0d4675e241b3768cd9fb7b24c9afcf1dcbd73b6545e067c7e68081f6691ce64e

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2024, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241102-kr61pasphr
SHA256 0d4675e241b3768cd9fb7b24c9afcf1dcbd73b6545e067c7e68081f6691ce64e
MD5 f5cf17697d03261de33ccc85879505ce
SHA1 5f9f3eb0d110387e2bd29d83bc77f9d445d74595
SHA512 ea6f6e1febf57ecab347bac0fd93c68d62304b7e2997ace8c6c05dc547bb3bd961c869e24a0e62f01de81ae2aff7e3535cf2c22870e22cf9c3e7de3b0518a3c8
SSDEEP 12288:4qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Tz:4qDEvCTbMWu7rQYlBQcBiT6rprG8abz
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1136	taskkill.exe
4648	taskkill.exe
4512	taskkill.exe
1740	taskkill.exe
2324	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1728	file.exe
1728	file.exe
1728	file.exe
1728	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	taskkill.exe
Token: SeDebugPrivilege	4648	taskkill.exe
Token: SeDebugPrivilege	4512	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	2324	taskkill.exe
Token: SeDebugPrivilege	4092	firefox.exe
Token: SeDebugPrivilege	4092	firefox.exe
Token: SeDebugPrivilege	4092	firefox.exe
Token: SeDebugPrivilege	4092	firefox.exe
Token: SeDebugPrivilege	4092	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
1728	file.exe
1728	file.exe
1728	file.exe
1728	file.exe
1728	file.exe
1728	file.exe
1728	file.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
1728	file.exe
1728	file.exe
1728	file.exe
1728	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
1728	file.exe
1728	file.exe
1728	file.exe
1728	file.exe
1728	file.exe
1728	file.exe
1728	file.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
1728	file.exe
1728	file.exe
1728	file.exe
1728	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4092	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1136	1728	file.exe	84
PID 1728 wrote to memory of 1136	1728	file.exe	84
PID 1728 wrote to memory of 1136	1728	file.exe	84
PID 1728 wrote to memory of 4648	1728	file.exe	92
PID 1728 wrote to memory of 4648	1728	file.exe	92
PID 1728 wrote to memory of 4648	1728	file.exe	92
PID 1728 wrote to memory of 4512	1728	file.exe	94
PID 1728 wrote to memory of 4512	1728	file.exe	94
PID 1728 wrote to memory of 4512	1728	file.exe	94
PID 1728 wrote to memory of 1740	1728	file.exe	96
PID 1728 wrote to memory of 1740	1728	file.exe	96
PID 1728 wrote to memory of 1740	1728	file.exe	96
PID 1728 wrote to memory of 2324	1728	file.exe	98
PID 1728 wrote to memory of 2324	1728	file.exe	98
PID 1728 wrote to memory of 2324	1728	file.exe	98
PID 1728 wrote to memory of 2988	1728	file.exe	101
PID 1728 wrote to memory of 2988	1728	file.exe	101
PID 2988 wrote to memory of 4092	2988	firefox.exe	102
PID 2988 wrote to memory of 4092	2988	firefox.exe	102
PID 2988 wrote to memory of 4092	2988	firefox.exe	102
PID 2988 wrote to memory of 4092	2988	firefox.exe	102
PID 2988 wrote to memory of 4092	2988	firefox.exe	102
PID 2988 wrote to memory of 4092	2988	firefox.exe	102
PID 2988 wrote to memory of 4092	2988	firefox.exe	102
PID 2988 wrote to memory of 4092	2988	firefox.exe	102
PID 2988 wrote to memory of 4092	2988	firefox.exe	102
PID 2988 wrote to memory of 4092	2988	firefox.exe	102
PID 2988 wrote to memory of 4092	2988	firefox.exe	102
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103
PID 4092 wrote to memory of 1608	4092	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e76fbd6f-3d5f-4333-bb36-77856da4681d} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" gpu
      4⤵
      PID:1608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2400 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5171b4fc-1b36-4a54-91f6-d388dc4655d5} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" socket
      4⤵
      PID:4756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3060 -childID 1 -isForBrowser -prefsHandle 2920 -prefMapHandle 2904 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4526c42-c4a0-49d7-885b-f2107e7d221e} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" tab
      4⤵
      PID:2852
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4152 -childID 2 -isForBrowser -prefsHandle 4144 -prefMapHandle 4140 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b68c91b5-1533-4c87-929b-8e5ce267d1ce} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" tab
      4⤵
      PID:4332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4888 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4880 -prefMapHandle 4876 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8b1a9c2-faae-4a22-a4d1-c20aa451bc06} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" utility
      4⤵
      Checks processor information in registry
      PID:5360
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5444 -childID 3 -isForBrowser -prefsHandle 5480 -prefMapHandle 5476 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24f4ebdf-0058-40aa-9551-fbc5ec4daa55} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" tab
      4⤵
      PID:756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5628 -childID 4 -isForBrowser -prefsHandle 5704 -prefMapHandle 5700 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11d9aecd-48ce-4b6d-a929-727983855e68} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" tab
      4⤵
      PID:3348
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 5 -isForBrowser -prefsHandle 5908 -prefMapHandle 5912 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4d4cb69-e6d0-46ce-99a0-ca716fb33c60} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" tab
      4⤵
      PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json
Size 24KB
SHA256 47b79da80d5649419d4a6c5924a97a9390630f1bb95ef08a7bdfc18f69f1293c
MD5 b9e263f3bbe015bcf4afb32647863baf
SHA1 a2c09fbce780d2d1f69cfea73cf1337ef0f96504
SHA512 47c102cd6c482788a1107fee0851fa5b6b95e2cd95b4c591a5dc8de4d1de34319e1a1a0dfd060a211bceb1e2236c4727584f38cb5ac4783cbbd9d32069e301dc
SSDEEP 384:syJ1L0kUTiuNcMCp6n2D6Ki7F4yaunl5lDdnnknp5:PuuUC0naVydljDdSp5
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 44cd6f65b7e607d3e80726f8f7a4c8b2baf5d46786d2f66deda8cb33b02e2c95
MD5 5f3b3780054649e302d3f95474c05f2d
SHA1 87c553c1af132192799761441d6ee72385a9ff7f
SHA512 922b577940020bc6b3a3264d740c96d80f870474904550bbb3f8f8cbfe7d3d30c27caad137a52ddb8a85541ed9820bc4da3b7c8a6996791b67eb7a8c9c770c29
SSDEEP 384:H/w5Iu9fiGLm4pUgA+Q+4IYKgH4Zv+3yPrIVy8eZZs:8Bi8mCUgxQ+4INy4ZcyzIVy8N
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Size 13KB
SHA256 b28d3b065ccba961cf24363b0de8333d15dcf3f5f32225b8d0d620781f184899
MD5 266e4f1bad191c3f04b4a6d7397758e8
SHA1 9dd9af188b07823e618307c0edccf4f3e4837bba
SHA512 3af84b6f837402fd1e080df31b571dddb9b2b0d5f264734866947202135c3d9266c1aff27148c5d509b895b6587fbc355fcccb29577f5a5f978b411f19c824c4
SSDEEP 96:f+5oyebVKJbRebOJJbjpebvpf+Jb0bAb1gbgzrb4bsb:m5hu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 b59d71a68e59854c517a63527df06d114fed001cdc18635eaf3c0385269be147
MD5 c304430404e80d04556953fb4249a58f
SHA1 9a86404b98a1d1567fc2b23b56871fb2bda8e3fc
SHA512 5e23a7be5d401e7890ae2ae946197af47a2556487eb7ccf6133dcd3d0d1a69dbd38dd15da1126ca08d253960338d93ce6cbfdc8424afec84b313540a13638c0c
SSDEEP 96:322QMT0BFl66JozGzgClKtmSSPSMF9ZbkW6Shm9SPP/PaxvWZ:36/66JozGzgCl6mSSPrvZboSh4UP0O
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 8e1360691bcde33c97d2a6778b0453281901cdae0aec951cf520d0286a239e36
MD5 0d586d1b2dd0a553b8fe9963e84d46e6
SHA1 b4cd7f5f7b7078a82cb3d70a7841849633baeaa2
SHA512 731788a02df9b5bff7f9e1c764ce40191eae725355e9a7ebe512d3454524b07874cc96482b1116ad3e2f01cf9b95c6a2c351c00f8b7b101d589f0f0c9a07c904
SSDEEP 384:9bofavzPK6/66JozGzgC1bMk0kueWbDVWjxbKbXi:9Ji3EZ0XeyDVWjxbKbXi
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 e75d2c644d99e955d45057d842e619c65a60db6fbc49b4dc094d9e7348b6be6b
MD5 5732b4bd91f9f633575de926bf49dbaf
SHA1 bb965dc15ed600d208636c4ebb34bf794143567e
SHA512 0cf7f1d950d0344db56a09592beda9fcb8ef8393a56e102c2196beaaf6abca3e499c307d6ab975bbc1409dc323b0bf0e679aaf661acb44a503b83b1d0c8b4222
SSDEEP 96:+22QMT0BFl66JozGzgClKtmSSbSMF9ZbkW6mhm9SPP/PhxnWBg:+6/66JozGzgCl6mSSbrvZbomh4UPDWq
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 349dd8dd337bc44580e3b15831f2a06115b7d6da92fbb3ace544cd88c35f87bc
MD5 b7129acf3a8cc08ab191696527503a4f
SHA1 665a0cffa4f44d55252fe8f55e06543c8a46bf4f
SHA512 c3b0dea72912a28cd87ab0afd4f1fb71e256012997b9db62449e0d7aa4bc45cc0372b417d150d1c2f62cbb38a5bc86b31173d9e17ad32d37794abd5131a885ee
SSDEEP 96:322QMT0BFl66JozGzgClKtmSSS1BaSMF9ZbkW6rBBnhm9SPP/PhxnWB:36/66JozGzgCl6mSSfrvZboPnh4UPDW
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 1560a38c49ad2379a168566669001bd44e39972669324289ee68b287fe7ab4d0
MD5 ca717301fe34fe1801628645926368d5
SHA1 77b88d5b155977f19ca94457514db0c71668c252
SHA512 b6b29e418cc06da6c839c9d1c6546a04297cb04feeeec5506e95ea0a104432e510f3b2d6f214db1542abac666711ed061edddc0d8a0a427ced0ab0ad9bcfe401
SSDEEP 384:36/66JozGzgC1bMk0kueWbDVWjxbKbX0boCvzPL:33EZ0XeyDVWjxbKbX8hT
MD5 SHA1 SHA512 SSDEEP

Submit Download

282912a4-7d68-457a-b939-f1327426745a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\282912a4-7d68-457a-b939-f1327426745a
Size 982B
SHA256 3649daa405fca162a95ac4c74a2b276478236898782254e3d9ba10ed205e4678
MD5 23ce323c2e2ffa48e7b5f423774a7cfa
SHA1 6f184b23e89f964ea297bf9a5c31ebdcd685f709
SHA512 04959b401919246cc5ce5f4c0ecd5df39ea727b52d9a1822426004c847e4381db1aebbe78297b80e97b13ea767bab2f22a5dad047d1b47081ffe749c8c19ba60
MD5 SHA1 SHA512

Submit Download

2ba2e295-18fc-48f6-8359-67a40756ab64

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\2ba2e295-18fc-48f6-8359-67a40756ab64
Size 27KB
SHA256 9d083db14c8915649ceb0cfe7f6290b78c3c91255116d6376684407a9369c2c1
MD5 77c3ecbbc6414fd2ce99c2d487f32558
SHA1 0a89c3074c93b135f34e9be4b6568321c78a7a8e
SHA512 a55be5c9f23d0cd96c362c074be55f630130a10e577f1d5f50dd91429531be710ecb4db9bf7bba09c340021c8294794635eaf917a27f28ba3fb89e1e645afeb3
SSDEEP 192:Q9XzOXGzSLkSrRu57P3zjQXBpS/2eZaFH1FKiAUCo4pso8dMEc0dEojC8S8rINUU:QRzhmoSrRu57t7hRp9VZu55pEod1o
MD5 SHA1 SHA512 SSDEEP

Submit Download

f485bd9d-fa6a-4b20-8dd9-a84e59359eae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\f485bd9d-fa6a-4b20-8dd9-a84e59359eae
Size 671B
SHA256 8cc7b83042bb2d941d925eb1ecdfc1ec43593d641eaba774cf413126afdef3ef
MD5 e938c1e23eb61d0ae96b7b7cf94af56f
SHA1 2dcd0f928a57e9ea549930795bbdb041e161cd5b
SHA512 da7b472b848270bfaed2438cf4d4f992fab02b487a819c740a1019eb0159f94f862963dc634bde09a0d8e2f125c225e61cde110318935fdc8d505ff647aa876d
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
Size 12KB
SHA256 970e9620af095235918fd19d9344fc86fd7a8b52436321cf95876ad91d5685d7
MD5 7ce779ca95cb5f5cac26e0ad10f361ed
SHA1 f43e3283163d68a06c24d83bb82270c17b083de8
SHA512 098928f6eb5aeb9b72a7c20cd87c1236174ca7b97b65912e934c0921f9d096ae3bc3fce56e50f66b28261c6d64446c83c10c559a88e07977c40f7fd643885881
SSDEEP 192:95nxlR1fqZoEK8I4g7BEctBfdd5VjnT3eaX6jaBw8HY:Zd98m7BRBBnicwH
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
Size 15KB
SHA256 31b26773886e408b276c17f95b3cafc2c3c1e83e1eca5fda343307d0b7612496
MD5 74daa493490e8af3b2048d7a781d500c
SHA1 b498a81304ef9700a53ca266c72f0965e1d57b4a
SHA512 6c0319b3d0ec8e9d282da916d3a538ce42a63536eec58d400fee5ac747b01ed78fc314af37fb900c56b012b9fc8f9f5d04baf8e47612770c7e8353f92418dedc
SSDEEP 192:9GnxlR1foZoEK8I4g7BEctBfdd5VjnT3eaXm+jeiBw8HhbHBCB:udT8m7BRBBnfJw2E
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
Size 10KB
SHA256 587bb95dd3c97012278210368c6628c014ac1c009bac60ecad27c582ce448d4f
MD5 45fd74cfae9c434c026ab11c62676c00
SHA1 722de77bef76efefcdcf801965fbaf0aa4f8bdee
SHA512 1d71f71741b1809ae6899aecf8e13023980c5dfec06c6a928efa05d68aa9fa9649cbbbd0fca2bc25f10506440bfc3f252f8657a6de6d7b8b8976251aab06dd30
SSDEEP 192:S5nxlR1fqIUGVofAHBtq8prddx9y1ZO43maX5jABw8Vj:wdBVoIbpd9y1ZOKaw4
MD5 SHA1 SHA512 SSDEEP

Submit Download