14f2929a732740fd351f55f501173d46292108b4c13da210e1a85a41edb51f0a

Analysis

max time kernel
126s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241014-kyv7rssfpd
SHA256 14f2929a732740fd351f55f501173d46292108b4c13da210e1a85a41edb51f0a
MD5 3c619512d7906fbde57e4c27bc8358b3
SHA1 bb416a8a83727bc1e1b8ef3137587c95767d34c8
SHA512 491ae2bc4707e8880e5a181b7ce0dd56ee2a83cf8f919dd6bc716ec1c15395692c6fa9e0523faa35ebdda420a076b943523928969d1d72d71691c4e2c479085e
SSDEEP 12288:pqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Tc:pqDEvCTbMWu7rQYlBQcBiT6rprG8abc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2020	taskkill.exe
1244	taskkill.exe
1884	taskkill.exe
2480	taskkill.exe
1052	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4932	file.exe
4932	file.exe
4932	file.exe
4932	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	2020	taskkill.exe
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	1884	taskkill.exe
Token: SeDebugPrivilege	2480	taskkill.exe
Token: SeDebugPrivilege	3104	firefox.exe
Token: SeDebugPrivilege	3104	firefox.exe
Token: SeDebugPrivilege	3104	firefox.exe
Token: SeDebugPrivilege	3104	firefox.exe
Token: SeDebugPrivilege	3104	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4932	file.exe
4932	file.exe
4932	file.exe
4932	file.exe
4932	file.exe
4932	file.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
4932	file.exe
4932	file.exe
4932	file.exe
4932	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
4932	file.exe
4932	file.exe
4932	file.exe
4932	file.exe
4932	file.exe
4932	file.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
4932	file.exe
4932	file.exe
4932	file.exe
4932	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3104	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1052	4932	file.exe	84
PID 4932 wrote to memory of 1052	4932	file.exe	84
PID 4932 wrote to memory of 1052	4932	file.exe	84
PID 4932 wrote to memory of 2020	4932	file.exe	89
PID 4932 wrote to memory of 2020	4932	file.exe	89
PID 4932 wrote to memory of 2020	4932	file.exe	89
PID 4932 wrote to memory of 1244	4932	file.exe	91
PID 4932 wrote to memory of 1244	4932	file.exe	91
PID 4932 wrote to memory of 1244	4932	file.exe	91
PID 4932 wrote to memory of 1884	4932	file.exe	93
PID 4932 wrote to memory of 1884	4932	file.exe	93
PID 4932 wrote to memory of 1884	4932	file.exe	93
PID 4932 wrote to memory of 2480	4932	file.exe	95
PID 4932 wrote to memory of 2480	4932	file.exe	95
PID 4932 wrote to memory of 2480	4932	file.exe	95
PID 4932 wrote to memory of 4280	4932	file.exe	97
PID 4932 wrote to memory of 4280	4932	file.exe	97
PID 4280 wrote to memory of 3104	4280	firefox.exe	98
PID 4280 wrote to memory of 3104	4280	firefox.exe	98
PID 4280 wrote to memory of 3104	4280	firefox.exe	98
PID 4280 wrote to memory of 3104	4280	firefox.exe	98
PID 4280 wrote to memory of 3104	4280	firefox.exe	98
PID 4280 wrote to memory of 3104	4280	firefox.exe	98
PID 4280 wrote to memory of 3104	4280	firefox.exe	98
PID 4280 wrote to memory of 3104	4280	firefox.exe	98
PID 4280 wrote to memory of 3104	4280	firefox.exe	98
PID 4280 wrote to memory of 3104	4280	firefox.exe	98
PID 4280 wrote to memory of 3104	4280	firefox.exe	98
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99
PID 3104 wrote to memory of 1860	3104	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {597459c8-70d3-478a-be3c-4c3a85706634} 3104 "\\.\pipe\gecko-crash-server-pipe.3104" gpu
      4⤵
      PID:1860
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1362455f-51a1-4fc0-8f0e-65686c5cd1aa} 3104 "\\.\pipe\gecko-crash-server-pipe.3104" socket
      4⤵
      PID:3452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2856 -childID 1 -isForBrowser -prefsHandle 3352 -prefMapHandle 3368 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e7dda60-e612-400e-a083-e102c91d93b6} 3104 "\\.\pipe\gecko-crash-server-pipe.3104" tab
      4⤵
      PID:940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3748 -childID 2 -isForBrowser -prefsHandle 3516 -prefMapHandle 2868 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c7ec956-d54c-4826-8026-b5d57c3c1fa5} 3104 "\\.\pipe\gecko-crash-server-pipe.3104" tab
      4⤵
      PID:1240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4108 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 3068 -prefMapHandle 1716 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f357ec5-056f-4f43-b649-67da197a58c0} 3104 "\\.\pipe\gecko-crash-server-pipe.3104" utility
      4⤵
      Checks processor information in registry
      PID:4624
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 3 -isForBrowser -prefsHandle 5412 -prefMapHandle 5408 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {093757fa-f1c2-48ed-978f-fe7ca6d45186} 3104 "\\.\pipe\gecko-crash-server-pipe.3104" tab
      4⤵
      PID:32
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5528 -childID 4 -isForBrowser -prefsHandle 5572 -prefMapHandle 5580 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa71a972-3e4b-4807-ab58-770c7f9d62d5} 3104 "\\.\pipe\gecko-crash-server-pipe.3104" tab
      4⤵
      PID:4952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5732 -childID 5 -isForBrowser -prefsHandle 5740 -prefMapHandle 5744 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a41aa8b8-6267-444b-997a-3ab1ba78c292} 3104 "\\.\pipe\gecko-crash-server-pipe.3104" tab
      4⤵
      PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\activity-stream.discovery_stream.json.tmp
Size 19KB
SHA256 1da25a526639d6d5fe3dd3c45d59752e5a39c12590c45340a787ca0658b7ef93
MD5 6965ad92f0d278f89f85e9f8f7264fa3
SHA1 be9e645c29b24b6f2f172bf5d15f6299075bd1a3
SHA512 e805a3b2b727ac980726e6fbe3b3f897794c148b7ed0343ce2cb7d2e952d3c0cfd98dbd12f93abc4550c592f80a8fecedb4e04217f8bc7d46fae50c5b77fe371
SSDEEP 384:4rnvzWoYG7rGK090O0tQMn7Aq1WAiqyTyaE:4rnrcGeK21LGiq2yp
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 244c4022e781865b9d89437ad48a076fd1782d387188b8ecef2a2af9ca501463
MD5 7729d89acd821c39e1ad6d5d6ce043e3
SHA1 3bcf26da45c15993a6efff00850d5b5eaf7de332
SHA512 b02923ed217c5db1f86de3fe2529a47dba55c210f198b59d7fb5fe45543ad6f7a5fb4a4f4238711c26f072ccd928287f3aa9dabe76fce1e1b9b89b5b1607dcfd
SSDEEP 384:H7C9Du9fiGLm4pUJpHLFoCr/E8HPJyD3VonFcP+AWRMAC/ZI:bbBi8mCUJpHLGCr/E8Rg3V/+hRMFG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
Size 10KB
SHA256 70baa78c7743d3dc0d7663b428ac421814c5a18513d1d58d2bdff9e1f70e5689
MD5 a7523cfa85a10055cb40f594f00c8291
SHA1 72371b64479a9b95e5a244d0cc82ec23a7b28629
SHA512 c4e86434f16c80884baf4730e2db2c3c9797062753122f65a93ef21109046ba02ff96b92567576c668a1a9463cf7398bd0e805449c0829d9ee2d4eeb7fa50e42
SSDEEP 48:0cgJ5ogB9cO0mTebVKhbgsebOJhboJpebvpf+Mb:E5o8ebVKhbdebOJhbEpebvpf+Mb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 49854948d261e88a95e58f82d27335d3f25634ea080a7ce1375fca1c24c91c64
MD5 a4338d914bf0751550be0b6b42c02915
SHA1 413b00a8617efe6afe635b32ce05efe6b0083d2e
SHA512 b8ccf163d7af170a1591ed6d3f844d4edd6a217c98614b9b2be33ae0d4a7e3cb3d0a1ae11662f1597046beb28fbf614454b1513f0212b30e7fed80dd80ef90e1
SSDEEP 96:YSMF9ZbkW6ShmIUPP/PrWZbHQJQwvFl66JozGzgClKtmSS:YrvZboShhqPCi/66JozGzgCl6mSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 189661b68c74fd08bdcd45fb2e74e5a15894409d22f147a3a2aaacdbaff05599
MD5 44e026a47beed1e5491a336db47f1fa0
SHA1 066c6fa6646307bb60a0eea9bb9d264764550632
SHA512 101ae31a19d0ef49a31c3584f966fa3333c8f92636ef2a68cbd613e263a84596184e81b4c42ff08b5d72c372c2f8aaf9a68015da7a018cf815af870b1e5582d0
SSDEEP 96:SBySMF9ZbkW6rBBPhmuMUPP/PrWZbHQJQwvFl66JozGzgClKtmSSM:DrvZboPPh8qPCi/66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 c3e484ad93c2c7e106d9cd7e6548a4c1fd43cc7c31919706cf4569eda860fb35
MD5 59b24a9785379a5f7f26087b349bc41a
SHA1 76be6df080afa73dafc509d44432c2c7fc903fcc
SHA512 81e3e77ea6f953f911610e0984ee93e6319fac53a2add4278d16853a714afc4693d32d4c669ab4bba9eec2a67caddf14180bbdd518cbb54ac2d593d912f41a76
SSDEEP 384:ZWtATQTZDasfrb+bjPbonyPA/66JozGzgC1bM:UtFTZDasfrb+bjT3VEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

63b51c75-1866-4660-9bec-c07f2a5edec6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\63b51c75-1866-4660-9bec-c07f2a5edec6
Size 671B
SHA256 89b8a37ade0ee5a7a3f1560e66e9654155ad18e9229a4129c74dc9e53def44fa
MD5 53d302939fef7c604e056738e9df38fa
SHA1 58fccad1e8e6477fc62bf182f11b2d7d14e91046
SHA512 b0ec11600f9ce82a5950ec3cdef8ea6656ba803fa04051f65d43934b0f5be80ae195896044b7e6c19b9b136b6b85d1d76a99d90b1eae6ac203318f0bc2839f47
MD5 SHA1 SHA512

Submit Download

903c5a27-942b-4c06-aad0-06d28f9ccf42

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\903c5a27-942b-4c06-aad0-06d28f9ccf42
Size 25KB
SHA256 d32916f2eaedeb2555fe0bd3c66522a05cc0b6be3b926e0740eb50ef7248a3b6
MD5 84d691eb0a3cfa24953a93be76091b5f
SHA1 e205d38b498cfc2ad71add64cc20942054b68bdf
SHA512 b84ad9eca59007c0b87ebc2407e247eda51d1f822713cb915f1d2e22cc79bba5ab871dba8c22d58b56bdf6905b0eb5db3c126805582fd61169ddb4af460a5f80
SSDEEP 192:G3z36Me8M2u3WliWzSmEucjGFBaCNIbskci/SDmMMbz3oxv63ULr4h4JSbcDEl9n:Gj3M8MVEiWmmLcKbsq9RwjFMhn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc9f889b-e88d-40aa-a98b-4b4ab98f6d41

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\cc9f889b-e88d-40aa-a98b-4b4ab98f6d41
Size 982B
SHA256 79bd69a81d49856f0da61dded066b3a291455840971304d43806dc1a915ebfd5
MD5 bda1706f58f3c595fa3e86adf2c54395
SHA1 ad61a02cf65ee903161ffcb36114318c9e8132e0
SHA512 c77da462a9b8a1c1750e9eb31cbd73a81447cbb4b6e8474606dcc050190c2d8abb0b6df4e7a42aa3eb2347d290d1590b9815e4acf388296a165248f91ffc99f9
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
Size 12KB
SHA256 733f2583078107f624cb7b5bdf183ff29cc4f10ddf646274ba62bcb47956b743
MD5 81ee19bc7dcff15c8db6be1518477bba
SHA1 bdf17e5ff24287cbec3cc924b443ab8bfe73d885
SHA512 cf7863b48076053b773f15d0c919cca4a88db86cd2272a6f70a05debacb1f6f9196c5660aee6775f2b3bf295a91e475827e035eea60283ab3455ab66aa36c01f
SSDEEP 192:y5nZRVpf2qqBGVcAfWWEJUlcjztFqdgdnQHrQF5XaXVVJJrBw8HO/D:Kpf2Au7rv1nQLbVxwj/D
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
Size 16KB
SHA256 f16976417a5bccd835791c045124fe0af84b4de24e822eee73697cdde56c9b27
MD5 f6d59eccf73028d6d1ba30278c5ec487
SHA1 802e4df2b4d61615bd0aafd9421555552421a8ef
SHA512 65e1399793d1efabe0b2c9b85e6c707250e432cb49816eeb9233c43744b65d0e4ea3f40eb32401239fa160de24d86608a8c826530109f12ee1da4e3b9e77d930
SSDEEP 192:yinZRVpfwqqBGVcAfWWEJUlcjztFqdgdnQHrQF5XaXv+VJJNiBw8HOjutVp8fj:Np52Au7rv1nQLUVOwjjurC
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js
Size 10KB
SHA256 4662405c126e441f913a1c9369262487d4bc5f8d721fb88e087c6599c74eeeca
MD5 2e00c4c63aaeedbca09e5e84f0b06bab
SHA1 4b624fd49d1b755da75fcd87c52b4fcb59b5e80d
SHA512 283bf2c11d278742037a23a863e8a2059b3a410352ab1ce48bdbfa1fc3fa05eedf0a2519a5063f37a9b40968e33b0d819a66d45bb354019ca01e2a18af1b0e12
SSDEEP 192:X5nZRVpf2DZvgns/uI4gYcU8BtD8JJCddLMy1Zzw3iKaXvAVJJ/Bw8Vd:HpTsWuYgUJJ6My1ZzqVlwu
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.2MB
SHA256 8671dd6541508dfaf443b5e0f24d2ea6cfc14dc14a833ae0f5e61121e44889ae
MD5 6f0385743e5cb24d0d41c11a2f79f213
SHA1 8ad467f8272eb05e8ac62d803e1228a6580dd584
SHA512 acc9b7c76be430f266c7d02caaca93d7286d2b831791519d13adea2f1a179884e531561667d02854e21038ec8d1ae54fab98f0a42e53e3b8b284c23b16aae50b
SSDEEP 49152:nxcCC5ZhmB6L520yb6a2A3/UytVs3mjHMTkPpvr3RIPLBU9ek7GMcZ30hXBm7+vh:Vv
MD5 SHA1 SHA512 SSDEEP

Submit Download