bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813

Analysis

max time kernel
128s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 897KB
Sample241008-yttp2a1drl
SHA256 bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813
MD5 5394d548b6afb562a42ff0e39507550c
SHA1 a66ea4a0d81531b5daf16b87d9298326c70b90c9
SHA512 a08760331c5f3064c046f3231076a57f5cdc3e84f102231baf2554587567104a9b3ca657b08f20a17df81fea3f008f194ab62093ecd048b720c20f0d373f54a6
SSDEEP 12288:TqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga3TY:TqDEvCTbMWu7rQYlBQcBiT6rprG8ajY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1764	file.exe
1764	file.exe
1764	file.exe
1764	file.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	firefox.exe
Token: SeDebugPrivilege	5068	firefox.exe
Token: SeDebugPrivilege	5068	firefox.exe
Token: SeDebugPrivilege	5068	firefox.exe
Token: SeDebugPrivilege	5068	firefox.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1764	file.exe
1764	file.exe
1764	file.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
1764	file.exe
1764	file.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
1764	file.exe
1764	file.exe
1764	file.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
1764	file.exe
1764	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5068	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 3928	1764	file.exe	84
PID 1764 wrote to memory of 3928	1764	file.exe	84
PID 3928 wrote to memory of 5068	3928	firefox.exe	85
PID 3928 wrote to memory of 5068	3928	firefox.exe	85
PID 3928 wrote to memory of 5068	3928	firefox.exe	85
PID 3928 wrote to memory of 5068	3928	firefox.exe	85
PID 3928 wrote to memory of 5068	3928	firefox.exe	85
PID 3928 wrote to memory of 5068	3928	firefox.exe	85
PID 3928 wrote to memory of 5068	3928	firefox.exe	85
PID 3928 wrote to memory of 5068	3928	firefox.exe	85
PID 3928 wrote to memory of 5068	3928	firefox.exe	85
PID 3928 wrote to memory of 5068	3928	firefox.exe	85
PID 3928 wrote to memory of 5068	3928	firefox.exe	85
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 3300	5068	firefox.exe	86
PID 5068 wrote to memory of 2308	5068	firefox.exe	87
PID 5068 wrote to memory of 2308	5068	firefox.exe	87
PID 5068 wrote to memory of 2308	5068	firefox.exe	87
PID 5068 wrote to memory of 2308	5068	firefox.exe	87
PID 5068 wrote to memory of 2308	5068	firefox.exe	87
PID 5068 wrote to memory of 2308	5068	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2701e8dc-ad69-4459-a7aa-59c7f203a009} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" gpu
      4⤵
      PID:3300
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1673c80c-5e4f-4cb8-ba15-ad81c45ea24c} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" socket
      4⤵
      PID:2308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3060 -childID 1 -isForBrowser -prefsHandle 2808 -prefMapHandle 3084 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ce737cc-ca86-405d-b74c-2865e3e94c12} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" tab
      4⤵
      PID:2736
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3712 -childID 2 -isForBrowser -prefsHandle 3704 -prefMapHandle 2852 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88e98d69-38fb-4ae0-b3b7-3cfc9211c9e8} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" tab
      4⤵
      PID:1492
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4376 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4356 -prefMapHandle 4408 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c742e7fb-bcbf-4c40-ab7d-0fd1bb7e6a24} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" utility
      4⤵
      Checks processor information in registry
      PID:2732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5548 -childID 3 -isForBrowser -prefsHandle 5532 -prefMapHandle 5528 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31ef3679-7977-4f62-ab29-23ee4d5abb56} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" tab
      4⤵
      PID:2324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5672 -childID 4 -isForBrowser -prefsHandle 5644 -prefMapHandle 5640 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6636398-ea11-41a8-87ee-b06d48e52b7c} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" tab
      4⤵
      PID:1632
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5872 -childID 5 -isForBrowser -prefsHandle 5740 -prefMapHandle 5744 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06c1a58d-ada4-47cc-b49e-b0ebbf2fa062} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" tab
      4⤵
      PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json.tmp
Size 19KB
SHA256 625d77a26cf9709c05880b1be1d4cb1b50b4dff5b1e878979852299a2d66a454
MD5 b15de4921cd1f88a7abfb4b48fba434b
SHA1 edd85606dfb7c1193f9c7849fac1e8083fe5ee17
SHA512 718492b7a93034e79ce71faa9c1036f91543aa732eb513c3b580ee5ff07e8ca58f770aaba86c46bc2c00faaa9a123b8c7191f8ace5b77446ec9c464815fbe7eb
SSDEEP 192:zqiFe8r698cnzFRHw19WYraa3fRxkBi7qgOa9jf2BKFIowv+yrTP1ItbbvUwHqAN:fjcnHWgY1RY0tOB0WGkh2feji9yigyaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 a41e33024aed58f8b0ef75eb05e040cbba12325bac0f7ff5285653520804dd36
MD5 eb53bc7eacff755899cad493b167e9e4
SHA1 63c10ae37a1cb3004dd8c8d66c7dff86a8ebd535
SHA512 6d34ffff5df5fc231b724030bd6cd463484b3ebbd3f264db581e83b10181ce3e57a1f806125322635cfcb1d6a0131e9416d03809549c0f7a092fecbdf016e909
SSDEEP 384:H7C9Du9fiGLm4pUhpHLFoCr/E8HPJyD3VonFcP+AWRMACPFUNFR:bbBi8mCUhpHLGCr/E8Rg3V/+hRMFK
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Size 8KB
SHA256 41fbf7a995255af0e9432b4d4ca4e8df20748ff00d457076ad59de6d5e4527c7
MD5 fae71316725c65cbb2442c7c6ce8705b
SHA1 259415183c0388f81a70210b6ef8a4df00bf8fe4
SHA512 677400391bc4ae469a71bf55e48430911bbc9ba8640bdd69b17c736bc53bdf44a4320544c5b42b8edaab7a1b239acd292fc38c5e3091da93e17f61a123091c48
SSDEEP 24:5uB1oDHyFsh2F3LFigu1xgRb+pR5cO+uhMZTsJblLKKalbssJbF0J8lb:fHb5oq9cOKebVKKwbsebOJWb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Size 10KB
SHA256 a0377d1786b1a8cae8986e1996fd68e11fbb34bc84052370d60505884d7e4d89
MD5 200493c476fce15f92bd9c50a7b6973a
SHA1 616643496c11743852e860a6251e10db0616afd1
SHA512 035b7d17e5823db9e3cfa850513a8058d13c606054ef2c14d7f92bb45cf401b1577ac2104a3e21a310a70004d2f1a98b555cb23b3cf2760a3b6bd3e9fae3da2a
SSDEEP 48:fHE5oa9cOhebVKKwblebOJKwbfpebvpf+Kwb:fk5oMebVKKwblebOJKwbfpebvpf+Kwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Size 13KB
SHA256 704f3add74cecb7bff094f6de0fe1618ddfd58a40f2de13e4929186829120340
MD5 d7ac99a62d507a0ae57c7494c649faee
SHA1 62b76d3e67dd1a2d6398ba8c311809f1401fcdb9
SHA512 85c9f10acc93c4b9b17e4c9709a43674dbd06cb3806512a1420a982aaf590f39cb43c248b84c883d4e12bf4649b90af0df1aff1664ff53b5f54aafa726be7ca0
SSDEEP 96:fY5oMebVKKwblebOJKwbfpebvpf+KwbBbewbsgbgzlwbNbiwb:w5QzGu/bzz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Size 18KB
SHA256 cf1b5388ad7cdb8c28ca598315687ef990ba15f0f7382983ce595e45e25dc11e
MD5 ad5b814af3be0eb160efbba60d320fe5
SHA1 db48867b3cdad1402d776e0010c927a4d1a0839f
SHA512 682b6d7d271f27b2f25641387ffdeed1023cd01472379addd3928cafbf72f71ee646bd1e807df2579fa1b999e2c96ca0d7ba4b2c054d59c0c437e802e697f83f
SSDEEP 96:M5oMebVKKwblebOJKwb1ypebvpf+DwbBbewbsgbgzlwbNbiwbpbawbSfFb/wb:M5QzWyuKbzzbpfN
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 09fb3f3a6a227f697db67ef1099b470b76d12c29f869823617e483b95227426d
MD5 bbd58c596b65b24ee5e9bf966f2688fe
SHA1 dde61954ab00369dd84660c73cf82040cfc83279
SHA512 51674aafb97b8d3dddc74d569ece2e943db0dd25b52906a8ed289f7731b74ece2b7158e4d44dee277b6b3376f952b42cb0a5e5fb6be60fa0eadbe1f31aaecd1f
SSDEEP 384:32/66JozGzgC1bpbodYGPb6LAdscfkDMxDbGKnbEbq9:3zEf4mLA3kwxDbGKnbEbq9
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 097c72081b065038d25c94609b4a37bcf3857de987c996ea9eb7fe408c18dd18
MD5 9236b87623a4caa80c20f70a7842aa10
SHA1 26a3e48e43d034755a75aa7d9d315baaef5d4db0
SHA512 26234e64dd500998db1e242cc94970c8d19c85b039936b2aa9a281d1a09e8fcc03be28fb05479eeeb88ed779947574e92eb21715a709f3c719088580d6c1c9b3
SSDEEP 96:+22QklyBFl66JozGzgClKtmSSkSMF9ZbkW6ShmoDPP/PrWI:+2/66JozGzgCl6mSSkrvZboShdLPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

2540b677-955f-46c0-8475-a656fae555ee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\2540b677-955f-46c0-8475-a656fae555ee
Size 982B
SHA256 1cadbec7590348293ffb28f39b6835cdc6e3e509b025bb6e1b0d8ead6b2b5e19
MD5 7d68a067d31f5d0462b2ecef60dbcc2c
SHA1 ea92baef630ff66aa88e3cbdf1f24ca283f25878
SHA512 760362bcb25c9c8303a7448c6cbf10018ca5dc660f55472dd2a85b9805c9cd101dd336b681f04e397102856c9ce9203b3ef02595d99da02b5ab3196179cea339
MD5 SHA1 SHA512

Submit Download

68e6d323-30b3-4006-9ce0-4565af2ccf69

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\68e6d323-30b3-4006-9ce0-4565af2ccf69
Size 671B
SHA256 251c4e3c2c7554683cdb32541b110c032090222efc426202843d533897f64ba3
MD5 904872d6f0c1813b139c4e2f96830e1c
SHA1 e3fa4a9af6e1617ef3956eda93e908726cfc69b4
SHA512 265165d30dc4663d967abdbc2689b034a2c8cee8fd2655974d40b4d1f6d3fd9dbd33ef8915b4244c84432cb9a9e0bb4885084e09247c498c409f92a434466ab8
MD5 SHA1 SHA512

Submit Download

7268a78b-9460-4a3f-b75e-61ed70d155bc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\7268a78b-9460-4a3f-b75e-61ed70d155bc
Size 27KB
SHA256 b44e592d933ac90a6b219204da2749aae7bd77ea0bfa185311d389897ee5b637
MD5 38c293fea9290c2562fd3b64a6b2a646
SHA1 9441b128b7b9413eddc2622eace3d4d19771cab2
SHA512 182999eb9eaf7cf5b8b2da31765c3eec9df5dc5897c9c52f434dffdc7bb175817e7127fbc8c75c90cf3c9fc4b8cc3139b9fde09246d70c09048ada0120f58fed
SSDEEP 192:ar4tg1D1M7tL2ZATbYfuzxcKfoCqO/1qDcfg13ViYj1jo1Kt/2F4dOZOU5z3d9uE:ar4te1k2ZOcmlcKfok/1SnX+uOk0ste/
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
Size 11KB
SHA256 d0e1b9a4b7c32e4fc38e10b26d093827939ec69a6c4bdfcacca90ad8da4bdbea
MD5 f1d064ab36f2a3431b7156cad1e3ed58
SHA1 1a9c94eb06cf8413dc694b0725c875b3bc3e8706
SHA512 0855d9138052d00e9af62e9b5971e33b936427da33e7dd9829bf5d44069d9abc0418ac1d96b006142560e904510dbb48787133b633b167f0b4828aadf4227bf9
SSDEEP 192:S5nxlR1fqHqxKI47GzbM++te5mdgdlQHrqk5e4aXfujABw8H1:wdfKV+Z5lQLBawM
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
Size 13KB
SHA256 66048c34b843f4d81bc636d8a5387e68a557fea9bd43bc1cddbdeedf62e0d712
MD5 c1d3a89b8f0e0c347b5e23cf14d56d97
SHA1 a1e6f401c6994e62626cb0577faab16f9d83db91
SHA512 72ba03ce502da151caa8a7464b26b55c0588f15d0baff7347d4fc8cc372996c8e5c153d07276ca066e972ff1c10c4415cc50c915e176fb53271bff84149b086f
SSDEEP 192:95nxlR1fqHqxKI47GzbM++te5mdgdlQHrqk5e4aXfujmBw8Hw/T:ZdfKV+Z5lQLBgwR
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
Size 16KB
SHA256 4d7db37dd2893bd1fa374aa417db30ced8f8853e35454ad992c7629ce5a11d25
MD5 9ef68e664c8579dc66be4c4c0e17e634
SHA1 b08bf3b1f9d7ec651867f2291864bf6dd20b900e
SHA512 77f2591e9d0827de46d137fdcfbc26a95abb542462f0a4ab00f01c4c4474a67d74e768b84067e84f3ebc4f3060ea6165e797f0afc15bd1368207518d84f9d7dc
SSDEEP 192:9anxlR1f8HqxKI47GzbM++te5mdgdlQHrqk5e4aXfq+jNdaiBw8HwUhJu9L:qdNKV+Z5lQLqdwGy
MD5 SHA1 SHA512 SSDEEP

Submit Download