4ade4fbaba2bb171fe05f150f8376c3daa7d7c79e0ecebcaa0a15aaeb1d31632

Analysis

max time kernel
128s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 900KB
Sample241120-ak2ghswlat
SHA256 4ade4fbaba2bb171fe05f150f8376c3daa7d7c79e0ecebcaa0a15aaeb1d31632
MD5 b02583abf5640a7b340e3856d1d97b7a
SHA1 aaa40e9fea46884fc01d20a2072d915e0ba413cb
SHA512 6621203ffa697fabe3e986f033e6da5534d233557d709f9529d485636e0cb4254da760cbb72562523526195f4e4ba6042acfce842a0fea338efe14943b02bf4c
SSDEEP 12288:pqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaqTx:pqDEvCTbMWu7rQYlBQcBiT6rprG8a6x
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3624	taskkill.exe
644	taskkill.exe
3092	taskkill.exe
2064	taskkill.exe
3896	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3872	file.exe
3872	file.exe
3872	file.exe
3872	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	taskkill.exe
Token: SeDebugPrivilege	644	taskkill.exe
Token: SeDebugPrivilege	3092	taskkill.exe
Token: SeDebugPrivilege	2064	taskkill.exe
Token: SeDebugPrivilege	3896	taskkill.exe
Token: SeDebugPrivilege	3052	firefox.exe
Token: SeDebugPrivilege	3052	firefox.exe
Token: SeDebugPrivilege	3052	firefox.exe
Token: SeDebugPrivilege	3052	firefox.exe
Token: SeDebugPrivilege	3052	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
3872	file.exe
3872	file.exe
3872	file.exe
3872	file.exe
3872	file.exe
3872	file.exe
3872	file.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3872	file.exe
3872	file.exe
3872	file.exe
3872	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
3872	file.exe
3872	file.exe
3872	file.exe
3872	file.exe
3872	file.exe
3872	file.exe
3872	file.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3872	file.exe
3872	file.exe
3872	file.exe
3872	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3052	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 3624	3872	file.exe	83
PID 3872 wrote to memory of 3624	3872	file.exe	83
PID 3872 wrote to memory of 3624	3872	file.exe	83
PID 3872 wrote to memory of 644	3872	file.exe	90
PID 3872 wrote to memory of 644	3872	file.exe	90
PID 3872 wrote to memory of 644	3872	file.exe	90
PID 3872 wrote to memory of 3092	3872	file.exe	92
PID 3872 wrote to memory of 3092	3872	file.exe	92
PID 3872 wrote to memory of 3092	3872	file.exe	92
PID 3872 wrote to memory of 2064	3872	file.exe	94
PID 3872 wrote to memory of 2064	3872	file.exe	94
PID 3872 wrote to memory of 2064	3872	file.exe	94
PID 3872 wrote to memory of 3896	3872	file.exe	96
PID 3872 wrote to memory of 3896	3872	file.exe	96
PID 3872 wrote to memory of 3896	3872	file.exe	96
PID 3872 wrote to memory of 4856	3872	file.exe	100
PID 3872 wrote to memory of 4856	3872	file.exe	100
PID 4856 wrote to memory of 3052	4856	firefox.exe	101
PID 4856 wrote to memory of 3052	4856	firefox.exe	101
PID 4856 wrote to memory of 3052	4856	firefox.exe	101
PID 4856 wrote to memory of 3052	4856	firefox.exe	101
PID 4856 wrote to memory of 3052	4856	firefox.exe	101
PID 4856 wrote to memory of 3052	4856	firefox.exe	101
PID 4856 wrote to memory of 3052	4856	firefox.exe	101
PID 4856 wrote to memory of 3052	4856	firefox.exe	101
PID 4856 wrote to memory of 3052	4856	firefox.exe	101
PID 4856 wrote to memory of 3052	4856	firefox.exe	101
PID 4856 wrote to memory of 3052	4856	firefox.exe	101
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102
PID 3052 wrote to memory of 3076	3052	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3624
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:644
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3092
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3896
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4a697ed-f005-44dc-869c-663289b86b13} 3052 "\\.\pipe\gecko-crash-server-pipe.3052" gpu
      4⤵
      PID:3076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d443349-5187-49e2-9ec5-8a4abcad0008} 3052 "\\.\pipe\gecko-crash-server-pipe.3052" socket
      4⤵
      PID:4396
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3136 -childID 1 -isForBrowser -prefsHandle 2848 -prefMapHandle 2952 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2fb0fe3-c759-4763-a595-3f2326cf83fa} 3052 "\\.\pipe\gecko-crash-server-pipe.3052" tab
      4⤵
      PID:2652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3892 -childID 2 -isForBrowser -prefsHandle 2584 -prefMapHandle 3884 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe7867a4-788c-4b97-80b1-8a99c88d7e4f} 3052 "\\.\pipe\gecko-crash-server-pipe.3052" tab
      4⤵
      PID:2940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4880 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4864 -prefMapHandle 4840 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a03af42-39c8-4f38-b8d6-290c064c7d50} 3052 "\\.\pipe\gecko-crash-server-pipe.3052" utility
      4⤵
      Checks processor information in registry
      PID:5064
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5200 -childID 3 -isForBrowser -prefsHandle 5380 -prefMapHandle 5368 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bf79c64-0c96-4b13-a120-8bce2133ecac} 3052 "\\.\pipe\gecko-crash-server-pipe.3052" tab
      4⤵
      PID:3092
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5640 -childID 4 -isForBrowser -prefsHandle 5716 -prefMapHandle 5712 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b72c45a1-3121-4709-9c4e-bdfeb0652f90} 3052 "\\.\pipe\gecko-crash-server-pipe.3052" tab
      4⤵
      PID:952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5816 -childID 5 -isForBrowser -prefsHandle 5824 -prefMapHandle 5828 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e45cb1fc-0066-41c4-b438-2bfdf65b3da0} 3052 "\\.\pipe\gecko-crash-server-pipe.3052" tab
      4⤵
      PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 6d3eeaf129bb07acfdccbfbbdf56eb76ab258badc101b5109c81fbba8446f0b3
MD5 f7831dfe6fefaf14450a91ac9b588a4c
SHA1 328dedf3af124002e68c9efc4d2f347b5df5ef88
SHA512 3f78943cf16ac41a2e5ac1796d19cf942760c3ec2440dbc5983a728588852af5d492c2669ad0fa315d332cb709f7fe234bc1036733d7ac987a4a754eda89a608
SSDEEP 384:a8F3PweMA7x2rKeSXBbCHpLUd9pnwyKpyyyau+eGkG:JVPbMUx2rKNxbCH5Ud3Xgyyyd+XkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 f7aeb0811f69e94c687086df63a373ac98cbf9812041b85160bc054efd11f71f
MD5 6a2f9edd018e9a4f4af0974f3b6a8a6a
SHA1 a5eb3532e20df0f2666a91616e8ecce8826d150d
SHA512 6bece2b569bbbb4e3afa9234087e34f73dd5a1e80a542e5ce5e6da7fce5d4ae3ec274739b0716c0222abc68a6665fa39a5b5eafadbc4b64d98cae70e7910cd1c
SSDEEP 384:HfNIu9fiGLm4pUCA+Q+4IYKgH4Zv+3yPrIVy8e87D:llBi8mCUCxQ+4INy4ZcyzIVy8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Size 6KB
SHA256 8c259c2770840e2bdac61bf3020d0c765108c311937c43a1179d0a33ff681b82
MD5 d04114999b45a9e38924a5d291d22ea5
SHA1 f989ed773b5c1dd07a3fcaddd5b2f567bacfd842
SHA512 2bda3c2e19f21b6249ef3eedb1c6e9a0e7924c37cfd9cdd6451b19f9037426804dda6ddcb88a0c5f8fd0effc7db582cbc66091f09b8b3bc6e75265fda8896a52
SSDEEP 6:gNe0gidpq88gidydgid8UpmlRTHgidpqs7HgidBgidW3m:ggQpB8gQWgQ87lOQphMQSQW2
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Size 10KB
SHA256 7c26f442665684443e8efee6fae99c24ad2868be4e1b4cdc482ac0adf791cf91
MD5 0cebde6b0dab7b4226b1e2c72386b23f
SHA1 86a53be423b37e146a99e05bf6fe73baa37bb0a9
SHA512 b4a7f2176cc1ee3180bdadfd8a1a81c5db5992d3581766f959ee7ef42b620097fcd905f1a0e1042f1b971c4ac8e728afae121e2adde4dff59775c1202e33b545
SSDEEP 96:sebVKTlbHG5o5/9ebOJTlbDspebvpf+Olb:75vu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 25ca24900ea8e82a951827aa657325b16873d54fed8d3a7e3d9032d8b3a4874c
MD5 f94d8e7f52f7b55eb0ca5b1a5830ad71
SHA1 3945d5d8695042cfebed788ee8801773e0c6f34b
SHA512 d17db8e33eda31ff30c140a96b9d64c95952593348c184e48758a42ca283b83f21b743cf1a934adc0b0a6643f086bb77a01b56f66920b52d86c0c5fa76fb64ed
SSDEEP 384:EboSLPXDHFZRfpY6iPfvcHFH8EI1JXb0bJbibXbEbpbQb5bybXS4BzU/66JozGzC:sRvzHRfpYnPfvcHFH8EI1JXb0bJbibXQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 24KB
SHA256 2a26b10b07e5bc19ff8e92254387659ee9b22516dc7bdb0e0334a1056a85e177
MD5 d404e6c974fbb87834a596ba15a5b7f5
SHA1 9be66b39a9890da0960456e6afca56167abd68a3
SHA512 56e41eaa7b5b520cf874c68e456eb80cf2a425e95bcfa422425e36cb2836c1ed9bc7e497f251f68e757fc1201b283c1b2a87cd0a64fe622b648982b2b8890f17
SSDEEP 768:2EbbYEzpKUgnDfviIFH8EI1wzb0bJbub4bEbpbQb5bybDWRV:MEYHRWRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 6066c49fcfdf411f3004865112723a33f2a7623837fe3c2e68a1dfb4411b3ab3
MD5 81bd2f010f62feb576c7cec7ad9b1868
SHA1 db753454b55bc962ff4dfdf61026448d1afb0abf
SHA512 d9e490c5016e7ea76496eb24eab9954fa3a041539df608d0dacb600c4449571330bac47a6940acaaa5db423319d82f18af346c1a1ebf12fe86d5b7450768340e
SSDEEP 768:OzYEzpKUgnDfviIFH8EI1wzb0bJbub4bEbpbQb5bybDWR1Em:PEYHRWRb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 542c761eee952870a90a0dc50746c478bccfadf2796920ef0dcce57b3933ce9a
MD5 b86f4f58b2a9607f3c1406352d129929
SHA1 7bbb996a09cbb7f3cd61815252ac75e06944e6fe
SHA512 930f6714a0d30a051b7b3be713a83ebdbf7e6aee20f4946f51459764ca61f8883dad7f51a924422fa9f59f3ef828f2c478334a76d19a11ac866a8065a2817cfa
SSDEEP 768:VEzpKUgnDfviIFH8EI1wzb0bJbub4bEbpbQb5bybDWRFzLEm:VEYHRWRT
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 0e6e3e7697e600bf550c24d350a7404bb4812b07bd522855e749f3826b26bc68
MD5 1d64bb5bc3a9efce922a4f6f046748a0
SHA1 13cdc586b053f348ca8acddcca2c05a4ce248c24
SHA512 9ef71c5631f81371b0f3a6c6ffacadc8b940d5f2a52d3d47e463c2ee8989b24acf4f394c6e800f93f2459de9d5c1bde20d45b7488e18ceb20a1c20ff4895ff5e
SSDEEP 384:oDHFZRfpY6iPfvcHFH8EI1JXb0bJbibXbEbpbQb5bybXS4BziboVLP8/66JozGzC:ozHRfpYnPfvcHFH8EI1JXb0bJbibXbEL
MD5 SHA1 SHA512 SSDEEP

Submit Download

151eb4a6-d95d-443d-8d41-7a057c1b5968

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\151eb4a6-d95d-443d-8d41-7a057c1b5968
Size 659B
SHA256 86ed0f1e531db7766f1d3ca636504022bc2bc07346bc91a5781a2793661dd79c
MD5 b53f6e44b9ab2c3087c1743c5b27b225
SHA1 32951a0c4ac67f0b7e70c1465266410d2a87ac4e
SHA512 a2519f5ef81d9e36e5bccbb67c0cd775756192575dbaa7598bbdcefdf8cb34ec7d920a35af9662090d7202fd55aaca10b0a3e93c0bae2e42f85cfc897b2d058d
MD5 SHA1 SHA512

Submit Download

8c4ec23a-b711-4ca4-ad32-76c5963065c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\8c4ec23a-b711-4ca4-ad32-76c5963065c9
Size 982B
SHA256 b2bc84324d424f96d3368089b609b4939252f1ec0e7101ce6b8908a85c452fae
MD5 8f8f01d96171562033177b7f38406190
SHA1 2b307b11dc788f4ab27c2c3199eae0a035ac300b
SHA512 693f80eaf1656e17a70bf070aca2c787eeaf7f003583627f683e6d06afde5eb0a5da355437809b8323f0dda09aacdde25254d0a022b2a54d4b9429031c707574
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
Size 12KB
SHA256 ffe76629cc92079ce8f2974ec0da7b58988b71de7c841eadc57d00d6afaa910a
MD5 b34f00b4b2bc32a1be07cccd83882125
SHA1 770dc5e38b9774c2c1baf548655b51559b15f30e
SHA512 8e4ce2d43d14e90410b28d2c08c670217ce2e4889beb6bec8a45c9e9456d3efa384fac8d003a307e0337a72d7d2767a67c7ee9db72098cb534965ece7d1e3135
SSDEEP 192:GB5nSRKfE29MAYxxnrd37LQyUitoPVOtMgTwDaX2DvbrBw8HT:GvHYxxlHMgIDvRw8
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
Size 10KB
SHA256 d4a06f68bbf217892f06033054474f37aec9ee30f56e8ce3c9e10071a23ae707
MD5 ea913eebaebab507537c62f6aaa6606c
SHA1 36ede598ccd5a96f074b26188e876349c2246fad
SHA512 e884c9ba7f365bd589d32843d372502ea355e43ee1c5e19a1bb51c81191d08dfe61be8faae6305b8d5aabbd15234a17bcc0f7bc35eeab428e7e4c77139b06332
SSDEEP 192:RB5nSRKfE29MAYxxnrd37LQyUitoPVOtMgTwDaX2DvbrBw8Hi:RvHYxxlHMgIDvJwz
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
Size 15KB
SHA256 064b6c4a75925a4898f76c0ccfac5c87c3339181542c316ce05c16bac6e46138
MD5 c0350a0adece143bca5d5c438f7bd9f7
SHA1 0708f1fc718efe7c8580c265b8fca7a61971f135
SHA512 ba5d0c049e66e1e83d492a6ded09cd087db1b6a5f75b32f9d998c126f0e53230ed8efb61412ee1107be7fcd80cb28532fb7bc3fc2c45fa70e4615ff35ee8a137
SSDEEP 192:GBenSRKfe29MAYxxnrd37LQyUitoPVOtMgTwDaXy+Dvb1iBw8Hw7f961:GeFYxxlHMg1DvGw5c
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js
Size 11KB
SHA256 ec806b2f57d3bf058ebe7adbb3ab59a9eab28cc143c0ddf5c884138cb14ce626
MD5 089ca379af7107b8d0898cf0d8b69dc7
SHA1 f6e8201e169c9dadd921fff27798a149312567c6
SHA512 5d7affce614c0a542bcee33c22b5d8cde8085357515adb1cfec54304473a6714cfcb42b735724b000572f504570477268e3f938ceb40b4202019dcddb57294c0
SSDEEP 192:RB5nSRKfElLys/uI4gYcU8BtD8JJCddLMy1Zzw37aXYDvbrBw8Hi:RvNsWuYgUJJ6My1Zz2DvJwz
MD5 SHA1 SHA512 SSDEEP

Submit Download