cbf720282c86ea5b9a35ceb210b1e8e8e19415ab0d67923dc6831195cea6bbc8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2024, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241022-m4jf9stdpm
SHA256 cbf720282c86ea5b9a35ceb210b1e8e8e19415ab0d67923dc6831195cea6bbc8
MD5 a7db87728d73df8045e10b37f2bdeac5
SHA1 4e3fdf61d7438e6f2834e3512d3187e8c75bb43f
SHA512 d9f64395eecbb15b208ac75e35128e3fb8fc1e1eb9bef128263a2addcb253d7e5f8830a77978f098d2142f2d1f9a3fe01c045512a530dd9d4228ba8012a22652
SSDEEP 12288:zqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Te:zqDEvCTbMWu7rQYlBQcBiT6rprG8abe
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2684	taskkill.exe
1812	taskkill.exe
1480	taskkill.exe
3268	taskkill.exe
5068	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	1480	taskkill.exe
Token: SeDebugPrivilege	3268	taskkill.exe
Token: SeDebugPrivilege	5068	taskkill.exe
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	4540	firefox.exe
Token: SeDebugPrivilege	4540	firefox.exe
Token: SeDebugPrivilege	4540	firefox.exe
Token: SeDebugPrivilege	4540	firefox.exe
Token: SeDebugPrivilege	4540	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4540	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1812	5020	file.exe	84
PID 5020 wrote to memory of 1812	5020	file.exe	84
PID 5020 wrote to memory of 1812	5020	file.exe	84
PID 5020 wrote to memory of 1480	5020	file.exe	92
PID 5020 wrote to memory of 1480	5020	file.exe	92
PID 5020 wrote to memory of 1480	5020	file.exe	92
PID 5020 wrote to memory of 3268	5020	file.exe	94
PID 5020 wrote to memory of 3268	5020	file.exe	94
PID 5020 wrote to memory of 3268	5020	file.exe	94
PID 5020 wrote to memory of 5068	5020	file.exe	96
PID 5020 wrote to memory of 5068	5020	file.exe	96
PID 5020 wrote to memory of 5068	5020	file.exe	96
PID 5020 wrote to memory of 2684	5020	file.exe	99
PID 5020 wrote to memory of 2684	5020	file.exe	99
PID 5020 wrote to memory of 2684	5020	file.exe	99
PID 5020 wrote to memory of 1436	5020	file.exe	101
PID 5020 wrote to memory of 1436	5020	file.exe	101
PID 1436 wrote to memory of 4540	1436	firefox.exe	102
PID 1436 wrote to memory of 4540	1436	firefox.exe	102
PID 1436 wrote to memory of 4540	1436	firefox.exe	102
PID 1436 wrote to memory of 4540	1436	firefox.exe	102
PID 1436 wrote to memory of 4540	1436	firefox.exe	102
PID 1436 wrote to memory of 4540	1436	firefox.exe	102
PID 1436 wrote to memory of 4540	1436	firefox.exe	102
PID 1436 wrote to memory of 4540	1436	firefox.exe	102
PID 1436 wrote to memory of 4540	1436	firefox.exe	102
PID 1436 wrote to memory of 4540	1436	firefox.exe	102
PID 1436 wrote to memory of 4540	1436	firefox.exe	102
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103
PID 4540 wrote to memory of 1432	4540	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7636fdf-8170-4f6a-b5f8-e1bdc5ee1777} 4540 "\\.\pipe\gecko-crash-server-pipe.4540" gpu
      4⤵
      PID:1432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce5c321c-63b1-45b5-b156-e173adde54ae} 4540 "\\.\pipe\gecko-crash-server-pipe.4540" socket
      4⤵
      PID:1556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3036 -childID 1 -isForBrowser -prefsHandle 3088 -prefMapHandle 3084 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1056 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9963e589-72d5-42be-911d-42fd76f10f33} 4540 "\\.\pipe\gecko-crash-server-pipe.4540" tab
      4⤵
      PID:3876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1060 -childID 2 -isForBrowser -prefsHandle 2552 -prefMapHandle 2736 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1056 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de04a8e3-dcbe-484a-8033-4d98d85466be} 4540 "\\.\pipe\gecko-crash-server-pipe.4540" tab
      4⤵
      PID:2820
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4912 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4836 -prefMapHandle 4772 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c82eb7e-3ebf-434f-a631-b3cc0ce5a590} 4540 "\\.\pipe\gecko-crash-server-pipe.4540" utility
      4⤵
      Checks processor information in registry
      PID:5336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 3 -isForBrowser -prefsHandle 5556 -prefMapHandle 5552 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1056 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73ff4b3f-94e8-4a60-b158-b47956ddbf69} 4540 "\\.\pipe\gecko-crash-server-pipe.4540" tab
      4⤵
      PID:2436
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5692 -childID 4 -isForBrowser -prefsHandle 5648 -prefMapHandle 5512 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1056 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d63dd0ab-902e-43e2-80c6-dd99e99d803e} 4540 "\\.\pipe\gecko-crash-server-pipe.4540" tab
      4⤵
      PID:5300
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 5 -isForBrowser -prefsHandle 5900 -prefMapHandle 5896 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1056 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02077b02-0d70-4d07-8e57-c581173cb4f9} 4540 "\\.\pipe\gecko-crash-server-pipe.4540" tab
      4⤵
      PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json
Size 25KB
SHA256 b14164c6bfb571b57b5ca8433b3a928f1864bbf439174f070bed909ee79d9e85
MD5 8552e7369e07b76a566352b8117028e4
SHA1 79917950a1ef5378cce775af439526053ffe1ca7
SHA512 7918ad28f970e354b0b782ff43aaa968d217fc0cccb5d7a0149d0a6ee99d717dd40a6b615fddbbf3beb948c1c6b438de5034311df9c51653dab930f44835344d
SSDEEP 768:XcR4C56cqnEZVDpp7UQf6YydIBX4wW4wQo1wJ1weG:MV5ZYETTUA6jeBXY/Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 57b84140fe02e5ac30b9c3d4ec37e45a4a5856ea9c3071363d22c86b0d0ffa54
MD5 c029fe45d10b757f65290e981ba1ab8e
SHA1 dcc030973e6662705e54337e80de5a1bd944bb57
SHA512 16564ef83fde162601901232beb26334f57f48fffc7c2fbf8b665b46c8c80fc433f74d6499d23dfc6d579390e8db8c5f9b744f464aecbf3b22833597f3c399bd
SSDEEP 384:H7C9Du9fiGLm4pU8pHLFoCr/E8HPJyD3VonFcP+AWRMACPFqFN:bbBi8mCU8pHLGCr/E8Rg3V/+hRMFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 17db66b16c07ece831d1dcee2118dd5a373107b93fdcbc5881a5f280ee9eeb95
MD5 183e7c20932db9b7ce73fc64a3c2a9c3
SHA1 bb698900c2395f890177ca1b15357ddcde7ad51e
SHA512 3ef95a65b6fb41d11448aff9776e25ada104643791757ff2de4bee7e3bc20e3666fb3e851f3ab49d8b27cd109d84d807bf94e286834230d752335e3dcf290c8d
SSDEEP 384:H/w5Iu9fiGLm4pU1pHLFoCr/E8HPJyD3VonFcP+AWRMACW4g:8Bi8mCU1pHLGCr/E8Rg3V/+hRMFi
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
Size 7KB
SHA256 e2f43126f92ad7f7d259ab2beda85e3da3b6caae20f361b670d464ed2f27978b
MD5 6020b5c808658978be61d0e58f243af7
SHA1 a1213489da844d3cf50b0bea13903db860a19953
SHA512 bf7f1440688c309f98d62943de5ba428c3e69a49f1cfc2d30be42493948ae7293cca9f57167ccf5df514b8a22791ae70bdf537f17543282e669833ad80f2efb2
SSDEEP 24:5uB1oziHFsh2F3LFJdgu1xgRbXpR5cO8MuhMZnsJblLKJQb:vYd5oz9cO8IebVKJQb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
Size 13KB
SHA256 7361eed4ba49c1a4ee3fe250f8becb756d71fbffb201d2905e8e845c4c877763
MD5 38a2a835edd5bb1571cc4a41339375bc
SHA1 85e9b2c8d4850cc075c55b7e574779aa06c84f8d
SHA512 ced435c7e22c0205aad83b3d46ea6888a5533add5a96de79fe369725b023508192ac4645b64bdfe16ba91ce92d3d98919006a8f05ed199b50ca52d2f6f0f7a69
SSDEEP 96:P5o+ebVKubcebOJubupebvpf+ubPbLb2gbgz8bfRxbfb:P5huZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
Size 18KB
SHA256 413dac1a68912c844bb0c2745ca78a838a07b24d0ad6b7e1e34e324ca0afac4d
MD5 0af28abc491edda071fee516c61abf4a
SHA1 1d6ada991800b943119023b0a6a82189ef92be03
SHA512 82af38c1f18730ed33fa6a393800d81fcf9b7e858ccea6d5df64b983d699468b5729ca4e10c39135d7408b4e8c98e27ac0fce5f83751c26298250d32fdde2988
SSDEEP 96:j5o+ebVKubcebOJubkpebvpf+MbkbEb2gbgz8bfRxbfbebAbv4bsb:j5fuf
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 9918de486a578dce9465017e4c5de445c96645616f704ab3f42c55f043fb5978
MD5 c263f91054bc7e53e8e94cd8ef390fc0
SHA1 cf0764115d98969cef670e1a275ed56e80e7e197
SHA512 ba75164368eff3afb7ba0d5c9bc948384eb59d2c7a7dc4f3ded8d6b9a4f6e88a88ef55cfb95020ce3e930f76a57fcb7833b122161ae4af73f50226dc4d8004a3
SSDEEP 96:kMQ7KFl66JozGzgClKtmSSioSMF9ZbkW6ShmrCPP/PrWI:l/66JozGzgCl6mSSiorvZboShikPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 a811ad676c7d39595c6fdfae5a363ed00a45281cbf3f961eb1f9d91fec786c77
MD5 13b9a631b128c227294f3b4b408a6eb4
SHA1 4a3131ee1b44a6031a36b9cc1b550ecfaf4b9e8b
SHA512 c99f0c45cf391b2bc6397651b6f061a6f46e544b208af207ec181a1b05bbf0db1879ecf4197ebfa2d47d8f5adbe104bec0698c88cf22ef7a467f52df4f0f70f4
SSDEEP 384:Z2boQovEPX/66JozGzgC1blOZML9FkARDGkzjbvbw5:Za7b6EaZ4HkiDGkzjbvbw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 96b8c150e3ede80c5ce3c875734c36b70ac36165037ed9a585b78a0ef5685b9d
MD5 8d7dc666adedae2f540fb61c7a2fbbcd
SHA1 fd40f58af038210084061390c4787eb16e3260f5
SHA512 687438d602ed57a2b324bbd85b464b23beb574818ba24d4621500b44f9f56b9a36b94eb790e8d89e17a0717b10a32e1d021477810e95dd9efda572a82b08c5f7
SSDEEP 384:+2boQk7vEP1OZML9FkARDGkzjbvbwS/66JozGzgC1bM:+a7jUZ4HkiDGkzjbvbwPEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 41b2c4dcf3d32bcd1e942e4303052f65cdf4a400081b4e62cc1fe0cad5dc135d
MD5 fcafbd795f7fc3fe26b0453551a3664c
SHA1 ae3b8ac8a4746f319c95d936b59fab61027462a4
SHA512 23a5e2feb30505ec133efccf274608a9947042e34e686d77bbc72f66c58c955818ba64e047ca9f01976522b8088c32a371d73dbd7ca12d560dd57ad90f782fce
SSDEEP 192:w/66JozGzgCl6mSShorvZboPIkhtckkPDfv:w/66JozGzgC1bh2boQkDSPD
MD5 SHA1 SHA512 SSDEEP

Submit Download

0fa44439-aadb-467a-a733-3b265e780bbb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\0fa44439-aadb-467a-a733-3b265e780bbb
Size 26KB
SHA256 535da96838ac7203a11a3e64d70319161ccb5f9fc406d80ea6c3ad97a1b1dbaf
MD5 d806de6ab250eaa36ea9a79579bc66c0
SHA1 a5e5e8edfd3d9435343c2d79fb922ac6fb88a288
SHA512 01ef701f3d00af325f7291d9db332ae57c14a80a6d24080d6c6286fa27168a37669f1f42bc1608c202c7305219595e2cde5c15c52c01f32a26558647eafb1cfe
SSDEEP 192:jGZahuNJXh+PGUVW2mKtHNcjK27SSrxzGRcJEudMbRwPSVdGMF8GH57idvUkoHUq:jj/VW2EK/SVSRcNSbCP4dpLBvT9rJSML
MD5 SHA1 SHA512 SSDEEP

Submit Download

cf745b90-bd6e-435d-a07f-6fea9793a9be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\cf745b90-bd6e-435d-a07f-6fea9793a9be
Size 671B
SHA256 5b7a7df51180c0e7874c3eb978657eb39c76232c5ef117f2040172652d07be65
MD5 73e38273af2096f1b91883a4fdc1c454
SHA1 665571e4932739ca15132feea8780a2691a7d891
SHA512 490497ff191ebfa85a13e993b84ef961a385ca60faa617f60d053e236f5b2a5b52238f5a9594f219ae29997bb61d71763a08a98cc419671036a6249afc0bd5dc
MD5 SHA1 SHA512

Submit Download

f1c48dee-3488-49cd-87ce-bca4e27f09f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\f1c48dee-3488-49cd-87ce-bca4e27f09f6
Size 982B
SHA256 d0454f4a5489f2363b0497ef8e22fbdd046a6edffbe8ce68ca1e13f5669108eb
MD5 d63156da3541729cd19ef5dba04cfd54
SHA1 fbbff858f5bbefe2068dd472d2b8b3f7532a7c3a
SHA512 5953aec212da545a17c426d9bb027aa244e75655e7d3d7f2316176e5241f853d6eb59f62067a794793e7f732723c39b6796498fea985319991208937088d2923
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
Size 16KB
SHA256 193f26c780645e04f75da2b78e4973057129d8183ee2b3320ad82d0a9a6cb309
MD5 6b9357855e6aaaef79b6439680738954
SHA1 4ac271464ef50c9fc617249a3e42172b4f0f5db4
SHA512 10c5500ecc23c963ccdc98222d49f25ed2238c75346f2ab7fa252dc38b66219a65cab6ef667bc76ec65295797e3062b12b25e014e3cf93e1c77531a8bbbcce47
SSDEEP 192:HsinZRnfk4a80I4J1Xfltk8Vpddsy1Zzp3eaXb+A70ZBiBw8HMhXvdan:RD031XfxV2y1ZzM8wlG
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
Size 11KB
SHA256 7d923a34c13b388c9c22c14c34c24b0e64a0eeccb464ec178ae93af09b7049b2
MD5 922ca43007159960cbd0495af77e253f
SHA1 e6db7e272c7203261cec64616c15387b74a4ee25
SHA512 7f1e7fe6301cfcff6b106325261f88b4c65946f25c9ecc14ca3f5e0f47b1c24138b8c26fc8f0ec4527e2b8890278fb4a77c2a08da4d311804b070f127fbb7748
SSDEEP 192:Ys5nZRnfg4a80I4J1Xfltk8Vpddsy1Zzp3eaXhA70ZRBw8HQ:5P031XfxV2y1Zzjhwd
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
Size 10KB
SHA256 5eb1a5cb2e0620416ec71d90bfaebfa27aaf0cc20680cba51b54e6ba7ab7d9c2
MD5 1a14666914cecde649937a55230ed59e
SHA1 5dc1906ccd7f2b2abd21e3d243a72e5b5e295060
SHA512 22a3db57032b969004d2d2764c3ed4ea2948a5183b304a5a6a50c51958d09d23dcb18e1abf0bfd94c917cbf7b9aa1c7184943ccc7f174b85682a37147b8968fd
SSDEEP 192:Ys5nZRnfgtDp3psxnHd3LtVNUnNt+8+V0tDsS3waX5A70ZRBw8VQ:5uuxxLtuzD3hwr
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
Size 11KB
SHA256 e1ca05a95c7356e1026bc42ba84268e8aea12ead19b4adbd8b92f48f3bbff2d4
MD5 b9dde8390dced9f790dbac9ee4efb9ab
SHA1 d809306b39adfbd1291a07081730794fd19a1045
SHA512 650231446774808b66cd0876e7ec6fca246ba7941285480ced115a700f99d15693b848822d727e3a0beada1c077016b4252e17135c8dc62f2be97ac1cbaf1a07
SSDEEP 192:Ys5nZRnfgtD80I4J1Xfltk8Vpddsy1Zzp3eaXhA70ZRBw8HQ:5H031XfxV2y1Zzjhwd
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
Size 12KB
SHA256 581d1c4f16e85a31c899d57b918c2f705fc97a8a25376181813fba272b7af12b
MD5 36b86d5b1598216d1297fa4346882577
SHA1 e299ed01a45f979558681fe4073cc3ad5ac94171
SHA512 7a876f85bfa333ab6eff0035677817ba2af2239d3dad623d8964b35911f983d26028d8aa8f4804d9a162db40644211ee58da58198a7edf9a2ecea5d2bab6fa70
SSDEEP 192:Hs5nZRnfg4a80I4J1Xfltk8Vpddsy1Zzp3eaXhA70ZYBw8HMSs:6P031XfxV2y1ZzjMwL
MD5 SHA1 SHA512 SSDEEP

Submit Download