1674205078159c8d56e0334465120c37cbf2c7a116f3a607fd81e35cb47df8aa

Analysis

max time kernel
136s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2024, 11:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241027-njt8psvmhy
SHA256 1674205078159c8d56e0334465120c37cbf2c7a116f3a607fd81e35cb47df8aa
MD5 bcd617e24ac55cfb8eee80c92fac6f79
SHA1 ee4f22cdad260b15fce83d97e160de79cc7551a3
SHA512 7fecb5f0c353959568e53ddd3b50552a94e33bbb9785614c36a6c84c3c041ac53d0ea1b5f4f3d12751d30b34b44d796c98b68dad564de766cf3200d3f2671398
SSDEEP 12288:HqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/T7:HqDEvCTbMWu7rQYlBQcBiT6rprG8ab7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4164	taskkill.exe
1884	taskkill.exe
2924	taskkill.exe
2952	taskkill.exe
3768	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4948	file.exe
4948	file.exe
4948	file.exe
4948	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	taskkill.exe
Token: SeDebugPrivilege	1884	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeDebugPrivilege	2952	taskkill.exe
Token: SeDebugPrivilege	3768	taskkill.exe
Token: SeDebugPrivilege	5000	firefox.exe
Token: SeDebugPrivilege	5000	firefox.exe
Token: SeDebugPrivilege	5000	firefox.exe
Token: SeDebugPrivilege	5000	firefox.exe
Token: SeDebugPrivilege	5000	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4948	file.exe
4948	file.exe
4948	file.exe
4948	file.exe
4948	file.exe
4948	file.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
4948	file.exe
4948	file.exe
4948	file.exe
4948	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
4948	file.exe
4948	file.exe
4948	file.exe
4948	file.exe
4948	file.exe
4948	file.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
5000	firefox.exe
4948	file.exe
4948	file.exe
4948	file.exe
4948	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5000	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4164	4948	file.exe	84
PID 4948 wrote to memory of 4164	4948	file.exe	84
PID 4948 wrote to memory of 4164	4948	file.exe	84
PID 4948 wrote to memory of 1884	4948	file.exe	91
PID 4948 wrote to memory of 1884	4948	file.exe	91
PID 4948 wrote to memory of 1884	4948	file.exe	91
PID 4948 wrote to memory of 2924	4948	file.exe	93
PID 4948 wrote to memory of 2924	4948	file.exe	93
PID 4948 wrote to memory of 2924	4948	file.exe	93
PID 4948 wrote to memory of 2952	4948	file.exe	95
PID 4948 wrote to memory of 2952	4948	file.exe	95
PID 4948 wrote to memory of 2952	4948	file.exe	95
PID 4948 wrote to memory of 3768	4948	file.exe	97
PID 4948 wrote to memory of 3768	4948	file.exe	97
PID 4948 wrote to memory of 3768	4948	file.exe	97
PID 4948 wrote to memory of 2340	4948	file.exe	99
PID 4948 wrote to memory of 2340	4948	file.exe	99
PID 2340 wrote to memory of 5000	2340	firefox.exe	100
PID 2340 wrote to memory of 5000	2340	firefox.exe	100
PID 2340 wrote to memory of 5000	2340	firefox.exe	100
PID 2340 wrote to memory of 5000	2340	firefox.exe	100
PID 2340 wrote to memory of 5000	2340	firefox.exe	100
PID 2340 wrote to memory of 5000	2340	firefox.exe	100
PID 2340 wrote to memory of 5000	2340	firefox.exe	100
PID 2340 wrote to memory of 5000	2340	firefox.exe	100
PID 2340 wrote to memory of 5000	2340	firefox.exe	100
PID 2340 wrote to memory of 5000	2340	firefox.exe	100
PID 2340 wrote to memory of 5000	2340	firefox.exe	100
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103
PID 5000 wrote to memory of 5032	5000	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3768
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {581b4bc3-76dc-46b9-84ed-ee126f91f76a} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" gpu
      4⤵
      PID:5032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2428 -parentBuildID 20240401114208 -prefsHandle 2420 -prefMapHandle 2416 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d79866e-204f-4385-b913-1973ac89cc74} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" socket
      4⤵
      PID:1872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3268 -childID 1 -isForBrowser -prefsHandle 3244 -prefMapHandle 3260 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2117858-a66c-4c38-b1a2-debfe6767798} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" tab
      4⤵
      PID:3428
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2788 -childID 2 -isForBrowser -prefsHandle 3156 -prefMapHandle 3040 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3249ac7d-758e-47e0-a450-f60179134fba} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" tab
      4⤵
      PID:2260
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4748 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4716 -prefMapHandle 4712 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ce91b42-8c60-42fd-b36a-78e87905b30a} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" utility
      4⤵
      Checks processor information in registry
      PID:5308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5184 -childID 3 -isForBrowser -prefsHandle 5272 -prefMapHandle 5188 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82dbc866-87dc-4a3f-93c8-3a2e46f23893} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" tab
      4⤵
      PID:5924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 4 -isForBrowser -prefsHandle 5164 -prefMapHandle 5168 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e710c2f-69e6-44a2-a3be-237257ecf70f} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" tab
      4⤵
      PID:5936
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 5 -isForBrowser -prefsHandle 5584 -prefMapHandle 5588 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b83a7b9-dbcb-4d32-a2a2-13d20fb939c7} 5000 "\\.\pipe\gecko-crash-server-pipe.5000" tab
      4⤵
      PID:5952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json
Size 30KB
SHA256 795e7cdfa7fb288a59f4e57a16163eb1d808d5adac47bba151af4bacc9a12272
MD5 229017d310bdd6445b409ed7854582c5
SHA1 ffffb256241171c29fcdc7d638088a03ab9d7538
SHA512 252204db8e20deffd6daa3827bb0b52b34274ff3fd7883a0ec8662137751f3b78b330eee73230b62d5114a97096e63917e147c0a8396fb64f5633cf9adf6074f
SSDEEP 384:Ki8o+axiO+L1MaW8RNMx9jjgyauHJPeogCACU0dC5CsJaH:aotxYLa8O9PgydHJGof/UwC5CsJaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 a489337fdcd2d768407c5a18f2e5725b76131aed2752763689313f6ce56cbd5c
MD5 b0d42505e8dd6cd345109baafaa15d5b
SHA1 3e6a1aa75feda45d487601310b4b6293558b598b
SHA512 cf4cc2f317380016db0fc57272186b8583cf39a3551f632b9ddb46db2b9f32645e3f3a93e70f00ff4f836825f07a51174486200eb8779f5e77483787d0566875
SSDEEP 384:H/w5Iu9fiGLm4pUAA+Q+4IYKgH4Zv+3yPrIVy8eUVF:8Bi8mCUAxQ+4INy4ZcyzIVy8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
Size 7KB
SHA256 6e5e86c0c7fc03d0d59f59073fa84fac23e13d401093c5710594e50e590392a3
MD5 972cec87de79a7511366286923910548
SHA1 6ba64f714b9b5eca6b3a1b481f34bdaf72f3b9ec
SHA512 c4efcad3d3c018a14c4040e192c40eef2c1ebac81c807115ab2c2d20f7e84ba841315a7f445a0b5e05db7088081bd2eed137ce1bfabdca548a1a7d675d9d86fa
SSDEEP 24:5uB1oogu1xgRbrabpR5cOSabuhMZrPhFsh2F3LFXLXsJblLKXZb:05oCb9cOlPzebVKXZb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
Size 11KB
SHA256 8eb23e77e25c4dd4d387280b43db39676400e04bdae8615d07b845417910046f
MD5 9a92ccb0322847b8d16fab4e27b455d9
SHA1 622c56a089a821a8759f7721aafbd6743c9ecf7e
SHA512 3266f90f01f9b41491bdf01cfb3df327bb9658eb61b9eb947a65064ad968c30e64df89cd6137a0809a1c4ea2fc31a988e24ceacfe4bda3d9f290bae4498f91d9
SSDEEP 96:95oVbEY2ebVKXWbcebOJXWbXpebvpf+XlbQbWlb:95Ku
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 28564906bdd60a6d2f9a98df357d5340d12c631250cb279d7f57e4b45bcc20ea
MD5 2c1f6b4dd7aae460e88e619d76869b78
SHA1 88272b917fe2746f96b5a9459176d16a2440d0e6
SHA512 227bc5224efcc3f16e1e72c5e31c443c744f27acc78ae3b73070743e7220f00639cd9daab5a013f4c8fe343f9c9ff26374fcaafda7cb9d9286896ab32d700a5d
SSDEEP 96:USMF9ZbkW6ShmhIPP/PrWZyMQBmFl66JozGzgClKtmSSM:UrvZboShE+PCYS/66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0e07f4e0953fc154e3c47e4ffcb1385f120cbc6758c087af537e3c33c5b07c36
MD5 2bd6865f4cc3add3e6b4e1db7391a86c
SHA1 5a89be36d7c055d324910958d131341146e4c6cd
SHA512 aca54d11a50833f800e06f197351421e0fa49bb07b78a122f671627772b91872379f2d02b03745b641c74613031e73fbb133f7e7daa48edf490efcf482792427
SSDEEP 96:8BXSMF9ZbkW6rBBchmQIPP/PhxXnWTMQBmFl66JozGzgClKtmSSM:8rvZboPchT+PDmTS/66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 5368c74f2002290a4dfa2a6a1c494041a64f8a11bbab2e79d07e6db830618276
MD5 c892d3e55fbea1452cdc80207c8abc46
SHA1 1bae534c7270ef7d6e0a6e0d8a10f91d2fde40b5
SHA512 24b18e51797c13ca2cf0a1611f28fdc38ece6443dc3c1d8208578370d9e83a437ef0be7babf3745b95022f2a1ce1e8ec2adebdb997e512f7059cc41f75a60edf
SSDEEP 384:mmYFztGwDe2yKbcbHRZ/66JozGzgC1bGbokUXP0:1yR7De2yKbcbHRcEcYM
MD5 SHA1 SHA512 SSDEEP

Submit Download

2ab94545-17f0-4303-885d-cea9cb4bdabe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\2ab94545-17f0-4303-885d-cea9cb4bdabe
Size 26KB
SHA256 55031e7e582e89fd9d53c58a07b2befd4284012a59fef48aef6d8643fe2d7782
MD5 c255e6d44a64cd5ef8e2652176d73ac7
SHA1 8430984603e5ab7a8c165a3bbde7b3cbfe829370
SHA512 60ccbe9119a5b9da8ca8fb79dacb1992ab0c21c63d8d855819a7f2b3d90e31e5587e12f1d604b2bd144d3cf8213c092baa0562a5201f26861ee0b37362991488
SSDEEP 192:/f8z9GGqCS8PFacybEVMWXS2gJZc4jzkOqDipEAoxvn/G41lAuh3x+/7hLcZgfFt:/EcGqXQFac8EVNSNckuVQDFepU30xXd0
MD5 SHA1 SHA512 SSDEEP

Submit Download

798410c8-a295-4fd7-a026-87d7fe8db073

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\798410c8-a295-4fd7-a026-87d7fe8db073
Size 982B
SHA256 13ba83e9a12b567be7c2be1411651192a094413d0a8d1ad773b09f13bf0b1744
MD5 bdaa23f5ac61ea4e06f27d0796407ed0
SHA1 b0bd4d4a987f35073b33311e8fe76b1bf755212e
SHA512 0694d2f25575ad5f57849edf29be05f4c08186263c19403bf76be95847d189e5a07776d0f56732d1e216f956ea6a774fbf20a46d41b63c7cce2596795e5fd75d
MD5 SHA1 SHA512

Submit Download

fe3b9ca3-f134-42e0-b7e9-c8661fc4ce5f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\fe3b9ca3-f134-42e0-b7e9-c8661fc4ce5f
Size 671B
SHA256 a720e365da24d30aa52197d815d78bd4d86d870906787897fe85ec6b682fe7cf
MD5 44d6d4372990ee04450be44733e1d0ca
SHA1 d7a72f43d0fdfd6c82d5e56e6ba586369b05fcde
SHA512 2a57ae9952eb233a244085a5e528ac282d22261f50cfd5d7a6bb31abf008cf2e709919cf2dce5609354161382c71cf0110f1552ab58b7c6f0a3d2c6d3e0fa86c
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
Size 12KB
SHA256 ec347344c67af7701e4bb508dc31fcd6ad210a07ad09cbbe52deffbc857fff08
MD5 b015a0cf9ae598b39661c2816055aa46
SHA1 b0b43874cad6c01de66a44b8c864cd157d341cfe
SHA512 fe0ad221fd8bac15f520e914455a68c248fe43b90a8c217edf12c2a15fc37675ab65a4b8f3ffa2a40b7d2a5d9147251ed7095cb6744240a9da1faf3b85ce7454
SSDEEP 192:Q65n/ReMYfMFRSmyI4NaNptvHGU2dendRoE5BcUnwNk9RaXNXdxpSGpBw8HF:QFznh7aoU2dev1vXnwNgiNxHwa
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
Size 16KB
SHA256 61f3249c824432cdebcf7ca5f62ad6ebbc920b938f06c4e783877207b4d99ada
MD5 f6bfe4aed493eb07f33ef8565d0b192d
SHA1 82da6767461ca4fe1e46a69f6e3813b3bf742050
SHA512 f6dcb0172e273ebda1ccf176a5959cf7f979b830cf92a843eb17f87be3b928095dfe33ea87967c16f9b424a641667cbb50b8d5be1f72445ec6f0363d66ef928f
SSDEEP 192:Q6yn/ReMYfWFRSmyI4NaNptvHGU2dendRoE5BcUnwNk9RaXn+XdxpSG6iBw8H5n7:Qszlh7aoU2dev1vXnwNgfNx1wC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js
Size 10KB
SHA256 89e70331281ce4e5f603eacb127a105756bc9a448aca86be46574fed5cbda582
MD5 0afe44f1fc50321301c74f8d33ace74c
SHA1 0fe85d00ba643615d7c9abb77149a184d7623dea
SHA512 48a432b9857528ea89ba6b5fa84b2a2c1309ae505c7d2c6d4fb76a6ceba104976d140e8d3f585812085e0fa0b1488b03b7c81b5e56df5a8fd3a11cc76b4f9fc8
SSDEEP 192:F65n/ReMYfMKN+s/uI4gYcU8BtD8JJCddLMy1Zzw3maXWXdxpSG4Bw8V5:FFz0sWuYgUJJ6My1ZzVNxqwq
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.1MB
SHA256 d62f2ba88a0bd0f3c8736fa4f18da4e798088eb37c345178f7eedf1e93e8af78
MD5 6ada2255cb5bcb1d6b8c2efcb04277d5
SHA1 b3bb6da76f61932b927d09b21f99f1071a35a977
SHA512 947930497ecdc6531b3004a30892506ca45261561102326ebf70cce698f31c91ddd9f1684f8aa69ec68683b2226626a0599ba8449b0c102c760fdf029e79f484
SSDEEP 6144:967rIAt3e3B393z33THlaeMsmVUDj3Z9UlCpio1PtdzejkwwrleHN1HmcH11HAZ4:9rnMsm+Djp2A0UprkM0zlbpF
MD5 SHA1 SHA512 SSDEEP

Submit Download