH
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6mx7q9sf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.7MB
SHA256 7d83f6f2916d32c9d6ababeab95027d5bb5a5f04433d6047b9ae85a0890f5060
MD5 e1b413a98e250690c1e24a866f8ca2b9
SHA1 a0eb34fc75c6313c39f1265483670f3a36c06212
SHA512 87c77fe6dd8b01d14324693e6ad06d8a3953c01a6db83e5ab3cf2f17fffc2d69f909a40c25ea2bc7ebcf9c6222e38629cbde065e7babeb3908eb15efed5a3112
SSDEEP 24576:V0T7S1tyA9LzmPEeDzbiXpl+AyXNdajxWfV8X5/oZK9QK/WQhAm46s9enL7F7dko:Sy1S9UDxzo2Lzl
MD5 SHA1 SHA512 SSDEEP

Submit Download