e2ff5820134e0a7ff1f2a4ca338ea9c2c3f14c83aac0bf67fcfc7b0845cd8be0

Analysis

max time kernel
135s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 901KB
Sample241117-13ch8aypgw
SHA256 e2ff5820134e0a7ff1f2a4ca338ea9c2c3f14c83aac0bf67fcfc7b0845cd8be0
MD5 1b00404c428ec7fefc700afb119d3bbe
SHA1 eb279e9bc49d3142a64c848ba3fcbcf8127b9e5b
SHA512 6c7e9e85ea6a12597f6e182c7626fc6474258bc008b63e831ac3d835d1cee97018a7ddac948f76d2e0831e72b2c28e3d5c2a23efa2200f1587a92094f2be5288
SSDEEP 12288:7qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4Tr:7qDEvCTbMWu7rQYlBQcBiT6rprG8aAr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3004	taskkill.exe
5080	taskkill.exe
3752	taskkill.exe
764	taskkill.exe
1800	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4156	file.exe
4156	file.exe
4156	file.exe
4156	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	taskkill.exe
Token: SeDebugPrivilege	3752	taskkill.exe
Token: SeDebugPrivilege	764	taskkill.exe
Token: SeDebugPrivilege	1800	taskkill.exe
Token: SeDebugPrivilege	3004	taskkill.exe
Token: SeDebugPrivilege	4840	firefox.exe
Token: SeDebugPrivilege	4840	firefox.exe
Token: SeDebugPrivilege	4840	firefox.exe
Token: SeDebugPrivilege	4840	firefox.exe
Token: SeDebugPrivilege	4840	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4156	file.exe
4156	file.exe
4156	file.exe
4156	file.exe
4156	file.exe
4156	file.exe
4156	file.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4156	file.exe
4156	file.exe
4156	file.exe
4156	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
4156	file.exe
4156	file.exe
4156	file.exe
4156	file.exe
4156	file.exe
4156	file.exe
4156	file.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4156	file.exe
4156	file.exe
4156	file.exe
4156	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4840	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 5080	4156	file.exe	86
PID 4156 wrote to memory of 5080	4156	file.exe	86
PID 4156 wrote to memory of 5080	4156	file.exe	86
PID 4156 wrote to memory of 3752	4156	file.exe	92
PID 4156 wrote to memory of 3752	4156	file.exe	92
PID 4156 wrote to memory of 3752	4156	file.exe	92
PID 4156 wrote to memory of 764	4156	file.exe	94
PID 4156 wrote to memory of 764	4156	file.exe	94
PID 4156 wrote to memory of 764	4156	file.exe	94
PID 4156 wrote to memory of 1800	4156	file.exe	96
PID 4156 wrote to memory of 1800	4156	file.exe	96
PID 4156 wrote to memory of 1800	4156	file.exe	96
PID 4156 wrote to memory of 3004	4156	file.exe	98
PID 4156 wrote to memory of 3004	4156	file.exe	98
PID 4156 wrote to memory of 3004	4156	file.exe	98
PID 4156 wrote to memory of 4640	4156	file.exe	101
PID 4156 wrote to memory of 4640	4156	file.exe	101
PID 4640 wrote to memory of 4840	4640	firefox.exe	102
PID 4640 wrote to memory of 4840	4640	firefox.exe	102
PID 4640 wrote to memory of 4840	4640	firefox.exe	102
PID 4640 wrote to memory of 4840	4640	firefox.exe	102
PID 4640 wrote to memory of 4840	4640	firefox.exe	102
PID 4640 wrote to memory of 4840	4640	firefox.exe	102
PID 4640 wrote to memory of 4840	4640	firefox.exe	102
PID 4640 wrote to memory of 4840	4640	firefox.exe	102
PID 4640 wrote to memory of 4840	4640	firefox.exe	102
PID 4640 wrote to memory of 4840	4640	firefox.exe	102
PID 4640 wrote to memory of 4840	4640	firefox.exe	102
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103
PID 4840 wrote to memory of 4336	4840	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5080
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3752
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1800
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e993946a-8f60-42c0-b0a5-f7504cc45a2b} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" gpu
      4⤵
      PID:4336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2384 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d96a80bc-800d-41b4-98e6-f1a98f57a9ea} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" socket
      4⤵
      PID:1692
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3176 -childID 1 -isForBrowser -prefsHandle 2820 -prefMapHandle 3288 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d15816c-8ad0-48be-b34b-cfea73fef812} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" tab
      4⤵
      PID:2804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3920 -childID 2 -isForBrowser -prefsHandle 3912 -prefMapHandle 3908 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdc2b107-c44c-4352-9112-39e98c40d13a} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" tab
      4⤵
      PID:1756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4728 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4768 -prefMapHandle 4764 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47f3f22f-5cd8-4650-b878-f85c865ffd42} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" utility
      4⤵
      Checks processor information in registry
      PID:5124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5064 -childID 3 -isForBrowser -prefsHandle 5060 -prefMapHandle 5056 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d7ab86b-8a84-4270-aab0-3a2b353dbf07} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" tab
      4⤵
      PID:5484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 4 -isForBrowser -prefsHandle 5368 -prefMapHandle 5364 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e85b60a-9373-4221-9e01-89bff5cd3a45} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" tab
      4⤵
      PID:5504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5372 -childID 5 -isForBrowser -prefsHandle 5356 -prefMapHandle 5436 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95095216-2ca3-49dc-bcd4-45060ecb7e8f} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" tab
      4⤵
      PID:5536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\activity-stream.discovery_stream.json
Size 19KB
SHA256 f7876c91050db8a34d34ee0bcb9f9d4ef1dedd83ff1360b5d7e9a78020775542
MD5 285823f1eea57d729bc409a7287946d3
SHA1 4d5bfb413ab3fd858fa61062575f6cf372051217
SHA512 3c0d4a35030a604a06ea6aecb96251a521f4b77504764e2789af717dc800f3dc411e4b3b0affcf900019037416486f319232ac6692d7357f2ce266955a7c64dc
SSDEEP 192:zXWSvwNwqmDomczE9LHwkTiaijPnU9/cDxqfhcxQeo5ECSa+rxtb5ZbrAQLpP5E+:KOzVQB0u2qlTFZvOiRbEagyaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 385c932b7d60cafe0c8df75dae1f21261abcde25ac60b195c1671558e7cda463
MD5 83b565eb834a37a6bb5e64352e84c994
SHA1 778554c63ea0686ea9b6327f22384cee745d9c58
SHA512 2ab49c69fd90db3179881b81900588755e2a1a44df32b87ffb4fe80484d2015e043737f010b7ae989fe4f85e2170661750c1d58988d9d929df9d3f5844b987f6
SSDEEP 384:HfNIu9fiGLm4pUDA+Q+4IYKgH4Zv+3yPrIVy8e4G+:llBi8mCUDxQ+4INy4ZcyzIVy8v
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 8KB
SHA256 76e48fe503bd6cc3f2ff293a0646c2509859db2bf48ee5e82bfca8c64a8b774a
MD5 e9fb96a9945731eca2957c6f5ca18a9e
SHA1 7a2be14d00cfc4d2b522fde7ee0706b1837e99f4
SHA512 f45d75aadf1459275ac4c42c1b0e211c29935114d856d1b91a85cb592faa581cd055a7f89dbd26b2adeb6fd8ebc536279eb509681df1e518061364a15a44ef9f
SSDEEP 24:5uB1ooxgu1xgRbK5pR5cO1uhMZh2Fsh2F3LFA0LsJblLKmbT0sJbF0Jmb:q5oC9cO94ebVKmbgebOJmb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Size 12KB
SHA256 b00173510a1e57206b1b8e3f03a3446b365f3eadbe737be848ca36cb01b239ba
MD5 ddfb1f71e8f2908e1095a242d9a91636
SHA1 5a18298b5649b3c99fe5558ad5ff0b5406ceaeb1
SHA512 665251674400dbdab377ce9f8c2732558cca305699ace29f6bb84e36b050e65d38bc208d01c81c4e6599cb5a61180ddd7ee2a3e26a5f3418f5648c256fdb15ac
SSDEEP 96:q5oW4ebVKmbgebOJmbrpebvpf+Fbrbnbqgbgzkb:q5NHu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 f0e19de858148fc9841fa805373456f8f1d2a0583c2992586c6862ce83bdc942
MD5 50c7839f11bcff5ef29188067e2085b1
SHA1 5d2412805e65bc1e26c45d15f543ff295adfa207
SHA512 2224d615c140d5e3456a9392577be283d8fba24548331a2e694df7d355fe0d4ea0e19cf19eb198b2158886d7e19d1f644b4b68684824fc02a6b2aba424a3b05a
SSDEEP 96:NgSMF9ZbkW6Shmu2PP/PrWZDxQQIwY1INOIhIlFl66JozGzgClKtmSSM:NgrvZboShn4PCSpCNdml/66JozGzgClY
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 876ee183c01c08a472fc6450743c21d549fe669d15617fd9e0e862888a03d85f
MD5 26f0d4de45619700ee3676ae44088769
SHA1 eadae89f01ca46151cb0b663280f01b32c80ed33
SHA512 e3131ea3c93d63a54fd66d1c9a53efb45b73fb93d22ca0a8fd15f9e13b213349bebf600d6a1652a35bd9c3c4b3e782898f05f6a04da74d08173b4946321aa00c
SSDEEP 384:nu/8kNU7izDvf2KbzbpZbolr+PJ8o/66JozGzgC1bM:9QMmDvf2Kbzbp5vx8VEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

544a1a1c-a827-42cb-83bc-1926f8268fc1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\544a1a1c-a827-42cb-83bc-1926f8268fc1
Size 671B
SHA256 1bf89d238b58942dba2279999e2bad007eb51cdce1ccbd34bfdb3d2dd68171c8
MD5 2d8549a77214f612ebe5a64e34c75e06
SHA1 abd01c12c091a69cd12ccc954fb7422502e7471f
SHA512 20142f016e9ac8b25d7df8ae5e489c65179bf872e23c17179a2d265c651322940b34cde94780ad6f7f9e4b2584d3d699570be8a705ad9ce8eb9019093ef48bf5
MD5 SHA1 SHA512

Submit Download

60867e29-ddc8-4787-81eb-baea8055b835

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\60867e29-ddc8-4787-81eb-baea8055b835
Size 27KB
SHA256 21c7315e8b2bd27245236bbb834e8bf819ba948b5a04e268f9dc4dca085bbba0
MD5 d1db7662b9b07ba0dbe549a812a45199
SHA1 9389d5cb53ffb0a2a66605935ea5d7dc415d8b34
SHA512 3bfee2c49f444f616518d40c08636a09538d1722abe0067b0e6d5e9cc4d645e013182c8aadb403de99f44b4affc089073cc0322f6f0fc0912eafcd92420ca3fa
SSDEEP 192:pZg7oGRWJ2juPpjFVLdWYXTNW0awJBrlZsBNF+wWq3yJtKU5rJYB0sg5yjfIZcSu:EU+SdNzhch7Ci3C72RZcK7RLd0ix
MD5 SHA1 SHA512 SSDEEP

Submit Download

a074c9a0-61de-46e1-bafc-8d2e951dcdbc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\a074c9a0-61de-46e1-bafc-8d2e951dcdbc
Size 982B
SHA256 1f3ce809c786766ea7052990d4a63a8a433bd1d696645e4ae63bb34f148a1f98
MD5 2bbec4e49abc1dfe6b3cef25a403e4ae
SHA1 ed727f42ab39392f3aa28443c450800ecc298ca8
SHA512 138bca904c775f55fb6b13446e19e7213705e3740862da3c40bca18302ba78136aed91d416d78242ea9ca75ded7c5a01db6f3df1bc29a617670b4ae6a607ab76
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
Size 12KB
SHA256 9350ac8fe741a3ad4b7b877e9f4c4f1c0c84205e32e2a0c0b3f5f039c35c0147
MD5 09861db53470f10f050b24c10926e599
SHA1 1da11c1ab13a33649c3994d458e22543cd42b479
SHA512 9d0882af7c039047af7720a5a153a6aa14454d17c274794a963369a53cb7cd02dd9efef6db01ab3a64ed1d0ce2f0a7001701641b62de1c27a1782c0d6a8c2f0f
SSDEEP 192:Lb5nYRof/BDK4O2xnId33LQQ+x2t7nV7t+g6F3FaXPMUBw8Hi:Lt5zxIHT+gHrwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js
Size 10KB
SHA256 d2a744da5ce1eb3f4310dbc2b6ded8594dc809b5dd1a2bcfba577919a170bdc4
MD5 b54ae0288cb54f6d8bc82aa42fc1b795
SHA1 774df47d107a6b1d404e821fd3734c630c1bb30a
SHA512 c5feb8bec55c99669695a0c35becbc68e53cef23010788553a3661debc0cdb3767234c4e521b2cda115036f7f5507c0fe3e27984a11e7547e365a35ce7fa932e
SSDEEP 192:Ob5nYRof/iXNh3psxnHd3LtVNUnNt+8+V0tDsS3waXw1MSBw8V8:OtCuxxLtuzDODwz
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js
Size 11KB
SHA256 cd43be76a9ca63d1ad1755c656f146a1a03c471914de1aa9ba1edcae1f067aed
MD5 6394168b4114e19666edf31b22ba0ed2
SHA1 1650a75b9867f586d5a84615b20e3cb0cc4f80b0
SHA512 3c9c6ae8c2d62bef03e7357d694e45cb654e9c96aedff1da40e4fd42b02e21f272b20bafe079eac05bfbb5d1ad402fafc90f851a1d501af48ac1a4a9254ed3ea
SSDEEP 192:Ob5nYRof/BDK4O2xnId33LQQ+x2t7nV7t+g6F3FaXPMSBw8H8:Ot5zxIHT+gHDw5
MD5 SHA1 SHA512 SSDEEP

Submit Download