c0c74c1e71d23d484bfd9d6b6cd3f5baced40cbe19345991e9f1981bd20edf8c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2024, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241031-a2b8ysvfqa
SHA256 c0c74c1e71d23d484bfd9d6b6cd3f5baced40cbe19345991e9f1981bd20edf8c
MD5 df53e224b7ec467a1ac0728fca54456d
SHA1 3e9a3ded74a890ce8a5045297759b5a380b0bc2e
SHA512 1966dfcdbb317761f4340ec164215027ee59755507043219422b820575592e12bb2ffbc63e420076f769a210ff7033975dc53f757512e326489fa6c7102c3d9e
SSDEEP 12288:bqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Tw:bqDEvCTbMWu7rQYlBQcBiT6rprG8abw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1160	taskkill.exe
3740	taskkill.exe
3376	taskkill.exe
2964	taskkill.exe
3692	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	taskkill.exe
Token: SeDebugPrivilege	3376	taskkill.exe
Token: SeDebugPrivilege	2964	taskkill.exe
Token: SeDebugPrivilege	3692	taskkill.exe
Token: SeDebugPrivilege	1160	taskkill.exe
Token: SeDebugPrivilege	4176	firefox.exe
Token: SeDebugPrivilege	4176	firefox.exe
Token: SeDebugPrivilege	4176	firefox.exe
Token: SeDebugPrivilege	4176	firefox.exe
Token: SeDebugPrivilege	4176	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4996	file.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4996	file.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4996	file.exe
4996	file.exe
4996	file.exe
4996	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4176	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3740	4996	file.exe	84
PID 4996 wrote to memory of 3740	4996	file.exe	84
PID 4996 wrote to memory of 3740	4996	file.exe	84
PID 4996 wrote to memory of 3376	4996	file.exe	91
PID 4996 wrote to memory of 3376	4996	file.exe	91
PID 4996 wrote to memory of 3376	4996	file.exe	91
PID 4996 wrote to memory of 2964	4996	file.exe	93
PID 4996 wrote to memory of 2964	4996	file.exe	93
PID 4996 wrote to memory of 2964	4996	file.exe	93
PID 4996 wrote to memory of 3692	4996	file.exe	95
PID 4996 wrote to memory of 3692	4996	file.exe	95
PID 4996 wrote to memory of 3692	4996	file.exe	95
PID 4996 wrote to memory of 1160	4996	file.exe	97
PID 4996 wrote to memory of 1160	4996	file.exe	97
PID 4996 wrote to memory of 1160	4996	file.exe	97
PID 4996 wrote to memory of 1104	4996	file.exe	99
PID 4996 wrote to memory of 1104	4996	file.exe	99
PID 1104 wrote to memory of 4176	1104	firefox.exe	100
PID 1104 wrote to memory of 4176	1104	firefox.exe	100
PID 1104 wrote to memory of 4176	1104	firefox.exe	100
PID 1104 wrote to memory of 4176	1104	firefox.exe	100
PID 1104 wrote to memory of 4176	1104	firefox.exe	100
PID 1104 wrote to memory of 4176	1104	firefox.exe	100
PID 1104 wrote to memory of 4176	1104	firefox.exe	100
PID 1104 wrote to memory of 4176	1104	firefox.exe	100
PID 1104 wrote to memory of 4176	1104	firefox.exe	100
PID 1104 wrote to memory of 4176	1104	firefox.exe	100
PID 1104 wrote to memory of 4176	1104	firefox.exe	100
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101
PID 4176 wrote to memory of 3648	4176	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3740
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6158eff0-e8ca-4f55-aaf2-2a257d23ab0a} 4176 "\\.\pipe\gecko-crash-server-pipe.4176" gpu
      4⤵
      PID:3648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2384 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4558e9a8-cbd3-42b8-9f94-85602b60cc27} 4176 "\\.\pipe\gecko-crash-server-pipe.4176" socket
      4⤵
      PID:3776
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2700 -childID 1 -isForBrowser -prefsHandle 2616 -prefMapHandle 3152 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d162c1f7-dc87-4e82-abf8-645c2e51dcfd} 4176 "\\.\pipe\gecko-crash-server-pipe.4176" tab
      4⤵
      PID:4312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3856 -childID 2 -isForBrowser -prefsHandle 3840 -prefMapHandle 3836 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50a07a1b-0c33-457d-976d-242ff427d90b} 4176 "\\.\pipe\gecko-crash-server-pipe.4176" tab
      4⤵
      PID:3732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4572 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4552 -prefMapHandle 4716 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f966e75-dfac-49ff-8e68-f96e6f7552d7} 4176 "\\.\pipe\gecko-crash-server-pipe.4176" utility
      4⤵
      Checks processor information in registry
      PID:1304
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5148 -childID 3 -isForBrowser -prefsHandle 5204 -prefMapHandle 5200 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9edf2c50-c117-4aa0-9f8a-fbdb2ff7ea75} 4176 "\\.\pipe\gecko-crash-server-pipe.4176" tab
      4⤵
      PID:5668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5360 -childID 4 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d84f3bc-9963-422b-8311-a8f2d7dc33c8} 4176 "\\.\pipe\gecko-crash-server-pipe.4176" tab
      4⤵
      PID:5680
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 5 -isForBrowser -prefsHandle 5584 -prefMapHandle 5592 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd6bc49e-4e5e-479a-a45a-66547e0c8507} 4176 "\\.\pipe\gecko-crash-server-pipe.4176" tab
      4⤵
      PID:5696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\activity-stream.discovery_stream.json
Size 21KB
SHA256 2a36e4ec6a35f5719bf3876117f5638f82ce2cf33e9ede4e58517a5dea1f6bc8
MD5 4d712438fcbb3ed9eb7fa7576e94ce8a
SHA1 647b4a02f32863fcf12c998100d2c943b8eba4c2
SHA512 ef0f51fc61ccca9b03546b1f760ac60549d4a4982018a3beb075c6ce2397696d884e6c7d25b5b3c6effb3555b96549067bd97c6ff8b3ac9a196044b7e2fcf101
SSDEEP 384:mVYPAZLw1gYoZwbEBtJsRmS+vqHD+UaCJyauMa7La7wG:m8UUy6ABzsRLtTaCJydv6wG
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 205d72a600c05c0b1afb8c92bb6d06e57a7fa4223d0dfa0cf13b608660574f06
MD5 40c0049b5be761061f53e7499f4639ca
SHA1 64ab2d2cf1dcba07ae7b4aa812361ab50270fff6
SHA512 4ab06d0546191c199d355cbe3ed856e4ef6318991862d4f9ebb395278d5ab685b765920366b8f66256371e82581888bf319165727a8b3c00ba4de1fe4537cac5
SSDEEP 384:H/w5Iu9fiGLm4pUGA+Q+4IYKgH4Zv+3yPrIVy8e6G8GO:8Bi8mCUGxQ+4INy4ZcyzIVy8x
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
Size 10KB
SHA256 51e8d2194a91ba502772649b1e9d2435a045d05d2109133dbcf4dd9c8fe0d94d
MD5 b903ec8fdbccd06480a247cabba120aa
SHA1 46c44b3a1ae9125417f083efe972cad948cd0c80
SHA512 8f4cd7eb3099a81f0f38de20ae9dd7b67d264100f55fd41b3a16cb2deb6c53bb85548c81231dfd3552c2c0bd07214384ca442e600d6c99c4ec91c6056c075ff0
SSDEEP 96:/95oajKbebVK8ibGebOJ8db0pebvpf+8db:/95XjK8eiu3
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 26ec085f85974eca38d04cf91f5fa6e54c60d690ddf7b8892b33ee9c43cf4360
MD5 31f2327de6d146563c3032db376fff31
SHA1 8a2becd7ef74d6804e401e6046fda2c4267bbeb4
SHA512 2e00ceaaa283708a4eeafeee4368c516dade358b01b71b1b1ded7a19d11a2ffd2d93acb5ab5f32c4a0b09270ca5ca6ec58930d3094b3a5c6e3688e5dc49b25da
SSDEEP 384:N7Qn/z7wMMqlRfvBWPvGimIK8EvW9bVbib6bNb1bsb2bvbZmRh3yDboSmPT/66Jq:an/3BRfYPvGimIK8EvW9bVbib6bNb1b1
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 dfdd3311067883b46ebf176b2468bb5171faee30d204fb0eeef8bbfca0ce2a9b
MD5 26f4b765fe8d656b879cbb62e943456c
SHA1 1721430f1e55098810d0660cc62e3394e1c59cb5
SHA512 b2ea12679d8e4cf299e238dae67a17270e096124723014a64430ccbf950e38dc98279bbf6e5c47df09568729f036c7093e18a08f5cbb6ba9c7abad4a31660567
SSDEEP 768:5E5bLHAf++DvGRZIK8EvHVbVbib0bJb1bsb2bvbzOdifNsJ:sbLg2zOdifw
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 3bdd78e909300b0b8e86c4f3819f77d5cbac4b88b0621ef5e388d5d7c001ebd0
MD5 8096c5d2e1171741e5cd3d5ae7fa1597
SHA1 7269edb8a71f9a6a281724cacdb690ee3524b861
SHA512 1d2f0839b1e0ea5899bf5b9967b50f56b08e53ede644357c395e86677d28affed4fd5876bf9c53bce1a55e8963a3289171ccc2696d07a7307e194629f43bc642
SSDEEP 384:c/66JozGzgC1bD7Qn/z7wMMqlRfvBWPvGimIK8EvW9bVbib6bNb1bsb2bvbZmRhT:5E2n/3BRfYPvGimIK8EvW9bVbib6bNbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 6f203c2deef86e442aa33d30b540bbbdba972c459c68082aedbe3716782f427d
MD5 b81d72b3c5740366d7561005695bdc0e
SHA1 2154052a716ecf7d6353753e385780cd85cbe09a
SHA512 5fae0ca525aabf4f6d5768514cff20bd2710b8a31b1db98e1634927bc38cd2b01c2f909a9852c4d931bc0a211b32250211091e7bf80c7a5a41deb2a8756494fc
SSDEEP 384:fboDmPH/66JozGzgC1bD7Qn/z7wMMqlRfvBWPvGimIK8EvW9bVbib6bNb1bsb2bV:DVqE2n/3BRfYPvGimIK8EvW9bVbib6bz
MD5 SHA1 SHA512 SSDEEP

Submit Download

2286aa3e-ecbd-499b-b790-fdf29edb3498

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\2286aa3e-ecbd-499b-b790-fdf29edb3498
Size 982B
SHA256 65d71b68a063f4ff0d236b620116b88710c8d79fde6556feec130d14fb2114c0
MD5 def0b6d691c7d058f72c261b17ba0f82
SHA1 04efab285b20e13c528265b920378e0ab6a74d05
SHA512 81181063bfbc15a79bdd542581e6c8d20b980a7cdb27409158411d76225e086fc1568813ccf04243240fc1f9010b11de6d58bb194ecdfb211a980303686d0372
MD5 SHA1 SHA512

Submit Download

238dd3f6-1990-4945-8e39-d1b3286662fb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\238dd3f6-1990-4945-8e39-d1b3286662fb
Size 659B
SHA256 126468f4327348b4cb75f076420cfaeb2ed0f2ab217e67df0d1c72fa8563ab3a
MD5 7c1180073a42e77ea753229b8aceb5a0
SHA1 315629eceb5e9e19de9a29e05ffb5cb6e2c0d4ef
SHA512 78d39e3aa616a8b68b98f4d68b93a9f0bc6e3b33ef2ff4c0df2c83d4d0396346c5d08b95ab4542d14216b56eac261d6ed7e13405001adaf5651343e97e6d8b6e
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
Size 12KB
SHA256 5b990060f4ab7655382bf80e43ed623c74bd4bd6778fc7f048bc8ce88eab2698
MD5 e72be57ac0a61531d9368538fea84a6b
SHA1 15a55c5941fccb7fdee5c6a20485225724db093b
SHA512 9e927553290668124079d53a371ec1dfa42c513d4d416463375b7140e6baf16177b0c4e5b8ee557ad2143c869d14663bd17cc31b2b8994fdac06c453415516c5
SSDEEP 192:y5nZRVpf2iOeqfUgSUsRt1udDyH8JRVkpaXJEVJJ7Bw8Hs:Kpdq8gm5UycJRW0EVxwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
Size 15KB
SHA256 28ff020955aa10a5335f7a76b405d5cf45e47cf3e1d117c76cc818b209b9069d
MD5 8c77d8ddaa481ef7e8342588e1a2020d
SHA1 01b0a7673ef4999ae0534b7b13b4ba4fdd7300e0
SHA512 c1863b80266886651873adca555025343e7ef670278a0756ddaf54643932b11cdf42ba316f3f8a6a4c30b1de60a059989b49ec12b91c07b0fa5629eea17b424e
SSDEEP 192:yinZRVpfoiOeqfUgSUsRt1udDyH8JRVkpaXJI+VJJQiBw8HB7Xluw:FpXq8gm5UycJRW0pVfwiN
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js
Size 10KB
SHA256 dee56ff9afc0d08e941888d5bf0bc1c8bcd5e04a33b32bf9da7489d0936e1fdf
MD5 d731f63ff24d134d964401f974e14caf
SHA1 2c85066c15416ff1d251547171f732671af4e302
SHA512 3328792388e4065eaa6e7df95017869c68f0aed15fef14921b008b5a5dc94d2967ba4e0a6dce54f50dc887e17deff43f6932de67df4aab85c9e71915a3d1f751
SSDEEP 192:X5nZRVpf2DZfVofAHBtq8prddx9y1ZO43jaX9VJJ/Bw8V0:HpSVoIbpd9y1ZOfVlwb
MD5 SHA1 SHA512 SSDEEP

Submit Download