e1dbdd47c09f5564f86e2e920421462132b06736d2bdd05da45914b837cd366c

Analysis

max time kernel
126s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 17:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 900KB
Sample241121-v9flkatdnf
SHA256 e1dbdd47c09f5564f86e2e920421462132b06736d2bdd05da45914b837cd366c
MD5 2715ba15ec190904679a73d96ae075a1
SHA1 ebcb32a133b2a155bf9deef36a7d4f8b95bda139
SHA512 6f86f7e48658d8e806e8b8e8a268f06fca9620dd6bc238d7d693578f664b31ee195ddffe18881785727d45fabbe63b3ede2f46abed5e1a5541b08bc2281c830c
SSDEEP 12288:tqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgayToP:tqDEvCTbMWu7rQYlBQcBiT6rprG8aS0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2888	taskkill.exe
4576	taskkill.exe
1552	taskkill.exe
1180	taskkill.exe
1916	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3332	file.exe
3332	file.exe
3332	file.exe
3332	file.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	4576	taskkill.exe
Token: SeDebugPrivilege	1552	taskkill.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	5000	firefox.exe
Token: SeDebugPrivilege	5000	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
3332	file.exe
3332	file.exe
3332	file.exe
3332	file.exe
3332	file.exe
3332	file.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
3332	file.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
3332	file.exe
3332	file.exe
3332	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
3332	file.exe
3332	file.exe
3332	file.exe
3332	file.exe
3332	file.exe
3332	file.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
3332	file.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
3332	file.exe
3332	file.exe
3332	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5000	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 2888	3332	file.exe	83
PID 3332 wrote to memory of 2888	3332	file.exe	83
PID 3332 wrote to memory of 2888	3332	file.exe	83
PID 3332 wrote to memory of 4576	3332	file.exe	86
PID 3332 wrote to memory of 4576	3332	file.exe	86
PID 3332 wrote to memory of 4576	3332	file.exe	86
PID 3332 wrote to memory of 1552	3332	file.exe	88
PID 3332 wrote to memory of 1552	3332	file.exe	88
PID 3332 wrote to memory of 1552	3332	file.exe	88
PID 3332 wrote to memory of 1180	3332	file.exe	90
PID 3332 wrote to memory of 1180	3332	file.exe	90
PID 3332 wrote to memory of 1180	3332	file.exe	90
PID 3332 wrote to memory of 1916	3332	file.exe	93
PID 3332 wrote to memory of 1916	3332	file.exe	93
PID 3332 wrote to memory of 1916	3332	file.exe	93
PID 3332 wrote to memory of 2384	3332	file.exe	95
PID 3332 wrote to memory of 2384	3332	file.exe	95
PID 2384 wrote to memory of 5000	2384	firefox.exe	96
PID 2384 wrote to memory of 5000	2384	firefox.exe	96
PID 2384 wrote to memory of 5000	2384	firefox.exe	96
PID 2384 wrote to memory of 5000	2384	firefox.exe	96
PID 2384 wrote to memory of 5000	2384	firefox.exe	96
PID 2384 wrote to memory of 5000	2384	firefox.exe	96
PID 2384 wrote to memory of 5000	2384	firefox.exe	96
PID 2384 wrote to memory of 5000	2384	firefox.exe	96
PID 2384 wrote to memory of 5000	2384	firefox.exe	96
PID 2384 wrote to memory of 5000	2384	firefox.exe	96
PID 2384 wrote to memory of 5000	2384	firefox.exe	96
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97
PID 5000 wrote to memory of 3520	5000	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1180
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4a630ea-c7e5-49f3-b333-f02578144b0d} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" gpu
      4⤵
      PID:3520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2384 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4faa0b9-bbcb-472c-ad1f-1c8c0a9f09b8} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" socket
      4⤵
      PID:5044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3248 -childID 1 -isForBrowser -prefsHandle 3260 -prefMapHandle 3024 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bad653da-5089-49b5-a741-c5f9251a7f9a} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" tab
      4⤵
      PID:2636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4164 -childID 2 -isForBrowser -prefsHandle 4156 -prefMapHandle 4152 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ba0c228-dd8c-4749-b450-df7143009a61} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" tab
      4⤵
      PID:3168
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4800 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4780 -prefMapHandle 4716 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {700ec209-8b29-4740-a3dd-858288933ab2} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" utility
      4⤵
      Checks processor information in registry
      PID:5072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5236 -childID 3 -isForBrowser -prefsHandle 5216 -prefMapHandle 3716 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {649501d7-387a-4fd5-912f-bdd2fc85fd85} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" tab
      4⤵
      PID:3696
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5256 -childID 4 -isForBrowser -prefsHandle 5388 -prefMapHandle 5392 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c17e9813-627b-4346-a2f4-7e8f8eb5037f} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" tab
      4⤵
      PID:1200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 5 -isForBrowser -prefsHandle 5572 -prefMapHandle 5576 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f732f673-c8f1-4c9f-97f1-edf4816938f8} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" tab
      4⤵
      PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json
Size 20KB
SHA256 f6c6d774e9d219e959ab3817cfaec0e20be6be15c92c5fe75a03ab5b2988ba4f
MD5 953bd0e077e139d3364df0816f6c7d09
SHA1 9047589da8dd4cd1316096c46ab186979950eced
SHA512 b40e3e1039294d746fa2a0171a18bf972bd80ccf734ae3e5cefd6fe03f540ed9f79111446520859e5e5c3367c927cdcaa97e5f4c1901a3efbb803374304b0601
SSDEEP 384:+YoWY7jwtjzeOrUE6gqy+8/V2OdAVUIRiCD7m+/f0KgyaE:5wgGEd+8fayZ+7N30Kgyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 df4c6ffa2d383d54f92ff25e638987a429f135aab8b1c8cf8e48f1d4529f0531
MD5 de26f540dd8a2375a72178b00cef25c7
SHA1 0a76cfd33af3b27e212e92356261252d4e86cfb9
SHA512 6deda58c4f54bc1e7ae1378c72c3b56de4f051689d9783a9c95da4dc9ab8aba0e1de9eeb30cf617b3abc719916fdf04c0bbcaa5a50b0f1f6698084b4c3c4c8fe
SSDEEP 384:HfNIu9fiGLm4pU8A+Q+4IYKgH4Zv+3yPrIVy8e+k6:llBi8mCU8xQ+4INy4ZcyzIVy8l
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
Size 6KB
SHA256 f5f7b459b17fb1f50b47bb6722bd3ce7f200ac2599b9610e18f5ead65f9fc054
MD5 cac116e849e24bc1418c42715d7ac100
SHA1 c42d635a90b4e5bb0cd05c5122894c0a6c2f6472
SHA512 417f91f0dec1490d95031957127addf84c25e950d8b085808d16cfa969a53d50b0800237f70afd0b867f83034ec9db97422b98e6b10f7fc43ec3ab5d2bb83b84
SSDEEP 6:gNe0gidpq88gidydgidyl5+jwlTHgidpqs7HgidBgidFp+jw:ggQpB8gQWgQylWwCQphMQSQMw
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
Size 18KB
SHA256 820ca16f4fd4d97d3d540373e2ea681a56fb2b1ffb00dd5991872e65be20d844
MD5 0f49664d7b03efc117a70934903a96b1
SHA1 0d219ccb51d854078fe7fbe161f57e68c5805479
SHA512 35817a1512eb4f9ff63accd5777b42224ebac0ff2dbdd13db560bb1d6a02e57e364885405e004f9ce038d98d2d181914e11244603eb5502d219f37e318c18d13
SSDEEP 96:bebVKYb55ovebOJYbNpebvpf+/bCbKbXgbgz5bSbubcb2bX6Ycbeb:w5Fu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
Size 8KB
SHA256 e1b2f9b99c141d887fbcfdd9e32640f1970bf3a6cb81e4be5eaa2bc58620c703
MD5 3db818f312259587deb7b2eea3b0ef86
SHA1 98cb641a1a518f51afcfebc41ae3f67d387c1dba
SHA512 12d95da173575392360834e1c03de82a1034e3be45488b84f3e7d13fe017087793e36918214f54f0c93e7870544bea3f5afb53966a13c79a8b3869ee89489686
SSDEEP 24:5uB1oDlW0Fsh2F3LFivmsJblLKivlb5gu1xgRbovVuhMZXgqpR5cOPvmsJbF0Ji9:fgeebVKi9b55oUwq9cOPeebOJi9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 4ca212d4115b64f01f6cc479153a4968189da6b875ce9fbb56f4fc99d1e49c42
MD5 c3290766939e3da18cf91a47445c341e
SHA1 dfa97ef97f8efa542fc1526cfee5d9aa351c8cce
SHA512 729d497471388114795682a05d62bcf9b8f903747eff777c5adc9e014068add73c4c2a74be12121eba160b682ebf1026ad60327afafc638ae57e4a2009875c4d
SSDEEP 96:VJ1KC8Fl66JozGzgClKtmSShSMF9ZbkW6Shm2Rp:u/66JozGzgCl6mSShrvZboShTL
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 cd3177197a0a4b0a0a666cae5cc4cb90bc24a5c6f5d27977c9a2d9b0cc7a48b7
MD5 4dad0aaed4812d49e2f4df56374627e2
SHA1 e30334983ab5476a5edea3ff5fba215f26d62dfa
SHA512 de890232913abcbd493c089864e274d14ded680953fa0e797e43423e48d0365039337346a3e3da0e796bf1848ea09f523151fbc3ceb4d4fbcba2624b42f2275e
SSDEEP 96:kZQdKC8Fl66JozGzgClKtmSSuSMF9ZbkW6Hhm2RPP/PrWZ:o/66JozGzgCl6mSSurvZboHhTlPC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 b065baba7e5c725502385955430c488aa0ac414f56eb4dfa49cb283214eff8f5
MD5 b53c315c7ebdc110b074a5498e8be954
SHA1 41c1eca873ce1c5a5e84c4cb9ccec8c632e3aa41
SHA512 b38d07a582555ad1b4c75675b00079782356981714f99ff2d24bd65e3e3e37183f798432dfc620dc0100c52260fed8ce1d2579bd55edf9391c195ed634e8bcfd
SSDEEP 384:Kboe8YP3/66JozGzgC1blRvP8/zk7W5hDiWtOb5Ubex:etaEpc82DiWtObKbex
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 d088848752ba84c4541cde8c7eab8e45f5f2778b5b05e7522b725b1009fc1259
MD5 038e8d5036a17f2b1b6579c6a60ecf51
SHA1 9ea83f021c2cdd35182be28c9bb3367356dc1656
SHA512 b966722b8ca28865823103127ba6e9504e15a514236369c85c354f5aa404add413355a1ddecbbdfbb656b74b523eb2bfddd4d88310e260ac265ee7eaa9d1c609
SSDEEP 384:nRvP8/zk7W5hDiWtOb5Uben/66JozGzgC1bcboe6YPB:lc82DiWtObKbeiEarZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

56294184-ab1d-40a9-8769-204418a22975

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\56294184-ab1d-40a9-8769-204418a22975
Size 982B
SHA256 a416f90789c3256e0fe0f36eaf9de8af672d4bef81b71ab3fe1afb998be4ad19
MD5 9b16f881ee09f22cf3b6f3db38daf742
SHA1 bb92fd434f5c4bef9da8082cf1661c1ebe3102af
SHA512 e8246ba2a72087c27ceee18ef579272b45c7e93aa35b0e9bf7942017d151fc40cde94a3b430051f35d7eeb4891adc365fe0e8413492fe37b2c2b52ce2fae5ddc
MD5 SHA1 SHA512

Submit Download

a9389b94-6c35-4133-aef4-07516507e3d5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\a9389b94-6c35-4133-aef4-07516507e3d5
Size 25KB
SHA256 1a8b3cb52a1553120fbeefe6c0f62666766c0dc4639520782efcc93ec862201e
MD5 e80ab8126cacad31d33a3cf3bf031a34
SHA1 717a500b4593d01c2c0dbb91931b44e4acc31b4a
SHA512 93390f7c7886da4e2debce7ff321d24951daee679ba6e3b39fbfe8cc90ec91e229d41cbe80ab0956c2fbb52b8c68da2fad4ea48da5e103979717b5c2f10a75a1
SSDEEP 192:ryhMq875a+z7FcmP4Cu7QFIwAiY+QReAuNyDtvEm2uSu2d1fFTNZseb4g4VRVMZg:rtqchmsishYLtsfNcbRlRTr7gm
MD5 SHA1 SHA512 SSDEEP

Submit Download

d603315f-57c2-424f-868a-fc2ca245bc1b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\d603315f-57c2-424f-868a-fc2ca245bc1b
Size 671B
SHA256 cc9faf9e7fe204775fd0e53e9d901efec6f4c65b086d69607f085307d3f1a2ab
MD5 0b349d9660719f4c709fb41f407c85e5
SHA1 1754118dde61a80d94486f246ee62d5dc3ef838f
SHA512 f45cc87aa9c21b622a0cb7814bb5a2cc419e34c57d12ddbdb8ff8ac2fd161e57eca835158d75cd8bb0759cbec326f5fa31743eae47ec1a88fbf9db8502683bb2
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
Size 11KB
SHA256 6ee5419d3b9c2b7510838fe34d9ad7412809d02877e0286c5945717206661015
MD5 edb6f160125fa32b0638555433eec17a
SHA1 ca3865aa495af1e37bb44a847547151b4a69f051
SHA512 c075c74b472b520d9e14064a12d09bb6e93dcf49910a31f39b2802585404221531f20248d861fbacf0f252cd2441a19713dfbeca0efea91cf54d52a73ddb83c0
SSDEEP 192:15nSRwfj2VXgmhL/f0YWUQdv9CIddZy1SHSaX4EY9HBw8H9f:x09sYWqyy1OY9hwCf
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js
Size 10KB
SHA256 5ad7f8728183213c3cca3e979f57ae615d1991cfb1573beb5d9dfd8d480c94b5
MD5 55c80d4e4d070623c428ea1202d2d1d2
SHA1 9a5d078320fd33197f6434bfb974896c5386a3ee
SHA512 7951a1496aa70113539527c5996ece364e1cb00fa0f4ee1fbf3186b97a89e4354262821e045df06e27d2106a81cd5314e303156c5f16508881a51e99c17fe9ac
SSDEEP 192:l5nSRwfjZUbnYcI4HyqqtV8pIddEy1Zzk3/aXcY9PBw8Vof:hiXtyqhpzy1ZzaY9Jwdf
MD5 SHA1 SHA512 SSDEEP

Submit Download