80ede1824d66c38aaccff7459cbf5a12b4e6799041f1db1817cbdc7016f8e67b

Analysis

max time kernel
134s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2024, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241023-j55jca1gpp
SHA256 80ede1824d66c38aaccff7459cbf5a12b4e6799041f1db1817cbdc7016f8e67b
MD5 042ca8acf27d1431e029b2aa0bb19dfc
SHA1 ed98f75a1ecbf95f5e25f8736a488a548b2770b7
SHA512 edef5cc1529d60843d6a2a19d19797ab6b7ec182218a9b16d8b1caa8651b612421892558abeba7501702c7355d191b8d81bb0cc6861836652f2d4a1688f02fdc
SSDEEP 12288:pqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/T/:pqDEvCTbMWu7rQYlBQcBiT6rprG8ab/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3972	taskkill.exe
4236	taskkill.exe
3832	taskkill.exe
4108	taskkill.exe
1108	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
832	file.exe
832	file.exe
832	file.exe
832	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	taskkill.exe
Token: SeDebugPrivilege	4236	taskkill.exe
Token: SeDebugPrivilege	3832	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeDebugPrivilege	1108	taskkill.exe
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeDebugPrivilege	4160	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
832	file.exe
832	file.exe
832	file.exe
832	file.exe
832	file.exe
832	file.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
832	file.exe
832	file.exe
832	file.exe
832	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
832	file.exe
832	file.exe
832	file.exe
832	file.exe
832	file.exe
832	file.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
832	file.exe
832	file.exe
832	file.exe
832	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4160	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 3972	832	file.exe	84
PID 832 wrote to memory of 3972	832	file.exe	84
PID 832 wrote to memory of 3972	832	file.exe	84
PID 832 wrote to memory of 4236	832	file.exe	91
PID 832 wrote to memory of 4236	832	file.exe	91
PID 832 wrote to memory of 4236	832	file.exe	91
PID 832 wrote to memory of 3832	832	file.exe	94
PID 832 wrote to memory of 3832	832	file.exe	94
PID 832 wrote to memory of 3832	832	file.exe	94
PID 832 wrote to memory of 4108	832	file.exe	96
PID 832 wrote to memory of 4108	832	file.exe	96
PID 832 wrote to memory of 4108	832	file.exe	96
PID 832 wrote to memory of 1108	832	file.exe	98
PID 832 wrote to memory of 1108	832	file.exe	98
PID 832 wrote to memory of 1108	832	file.exe	98
PID 832 wrote to memory of 844	832	file.exe	100
PID 832 wrote to memory of 844	832	file.exe	100
PID 844 wrote to memory of 4160	844	firefox.exe	101
PID 844 wrote to memory of 4160	844	firefox.exe	101
PID 844 wrote to memory of 4160	844	firefox.exe	101
PID 844 wrote to memory of 4160	844	firefox.exe	101
PID 844 wrote to memory of 4160	844	firefox.exe	101
PID 844 wrote to memory of 4160	844	firefox.exe	101
PID 844 wrote to memory of 4160	844	firefox.exe	101
PID 844 wrote to memory of 4160	844	firefox.exe	101
PID 844 wrote to memory of 4160	844	firefox.exe	101
PID 844 wrote to memory of 4160	844	firefox.exe	101
PID 844 wrote to memory of 4160	844	firefox.exe	101
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102
PID 4160 wrote to memory of 2724	4160	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4236
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2f365bb-6555-4d88-8941-cd296681bdc5} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" gpu
      4⤵
      PID:2724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2420 -prefMapHandle 2416 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {455fffac-bc72-4bcf-b00f-5791ed6b5e50} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" socket
      4⤵
      PID:4808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3068 -childID 1 -isForBrowser -prefsHandle 3172 -prefMapHandle 3276 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f35e19e7-8d9f-4a50-8c30-3fe0564d1e3c} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
      4⤵
      PID:716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3868 -childID 2 -isForBrowser -prefsHandle 3044 -prefMapHandle 3396 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcdab641-9e57-4ac4-a4d7-d15882313c04} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
      4⤵
      PID:2364
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4512 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4536 -prefMapHandle 4532 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97d85930-a3f6-4174-b7f3-b7e3540bf3c6} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" utility
      4⤵
      Checks processor information in registry
      PID:3712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5268 -childID 3 -isForBrowser -prefsHandle 5292 -prefMapHandle 4824 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f17a16f-0cbb-495f-8077-f190013c9d78} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
      4⤵
      PID:5796
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5388 -childID 4 -isForBrowser -prefsHandle 5392 -prefMapHandle 5396 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85ef319f-f9e9-45d7-99e4-2276d8ce63e5} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
      4⤵
      PID:5824
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5728 -childID 5 -isForBrowser -prefsHandle 5720 -prefMapHandle 5292 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {320045a5-f571-4fd7-b4a6-321add8123ad} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
      4⤵
      PID:5856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 084c00dd3623e43878c00b6e8de5ae9ed7209c7dd4cb551a660556c8e628012c
MD5 a2ad0b2ce2628b46f7952eeae41c5261
SHA1 21abb8ef4e9316cd7b71535eb36ad9c8e7d94f38
SHA512 9676a2fe7dcb92bc44da31918c9d1fa98a2e369e2a023fa1bae069609a478ecbda1d2d7d8b114fc69ec14a119d542c29a7b0753d8920cc83db19cb2d03799483
SSDEEP 384:H7C9Du9fiGLm4pUZpHLFoCr/E8HPJyD3VonFcP+AWRMACPF7FZ:bbBi8mCUZpHLGCr/E8Rg3V/+hRMFB
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 a039f9383026f3faf0f74631bd76302c5f46faf0645b47b4e7c73ff0a8e6e60b
MD5 e38936b57ceb7f3d087c0800571c6d3e
SHA1 40bb485f6516d10d82c768e63232ef29f8ea73f5
SHA512 53f19268ec25bc1c8f5feb859b6d1e8b733d3947a3b1dab0ba1e82f50f5e008aab00a3023d83b2e0d6c05916a15629889b88c1e0b605ffb58f2a5f9a5e1c9b49
SSDEEP 384:H/w5Iu9fiGLm4pUdpHLFoCr/E8HPJyD3VonFcP+AWRMACanD:8Bi8mCUdpHLGCr/E8Rg3V/+hRMFu
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 10KB
SHA256 d7ce46931b2121cbd6f07d43cd10c0a616daf80b3bf70bd7226fcb8a06e32c5f
MD5 b2620db6d18950a0b1b374a75ba4be31
SHA1 5bf9620d3ce86404a964dc5472804b60ac865150
SHA512 0746951955a8018f9ec9f35b05643748a451e85d52879fc8df4ad97469dc2a1f9ec3276ee565e872d2c927cbf0f15e13ad86dbbe4386bc6b2952deb2f62ca3cd
SSDEEP 24:5uB1oEgu1xgRb+/pR5cOuuhMZ5Fsh2F3LF8sJblLKDb4sJbF0JCbiWKsJblxWKfp:g5oO9cOrebVKDb4ebOJCbipebvpf+Cb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Size 18KB
SHA256 3589a75f08c2fa55da0fc46fc3376020d32846b5e522b6b97b202a781b1d0fbe
MD5 224250a06c44cbec82ebacf63ad7d3ba
SHA1 efb44324d1eae32501432cbdeaa3ccc70100a0e2
SHA512 1be442baae242049280b882f1164f0201d193fcef5ca319c3b6a1a9c5bb1933b7631a020c60b1dac4fd806e9bf6410ef518958a542ed544ac9dd80b24dea1231
SSDEEP 96:I5oyebVKDb4ebOJCbqpebvpf+ubf4bkbygbgzIb8bobqbAbWb+b:I5qu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 bdf18ca7df9d6685c87c896589d8dba85d1a478385d0d87f21254507262091bc
MD5 8f687ecf7f57d932b80cdc47443cc33a
SHA1 e7214ac8eb049a5f6e1d495173e6ac2022094084
SHA512 27586d527e8703ccae2e72cace88157d35d09c3a303da287f219bc6e4901827a1529cf35541d1493ceebdd05921c3fbed2810e99fa28882555d4123550b8a57d
SSDEEP 96:ppSMF9ZbkW6Shm6uPP/PrWZ6OQaTlWNFl66JozGzgClKtmSS:pprvZboSh7gPCQP/66JozGzgCl6mSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 a54e6ca52f39a5fb17afddb32500041968b4777b0cbc4e13d529f46138a32336
MD5 f898cfa9ccbdeb54965a547a13ec8650
SHA1 947cf8e512f6938d3da72073c21c9a5fce0927bf
SHA512 64eb6c2ff2355e7932228ebf37dd6953e8f3725fdb905fec15d8ae5d2ed789c67612f379fb326bbb12234ff68bd1d761df484925d7687207c58a49e22edbf524
SSDEEP 384:G/66JozGzgC1bufKse6GWIDTEM1Lb+bFeTXboM/MsP0:jEirArDTEM1Lb+bETrR78
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 297b21f158b7421ab82bbbec433fb1271876b6c0d27308d219f9cb77503ac7d1
MD5 be0a27e8c2dd282244fe5a027ba705d7
SHA1 fb69e537a9ed98b2473cbe4dd0029176598399e1
SHA512 efaded5c1261bacfc0abb1cfbc9f67a3b3910a89c531cb258def8c85a169c2df5bbf5da03099f8d55fdbb0c93b31428cb0d217af6964b800efc13774cd2a1e73
SSDEEP 384:EfKse6GWIDTEM1Lb+bFeOXboMEsPc/66JozGzgC1bM:erArDTEM1Lb+bEOrRbxEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

60131ebe-1ec3-4a0f-8db5-f476c5d05fda

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\60131ebe-1ec3-4a0f-8db5-f476c5d05fda
Size 671B
SHA256 fb55dcda8b8a1895df9da5ab749357c02318f9e7aa29a3f9532c848761bcd007
MD5 5507ad48823300ea97f1d1d281e89196
SHA1 2fa7f87a0a605b09ff613ee550edb5107f46e528
SHA512 6caab46223a376ad5496d9b5a165a0c3b0ca50488270a77db27b9023372dfe8cd630d403c88e2734db7cde644e0dee5b954ff6391a3230ac07f1bc6e3591ea33
MD5 SHA1 SHA512

Submit Download

621d4347-94ff-428a-9581-92df840bddb3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\621d4347-94ff-428a-9581-92df840bddb3
Size 27KB
SHA256 3e75854f17338214fcf9bb88aa831c54ed491c0eba1b51d09ca71fbb85bcb7c1
MD5 6618ac6943a0aa0cd4c852c5fafd176d
SHA1 a3b3fdfc313b6a753b921e3ace73c13e6d93a4f9
SHA512 979672b18c089e9879de72613cdba40ccf5b6eb874f3c11769a61f0bd84952f949ee7b185a5b183d4c9e26f36ccaccf3be5262a4951b1544accf3dfc1ae71646
SSDEEP 192:ihCls0WlJMkj5RIM//+1w3CtH8s7vs7QB98RtHtGiou0vVcUUpYiHbeYlfPMUpOV:iKs0gP+eG8HdOlNKVturXyaSRKloD4b
MD5 SHA1 SHA512 SSDEEP

Submit Download

f19d2bd0-601b-400d-8de6-81dac8e7cbfc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\f19d2bd0-601b-400d-8de6-81dac8e7cbfc
Size 982B
SHA256 6ccae4cecf0ae15a0e30c903381dc5d202fa7878b0c8b7852f268bc08cddbfd6
MD5 28d4aedafc9d87e2162b133b06810751
SHA1 689e5832daf0a470dfa279516a40c9c8a7e0a305
SHA512 b3904c3a65c0172f117053fe03254684dfb22359c8e49984452385541b29e71562062128e806c0f814ebb48116a1cb6b4432baf0adf56bd622627d1d3cd5606b
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 12KB
SHA256 a2f7f5f4e2eb9f903bc131a99cf8319facd0fedcb5b20516b5390f3f8211b4a3
MD5 84a9ea2e74a11c34dae87477df0e5e69
SHA1 a512639199f22c25643ea6020a9335c894946f77
SHA512 0f266f82b3873595c9fa1c3091e78bf7d208436c7c2182095985ef1079b8eddb46c6f935d171f6286f4fe26bf6312c933bee7ac9a1b197a45ee804fa16d9e66b
SSDEEP 192:h5nHRUfUhfQ4fWdEctw8gnddsy1Zz43SaX12n/Bw8Hj+:234+dzg8y1ZzCKwa+
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
Size 16KB
SHA256 ef91578c90066f6b92d8bcf81df015e5cb9c13e1cd980023f9d8437593d237b3
MD5 3785640adeaa9bac66de1fe65fcbd28e
SHA1 77dc1fe80cc2fe35ff316d02ac270becb31754c6
SHA512 f596b3c8c4f4509c49307dcf3c0520e36455403e91ef2fc20dea67707b7e73a453ca7621a21528539d0ebf3fc906fdf6585499503d229f9f52d0b9e4b3e2e740
SSDEEP 192:hinHRUfphfQ4fWdEctw8gnddsy1Zz43SaXP+2nHiBw8HNLrrQa:Xo4+dzg8y1Zz/pwe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
Size 10KB
SHA256 a2dc7ab41484afe0d95e159fc0bf7221a800339127807f5f0ba407093609816d
MD5 1ba2c3cf93679a8c39b9d9c0adb66759
SHA1 6cc1c54ef8a2670f303d04ec04ecf84ad9dfbef5
SHA512 b77b5fdeca7182c8ceb733b918b5c064459269063b343e01feaccb16aa49ac5774c06317212d4071d32273673cb042e5c2a4e9e5b59bc19f5fa495649238e0c1
SSDEEP 192:S5nHRUfU3GjVofAHBtq8prddx9y1ZO43+aXa2nSBw8VE:ZbVoIbpd9y1ZOVFwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
Size 11KB
SHA256 62f9ef0f20d0acbf22bc1b01c162848440fe2d89a3cb3a12d4fe0f9bba603005
MD5 a6507d2b6c5d2216cc203ab5408148e5
SHA1 48fe80baacac89d777ca3b57db6449f5c2722034
SHA512 5a5014d3d8d3a195967a310f8a81c69b7b0ddccf86dcbfed240bd6259a0669975527986f36c1417b7ffae8bf9915345a3b3c7d72b4f1c74775a35bf874b364bf
SSDEEP 192:S5nHRUfU3GQ4fWdEctw8gnddsy1Zz43SaX12nSBw8HE:Zo4+dzg8y1ZzCFwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download