6a40681afe1af44980983beff83ee9cf8e6de80c49f3d8c7e8abf51e8d7dc83d

Analysis

max time kernel
127s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2024, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 901KB
Sample241128-e5dcmsvrdv
SHA256 6a40681afe1af44980983beff83ee9cf8e6de80c49f3d8c7e8abf51e8d7dc83d
MD5 4982632eec3d2bad041ed5583fb4bf41
SHA1 f7bd377e184dfc0c3b174298ce18a8651e830639
SHA512 e21e148b4403ddd51ef45b1ae602258278d60be19c042a67e98bb011ed39b35edaf9683013a953bdf50571e2876c66d15d4ea72df84cb158cf0b0859e0add4eb
SSDEEP 12288:wqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaNT0:wqDEvCTbMWu7rQYlBQcBiT6rprG8aJ0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3932	taskkill.exe
232	taskkill.exe
2760	taskkill.exe
2892	taskkill.exe
4972	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1936	file.exe
1936	file.exe
1936	file.exe
1936	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	taskkill.exe
Token: SeDebugPrivilege	232	taskkill.exe
Token: SeDebugPrivilege	2760	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	4276	firefox.exe
Token: SeDebugPrivilege	4276	firefox.exe
Token: SeDebugPrivilege	4276	firefox.exe
Token: SeDebugPrivilege	4276	firefox.exe
Token: SeDebugPrivilege	4276	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
1936	file.exe
1936	file.exe
1936	file.exe
1936	file.exe
1936	file.exe
1936	file.exe
1936	file.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
1936	file.exe
1936	file.exe
1936	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
1936	file.exe
1936	file.exe
1936	file.exe
1936	file.exe
1936	file.exe
1936	file.exe
1936	file.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
4276	firefox.exe
1936	file.exe
1936	file.exe
1936	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4276	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3932	1936	file.exe	83
PID 1936 wrote to memory of 3932	1936	file.exe	83
PID 1936 wrote to memory of 3932	1936	file.exe	83
PID 1936 wrote to memory of 232	1936	file.exe	86
PID 1936 wrote to memory of 232	1936	file.exe	86
PID 1936 wrote to memory of 232	1936	file.exe	86
PID 1936 wrote to memory of 2760	1936	file.exe	88
PID 1936 wrote to memory of 2760	1936	file.exe	88
PID 1936 wrote to memory of 2760	1936	file.exe	88
PID 1936 wrote to memory of 2892	1936	file.exe	91
PID 1936 wrote to memory of 2892	1936	file.exe	91
PID 1936 wrote to memory of 2892	1936	file.exe	91
PID 1936 wrote to memory of 4972	1936	file.exe	93
PID 1936 wrote to memory of 4972	1936	file.exe	93
PID 1936 wrote to memory of 4972	1936	file.exe	93
PID 1936 wrote to memory of 4428	1936	file.exe	95
PID 1936 wrote to memory of 4428	1936	file.exe	95
PID 4428 wrote to memory of 4276	4428	firefox.exe	96
PID 4428 wrote to memory of 4276	4428	firefox.exe	96
PID 4428 wrote to memory of 4276	4428	firefox.exe	96
PID 4428 wrote to memory of 4276	4428	firefox.exe	96
PID 4428 wrote to memory of 4276	4428	firefox.exe	96
PID 4428 wrote to memory of 4276	4428	firefox.exe	96
PID 4428 wrote to memory of 4276	4428	firefox.exe	96
PID 4428 wrote to memory of 4276	4428	firefox.exe	96
PID 4428 wrote to memory of 4276	4428	firefox.exe	96
PID 4428 wrote to memory of 4276	4428	firefox.exe	96
PID 4428 wrote to memory of 4276	4428	firefox.exe	96
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97
PID 4276 wrote to memory of 3988	4276	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:232
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80d466dc-3e6a-46b9-a3be-2da3bce0612c} 4276 "\\.\pipe\gecko-crash-server-pipe.4276" gpu
      4⤵
      PID:3988
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2384 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9f39857-eb24-4f27-8973-c6bd0cd4a5cf} 4276 "\\.\pipe\gecko-crash-server-pipe.4276" socket
      4⤵
      PID:1124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2628 -childID 1 -isForBrowser -prefsHandle 3208 -prefMapHandle 3008 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6027a8c4-1cc7-45dd-8a9e-b648a4cc57ae} 4276 "\\.\pipe\gecko-crash-server-pipe.4276" tab
      4⤵
      PID:2028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3944 -childID 2 -isForBrowser -prefsHandle 3936 -prefMapHandle 3932 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee247ec4-3336-4f1a-b272-11580c49c902} 4276 "\\.\pipe\gecko-crash-server-pipe.4276" tab
      4⤵
      PID:2128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4716 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4748 -prefMapHandle 4744 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55614780-1f80-4d79-9845-de5e57939f17} 4276 "\\.\pipe\gecko-crash-server-pipe.4276" utility
      4⤵
      Checks processor information in registry
      PID:4804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5192 -childID 3 -isForBrowser -prefsHandle 5204 -prefMapHandle 5200 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e975770-ef02-4013-8a85-34259e732a97} 4276 "\\.\pipe\gecko-crash-server-pipe.4276" tab
      4⤵
      PID:4812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 4 -isForBrowser -prefsHandle 5432 -prefMapHandle 5428 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d292099-c6b2-45f5-b0a8-92cbb97eb38b} 4276 "\\.\pipe\gecko-crash-server-pipe.4276" tab
      4⤵
      PID:5016
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5628 -childID 5 -isForBrowser -prefsHandle 5548 -prefMapHandle 5552 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a7eafb2-ef1c-4000-87d0-3286d1950496} 4276 "\\.\pipe\gecko-crash-server-pipe.4276" tab
      4⤵
      PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json
Size 24KB
SHA256 aa20187e7cc5d305752c69519279308397b4d6e5002f449c30ca80c0e5b7ce40
MD5 09f6a34f57c6c93d85e3470e3fb3c05b
SHA1 44ce2c80a64baeb4c613b9c0d6620f2a0abf1d0e
SHA512 7fb6d0a32537f72fdfe20ecd96e7583aa7967c03295d08fc1a19c7335117ae256d93321a3cc545722c89314dc90c76a40a046ba4b3e03a28b25b9f638e6c0df4
SSDEEP 384:pto7tfkJV1h/1cCrP5SwqA87h1nxIzc3dmkSByaulIUITrj5NIJG:gfk3PI5N6ggydWBTRuJG
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 82ebaff8849f1bfcedd6ff92fb72c68c563b808ed677c5f6b6076400947a4782
MD5 80cf85626cf8e69861c8b208b0545ca7
SHA1 c722a16d3bafbf676e7ded5dbe86980052113da2
SHA512 9efc7ecbf6cc3e69d9dce932cfcb823b51f6b6bdd732f8c4b44ecc6949caa905d348586d81762c799f8d7bf75d7e0636a146d7b82ff93fba99690d4ef75c9f63
SSDEEP 384:HfNIu9fiGLm4pUUA+Q+4IYKgH4Zv+3yPrIVy8eyHF:llBi8mCUUxQ+4INy4ZcyzIVy8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
Size 8KB
SHA256 0d5225de01b47ef0c2b136a9759be58d2ff29ca2782b10d58e5e71405b3d7988
MD5 9d8785c0a634cf85cb7942d449524b8f
SHA1 38d2b44cd8a9ac8c5a48b1087cf754cf95ae6998
SHA512 51662200f6faf54464508ba910fbc58f969119090218feeb808dc50691dbb280e6df19bd4f409f800238ad4e98ef5e860bdf7a6618d4ca37013e7ec58b7ba00d
SSDEEP 24:5uB1oDlWEwsJblLK9tbIsFsh2F3LFGgu1xgRbmuhMZIqpR5cO2sJbF0J9tb:faebVKHb45oW9cO2ebOJHb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 c477e344c7b248adac92003e8017bde6039da101d915e1e498a4727c85c90c16
MD5 4009057a7e0df7c749cb6340d49f083f
SHA1 cf8c69eadfb138f377e06b015e58b76fdf5fe081
SHA512 7da54a6806154f35a32f00c9d5b89dc22f8f9c3d482dd86adf3d66eb1e930da46a75276d92d6519dc9657b8a653907f2e3da407461f1171d8deb4fd20f4d0bb0
SSDEEP 96:kZQms+BFl66JozGzgClKtmSSwSMF9ZbkW6ShmxLPP/PrWZ:O/66JozGzgCl6mSSwrvZboShcjPC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 bca77c9c8b72ddebea7688f621820d435df7cced15452819fa1a07d590c97525
MD5 a060a86ecb9b5ab047259678e80b6ea0
SHA1 a9c2da93f7ca52639c61788ec20098b38b011a32
SHA512 ca3990c16ea6f4eabc43b0a9b0b284bcc52ab128a52ed7006502190ac1a86fb4a4222ddd2d750e6f180179cb53a221425dc8017fb76d678a44cc00e84bd3e37b
SSDEEP 192:O/66JozGzgCl6mSSdrvZboPlhFcUjPDW+:O/66JozGzgC1bnbo931P5
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f9fe9974f3ab4f9145f0c60994cbe00f17c7ad8601f9aeec5969f8bf2c2a167d
MD5 d17f958788c554f16c292717c71cc41d
SHA1 f6a3a47c964fa1c81aac6bbf2889747c14e99b14
SHA512 0939568e66cd1e3cfcf09dde8543dc829daf74d9a43d1ed8a2346ca1cdc6b243d306bf3e0a2a8725bda8ca9afd595d5c63d56086eaa243b43c2038859291cf4a
SSDEEP 96:kZQms+BFl66JozGzgClKtmSSiBMSMF9ZbkW6rBBlhmHCLPP/PhxnWmh:O/66JozGzgCl6mSSdrvZboPlh5jPDW+
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 7210ddcce8c67e754015a3c59b08ffbb97b0bff9ead093456a26570194797a8c
MD5 8d030d1df55d2cdf8eb27f4af2eb7c67
SHA1 2fc126eed736297e38d0f95733da052c0557011b
SHA512 4cb22ed1c4d9ae6efeae237833ab33ecd127d1cd097b3714a4f036bfca21e51e0c48caf08b2327ec23337a2eb8e0490081137d0336f4efe4184f5d5b6863a6e3
SSDEEP 384:Z8IEFoXvYLDmYGLbQb7Gbo9/GAPc/66JozGzgC1bM:C7C6DmYGLbQb7KAhEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

47253962-d2eb-40d0-9af9-27276b676fca

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\47253962-d2eb-40d0-9af9-27276b676fca
Size 26KB
SHA256 153f18349b2f16ed3ed4e4cfba1f48acb8c76658cf06af5c6950ce5229d06de9
MD5 bfac03cd1c17a01ca4f9fe70a6eb7749
SHA1 016124f6e14db79fd332e0643469e38447caf4bf
SHA512 b94fcc153f30e5dfd1d9f31657039ec5d6e9f92272bbc861aa53cc4020c60d2414ae9a21697e0bae7dc3175bbcb607f16bf0975a0011527bdb1e0aec9cddac41
SSDEEP 192:a+X5cewWG9vGpxsXogshnigGSdCPbMi/5yDF98QIREjbRduV+QmlbNIh9piCDgRM:a+6eX1kAphKMIQ9WcRibi6aFFs
MD5 SHA1 SHA512 SSDEEP

Submit Download

67bd68dd-5502-4a0c-afa8-0176dbcc8a25

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\67bd68dd-5502-4a0c-afa8-0176dbcc8a25
Size 671B
SHA256 063794c8f7bd46dbdee2e41d15a7012619510a54417c9e341ad4a9d7af9d3d60
MD5 249d4330ff0ce8c0f294f84c826a19fc
SHA1 bc469bd5d8269f37638df1e6d6c1bcd42c00ae9a
SHA512 e6c8b9fca213a6707381bb98643c6a3a54d73ba68469bceff990ab9fab5b63aa5d81d7fed8b924177279cdeb5215aeef013967fd9fd2c3c526772a9504860933
MD5 SHA1 SHA512

Submit Download

753891f3-8366-407b-9774-741534af8d6b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\753891f3-8366-407b-9774-741534af8d6b
Size 982B
SHA256 bc8b07b14bcf59d328eca67e9aa821c257dbb2a110f882281a6f85babd40ac58
MD5 123ef78be278b278d66159b3e937403f
SHA1 102b85e40d4b60f781b56ebce53505f33d423c99
SHA512 06bae1490f7cd278ea7376dbcf81018d7ea4e6d5833589a58561bfba259d01203c6daf4ab9d206995f64c0ea404a5dd7109a84e1182e3b3c6a3af25d9c0b2289
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
Size 10KB
SHA256 e1db7372a47b2efabdd469bd0a221707c1cecbc45765d2c2b04084a9c52e1ccc
MD5 9c9f1f6f99e6a9fae109495a4ed646c0
SHA1 d584cf89a3b62a2e5cd5ce7d915bc387234b6087
SHA512 14bdf833568b5382ec9008b298e005327c5559e580440231d7988e26c7f656971b60b44070c8eaf3204a7fd81dd4541c81494eed159eaf7132668afc63a30214
SSDEEP 192:15nSRwfjJRDxnZd3oW+nd8V9tiFbo2aX+Y9nBw8Hb:xXxLoW+nmmY9Bw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
Size 15KB
SHA256 12c993113d8642fc0ebbf95ce92d7141d2fa916b5f9862fe47b3a1713e427c73
MD5 48e9b8b5f38adb1cf0b93875b4dcbb3e
SHA1 255000747247c7a4fc4e79d425b368d4c2ce098d
SHA512 93530630d09c1f5cbd38bb265defde05e9f0f8fab829ad1b171cde31fb41127f5c8c8e40504ba35756e14928ad37a1af2d9fbe8d0321976630d153afbf8c84fa
SSDEEP 192:1unSRwfeJRDxnZd3oW+nd8V9tiFbo2aX6+Y9biBw8Hr33fcn:8CxLoW+nm7Y90wGm
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js
Size 10KB
SHA256 1f49c4a84c15e5480a422198ed88e0b21a8a5d9c44256bfc72e6eeedbd049218
MD5 49d6c9a5703fdd88ffec31827742442e
SHA1 74ee50ab6f2d3b919e2173102185dc618585571d
SHA512 8794f264679f50cabb60ed7dc63b59dcef2bb003316e27cff7d66be913a9143400989347e8098d2b77b29c2d6b7e70a3101ea58047728fe45edf24b31f0052d3
SSDEEP 192:l5nSRwfjfefnVofAHBtq8prddx9y1ZO43kaXuY9PBw8VF:hGVoIbpd9y1ZOfY9Jwq
MD5 SHA1 SHA512 SSDEEP

Submit Download