98cdc2aed91cb1294429e43cebfe79adfe311761db9b00ae74ce4b424e38e808

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241010-a87nfasfpc
SHA256 98cdc2aed91cb1294429e43cebfe79adfe311761db9b00ae74ce4b424e38e808
MD5 8eb80d6a4bf81ccc902a45a404c7ed9d
SHA1 94bd95a6c577963d3608de4b659c892aa4013f84
SHA512 95ccca01f61452d25c34f05525d1a2d5e63b61ce62402e06ed9d6be26aa4621041d6480ef310356fbff4dac0b311e57b03cdf3b527238a14b598def1e53696e0
SSDEEP 12288:yqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TH:yqDEvCTbMWu7rQYlBQcBiT6rprG8abH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3916	taskkill.exe
348	taskkill.exe
1268	taskkill.exe
3876	taskkill.exe
2804	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2452	file.exe
2452	file.exe
2452	file.exe
2452	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	348	taskkill.exe
Token: SeDebugPrivilege	1268	taskkill.exe
Token: SeDebugPrivilege	3876	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	2560	firefox.exe
Token: SeDebugPrivilege	2560	firefox.exe
Token: SeDebugPrivilege	2560	firefox.exe
Token: SeDebugPrivilege	2560	firefox.exe
Token: SeDebugPrivilege	2560	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
2452	file.exe
2452	file.exe
2452	file.exe
2452	file.exe
2452	file.exe
2452	file.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2452	file.exe
2452	file.exe
2452	file.exe
2452	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2452	file.exe
2452	file.exe
2452	file.exe
2452	file.exe
2452	file.exe
2452	file.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2560	firefox.exe
2452	file.exe
2452	file.exe
2452	file.exe
2452	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2560	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 3916	2452	file.exe	84
PID 2452 wrote to memory of 3916	2452	file.exe	84
PID 2452 wrote to memory of 3916	2452	file.exe	84
PID 2452 wrote to memory of 348	2452	file.exe	89
PID 2452 wrote to memory of 348	2452	file.exe	89
PID 2452 wrote to memory of 348	2452	file.exe	89
PID 2452 wrote to memory of 1268	2452	file.exe	91
PID 2452 wrote to memory of 1268	2452	file.exe	91
PID 2452 wrote to memory of 1268	2452	file.exe	91
PID 2452 wrote to memory of 3876	2452	file.exe	93
PID 2452 wrote to memory of 3876	2452	file.exe	93
PID 2452 wrote to memory of 3876	2452	file.exe	93
PID 2452 wrote to memory of 2804	2452	file.exe	95
PID 2452 wrote to memory of 2804	2452	file.exe	95
PID 2452 wrote to memory of 2804	2452	file.exe	95
PID 2452 wrote to memory of 2732	2452	file.exe	97
PID 2452 wrote to memory of 2732	2452	file.exe	97
PID 2732 wrote to memory of 2560	2732	firefox.exe	98
PID 2732 wrote to memory of 2560	2732	firefox.exe	98
PID 2732 wrote to memory of 2560	2732	firefox.exe	98
PID 2732 wrote to memory of 2560	2732	firefox.exe	98
PID 2732 wrote to memory of 2560	2732	firefox.exe	98
PID 2732 wrote to memory of 2560	2732	firefox.exe	98
PID 2732 wrote to memory of 2560	2732	firefox.exe	98
PID 2732 wrote to memory of 2560	2732	firefox.exe	98
PID 2732 wrote to memory of 2560	2732	firefox.exe	98
PID 2732 wrote to memory of 2560	2732	firefox.exe	98
PID 2732 wrote to memory of 2560	2732	firefox.exe	98
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99
PID 2560 wrote to memory of 2456	2560	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:348
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3876
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1512 -parentBuildID 20240401114208 -prefsHandle 1964 -prefMapHandle 1956 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4e5cdaa-a783-4b3f-9359-6ca40b5cf751} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" gpu
      4⤵
      PID:2456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6753bc12-2ba6-4c7e-bd3c-8ef9c3a469d8} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" socket
      4⤵
      PID:4112
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3124 -childID 1 -isForBrowser -prefsHandle 3116 -prefMapHandle 3000 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99a799cd-3bbe-4d6c-b173-ad09fb94f3a7} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" tab
      4⤵
      PID:2264
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3024 -childID 2 -isForBrowser -prefsHandle 3712 -prefMapHandle 3708 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0de06457-05ea-4b70-89f2-96372efd0e6b} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" tab
      4⤵
      PID:3112
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1452 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 3716 -prefMapHandle 4456 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fe13195-f44f-4344-b964-980478f96fda} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" utility
      4⤵
      Checks processor information in registry
      PID:2288
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 3 -isForBrowser -prefsHandle 5396 -prefMapHandle 5388 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {844fc90d-b908-4df0-bede-affbb4c87a53} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" tab
      4⤵
      PID:4700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5548 -childID 4 -isForBrowser -prefsHandle 5556 -prefMapHandle 5436 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bb9113f-fa1f-4d74-a9b2-9b394bce537e} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" tab
      4⤵
      PID:468
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 5 -isForBrowser -prefsHandle 5724 -prefMapHandle 5736 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e66613d9-8852-4dbf-aab9-fc9c7297e438} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" tab
      4⤵
      PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json.tmp
Size 22KB
SHA256 1ce57920a48addba4fc52bfc1858ad156ef9a282b60004bc603f0bf41808ebef
MD5 b1e71bd3d5970f75601b452582253551
SHA1 31c0a60c37e14e8a312f211d0b0849cf2501b59f
SHA512 bcaf5fe4f9e9200cc8a6d430a88b6314ceef094c71abaad30ed207b487519e3e1aa343c359a6602be9452c24636adb65cd6d74e856c428627d4ba7821c8f2f7c
SSDEEP 384:D3nIWmYP0012IhGj03dYmOkyq+qyauzpg5:D3nIWM6wjuAkydqydzpg5
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 f03b9a9d2d1e078ab89b057ac77ea590889adca1a5d0102b09be6ae5ef99c170
MD5 3f50e3a8517e36b6a24329751acd367f
SHA1 48f45827e9900f3fd4a1c7b1c5bfe54a179153be
SHA512 43e3e5deb75000de84796913f76d13563550021a3ee0bfb6fe44cc44fca35278eb0270cd1a9cc674203703bee2b44d4b7f12b7f4392dee0f91689a204bf4f5cd
SSDEEP 384:H7C9Du9fiGLm4pUQpHLFoCr/E8HPJyD3VonFcP+AWRMACPFmFZ:bbBi8mCUQpHLGCr/E8Rg3V/+hRMFi
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 10KB
SHA256 9c61c8cebc92e249331c1e3968bdd0f61501732f4098d17e9a5259640faf7e86
MD5 767c44ecb789d2da3d2e4e2c6a2c9907
SHA1 26cc72d721b0f0c0c40fc83cf4392c955910b2e5
SHA512 9b0b1569acdd452fdbfb3f3d5771a6c103ef1fbc923a27d49b75e34b05fd19c12ba0d303888c8723fc32e4e4b3119f2511576e429eb14fa97b8b267cbc97768e
SSDEEP 24:5uB1oUgu1xgRbypR5cOhuhMZlFsh2F3LFJsJblLK3bfsJbF0J3b4WKsJblxWKf+O:A5oO9cODebVK3bfebOJ3b4pebvpf+wb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 18KB
SHA256 5b920da02ba8d7137b0de799d4c25f8708e3f9093c338326994968dae087ad92
MD5 565c3c700731adf5d06f6a43b98e6dc6
SHA1 93989d4eec6903e3190e9fa1fa4d45d751dc80c7
SHA512 3f9f98e9c5463747b5afa0d31deeab0f2dcf686af1eeb30db02f90726caa2147d69645e3c89cd1c8e1cb884ebf9af5bba4c83028f7926669f48cc17b3ea8cd9b
SSDEEP 96:g5o+ebVK3bfebOJ3bApebvpf+kbFbRbogbgzqbhbFbVb9btbNb:g50u
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 3f7bd4b4bef98f6578f8ca3823979542da48dc62085a29bf3f7f648eddbc7081
MD5 caa1299396e0ee83faba4846f8e5854d
SHA1 d1b936703417a2442395f3393485d3f02d71ab47
SHA512 702811d028ee62627058ecd223e77bcfda1e21050d5b0f162f1ad34df02fd86c4ae0198aa252b6eba5a036bce02036b059f5a8951b9d6e39aac5ea3078cbc92e
SSDEEP 768:+cw8YDmP3tZ8ME1YUSbkbTbxbFb6bdb/bXbdFBw9mnxifEFvR:+czNTFBw9mnxig
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 f4364db1d6b04714fad622249c94aff14e09fc469f7089c84b893c4320a1d2fb
MD5 62b64482c507a931ffd7b7676e4e5f0d
SHA1 4ae1ff64ef128edd488878dd035db5610bbc9bd3
SHA512 cb7e3eff35af9f9471f1fc7ace04fc1f78cb6847a78fedc6af2157f339a73e0d5d7916c0796892457149ba26fd266c115b2c15e7c669d080db5e456a1a60d819
SSDEEP 384:jboS1PH/66JozGzgC1bIOo+1NddJ+gPmPc+Z8ME1M8bkbTbLbrb6bdb/bXb3IzYP:XjaELo+FdJlPmPc+Z8ME1M8bkbTbLbrO
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 8a53df43e6e7a00397a59ae3a4de0a21381c2486a7e67f4225971ab08e3cf03c
MD5 7f29bd4cb9d95fc6cbb5fa5be5d6b452
SHA1 5fe812e19999b61559fba22b0ed13532d578fe48
SHA512 d3eed9feabc1ee9e84cd3d1fc43901db406d0c4d3f36531a77e7f36d0863cbb401adfac5e3743701ab1e8e2311662949976316ae843fe5bd0d5f229dfc5e6240
SSDEEP 768:bEgPlcw8YDmP3tZ8ME1YUSbkbTbxbFb6bdb/bXbdFBw9mnxiW:FczNTFBw9mnxiW
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 f07b7b5ff8be2a11296336259a4ae0a53f2670f3ac88c1c9cbd3a1529c85455a
MD5 630a9e10f2c337ac3ed06f09f10b10b7
SHA1 198cd9d66a1f4800f1e212b44f8516c825d35e41
SHA512 692f026edbd9e80158f6138db4af6735b81e3888af56bde379ada1a580d22330fa145dcd7b2c7ed139fc029ba8164f0e7c9efb3ce76bf892f346f2d36e75b989
SSDEEP 768:bEicw8YDmP3tZ8ME1YUSbkbTbxbFb6bdb/bXbdFBw9mnxi1vR:xczNTFBw9mnxiX
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 9b4ec503fa108ca9d0383f6d7041bb1b6fee4d1886d7010891d399ba7a157046
MD5 f20ac08473dbca07cc8cc736d5ffaaef
SHA1 67b9f11fd84c5e5191e856bb5afffb3f7ea6233f
SHA512 027cb7bc8b2382e3b382e6120b304c9ceeeae50bf7dbb7084953a207d3401f259472345a3fbba7965d66a032ff6031022d6a792d459d008c66cef7e4e165c8d8
SSDEEP 384:aOo+1NddJ+gPmPc+Z8ME1M8bkbTbLbrb6bdb/bXb3IzY5tp3nrViobow1PH/66Jq:Xo+FdJlPmPc+Z8ME1M8bkbTbLbrb6bda
MD5 SHA1 SHA512 SSDEEP

Submit Download

10749dfa-b5a3-4568-b174-58351a251d05

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\10749dfa-b5a3-4568-b174-58351a251d05
Size 659B
SHA256 d9744ceb08c17b2ba2f7153e9d535e0a66092e6de036c25014841ce5ce94d9cd
MD5 1ba4e2e8d034371b7186f1c39873887b
SHA1 1aaeb82336102f9b020335e50d4b0c5291fde1e6
SHA512 19617d912fa91b6eb8bb8173d61b8214e8cc2bae8b9b46f35dc3c524b5b03f27595a1f084feec17f99c4b1d81caa59bfd7daf4182b258b0c8df44968717ec01a
MD5 SHA1 SHA512

Submit Download

737220af-b367-4818-9a88-d6f464706d48

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\737220af-b367-4818-9a88-d6f464706d48
Size 982B
SHA256 db9ed650e1ab2dd710c3909deaf06793ef28f0e711c56ae97f0c1bc88417b099
MD5 88fcf00fabeea42c7b7f49b75074f75c
SHA1 fbc64b9157c542e00cfede0a47570bcfe9f4049b
SHA512 b9e6f792b5bf578c4647772d49b32caa95f4b81a3a1fed02435c18946445ca7cf5296e3f51fcc8ca6dfc0db44c75fdd57d43fbe05d3b5992f6c5bcc102593b53
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 12KB
SHA256 4873642475020cda9c3d7532a45cbc63234c17ae48c29e37582f34c18c96c817
MD5 84d9c7fbb8e2c977f7007ace9909dfdb
SHA1 02e0befd4a689dc99422f371e29639c6260d7cef
SHA512 699f6487f901bd97fb449e67c1e3f4a29561b376a477e98056b66113b36c2e1357fb5941d29536b095e13b048a1f7ccf8f742c4d087679fcfae9aa51399606df
SSDEEP 192:h5nHRUfUFozFxnrd369YqhwtK8SVXtpsZ93WaXn2nrBw8Hht:2HFxl62qYopYdGwe
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 16KB
SHA256 3dad66e30c67bfc8c13a46c350b91459d35621ae3843365efbe20c56ba6ef7f5
MD5 afb8e440deb080ab993fabb2736b2d75
SHA1 5c1b409b59a1d854fa7e0f81df68e98f86adea9a
SHA512 3d0d57a94e610d662c96c42985b55f85de0bf7e369af3231318b6126c2d2adde7e99bf8b10a13883a09adb220a2444269899e4426a1ecb9979436e4a47c79c06
SSDEEP 192:hunHRUfjFozFxnrd369YqhwtK8SVXtpsZ93WaXJ+2nXiBw8HvBdGlq:L0Fxl62qYopYudwW/
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
Size 10KB
SHA256 12c897ba5e7a7e8bc00f5f0187adfe48b11eeab007102fb2013a8755b889a232
MD5 c50f86b333d53e4d81c21897380ed7d3
SHA1 45220e440a30cea217422ee222f4116fba0414c3
SHA512 b9da1bba89bec283509258927b5f1c4b44d7f329ce01811273d88601e66031d1aa3e290b133b5948562e6115f739afcecc80b046d6b58905222e1f00dea80a0c
SSDEEP 192:S5nHRUfU3GjVofAHBtq8prddx9y1ZO43DaXa2nSBw8Hc:Z7VoIbpd9y1ZOsFwp
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.1MB
SHA256 37ab24ccd26cdc96d07cba31fa2c1980e5f254b44ba5ef4361ed2499c14534fb
MD5 5e21cdf1835b9d3eed72a56e028871ef
SHA1 5a67bb105ded9cd5811f59c66229f90e6bcad8b5
SHA512 f59bd104bb60832c4bedbd89c5186ee05b3df4adb6299c7d475725751929ed6530686db8a7e72e8d23ce9f38e37885efa3a27babd51e3dc779f2e47392eed244
SSDEEP 6144:37rSAt3e3B393z3lTHxDnsmEmzPi2U2iU6oZGAY5Zmz0Pu/elOnRuznXxeHN1Hms:ADnsmLqz236A5+rAwWv5R
MD5 SHA1 SHA512 SSDEEP

Submit Download