Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
24/10/2024, 13:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 898KB
- Sample241024-qdcsksxbqe
- SHA256 f02f2b6cc008e93e49656ee981244e2bc4c6d352dfe1921974ed88fd70c8fe17
- MD5 7204a55ed486cee5061c0518d9f594ac
- SHA1 58eaf918c76803f4405230aaad34582fa1a65a4d
- SHA512 e3cfd356db65c93a30842cadb5e04c7fddef5c2202a851c40a38b85ec8d49f2051cfc1790dcf4931cadab607dab92375ce41febbd06e9d7e72161e8afaee7c06
- SSDEEP 12288:NqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Tt:NqDEvCTbMWu7rQYlBQcBiT6rprG8abt
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Kills process with taskkill 5 IoCs
pid Process 1112 taskkill.exe 3944 taskkill.exe 4396 taskkill.exe 2624 taskkill.exe 2460 taskkill.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings firefox.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3992 file.exe 3992 file.exe 3992 file.exe 3992 file.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1112 taskkill.exe Token: SeDebugPrivilege 3944 taskkill.exe Token: SeDebugPrivilege 4396 taskkill.exe Token: SeDebugPrivilege 2624 taskkill.exe Token: SeDebugPrivilege 2460 taskkill.exe Token: SeDebugPrivilege 4704 firefox.exe Token: SeDebugPrivilege 4704 firefox.exe Token: SeDebugPrivilege 4704 firefox.exe Token: SeDebugPrivilege 4704 firefox.exe Token: SeDebugPrivilege 4704 firefox.exe - Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 3992 file.exe 3992 file.exe 3992 file.exe 3992 file.exe 3992 file.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 3992 file.exe 3992 file.exe 3992 file.exe 3992 file.exe 3992 file.exe - Suspicious use of SendNotifyMessage 30 IoCs
pid Process 3992 file.exe 3992 file.exe 3992 file.exe 3992 file.exe 3992 file.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 4704 firefox.exe 3992 file.exe 3992 file.exe 3992 file.exe 3992 file.exe 3992 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4704 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3992 wrote to memory of 1112 3992 file.exe 84 PID 3992 wrote to memory of 1112 3992 file.exe 84 PID 3992 wrote to memory of 1112 3992 file.exe 84 PID 3992 wrote to memory of 3944 3992 file.exe 90 PID 3992 wrote to memory of 3944 3992 file.exe 90 PID 3992 wrote to memory of 3944 3992 file.exe 90 PID 3992 wrote to memory of 4396 3992 file.exe 92 PID 3992 wrote to memory of 4396 3992 file.exe 92 PID 3992 wrote to memory of 4396 3992 file.exe 92 PID 3992 wrote to memory of 2624 3992 file.exe 94 PID 3992 wrote to memory of 2624 3992 file.exe 94 PID 3992 wrote to memory of 2624 3992 file.exe 94 PID 3992 wrote to memory of 2460 3992 file.exe 96 PID 3992 wrote to memory of 2460 3992 file.exe 96 PID 3992 wrote to memory of 2460 3992 file.exe 96 PID 3992 wrote to memory of 2880 3992 file.exe 98 PID 3992 wrote to memory of 2880 3992 file.exe 98 PID 2880 wrote to memory of 4704 2880 firefox.exe 99 PID 2880 wrote to memory of 4704 2880 firefox.exe 99 PID 2880 wrote to memory of 4704 2880 firefox.exe 99 PID 2880 wrote to memory of 4704 2880 firefox.exe 99 PID 2880 wrote to memory of 4704 2880 firefox.exe 99 PID 2880 wrote to memory of 4704 2880 firefox.exe 99 PID 2880 wrote to memory of 4704 2880 firefox.exe 99 PID 2880 wrote to memory of 4704 2880 firefox.exe 99 PID 2880 wrote to memory of 4704 2880 firefox.exe 99 PID 2880 wrote to memory of 4704 2880 firefox.exe 99 PID 2880 wrote to memory of 4704 2880 firefox.exe 99 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 PID 4704 wrote to memory of 4900 4704 firefox.exe 100 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4396
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking2⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0889f56d-6554-4602-9afb-5bff9024e37f} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" gpu4⤵PID:4900
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b8a74db-f200-4f78-b162-eaf580a73cb3} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" socket4⤵PID:4140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3104 -childID 1 -isForBrowser -prefsHandle 3264 -prefMapHandle 3260 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ca6b761-c1ca-4b71-a55b-0a51a123e40f} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" tab4⤵PID:2052
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4020 -childID 2 -isForBrowser -prefsHandle 4004 -prefMapHandle 4000 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b048e53d-6dd2-4bb8-b522-882c774d7ff8} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" tab4⤵PID:1732
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4644 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4760 -prefMapHandle 4712 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28f3e8aa-ea01-49ef-814a-adacd51b5bac} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" utility4⤵
- Checks processor information in registry
PID:4516
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5360 -childID 3 -isForBrowser -prefsHandle 5356 -prefMapHandle 5352 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ce0b02c-1f63-4d9c-9596-ba87b39d7ede} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" tab4⤵PID:448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 4 -isForBrowser -prefsHandle 5500 -prefMapHandle 5504 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fddcc19-9fed-4537-9053-db9dea82969d} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" tab4⤵PID:4168
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5780 -childID 5 -isForBrowser -prefsHandle 5700 -prefMapHandle 5708 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18f05ce9-3b4d-43e2-b278-2574e09dfd08} 4704 "\\.\pipe\gecko-crash-server-pipe.4704" tab4⤵PID:4584
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json
- Size 29KB
- SHA256 906a6b0540f1e7f340837a2ea41bd6752b9fb44aea494c4b25d88fdd64eae06c
- MD5 c375b08a9e5659282293ba6d590191be
- SHA1 f37e4f10286e6278133bac0901f28d9ec6dda9f9
- SHA512 65f9e0db7494b1b333635b76e37caa5e020482a6e58745e9bd794d0499142ac2c05a04861f28afcb96ba036d35fcaa530d8348d4526028abc1b9d7d4e7b3c2a2
- SSDEEP 384:Z2cZ7Nrg9n46BxmZFl+zGUod6ljYhW0bjyauTrJVxBxRNgt3d8E:QcZRs9n4qm5EGUoQ2hW0vydnJVPDNy8E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
- Size 13KB
- SHA256 04270a3578d71c32123c1e18edfbee97f48456478fb06e1e33f27c8dcf5aad31
- MD5 a5bcc7c84963092320d957e261856526
- SHA1 df15d05dd1c318432fda458929b6c4d68dabf6d4
- SHA512 d9e5cf45d7deb68ebb7ee5c06747cde4bbb4f58751f69f539161ff47b30f8f3a6dc53efc602cbdc9c472e97e27f7d862fe31af5b040e5d9d709d174730133bc3
- SSDEEP 384:H/w5Iu9fiGLm4pUxpHLFoCr/E8HPJyD3VonFcP+AWRMACMJL:8Bi8mCUxpHLGCr/E8Rg3V/+hRMF+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
- Size 10KB
- SHA256 cc259df5072c88544763a90adeb282151b34cfa77c4b3a065ebb94e1c686250f
- MD5 b615fc9cdb124be108f52479b9be9959
- SHA1 93de45f14a464b32a6cf59a4eb1e001afcf40a0c
- SHA512 9da9c294bbbda2f031c5fdfea3578fe37893bb11caabbe9672f4042bc0fcd45909e420a955b685fe8c162635db9df13bc418bec156547b369a3b2c44359a0fbc
- SSDEEP 48:a5o29cOVAebVKKbMvebOJ6bVCpebvpf+kb:a5oXebVKKbsebOJ6bspebvpf+kb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 a205a75b25b233887f26def50123231cbdd60c30f32ad6b02e19304f3100eac2
- MD5 4f2a8e305f8d0dad4c42dca579ec5996
- SHA1 6d674724dda783bb1f3d3b3e111d1fcaa870a5e8
- SHA512 ab63d9e14b58692c3772978ba60555a2781ec7294723ba0326df2ba8448150389314dab93ca934b93f6191e59570d45b04c4757ec45be2152c587ef3271b3dc6
- SSDEEP 192:ycDPcU/66JozGzgCl6mSS+rvZboPChCG4Pafc:HDPP/66JozGzgC1bYbo6T4PL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 5c3483a55e8de8b0dd76f8dce1f90791b3e0882b74ad7887b15adc94dd3bf673
- MD5 753cd0f882e2bce08b8abf679ddce2c7
- SHA1 e90155d4fa1241e14672c9da758e139617dca1b6
- SHA512 2fda6d572c3cb29bf98284ae54179bc31321957af3bda8d0dafa12056c79c2f44948941c89c0e3f345e3b9f223e487491eebba6015954f8fb591677acf39d09c
- SSDEEP 96:ZlSMF9ZbkW6YzhmyAPP/PrWZdMQHQqHDHPHcUFl66JozGzgClKtmSSM:ZlrvZboYzhDmPC3BbDPcU/66JozGzgCm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
- Size 13KB
- SHA256 ec0a6472a769e657bc01f40e266adbae2f74395e2273dfcedd258fd8832b0c6b
- MD5 6daa7f986a46eb98a72e356315ccbd44
- SHA1 612715af4f0b55bdb7869f9006b16b5008b12d5c
- SHA512 b602624d93515627c9109ad44e18ccc562345fb26b3dc592b69604a6e199abb2bb80b9eb4b48c3a4537cf1b4033e16026221e75c26b94dd626fd9937b31da345
- SSDEEP 384:5bbo7zYmPKeJi8iDt7H0bzbuKbDPP/66JozGzgC1bM:5/2FSeUlDt7H0bzbuKbDPqEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\050acfdf-5e06-458c-9d36-c08ad1c8fe6e
- Size 26KB
- SHA256 f76a4665696475753f20fffc45bb75448a6065662d84f090a44097046c0da9f7
- MD5 2e30ecc9c1829d79989bfcaf28ea9eb1
- SHA1 ca33e67a151fc5ba4b8ee6fe6d8577c63f7cf83d
- SHA512 e14544491a354dedbb08747e77e41690e24881cec7e2608266738cb6fd3bf787a112f77debc99947459d148b38345973517f6443cf687b0aff8d1a77d80d485d
- SSDEEP 192:cq1+qCYyzGnS0WLKZ7zCSVhlF0mHTPZzXnv7brTfS6F2+A3UQgS4NzjLAhwOvo6w:cU+sy6nS06KJuSd3kkF314EyzFUCukM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\9077ef3c-e707-4e74-ae6d-e96a775f47ee
- Size 671B
- SHA256 9805647f78831dd60347f3b8bbe50e40ffe05efd86de286b677b2c4f634f8f8c
- MD5 5a703f9f3e4c9cebf1068ccb4acab113
- SHA1 b8ce87acec477613835d4f394cf8f21f925570cf
- SHA512 4db7ad5d443d35189d5fd5302bfb803eb1281edf473afee87787f88babd4e61dddd71f05ffafc3caefb1b7f0dbf4c5f8062b65f2f8d87e5436e0c8b782b6f765
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\e9497475-f0e4-416c-8fa3-9a8fc7bb5fb3
- Size 982B
- SHA256 4afa08661764860c7b6b2e84970e5773ec75c9097cf5b1ed362430a3a578cfd3
- MD5 b04df072745252430c6c51b82afa9f1b
- SHA1 4845b6b4023f582b15695aa7ec198a2834b36044
- SHA512 24fefe517869eb793edb05abda1ccedf890517f4a822490ccfe7af53ba87e60dcf40e106462bbd30af14de407f58a8345ddb7aa2af0e7fe7136c9b4cde872c2b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
- Size 11KB
- SHA256 888e4fafcbeed2e90634422baf03bd4c020172307702999272eb5ecef87bb376
- MD5 106c1b1328986577787e0a3822c6e939
- SHA1 59a14801099db7d4229a1b907712921ed5cd023f
- SHA512 cef537b48f507f5ede5b8b5d0d53411faa729dbf2ecb3c7c8624787f1c296ed0f060bbe89cd621e319da7286c9ed8f303ef2ef4cb339822015a4cadf0caf8089
- SSDEEP 192:F65n/ReMYfMYztins/uI4gYcU8BtD8JJCddLMy1Zzw3eaXPXdxpSG4Bw8HM:FFz8sWuYgUJJ6My1ZzgNxqwx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
- Size 11KB
- SHA256 5569307f0d75e28c00892c9601602dfc500bebe14879ff97606777b4f3f23660
- MD5 ef08bbc211f2eed16b19f1a236b8ca55
- SHA1 9b81d51b423bfd417685e97f9904d2453f019dcd
- SHA512 28f7baeb71b90a511fcbc213d4653c1e9e830580f39e041e1cfe73c03cb250c928571640ff40760e549ad22a11b0f2489426a70b8e15a156a893d8945c44abb7
- SSDEEP 192:Q65n/ReMYfMYztgzubI4r6Tm9tT8YShddeRy1ZzV3daXPXdxpSG7evBw8HUC:QFzKubtKmgYSkRy1ZziNxyws
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
- Size 14KB
- SHA256 4d9a0e819c74977500e22ee924e90e36a13a74ac6e7f793cc090b0db1913c711
- MD5 71a505c5a779363e1a3577f890f7d6b8
- SHA1 812b6c078105b540da8c6c77b29751b15c4ac657
- SHA512 93f7b9b3800c888b20824115311b47634ae0b339884d949d65507697b995f4aed5121abeab9cd71d4b42fafacea20ec8463fd7c27f56fb5f8f3fc842aa3317fb
- SSDEEP 192:Q6an/ReMYfGYztgzubI4r6Tm9tT8YShddeRy1ZzV3daXR+XdxpSGd3O95UBw8Hp6:QUzIubtKmgYSkRy1ZzfNxrwF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
- Size 13KB
- SHA256 6913277b666db1c2fb11de931a81f06f9dd740f38b1cd4bb39382f4692143686
- MD5 6a23d00a662afd8ddcce1a1853119e74
- SHA1 1a80d13919b80c238f212eff83f7570a00eedf5a
- SHA512 85717f58669c315cb7865bbf9e0f6005b7c6996c3045a3245d03beccaadf44b3b6d37ac594baea74a25e75abc856587196d114abed396fb1d050a366e9644090
- SSDEEP 192:Q6an/ReMYfMYztgzubI4r6Tm9tT8YShddeRy1ZzV3daXPXdxpSGd3O9tUBw8HrDa:QUzKubtKmgYSkRy1ZziNxTw3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 952KB
- SHA256 47199b5b68ce14e57bad73c864fbfa9c06c30e36c320bf1b6f1d21be9d095674
- MD5 40bce507a91e5d6bf4598de9ad855bcd
- SHA1 28f68b975fa0938e6be55ca8f686f13ba62bd85a
- SHA512 3fd7b748123904d5a5f65ce34800b248bd4e28170204c96c2815dbebc57b04cf29bb916d19e7f0c45f7d14908afdc418be92c1717c3c89bc6887c53007ec43db
- SSDEEP 6144:xq7rSAt3e3B393z3YTHLPAU+VU4jr9iL9UzRbtugXNeHN1HmcH11HZZmz0Pu/elL:xePAU++4jxiL2tT9pbZ4k4V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 2.9MB
- SHA256 3076e5dc88755b878e729db4e1e4a244eee713b96fe6c96ef71d4420bea6c570
- MD5 a7546d2b8fa4d6a61c5f024f1f0107f4
- SHA1 776b5408eed948104f30ed0a1550748b2a44a55c
- SHA512 9ee547d47539e2f0350f34868b3de26a2ce8dcbb0d7afdc037857455a8db7702e55b6745225e845b8ba97971580d1b04937b77dce8dd75f8a27a7fc31643bde4
- SSDEEP 49152:jA4Nu2FMkDTBcX9ykbR7YN3czRF6DTBru/iIgzeyjEzCM5NtKA3ZQ4PxF0KOORRe:dko
- MD5 SHA1 SHA512 SSDEEP