8c64235da464f7c8dcd17a33980e7d18224d233fc55d6c209af0acd46e15312c

Analysis

max time kernel
123s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 897KB
Sample241008-nfenvavanm
SHA256 8c64235da464f7c8dcd17a33980e7d18224d233fc55d6c209af0acd46e15312c
MD5 6da8667731035dda2120b93cca05ca04
SHA1 81be154d71f19e3e3f40ac0077744a22c9eb0ee5
SHA512 57025e6d0028ab974a3f4724b2e7ee77df83c8e123d5a383990449374833c40214db826a84f7721fe5b9851bedc6e07c3018e360bf01edf2cf2e1298b8147274
SSDEEP 12288:XqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga3Tr:XqDEvCTbMWu7rQYlBQcBiT6rprG8ajr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2148	file.exe
2148	file.exe
2148	file.exe
2148	file.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	512	firefox.exe
Token: SeDebugPrivilege	512	firefox.exe
Token: SeDebugPrivilege	512	firefox.exe
Token: SeDebugPrivilege	512	firefox.exe
Token: SeDebugPrivilege	512	firefox.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2148	file.exe
2148	file.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
2148	file.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
2148	file.exe
2148	file.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
2148	file.exe
2148	file.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
2148	file.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
512	firefox.exe
2148	file.exe
2148	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
512	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2640	2148	file.exe	84
PID 2148 wrote to memory of 2640	2148	file.exe	84
PID 2640 wrote to memory of 512	2640	firefox.exe	85
PID 2640 wrote to memory of 512	2640	firefox.exe	85
PID 2640 wrote to memory of 512	2640	firefox.exe	85
PID 2640 wrote to memory of 512	2640	firefox.exe	85
PID 2640 wrote to memory of 512	2640	firefox.exe	85
PID 2640 wrote to memory of 512	2640	firefox.exe	85
PID 2640 wrote to memory of 512	2640	firefox.exe	85
PID 2640 wrote to memory of 512	2640	firefox.exe	85
PID 2640 wrote to memory of 512	2640	firefox.exe	85
PID 2640 wrote to memory of 512	2640	firefox.exe	85
PID 2640 wrote to memory of 512	2640	firefox.exe	85
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 1404	512	firefox.exe	86
PID 512 wrote to memory of 4944	512	firefox.exe	87
PID 512 wrote to memory of 4944	512	firefox.exe	87
PID 512 wrote to memory of 4944	512	firefox.exe	87
PID 512 wrote to memory of 4944	512	firefox.exe	87
PID 512 wrote to memory of 4944	512	firefox.exe	87
PID 512 wrote to memory of 4944	512	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1344 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {508a94b9-bda9-497e-8032-4c39138e9285} 512 "\\.\pipe\gecko-crash-server-pipe.512" gpu
      4⤵
      PID:1404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5627e881-3022-4583-8b5d-db407a6edb44} 512 "\\.\pipe\gecko-crash-server-pipe.512" socket
      4⤵
      PID:4944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1468 -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 3004 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb3c6e15-8422-460b-90f0-116924baf7e5} 512 "\\.\pipe\gecko-crash-server-pipe.512" tab
      4⤵
      PID:228
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3660 -childID 2 -isForBrowser -prefsHandle 3652 -prefMapHandle 3648 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cc455cf-740a-4c37-8fea-4e02f4d18216} 512 "\\.\pipe\gecko-crash-server-pipe.512" tab
      4⤵
      PID:1628
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4556 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4588 -prefMapHandle 4584 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a562a8b-b5ea-4540-816b-8943dd915fe7} 512 "\\.\pipe\gecko-crash-server-pipe.512" utility
      4⤵
      Checks processor information in registry
      PID:4104
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5280 -childID 3 -isForBrowser -prefsHandle 5228 -prefMapHandle 5176 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73d90081-c905-4b5a-a8ed-65ad07ef9e88} 512 "\\.\pipe\gecko-crash-server-pipe.512" tab
      4⤵
      PID:2656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5412 -childID 4 -isForBrowser -prefsHandle 5420 -prefMapHandle 5424 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74ca8c1a-b84a-4dc2-9bbb-1c69ad650bf1} 512 "\\.\pipe\gecko-crash-server-pipe.512" tab
      4⤵
      PID:4968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 5 -isForBrowser -prefsHandle 5608 -prefMapHandle 5612 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbbe2809-2979-49fb-a0de-70dbbfe982c0} 512 "\\.\pipe\gecko-crash-server-pipe.512" tab
      4⤵
      PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\activity-stream.discovery_stream.json.tmp
Size 19KB
SHA256 6b42b925fa7648884cf2da59e7c291819a60efbe3cbcc729a08dee9d4fde6b2a
MD5 44cb77f323200dca4323eddb6596f663
SHA1 1b011fc294c5164db8f979ffeea2e54fdfeefba0
SHA512 b373a84063a87dc6ff812e651a167993a010bdddb6455fa91c94b87c50c7dd89cd0fc0b3b7b9b4de887ba87606419b61ba4f756f99f5752c6685175be80417d6
SSDEEP 384:BfdYYntW7UMe0X5eGe0ANiLpUVRvB6GyaE:BfiYnt/Me0dUVRJ6Gyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 b58ea2b85905e3300772a1dffef7aa49ff615345045f25d443d8b339679d738a
MD5 dfa7ec52410e5d676d2a146798a20b29
SHA1 5b1c66033a69098adea99839370d7f4761bf7911
SHA512 39e20c9fb6dec459e2017dd505469d824189ac2b182170c9303fe8af7fc91309bc6abc652a3ff90eb3487c2cc1755a4aab27aef7f192521ad482f4f9abfcf3fc
SSDEEP 384:H7C9Du9fiGLm4pUqpHLFoCr/E8HPJyD3VonFcP+AWRMACPFU4FB:bbBi8mCUqpHLGCr/E8Rg3V/+hRMFX
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
Size 13KB
SHA256 f6581f5eb9aa064d762f4119e15a5cde5077999b7c753bcc85600d73a0d76bf8
MD5 be531074a92b502f7d4eb4be32502b48
SHA1 1c8e8728944f7d43d792eebaf06a73c0765a6d16
SHA512 2e3a5106ffe7b10a4e59f024516a55481c9081ba0bf41a207d054ed5571626d8cae58136961525bc25d66615e091bd6faaee8c35e54631a45a4bb04308912ebd
SSDEEP 96:x5oUebVKmbYebOJmbzpebvpf+pbkbsb1gbgzXbnbDb:x5Ou
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 03f5a9d3172aa3de1a675f7bebe5d66a7ef8505279adf400bf917dbede139c2c
MD5 f580e7867ecfa402ccbf10a155c7791b
SHA1 acd775c88504a75f7d75a51673e25a38f12e1f3a
SHA512 8f8892735446b2e0181bf77a240944df44acd2bdf7b81ed0492d0508476b2b59554570075c5a1e7917f50cc1e0bfb89d661ae17dc5fa4197ab669b7a2bda1ba5
SSDEEP 96:9SMF9ZbkW6ShmsxPP/PrWZVpnQAzzQULFl66JozGzgClKtmSSM:9rvZboShZFPCLH//66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 5ee692c24d97c7d482b92c5518fb54c845127cd98273369534f119d80699b6b0
MD5 0b506f13b3498054eae7a76457af926b
SHA1 9321d60d6de8e7abdf0b319025b08dd1d43619d3
SHA512 79f03354022755def13a277fe9107705674317ceb7158eb77e2eb808eb9d3991a5df8c28b562a07a6f1912cc865a4b012de64e9bd4fd09113bb7ab4c7b5704a8
SSDEEP 384:ZetmZGWPoWDanBOb+bGR7bo2rP6/66JozGzgC1bM:0tDWgWDanBOb+bQfpfEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 7dd1fc78fef5c960cce5467891f7769d6a2b6b3b205e8b5a185332c4e5c125ab
MD5 d66e771e019fe14ce3078e330b2d5c16
SHA1 c38e7964f12a554ee46563c688df972d4852e814
SHA512 4b5ff6832993490304c48e7a14764b2c49c2d34da0cac164389f87b3c517ac4249aa73bfadeecce9271e81048e05c8b64bb087dd69f73426417c7321c05e87d9
SSDEEP 384:wboY9rPHetmZGWPoWDanBOb+bGR6/66JozGzgC1bM:4BGtDWgWDanBOb+bQ3Em
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 147fd09b8b70b5f5ca98ec4f0349367849db768ae587e68522f557cc27ef954c
MD5 eb70e507f8fba4f154274398f4fb8818
SHA1 38e148e1b9c686d6770173521ff1592baadd9a9f
SHA512 6e5b0c277bd7c06b0e10416651c7b171e826dd2ae6cf26c140c0d093058f7998d28b627420829b9115f3ec6c253537853ab4bd91a38e36b6f62cf46fa084c0ed
SSDEEP 192:4rvZboPAhYFPUfFH//66JozGzgCl6mSSM:GboYkPM/66JozGzgC1bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

6afed4a9-2c4f-49b9-8143-c562d7c8daa9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\6afed4a9-2c4f-49b9-8143-c562d7c8daa9
Size 671B
SHA256 5aaefb4fb6a0f72d9df1e8fef11b779c89da620f421ebc095892fe81d371ea71
MD5 2c39b96586f01fcb9f204a9c996cc4f7
SHA1 11984853fbd2b730eeb179bc0581bdcd142132d6
SHA512 1b27f5983b6831291f0848040709a79cf1e16557d12353bed32ef01a16e9066d0420347e01c46a99bc39c2363f401ec20e48bc24a4f40140a8df597e64476568
MD5 SHA1 SHA512

Submit Download

cc3edb11-55f2-48f8-bc1a-4568d0ec20ea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\cc3edb11-55f2-48f8-bc1a-4568d0ec20ea
Size 982B
SHA256 4d2276bbe3478b23d5fb75a23be9b7261011a838b28beff1edcbb4c70310bfee
MD5 cff4be7c42ed5047cf54f11123379860
SHA1 53fae4ff43e13c66d2af11206ee79de03943c5fc
SHA512 9ec15f3a91e19f9bf169e1158a23c36440af6d79a5d775a64eb668a0ab113d840552bdc803eab558f33b34a1748b2fc4910ace6c99afa106d8375094e282d0cb
MD5 SHA1 SHA512

Submit Download

d1fdf297-3c29-407f-b452-57f7b526fd88

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\d1fdf297-3c29-407f-b452-57f7b526fd88
Size 24KB
SHA256 329a49b874fd7f75b6551c7d2763e9d15ba06a0e53b83a91a40b29dc58634840
MD5 651a574a3a690bebe52d14f252a47556
SHA1 e334c1809463c025af01f2b93f25a3178d3b5c65
SHA512 d6bcb1c04813bd1fb58678119ac980f660a334dd73f517ed4ffd8c3fa2f832aabd8639c83542958465120916fb82ac66256d53c90f52ecabe64bc4d36ba69321
SSDEEP 192:xai/3VAcMLJmBi9PxJldgOoR1oDALUUka4mCatXq4DPgdpFoIHb9t61U0VRlZy3k:xBUPL3HlJmBsX9vSL82vS7++50iSL
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
Size 13KB
SHA256 e56dea5ed20b4af05545830484f54ed3b25f99e290fe9c82aeb60c8d788689c7
MD5 70a835bd7c38df79abfd510bec988644
SHA1 e242235132de3191450c3d9959dd6d24c1079857
SHA512 a6cbfdc12356177144d4a13d6c3137e4c749a8345011c035846582d7da240b11f6fee3d86058bd54acc6a5239fca767b2ca0044c9b17925a9f1ca5822f43d649
SSDEEP 192:J5nARLbfXHLC22I49pp54to8NLcdd7ey1ZzV33aXtEVogBw8HQxC:AG1Ppsply1ZzCEVpwU
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
Size 16KB
SHA256 62efe03d6da5e06df2cfa9abed5cc25831962f21cfc77dc58b214ecb94f46daa
MD5 5f7aa362d1f22d0a20c6bdbd52308bb2
SHA1 0e0b358e64b42ac766afaa4692aaff6a725ea6b4
SHA512 9d2c9dfc84eee7d0234b39fb51f2e2fa8809f7edc9d37bb4ce11e8cf2f4c785af79c90779e0142ae008f285f386e5f6a62298db397c5d393c0641bed57b267c6
SSDEEP 192:JqnARLbfiHLC22I49pp54to8NLcdd7ey1ZzV33aXH+EVo8iBw8H47LzQi:dJ1Ppsply1Zz/EVmw9P
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
Size 10KB
SHA256 a300d0572fdea3ba67bd8c09231aebdbf2d7b0c765d54c138e5298adaf332ddb
MD5 75756e55955ff59bf595e010aed34d5d
SHA1 ec65077a16b634064b9e2da0f25170275394cc17
SHA512 4f2b62bf106aed17c086677ba80762e3e8ba25f1a5888803777155347a01b186d03696a1801b83e957d4f19210518f3ebae47aed56960b35b27290f03f479ea5
SSDEEP 192:Y5nARLbfXZzBs/uI4gYcU8BtD8JJCddLMy1Zzw3JaXuEVo8Bw8VA:pPsWuYgUJJ6My1ZzuEVfwH
MD5 SHA1 SHA512 SSDEEP

Submit Download