6c4bf8dc2f2c1cccb9a2470f1610c11397fe168e55972eb0aaee7e77afd5d3d6

Analysis

max time kernel
130s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2024, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241103-ecsa4atgrf
SHA256 6c4bf8dc2f2c1cccb9a2470f1610c11397fe168e55972eb0aaee7e77afd5d3d6
MD5 c2647ed78c0ea89aef2c32aa4e0f7770
SHA1 9be41ba2467fc53a7eb5d34ed15bf11e392e89d0
SHA512 959c8a7f5ad8387200736043649c814ebd5948a25f0878d6d6cbb18396762959d13878a7002c2303abdab5a0fb54381aa3318529568717aff6c784a721d6abdf
SSDEEP 12288:1qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TH:1qDEvCTbMWu7rQYlBQcBiT6rprG8abH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1988	taskkill.exe
2312	taskkill.exe
3612	taskkill.exe
908	taskkill.exe
3984	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1544	file.exe
1544	file.exe
1544	file.exe
1544	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	taskkill.exe
Token: SeDebugPrivilege	2312	taskkill.exe
Token: SeDebugPrivilege	3612	taskkill.exe
Token: SeDebugPrivilege	908	taskkill.exe
Token: SeDebugPrivilege	3984	taskkill.exe
Token: SeDebugPrivilege	4944	firefox.exe
Token: SeDebugPrivilege	4944	firefox.exe
Token: SeDebugPrivilege	4944	firefox.exe
Token: SeDebugPrivilege	4944	firefox.exe
Token: SeDebugPrivilege	4944	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
1544	file.exe
1544	file.exe
1544	file.exe
1544	file.exe
1544	file.exe
1544	file.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
1544	file.exe
1544	file.exe
1544	file.exe
1544	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
1544	file.exe
1544	file.exe
1544	file.exe
1544	file.exe
1544	file.exe
1544	file.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
1544	file.exe
1544	file.exe
1544	file.exe
1544	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4944	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1988	1544	file.exe	86
PID 1544 wrote to memory of 1988	1544	file.exe	86
PID 1544 wrote to memory of 1988	1544	file.exe	86
PID 1544 wrote to memory of 2312	1544	file.exe	91
PID 1544 wrote to memory of 2312	1544	file.exe	91
PID 1544 wrote to memory of 2312	1544	file.exe	91
PID 1544 wrote to memory of 3612	1544	file.exe	93
PID 1544 wrote to memory of 3612	1544	file.exe	93
PID 1544 wrote to memory of 3612	1544	file.exe	93
PID 1544 wrote to memory of 908	1544	file.exe	95
PID 1544 wrote to memory of 908	1544	file.exe	95
PID 1544 wrote to memory of 908	1544	file.exe	95
PID 1544 wrote to memory of 3984	1544	file.exe	97
PID 1544 wrote to memory of 3984	1544	file.exe	97
PID 1544 wrote to memory of 3984	1544	file.exe	97
PID 1544 wrote to memory of 3988	1544	file.exe	99
PID 1544 wrote to memory of 3988	1544	file.exe	99
PID 3988 wrote to memory of 4944	3988	firefox.exe	100
PID 3988 wrote to memory of 4944	3988	firefox.exe	100
PID 3988 wrote to memory of 4944	3988	firefox.exe	100
PID 3988 wrote to memory of 4944	3988	firefox.exe	100
PID 3988 wrote to memory of 4944	3988	firefox.exe	100
PID 3988 wrote to memory of 4944	3988	firefox.exe	100
PID 3988 wrote to memory of 4944	3988	firefox.exe	100
PID 3988 wrote to memory of 4944	3988	firefox.exe	100
PID 3988 wrote to memory of 4944	3988	firefox.exe	100
PID 3988 wrote to memory of 4944	3988	firefox.exe	100
PID 3988 wrote to memory of 4944	3988	firefox.exe	100
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101
PID 4944 wrote to memory of 3484	4944	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3612
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:908
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d9290d0-6295-4a64-ac60-e4d5461396fc} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" gpu
      4⤵
      PID:3484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e94bee7d-984c-45b8-bc7e-6cec94931e0f} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" socket
      4⤵
      PID:1084
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1592 -childID 1 -isForBrowser -prefsHandle 3008 -prefMapHandle 3052 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4494c95-e235-46f5-9586-86394e5cc13e} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" tab
      4⤵
      PID:8
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3968 -childID 2 -isForBrowser -prefsHandle 3964 -prefMapHandle 3960 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ce2bf42-3a2d-4ddd-8c0a-c65717324b9f} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" tab
      4⤵
      PID:5108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4696 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4756 -prefMapHandle 4760 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b892c41-df00-4a16-8528-7e92482a4321} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" utility
      4⤵
      Checks processor information in registry
      PID:4940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5280 -childID 3 -isForBrowser -prefsHandle 5160 -prefMapHandle 5164 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {349677f7-00dc-4b6b-8715-d2e0dfce35d3} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" tab
      4⤵
      PID:5584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 4 -isForBrowser -prefsHandle 5412 -prefMapHandle 5420 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e4f2a6b-c6ae-40e4-961f-e7958808bf5b} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" tab
      4⤵
      PID:5596
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5604 -childID 5 -isForBrowser -prefsHandle 5616 -prefMapHandle 5560 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a65f2f7-7d72-476c-8d5e-4043c884698b} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" tab
      4⤵
      PID:5608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\activity-stream.discovery_stream.json
Size 24KB
SHA256 4b7c96df3019675ba5c8c561a1f22fc00d7ecf5c577afd0304051385e1b4a908
MD5 620a72c82902f9ea9dd1665899dee388
SHA1 a22d308ae88f2979021808d6e2a91aeb92baf3cc
SHA512 0ca083309345d8753bbf3f3be0d831310bdb3dfb12d7fe2791685e88da74e54eac77f7e6b913403f1e74eb9133e7e9974c2369187e327eeb6ab90487aaa77b8c
SSDEEP 384:/Woh6D2n4SvwRzrepVSDtAaWKyJ1Yp+GTiuzyaudJ4Lj5:dh6DeIqVWWRAAGumyddW5
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 246a79b41c0cc5154985a8964362c34ad02ae5cab35889aaa9cf7c602f348345
MD5 6c8e3334233623f0cfdb8942e95669dd
SHA1 60d0ac358a3b0cc337fc889158feedbca7b376b9
SHA512 ab981f9a521c3a04d2c5d05f3f6afa09b3320d03374850e6844768044ed71c3a758091eeaee48c38cdf7576f7641ac5fda893f70aae5d0ecbe3b3e31729e04d4
SSDEEP 384:H/w5Iu9fiGLm4pUJA+Q+4IYKgH4Zv+3yPrIVy8e+uc:8Bi8mCUJxQ+4INy4ZcyzIVy8l
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
Size 10KB
SHA256 12dda80762966fcf0a3086ffaff25a1569382d9098b839314eb62dbedffb6417
MD5 d4123c943c156075baaec0550915ca02
SHA1 2a9a4a0e8a58d775f8080d7db27fde3b873dc9b0
SHA512 81516cbf8e153c37e3c5a0fa56dc7576870a5a69d3f235eab9487601942c319abcb4d22bfb0b67af7c1ef97de56649a03ed4610c19733cb1a9f5c8415d077f77
SSDEEP 24:CuB1o+Fsh2F3LFKgu1xgRbapR5cOtuhMZTsJblLKxblsJbF0JxbnWKsJblxWKf+R:q5oG9cOzebVKxblebOJxbnpebvpf+xb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
Size 18KB
SHA256 1f275e70e543c6c643e260da0da96ee9e94849ecc0f32c5cc07388a0047ec82b
MD5 931b57633662a6642bddb96944d5ac9a
SHA1 f3e80655d020eb15182b835545f5479835c3ced2
SHA512 72e14dec22908fbdaba99187613f4b9f5c8c31c1bcdc57f87ea5685d1e232ff3eaa5cd6cf28c2c66cacd91843bedd875c6ebe55432e15e89fc954d95d33c4382
SSDEEP 96:65oGebVKxblebOJxbGpebvpf+ibfbvbWgbgz8bHbzb/brb/bLb:65Qu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 bea3cc80392f7a641b6f85f0edb42776913d4008ea017f3e7eba1d50d49576f1
MD5 ab35dd9d6c7536f110802ea5e568263f
SHA1 201a525926faa3c457486a188180ce311222def0
SHA512 192e870c15aa04962011658b282b0e76a0a7c2f55cfe87c72a16bd91c905ef1ca4c1843500a7cdf52020db8c533d1417b652b003e92609ab425ae18c4b8ce4b7
SSDEEP 384:x+ozpl/1PX43dbKP/0z84a8Ev6QbLb0bRbGbQbibnb9bmSSvEjU04/66JozGzgCs:xvp5Z43AP/0z84a8Ev6QbLb0bRbGbQbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 f5c0ca8cd548640e5077b8a3d4d868335008eda0693fe880b76460e6c8646dad
MD5 39d15966420ba65eade7aefbc4c84730
SHA1 9f83fe0cbb5918e55a6acc3eef9bfac172bf18a1
SHA512 3e61863b8145ce0022aa24f00e0088b2476ca08f69d2bd76c738dc4026740e08c9832d8beca33f71e6711bc105ec7a715a7b83a022e3dc01e868a7d8c53aaffd
SSDEEP 384:E/66JozGzgC1b7+ozpl/1PX43dbKP/0z84a8Ev6QbLb0bRbGbQbibnb9bmSSvEjs:BEtvp5Z43AP/0z84a8Ev6QbLb0bRbGbq
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 24KB
SHA256 ad5a859c4ccd338b05cf578c385ca8b588f7c2104cdf315cea31ff4da4b50c54
MD5 4bd9c526dbf5dcd1dc4f3e0c5b37e405
SHA1 088089d9a7d266f83e8bc0c5e59087aad8ff5b6b
SHA512 3400b4cefc632da47e2b5cd67398b51523aef52118cc8c834263911f48a2aaf9234b2f057f42e3ddbb15ce5679d0c6c5b14c0f4f1e1e434d5a1d91d4c23c792d
SSDEEP 768:NKkxGNAD/0xG4a8Ev8hbLb0bvbqbQbibnb9bhlELtoZx4CEm:NKkYvlELtoZ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

3c9514c8-c04b-481e-b1e0-3c8e9bf80bb3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\3c9514c8-c04b-481e-b1e0-3c8e9bf80bb3
Size 659B
SHA256 008efd7d531af1ea2cf7d55dd67e15584d5b482ab0d5c08bc7c491c071e47e46
MD5 e9c6b1c9e54bc67e8b14b3e464dd8003
SHA1 a4ab4666cf46d9b03be3955bf8529e7e5dc26db1
SHA512 731944c8f45e3970f3e46df1d20b3d1e153b63244f09d99f6666f7ab9ac5d349a307963b6ee421db4be3ff250e024265ae7158cebb57bf216b325cffb2081787
MD5 SHA1 SHA512

Submit Download

92c66818-c6fc-4aa5-a6c4-4b89d9f68a76

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\92c66818-c6fc-4aa5-a6c4-4b89d9f68a76
Size 982B
SHA256 81145961ba8fbb2d68f9d7f4653b7bd90cada694073bbee3fc0b8cc1094002fe
MD5 37737771761a93ee99385720f0b9d326
SHA1 18e2dadae824c60fb0163aa25499e227c6324fdd
SHA512 78c78cb08427e35bb8c0eae8c3f0170e46b2fcc5f12a29fc8db93872a45885293055d4c4d5f9ccddc6f4d85c490cac31d59e7dfd43f3560776303828c4cd5eb3
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
Size 15KB
SHA256 0271dabd6417302f45be88774de31787699162c75fce2ff90cd9ff549ad82e4e
MD5 77402ae6096905b8ea52e96603999f15
SHA1 26da03285017dc4103b793961c0fe9fa524d0e1d
SHA512 0cbfd3494fc67fa3b72b6fb4fe3bd2056c38216d608d77255efde91562aa81754ba1cbae3efc93d5310583f19b464c8533a74bbed196c3faaae1c0653277776d
SSDEEP 192:yynZRVpf2QrL5EI4Tq6XUTtQQddifnZY3haX2+VJJcUcC/5iBw8HKjx1aJz:VppEVqwrLVYUcC/ewxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js
Size 10KB
SHA256 9b96e0a9d8647fbc51f05526f07c68b0fc98fb7fcbdab025ddfabf055f7864f5
MD5 066e902e30e80bd595ed8ab61c07b6a9
SHA1 931881ae7849d9410d2a2a5499f0b1f3960a414e
SHA512 bae6f3c76a6597b480183378d26823332fdcc620bbb22331cd48806dc07c86d65f34cbd54953b1ee98b67341ec8664df798fca76798749b72309e654a0a8c08a
SSDEEP 192:X5nZRVpf2QrL5EI4Tq6XUTtQQddifnZY3haXKVJJ/Bw8HH:Hp5EVqwrWVlw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js
Size 11KB
SHA256 c047cef828b54d435affc06e66e653cf69c32b8289da09f66612a43cae8adbe7
MD5 864ff288d4e5ff1ac34b3cfb28daf4df
SHA1 651534e8c6723cf2d029bc5e90694c45b597fd4b
SHA512 962fb16c7cb759bdcc091dc4f961a9bbe300300571fb4af19bcea3b3253a04c4bb8edc71185939be7020cebb955870c9c3315529e05a9c5852e3bd70b4fef862
SSDEEP 192:y5nZRVpf2QrL5EI4Tq6XUTtQQddifnZY3haXKVJJcUcCf7Bw8HKm:Kp5EVqwrWVYUcCfVwC
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 904KB
SHA256 c02e3e29c0e02bca3a99d3cbfb1c11af1d2ec36d2af28b33e2190ed8eda536b5
MD5 8ebe08c92732132590dbe252f4acbc94
SHA1 1b9932e14a1d96be054330ce8e17985be2e6a77a
SHA512 2769a86288ca642720f8a008a585127f272b890964cbc9c1551f16fa108d8b12bf5fd2c4854a54942e671e57d4c824fd8e88b87fa7a6fa05a5ca7447e8969986
SSDEEP 6144:x7JS23m37393c3veHTPyImt7UtUY4gUPwez0Pu/elSPPhkCOtd1ZEvTHW1HmcH1j:ePyImtQmY4g0e
MD5 SHA1 SHA512 SSDEEP

Submit Download