cd92df8f4e794b2a9726bd306c5ae5d8ea96ccffe4a47e0167b83b2a1c56677b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2024, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241102-nd9q7ssfla
SHA256 cd92df8f4e794b2a9726bd306c5ae5d8ea96ccffe4a47e0167b83b2a1c56677b
MD5 84b44b430672e64bc28fc3a0d451fd4d
SHA1 037da8b24f244729168cf9d220c66e8b5349802c
SHA512 b62a07fbf72da72e95c6eec05503e027b168499e8060e01f059d9421625fc7c76c2343256e8eaa9a692f9b636070d68e251cb7c52945acb038d9c5eb81cc7258
SSDEEP 12288:YqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TQ:YqDEvCTbMWu7rQYlBQcBiT6rprG8abQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3628	taskkill.exe
4056	taskkill.exe
1244	taskkill.exe
2956	taskkill.exe
464	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1552	file.exe
1552	file.exe
1552	file.exe
1552	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3628	taskkill.exe
Token: SeDebugPrivilege	4056	taskkill.exe
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	464	taskkill.exe
Token: SeDebugPrivilege	4664	firefox.exe
Token: SeDebugPrivilege	4664	firefox.exe
Token: SeDebugPrivilege	4664	firefox.exe
Token: SeDebugPrivilege	4664	firefox.exe
Token: SeDebugPrivilege	4664	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
1552	file.exe
1552	file.exe
1552	file.exe
1552	file.exe
1552	file.exe
1552	file.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
1552	file.exe
1552	file.exe
1552	file.exe
1552	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
1552	file.exe
1552	file.exe
1552	file.exe
1552	file.exe
1552	file.exe
1552	file.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
4664	firefox.exe
1552	file.exe
1552	file.exe
1552	file.exe
1552	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4664	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 3628	1552	file.exe	84
PID 1552 wrote to memory of 3628	1552	file.exe	84
PID 1552 wrote to memory of 3628	1552	file.exe	84
PID 1552 wrote to memory of 4056	1552	file.exe	91
PID 1552 wrote to memory of 4056	1552	file.exe	91
PID 1552 wrote to memory of 4056	1552	file.exe	91
PID 1552 wrote to memory of 1244	1552	file.exe	93
PID 1552 wrote to memory of 1244	1552	file.exe	93
PID 1552 wrote to memory of 1244	1552	file.exe	93
PID 1552 wrote to memory of 2956	1552	file.exe	95
PID 1552 wrote to memory of 2956	1552	file.exe	95
PID 1552 wrote to memory of 2956	1552	file.exe	95
PID 1552 wrote to memory of 464	1552	file.exe	99
PID 1552 wrote to memory of 464	1552	file.exe	99
PID 1552 wrote to memory of 464	1552	file.exe	99
PID 1552 wrote to memory of 1632	1552	file.exe	101
PID 1552 wrote to memory of 1632	1552	file.exe	101
PID 1632 wrote to memory of 4664	1632	firefox.exe	102
PID 1632 wrote to memory of 4664	1632	firefox.exe	102
PID 1632 wrote to memory of 4664	1632	firefox.exe	102
PID 1632 wrote to memory of 4664	1632	firefox.exe	102
PID 1632 wrote to memory of 4664	1632	firefox.exe	102
PID 1632 wrote to memory of 4664	1632	firefox.exe	102
PID 1632 wrote to memory of 4664	1632	firefox.exe	102
PID 1632 wrote to memory of 4664	1632	firefox.exe	102
PID 1632 wrote to memory of 4664	1632	firefox.exe	102
PID 1632 wrote to memory of 4664	1632	firefox.exe	102
PID 1632 wrote to memory of 4664	1632	firefox.exe	102
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103
PID 4664 wrote to memory of 4576	4664	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3628
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0af1f947-43f7-4395-98fc-f944137ebeab} 4664 "\\.\pipe\gecko-crash-server-pipe.4664" gpu
      4⤵
      PID:4576
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93fc11c9-cccf-47a9-af6e-298617f82273} 4664 "\\.\pipe\gecko-crash-server-pipe.4664" socket
      4⤵
      PID:2828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3116 -childID 1 -isForBrowser -prefsHandle 3172 -prefMapHandle 2928 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4c69770-2b67-4346-9959-ed13873802ea} 4664 "\\.\pipe\gecko-crash-server-pipe.4664" tab
      4⤵
      PID:1888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4104 -childID 2 -isForBrowser -prefsHandle 4092 -prefMapHandle 4088 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ca7a355-a57c-4278-a6b9-da57b4cc738d} 4664 "\\.\pipe\gecko-crash-server-pipe.4664" tab
      4⤵
      PID:1128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4500 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4492 -prefMapHandle 2736 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9946012a-b1c0-4e49-a4cb-a4f96fda2ebd} 4664 "\\.\pipe\gecko-crash-server-pipe.4664" utility
      4⤵
      Checks processor information in registry
      PID:2800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5176 -childID 3 -isForBrowser -prefsHandle 5168 -prefMapHandle 5152 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9701da5e-f0ac-405e-9b9e-04f725d36466} 4664 "\\.\pipe\gecko-crash-server-pipe.4664" tab
      4⤵
      PID:5780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5312 -childID 4 -isForBrowser -prefsHandle 5320 -prefMapHandle 5324 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7be9886-50db-4661-817f-796cc0553187} 4664 "\\.\pipe\gecko-crash-server-pipe.4664" tab
      4⤵
      PID:5792
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 5 -isForBrowser -prefsHandle 5140 -prefMapHandle 5156 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e84d4cc-d0bb-46ab-a096-1d1fd0a60a02} 4664 "\\.\pipe\gecko-crash-server-pipe.4664" tab
      4⤵
      PID:5808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\activity-stream.discovery_stream.json
Size 22KB
SHA256 3417855862163ffa6decc99b28067a6736c8583f900d1596ce3c7de16570cbc0
MD5 6d88fc06156593bab66702d031f9dae8
SHA1 806ded8ae7354d4bf900bb2a5853c421a64e3775
SHA512 fd8ebf8edb014b357a5d61ecce5de29dec6674797a1d534e24deb604b9c2f94cb89a928cf62d917e200c5777b26810ba9f28eb40255d0fe7cfbef0c5126151f0
SSDEEP 384:byJ1i0Mp6TiuiV834BKBNacRDJNPXN9+xyau/3tptR5:26EuS34s3JQydlHR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 4f705e54a53a2a59683c66ccdba90a8d31858c004b5b03331b79c3e36bec3a33
MD5 2bcedfe3184a32415c4af3dbf8193862
SHA1 cabcd56cbafb1ca0903ed32d4065a01f6a4391c9
SHA512 da1a734b9351016116a2d118f059d59a311446ac7d864bac81fad6f8b2213bcb3075c533a574a55a0eaeec8feda45a1b97a3a2142c3cfbf83d31efc199180d80
SSDEEP 384:H/w5Iu9fiGLm4pUeA+Q+4IYKgH4Zv+3yPrIVy8el8X86:8Bi8mCUexQ+4INy4ZcyzIVy8gEV
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
Size 12KB
SHA256 d7cf1334690bcab983f065669eb78814fb1f417ed5f8d31419f239675875676b
MD5 1627da26b0a17ec229103017cb21deba
SHA1 00a5ca64d417fceea5eee6c168d73fddabeef274
SHA512 e6c33eccd87cca950031e13bb56f7fbbc7c71781f8925e12664224f45733a151f2ea09c161db10b7d972c13990043bc470440a036aecbe5fd2607250b9b5923e
SSDEEP 96:Z5oGebVK8bWebOJ8bapebvpf+SbMbkbNgbgzrb:Z5Hu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 cb6be897095965f2acb5919c1f8db8f9528fb3a313b88b9a5e8a5bdf978abc45
MD5 65dae0ab7110aac41b8d7aa4c0da27a4
SHA1 a5d48be35a2fc865798b036f94fb1e24628de78c
SHA512 56ab1fd91a05060193ab1594df3509f022a4a1d1ae28fc9c13c9117170328a6d7d26292f3e2a063a4aa82a37959daf30e902102c99fa596689f5c78ee4b949be
SSDEEP 96:bHQpbMsFl66JozGzgClKtmSS9CSMF9ZbkW6ShmdnaPP/PrWZ:+/66JozGzgCl6mSS9CrvZboShUMPC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 f803985a6acc191c8d87f62fb7cecd53fe63c630c675b8a5151e035f8c760d4a
MD5 e3f8ddd24771cc54247367db86fb5477
SHA1 ff8081bd173d174063f1dc69097c7ce6afa5c105
SHA512 9be67819642a85ac6438d7180390767f5bae70b241726926cfed88f1eb7a82d972387ebd7da1d07811450c420ea4fe89f6acf2462775e7b0906272b818328271
SSDEEP 384:+/66JozGzgC1baPJsQsYDbPDZM0ZbmbHrboFE/P8:bE4N/PDZM0ZbmbHvl0
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 e5de1eb9f4c6ff6b52f5cc768e306af04c0793b7eaa6ea79f4e672db309aec45
MD5 7e65d6f886d2e32f9b5ab5b7a8e539f9
SHA1 af02fbb496d9b3d9e7be774febb49942cc2b7481
SHA512 5fafeac43d4aede74a2e32d951b40b1976e3b9dc78af8db7f8bbd61b77c03fa808f5df92338613e46fe4ac60a28a049e01c4e62e682fb5b388eed63e9509bddd
SSDEEP 384:gPJsQsYDbPDZM0ZbmbHqboy/PI/66JozGzgC1bM:EN/PDZM0ZbmbH+NtEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 87f970d0e38c5fd6c65c4a0aeca2a0eb5f007e56bd810e92a7822423edbc2f7d
MD5 0f8c269ae5f57551d1c203d56aa35354
SHA1 64c1c3ce38236fe3b1a2f8aa3eb6f78e83236fad
SHA512 ce60fe8a03af209749ab46d172eda488f0a03bed3dc7f45bd1869bf5c5942501caabc6b7a4c99cfded3b90c9c7e851dca2ed659be7e95a84e6b2c0f936d9f98a
SSDEEP 192:nCrvZboPUKhrMPD51/66JozGzgCl6mSSM:cboF6Pf/66JozGzgC1bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

167ac5a3-0486-4f92-97b8-c35b5ebb057a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\167ac5a3-0486-4f92-97b8-c35b5ebb057a
Size 25KB
SHA256 758ee91591bdfb7d56ed3073bf2aa269dfd5293cc11cf0cdeebb73aa5067df29
MD5 4dc3a9d3050d2812385ac03d0a0a15a4
SHA1 9af0287249d89c7fadbd535ad68d8dbf728f57f1
SHA512 264188d68293d938609daf505e2f8b1ec2c957c1b8a31acb578d12a9977363d51fa6ed5594c5efe1ed726a8f522341ef332a06774ed051ff43490a698258a7be
SSDEEP 192:JJfcabAiCIpCzu4ZcRj9bFJLAIFZNlWUt9MgIf1vV6UWZ8sMIEWOeZZjL0g08Cj3:JJ7K2j9VL3qc6WyRlab7pgla8OOfjv
MD5 SHA1 SHA512 SSDEEP

Submit Download

78f01edd-1e20-4682-aeee-22896b1b6500

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\78f01edd-1e20-4682-aeee-22896b1b6500
Size 982B
SHA256 030d88de02887721c26e3418359d124d15bae9a514bc8fe08c1db2c114ce93a4
MD5 32d35d02cfb51e2eb96d1d0d8e688c02
SHA1 c8ac0ea46545207f1244463923f9c058acfb1cc4
SHA512 d4c01bbec5dda81d926f5357cc0361502c8631e78b11296fd577239084e0e07554511b3d22e0e09da152a89d539caf7a1adf8c5516062acdd3e67da796cbb450
MD5 SHA1 SHA512

Submit Download

eb076bb2-0951-474c-999a-a6ef6d85260a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\eb076bb2-0951-474c-999a-a6ef6d85260a
Size 671B
SHA256 f1ca19ce88822075c2328fd8f00a25a5b5c126187bf8271ce6f45dd1b94c8db2
MD5 539d8a9ed53409fbd5af4f5d37b3d93f
SHA1 a81210f4191d77adef2468fc535fe3002ecae255
SHA512 2df9984bb4011c3ac9358be40acb7bd6c4f5503c21be6723892beb536e3b231355b173dc1c63fde279ad9fb16244553628a2ffa31e0a271c5c964da3f832df5e
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
Size 12KB
SHA256 3a24e1e3ec0de9b94c27509232c4b412663c8c9b5f12cf36413904e4ace9615a
MD5 da054ddc182e601f0f3ec5d059391852
SHA1 062737cd454142a3cd50f6add2aab308f6312e90
SHA512 d37923d5ff8216c8c098136ef0d3c28cc169a9c191d4c18d19c8ceca2db943e05338415ab26c49d888bffc0ce488775b2134cbaac45f0be03b8ce323f2ce6aea
SSDEEP 192:y5nZRVpf2XjiEI4wZ0BtFid0/t6/aX/VJJiBw8HIWiheOhDeP:KpJEuZETkiVkwvWiheOhDeP
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
Size 15KB
SHA256 503ab4a05d238832da210d0122685e0456d2029e9e7e6467c3dbc8fe7ec70611
MD5 32e6784cd7687e2bfd67c3f6b1cb660f
SHA1 d84e7e27f4ed82fe6865f70b3340340232d3d4df
SHA512 19b72c812aef3a41b9b132708a932d47dc2e29a395cf45ea29ebf1b88328ff346bd4eeff485a7a3516850c883cc2da68807ad2c0eec2fea58b1567a16cd4d458
SSDEEP 384:ZpvEuZETkfVHwBWi3MP7h5Je6ZOu26hDU3fqthG0eezNWcfU2eZ7:ZhOwf+Wi3MP7h5Je6ZOu26hDU3fqzG0q
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js
Size 10KB
SHA256 306f8ad503bb280ce01c9c5b7d864c392e6af6d3ce8c9f5bede7ec079799b03c
MD5 eed85bdb037c2cba4140d2c06c8a9fa1
SHA1 0aabc115b50335239fcb97235bf79022b375b375
SHA512 49bdcede5724ead44076caf407f9f1ba0df6e274f056ccd12163ca6271f1952c0ced84fedd943bd6b7f14c5afb0113a698f943d4675808de6fdb105761b18f76
SSDEEP 192:X5nZRVpf2DZvEVofAHBtq8prddx9y1ZO43BaXXZVJJ/Bw8Hi:HphVoIbpd9y1ZOvZVlwH
MD5 SHA1 SHA512 SSDEEP

Submit Download