f8537e5844cce90e065d476053c9d8dcd8a8369102975ae3cdfd74d4644bb105

Analysis

max time kernel
133s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2025, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 944KB
Sample250207-tbqs7symfk
SHA256 f8537e5844cce90e065d476053c9d8dcd8a8369102975ae3cdfd74d4644bb105
MD5 d1bf8e67a6a73aded20586aab5f29510
SHA1 a83f4fa3510333fe0223fa49df40275f6bcffb88
SHA512 e9be75c0e58e9bd634d55188e3d19b6bb8d0b8202b703c06a3570165710202ae3762abb564c042dfb038726851446e83876338550af851213aad02570d202f23
SSDEEP 24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8avrV:wTvC/MTQYxsWR7av
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	random.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
1484	taskkill.exe
5008	taskkill.exe
4252	taskkill.exe
4832	taskkill.exe
1308	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3932017190-1449707826-1445630-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2220	random.exe
2220	random.exe
2220	random.exe
2220	random.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	taskkill.exe
Token: SeDebugPrivilege	1308	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	5008	taskkill.exe
Token: SeDebugPrivilege	4252	taskkill.exe
Token: SeDebugPrivilege	2180	firefox.exe
Token: SeDebugPrivilege	2180	firefox.exe
Token: SeDebugPrivilege	4796	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2180	firefox.exe
Token: SeDebugPrivilege	2180	firefox.exe
Token: SeDebugPrivilege	2180	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
2220	random.exe
2220	random.exe
2220	random.exe
2220	random.exe
2220	random.exe
2220	random.exe
2220	random.exe
2220	random.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2220	random.exe
2220	random.exe
2220	random.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
2220	random.exe
2220	random.exe
2220	random.exe
2220	random.exe
2220	random.exe
2220	random.exe
2220	random.exe
2220	random.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2180	firefox.exe
2220	random.exe
2220	random.exe
2220	random.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4832	2220	random.exe	79
PID 2220 wrote to memory of 4832	2220	random.exe	79
PID 2220 wrote to memory of 4832	2220	random.exe	79
PID 2220 wrote to memory of 1308	2220	random.exe	82
PID 2220 wrote to memory of 1308	2220	random.exe	82
PID 2220 wrote to memory of 1308	2220	random.exe	82
PID 2220 wrote to memory of 1484	2220	random.exe	84
PID 2220 wrote to memory of 1484	2220	random.exe	84
PID 2220 wrote to memory of 1484	2220	random.exe	84
PID 2220 wrote to memory of 5008	2220	random.exe	86
PID 2220 wrote to memory of 5008	2220	random.exe	86
PID 2220 wrote to memory of 5008	2220	random.exe	86
PID 2220 wrote to memory of 4252	2220	random.exe	88
PID 2220 wrote to memory of 4252	2220	random.exe	88
PID 2220 wrote to memory of 4252	2220	random.exe	88
PID 2220 wrote to memory of 4440	2220	random.exe	90
PID 2220 wrote to memory of 4440	2220	random.exe	90
PID 4440 wrote to memory of 2180	4440	firefox.exe	91
PID 4440 wrote to memory of 2180	4440	firefox.exe	91
PID 4440 wrote to memory of 2180	4440	firefox.exe	91
PID 4440 wrote to memory of 2180	4440	firefox.exe	91
PID 4440 wrote to memory of 2180	4440	firefox.exe	91
PID 4440 wrote to memory of 2180	4440	firefox.exe	91
PID 4440 wrote to memory of 2180	4440	firefox.exe	91
PID 4440 wrote to memory of 2180	4440	firefox.exe	91
PID 4440 wrote to memory of 2180	4440	firefox.exe	91
PID 4440 wrote to memory of 2180	4440	firefox.exe	91
PID 4440 wrote to memory of 2180	4440	firefox.exe	91
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92
PID 2180 wrote to memory of 4620	2180	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4252
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 27413 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77825c46-0ad8-43a1-9c94-7aac844a0800} 2180 "\\.\pipe\gecko-crash-server-pipe.2180" gpu
      4⤵
      PID:4620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 28333 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f858b224-eb13-4550-a81b-d1f7a3af6b88} 2180 "\\.\pipe\gecko-crash-server-pipe.2180" socket
      4⤵
      PID:4028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2952 -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 2976 -prefsLen 22746 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e97bba8a-9cd8-430d-8d5e-f46e34ae5cfe} 2180 "\\.\pipe\gecko-crash-server-pipe.2180" tab
      4⤵
      PID:4912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3668 -childID 2 -isForBrowser -prefsHandle 3660 -prefMapHandle 3656 -prefsLen 32823 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba5108da-ea38-4a9e-a611-59e466fccbb1} 2180 "\\.\pipe\gecko-crash-server-pipe.2180" tab
      4⤵
      PID:2444
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4512 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4504 -prefMapHandle 4492 -prefsLen 32823 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54cdc02e-e743-4bd1-ab8d-b63c58e7d726} 2180 "\\.\pipe\gecko-crash-server-pipe.2180" utility
      4⤵
      Checks processor information in registry
      PID:3036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5172 -childID 3 -isForBrowser -prefsHandle 5156 -prefMapHandle 3648 -prefsLen 27038 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcdb48e4-04ef-4c9c-855d-bec86b8e3416} 2180 "\\.\pipe\gecko-crash-server-pipe.2180" tab
      4⤵
      PID:2264
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 4 -isForBrowser -prefsHandle 5336 -prefMapHandle 5344 -prefsLen 27038 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6e3dbc9-bce1-4b24-9495-c2f3dc774140} 2180 "\\.\pipe\gecko-crash-server-pipe.2180" tab
      4⤵
      PID:3872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5524 -childID 5 -isForBrowser -prefsHandle 5480 -prefMapHandle 5320 -prefsLen 27038 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1974cd63-10ff-498a-9bdf-25f8b43c43cb} 2180 "\\.\pipe\gecko-crash-server-pipe.2180" tab
      4⤵
      PID:4916

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z4pcagzk.default-release\activity-stream.discovery_stream.json
Size 25KB
SHA256 31c0ab7cf6625150956236b79bf4f7dce5f171c5efee0574542bacdf4569d9c9
MD5 f7533f7e5a525e2b78548a0113d678d6
SHA1 8f1b0d577d0de99de1ca0e95416fadfa5c6f32d7
SHA512 45d3c8ff3aaef452efc53f84ed7856f9982eae7bd069fdc889a9a0ae379f5affaeefc5c5f718153b6098a47f30b980a0bd02bad33938f2433467df1257ba42b7
SSDEEP 384:gyauyqPhow5duxx5uxxogfmIlaNZpL+zt9S48zceUMg4XgpbKUlM:gydJ5owam2gOIlarVS9S4UceBg80W
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z4pcagzk.default-release\activity-stream.discovery_stream.json.tmp
Size 21KB
SHA256 d69ef7763a680f3e838120e1b994f31a1b5df03def693e3e63f92fe81f7acbe4
MD5 28ea3f2fe31c780c318644aab5b8aef1
SHA1 273e8e0e3571af6d4ee59081e4eb7ffcae4460f6
SHA512 6e48a87fa352ebca2c520eef0092ef778e79802d997a119200b896c7ed13c1bb73b5063a340094528bff7413c67a09a496810768b931991d948eb561a1ad0b3e
SSDEEP 384:KyauB55zDBaq8z1L+PL9N9WmIleFeUA46X0ggsUf:KydBPzDBLU5Y9fxIleFeUAh0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

D18FB7DA89F8DD4E7A2C97703A1647E8C981D05A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z4pcagzk.default-release\cache2\entries\D18FB7DA89F8DD4E7A2C97703A1647E8C981D05A
Size 13KB
SHA256 3b76b4c236bee36bba9a5913715534cc5979a4dbdbf1b1cf5280faade4d31542
MD5 491189e9af121892246d01ed2e1d11c5
SHA1 037d2396eacac6517c6f587d289a969ffe77064f
SHA512 11e3cecf740fd1e0caa8c65eed441d6170671e1ab8abb34bb53e72b523c09a868adb07672c14927720d277b2f9724e45f975967fbdf3dc44f98207e0e78faeab
SSDEEP 192:HcepurcXz5RqvAcdRPSHXFCPD1Oo1zm07e8UCY/H9k7c3zA1G8BvaehOr1e0lpBh:HPcriO024Yzm07fx1ZB7t0lpDIIjwu
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\AlternateServices.bin
Size 10KB
SHA256 d82a8a14dc78214ba7b3effedaafdd80044a693a881d27d1d04b7cde6de00ad1
MD5 e914d979a020597dabbc373f020791a8
SHA1 c18c7706e49ef73837d9cc318186803035ec7bb1
SHA512 24dad006cc539bc84d9735280c283d2e606ca784f593e289b63580b1a13c8d8c89b511857344df1a03652a9fc5e69d5f2f9eeb6f2cfa0d061c3ee2ec2ebe4275
SSDEEP 48:l5oe9cOyOebVK+tboFebOJ+tbTpebvpf+Dtb:l5o4ebVK+tboFebOJ+tbTpebvpf+Dtb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\AlternateServices.bin
Size 15KB
SHA256 89728a4247fd41a603b6ee07675a11e62177c560f606cb771d39c71574b147f9
MD5 3178c9fe2e9131a2b0138630f5ab731b
SHA1 8b4d03db1e0c0e0088ff6d95ea198162c5bb9893
SHA512 1b94cb962b03f2d2efccd86d7ead07090fc05a6740c9e8ea182fe13d9d956cddaa89f02056486e3436536d2003d4f57864b9bbad3f002f1febdc5287c5a45ff9
SSDEEP 96:l5o0ebVK+tboFebOJ+tbTpebvpf+Dtbib+tbcgbgz6tbqbCtbkb6tb:l5Cu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 b91042e17ab207bcd5ac15f62987ad83e263eca8919f2efd51219381ebd30af1
MD5 0d0f5bc988ce98eeab8f30bcb71fc013
SHA1 451a9b54ad64c7261496d525fdbc0fa5d3bfc775
SHA512 4254e3c998ed0d157d739467dcde22d2dd3f7b99f0cb47f44841a8dcc2df441445ec3b994fe9fd5e58c6db9ecd89b640f5ecaee24b8b13c70e9a712b61e04a38
SSDEEP 384:P/66JozGzgC1bjhFg04LgaBLVuj/ZUEm91iPoPLzPC2EG0b1bHbtbfb5bBb0bfB4:qEPFgzLlruj/9PoPLzPC2EG0b1bHbtbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 02dfc20a2323883794dab97c90813e4d5a4eefeae9fa5abaa347a88ffa5a4992
MD5 09d5db074fb5407ff9e8ff945796c3c2
SHA1 161fec3c657c1dda51cd63f029f268419a4ccaa8
SHA512 064a7efd76f0d6e2767c61de2174c0009cee0b8d67393baec06b0ec885f5f4a8e1c5e0885da38b1c265a4bef18cb3e41be73735bc7c0c81b1fe6048f62a04b35
SSDEEP 384:P/66JozGzgC1bjhFg04LgaBLVuj/ZUEm91iPoPLzPC2EG0b1bHbtbfb5bBb0bfB8:qEPFgzLlruj/9PoPLzPC2EG0b1bHbtbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 482670c5d834f7b82635bb1515e5b02d253591425af95fc953bfae7e277c3a1c
MD5 c6df55d4916d4ff632ece196081eb07b
SHA1 ddcbba4ec6c45e11e188faa9afa4168773c50bc3
SHA512 04da15293ed4ce3d09b709057e9ca7ba962690c33cdefe167b8a4b66f47a8c3351c026899cc694d527aca14f1cd7cdf53b0b22eba1109037ba2cb8f8b69fb377
SSDEEP 768:qESRE0BDtR0DoP3rPC2E6Yb1bHbIb2b5bBb0b+ftcFS7BhC6:CREsDtRqftcFS7Br
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 d1fd49ca84a73f112dd30ee0a2709a9190cc621c1a8fe028ef1c43aff78214dc
MD5 7792427a7077ac8140b22fa94441c395
SHA1 6ee21ad302ed8868aad187f9828d1fb6c6c0edf6
SHA512 9edc4d8312a072f3b586ff8c5658ff130966ae041cb2ffa35f19502866100155a0b30b0d50bb42026f1b4ccf5a54afdee87f79562bfa3f441ac43759153c44f6
SSDEEP 768:eRE0BDtR0DoP3rPC2E6Yb1bHbIb2b5bBb0b+ftcFS7BECiEm:eREsDtRqftcFS7BC
MD5 SHA1 SHA512 SSDEEP

Submit Download

a515c571-b9e3-4275-8936-4f082e2e5ce0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\datareporting\glean\pending_pings\a515c571-b9e3-4275-8936-4f082e2e5ce0
Size 982B
SHA256 dc65d5f7a6004840b306254994eb22946988686c616d4f132527dabab8ca042e
MD5 2fbca50262f90935e299ecfcb3c8a244
SHA1 812e2906faad0b0f7bd2174b77a71435f44a79d9
SHA512 4ba277b0c50b6677fe9bb75caa741fd5b67657f5a394a79c02cab8bda3e9ad436cb72a70866c59c9a378f5f35cf3735f64dc7d8cd2edce6108f75a3262e7cc08
MD5 SHA1 SHA512

Submit Download

a67a5544-5d80-4ee8-b8b9-71fdd2b2ed30

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\datareporting\glean\pending_pings\a67a5544-5d80-4ee8-b8b9-71fdd2b2ed30
Size 659B
SHA256 fb80909db496085633eb056fa90387291c3bf3a221df9d8a134f342851731e22
MD5 cdc712c6adef714ad4f4f2d72e5e163c
SHA1 a2683d5b914bf5cf5e5701e6726ee9e1f99f8b8c
SHA512 009559dd6f6c83a1efd37d7da127ccec5f82406d37ceb2b2c6e6d09563fcfd4412780b3a06ff33046addbb83d0f697bd7cd64df5172af3b22aea5e0a16d872a6
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\prefs-1.js
Size 10KB
SHA256 60d3f50111067b892ae59dd39c041db62c3cb37c950a57b459e6de8b95980cf4
MD5 d6a648f7bbbb137c467fa2e0d3578345
SHA1 2f2358e80913e70b6c2148bc4103e5f6041c4020
SHA512 5b09e3a2991d183112f104f374baa61e384a8892766610e811133eae71b3f60eac9ff3a2cade56c98b5f6822d193c0d0261a98188a356ef0258ac3399ff11333
SSDEEP 192:q5nZRDfIoeh+ztvexdv1yEmQaXA5OVBw8Hp:4e+ZvexmCMwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\prefs-1.js
Size 10KB
SHA256 78f944504d8f6917e807d210d79665eb0a7e218ce3f4983ce96888b19283c44a
MD5 a687429de6dd5c15f3642e29324ee493
SHA1 ad1336415ac6da72ec222843137951580b28a2db
SHA512 9b64b226651602d5b2ee4d236c71866274d98d78f934f3c5d2f7fc18c09600a4425338ced261edf3f486be2e194f8a14037056320451a8ea11c07e1a06fd04ed
SSDEEP 192:y5nZRDfIoeh+ztvexdv1yEmQaXA5OFBw8Ht:ge+ZvexmCiwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\prefs-1.js
Size 15KB
SHA256 e9a97438ba0d7b9ea296a471261108074bdca757ba4103290123049122ebbb10
MD5 63ad8b9a806be0f32915705603c72fd0
SHA1 8121ef2ce19d758f96a5c34bf58b3af7a83e3cec
SHA512 3c7ef2f3e3be8ad98e229259639fe3d19daf0c053fa7a3f83179d5c2060d5cbe83809ce394a5bc3ac0e200fc81947161ac43fbeb58896a8e470d455e186d607d
SSDEEP 192:y6nZRDfIoeh+ztvexdv1yEmQaXE+5OfiBw8HptNv7Y:ze+Zvexm//wUS
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\prefs.js
Size 10KB
SHA256 11ad9aa7d1ee104914cc53a3783e05ffd26800fcd92ea7187a874cdee38f52f5
MD5 f76a18c9d17484bbd4e9ab6078ae6f88
SHA1 204a5204b2c0021eb92d629ae894f156fe45d763
SHA512 c5c17738847359fc78961c65c10bee0954a5815f40414f7d3048b793ffdf94ca6a066b63654b131f721864b2d613692e17d3bec72438bd51b351080c4ad9eaf3
SSDEEP 192:q5nZRDfIoehHbBtvyddPPv1eSaXi5OVBw8Vp:4e7jvydrMwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z4pcagzk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 9.4MB
SHA256 6925466435726722454aad11e637eaee25300ba73435797d1eaefb67688ab486
MD5 321574b426742f4bf0bd71464b808265
SHA1 efa8310a22d33323a68e8d2671574181d71d2321
SHA512 59cec17eb0f2604967847a4c9d2fb29a46b138cc06c6d7f9b358735fefb257ea2b9747e809415e907440eb8838193d94b31fbe94eae2af9c09a195dac0b611ec
SSDEEP 49152:4hwfB3fqpeg0I3L2/B4Nu4UyNRWmb56dZcRdnslSs+AuGOehhv8VCmFyepnX3Leo:plQ
MD5 SHA1 SHA512 SSDEEP

Submit Download