f963f59209443304c987ba8defe0b9d7b26284a25ed51c0cb3ee7b83bb356a8a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2024, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241028-vzvbzaskgn
SHA256 f963f59209443304c987ba8defe0b9d7b26284a25ed51c0cb3ee7b83bb356a8a
MD5 36e326562ccfc7504f9d23095789964a
SHA1 98d840a59071822ae34936c980039739f50f22fb
SHA512 5c75440cc85306cc281b41e994b64c82a03834b03678e6a63bc9e0b8e606b709d249622b7062afa5a3a0480d45ce58c4b8317d4d5c88f47099a0c6338a7a442e
SSDEEP 12288:XqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Ts:XqDEvCTbMWu7rQYlBQcBiT6rprG8abs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2564	taskkill.exe
3296	taskkill.exe
2684	taskkill.exe
3524	taskkill.exe
4072	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3800	file.exe
3800	file.exe
3800	file.exe
3800	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3296	taskkill.exe
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	3524	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	2044	firefox.exe
Token: SeDebugPrivilege	2044	firefox.exe
Token: SeDebugPrivilege	2044	firefox.exe
Token: SeDebugPrivilege	2044	firefox.exe
Token: SeDebugPrivilege	2044	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
3800	file.exe
3800	file.exe
3800	file.exe
3800	file.exe
3800	file.exe
3800	file.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
3800	file.exe
3800	file.exe
3800	file.exe
3800	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
3800	file.exe
3800	file.exe
3800	file.exe
3800	file.exe
3800	file.exe
3800	file.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
2044	firefox.exe
3800	file.exe
3800	file.exe
3800	file.exe
3800	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2044	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 3296	3800	file.exe	84
PID 3800 wrote to memory of 3296	3800	file.exe	84
PID 3800 wrote to memory of 3296	3800	file.exe	84
PID 3800 wrote to memory of 2684	3800	file.exe	91
PID 3800 wrote to memory of 2684	3800	file.exe	91
PID 3800 wrote to memory of 2684	3800	file.exe	91
PID 3800 wrote to memory of 3524	3800	file.exe	93
PID 3800 wrote to memory of 3524	3800	file.exe	93
PID 3800 wrote to memory of 3524	3800	file.exe	93
PID 3800 wrote to memory of 4072	3800	file.exe	95
PID 3800 wrote to memory of 4072	3800	file.exe	95
PID 3800 wrote to memory of 4072	3800	file.exe	95
PID 3800 wrote to memory of 2564	3800	file.exe	97
PID 3800 wrote to memory of 2564	3800	file.exe	97
PID 3800 wrote to memory of 2564	3800	file.exe	97
PID 3800 wrote to memory of 1568	3800	file.exe	101
PID 3800 wrote to memory of 1568	3800	file.exe	101
PID 1568 wrote to memory of 2044	1568	firefox.exe	102
PID 1568 wrote to memory of 2044	1568	firefox.exe	102
PID 1568 wrote to memory of 2044	1568	firefox.exe	102
PID 1568 wrote to memory of 2044	1568	firefox.exe	102
PID 1568 wrote to memory of 2044	1568	firefox.exe	102
PID 1568 wrote to memory of 2044	1568	firefox.exe	102
PID 1568 wrote to memory of 2044	1568	firefox.exe	102
PID 1568 wrote to memory of 2044	1568	firefox.exe	102
PID 1568 wrote to memory of 2044	1568	firefox.exe	102
PID 1568 wrote to memory of 2044	1568	firefox.exe	102
PID 1568 wrote to memory of 2044	1568	firefox.exe	102
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103
PID 2044 wrote to memory of 1652	2044	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3296
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3524
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4072
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {25e4db99-8ac1-4265-9514-1c37535db207} 2044 "\\.\pipe\gecko-crash-server-pipe.2044" gpu
      4⤵
      PID:1652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2400 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6d7d65f-7a3b-4e90-9e4f-71e82d59371f} 2044 "\\.\pipe\gecko-crash-server-pipe.2044" socket
      4⤵
      PID:2216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1628 -childID 1 -isForBrowser -prefsHandle 3256 -prefMapHandle 3208 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e21b62f-df11-4be6-a9bf-aad9a1aff02a} 2044 "\\.\pipe\gecko-crash-server-pipe.2044" tab
      4⤵
      PID:1920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4068 -childID 2 -isForBrowser -prefsHandle 2728 -prefMapHandle 4032 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d576fc0d-2590-49e9-a5c9-2e5126bdefc5} 2044 "\\.\pipe\gecko-crash-server-pipe.2044" tab
      4⤵
      PID:3068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4828 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4660 -prefMapHandle 4500 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea826302-2337-4f87-b000-c5f13d5219af} 2044 "\\.\pipe\gecko-crash-server-pipe.2044" utility
      4⤵
      Checks processor information in registry
      PID:5140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5076 -childID 3 -isForBrowser -prefsHandle 5216 -prefMapHandle 5128 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {000067ba-2be0-4fd1-b6d6-1ca1d9a7db6a} 2044 "\\.\pipe\gecko-crash-server-pipe.2044" tab
      4⤵
      PID:5772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 4 -isForBrowser -prefsHandle 5340 -prefMapHandle 5348 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d9166d9-12d0-48bc-9ea3-4163433d7906} 2044 "\\.\pipe\gecko-crash-server-pipe.2044" tab
      4⤵
      PID:5784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5504 -childID 5 -isForBrowser -prefsHandle 5512 -prefMapHandle 5516 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40e681dd-2909-4f8c-9cdc-7a9352cdbf2f} 2044 "\\.\pipe\gecko-crash-server-pipe.2044" tab
      4⤵
      PID:5796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json
Size 28KB
SHA256 ceeb1de476a2682e14ee4f0eca93b25588e91b99fb396e06728301c3198d7be6
MD5 bdb6f3c86d3bea2adb1e9a6e56a56457
SHA1 de74beac1a27412b40849ae5bb59f48d74949251
SHA512 ffc118f16515df14bfc8491da38c440f9414a1d6cd2da6621b6ea0cefaf77c9a8f1ad18cf8d5732098ee7c733b0a99f858d29c747a56409ec1760249ec220e9c
SSDEEP 384:Gx7yMzaIgqbNArU3nruUoets7voWyau5gX0XJQV0zxXQ0zxUAiIPSx5:GrjZ3rudvoWyd5O6JQV0zlQ0z6nQSx5
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 dfa3dd2de09ef3bd9f5e966cf75edcecbb2ae806eeb4665dec509a234c8cb324
MD5 f9083afe8f9dc6af995b0806d740d318
SHA1 b9c4976885a02f97d47d3f8bd93b03faa8fdc6be
SHA512 f6aa57a889d76a340a338296c4ddded1cb11b2f92d38afd346f9f77bc4131da476156433a35ff5ae73e04c487be7cff1a7d4cb2af3baa896ffff01708b45d5a2
SSDEEP 384:H/w5Iu9fiGLm4pUgA+Q+4IYKgH4Zv+3yPrIVy8em+E:8Bi8mCUgxQ+4INy4ZcyzIVy8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
Size 7KB
SHA256 091d04a2b284d82a130210c187fb06367956b03ace0002525973ef6f3652c84b
MD5 793d377d90abc71ef11527086c42ae31
SHA1 d45b25c9c8e1d69e40498f32ad3703a34aaa7c51
SHA512 e5c4ed4b1a13db9d27a8d192d30fdc772058d3dd0f54a34cecf828e938f41395bff69db29d43c35d736b44c5196c5b112ed4eb5392b0023e95689216efed7fc3
SSDEEP 24:5uB1oCgu1xgRbswpR5cOWruhMZpGFsh2F3LFLBYsJblLKLPb:u5oN9cOWeCebVKLPb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
Size 10KB
SHA256 d467973755945c95ac960313c44963270c1990e7b47e4c674bcac3c6d46b6e09
MD5 18812c91994b4201f73439c821d5f1e6
SHA1 0544f493f4bd2071af64bc499ff721037f9d1039
SHA512 ffa5b51390c7a2d2f17837e108cbef057ed04ad5ebdaf4b84ca89636388c5c93b729bc4627d2b3bde7c4319fa75afddbb6d4e1dd6eda7ad36b02c93c6b01c506
SSDEEP 48:z5oxc9cO0KCebVKLPbvebOJLPbdpebvpf+LPb:z5oVebVKzbvebOJzbdpebvpf+zb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
Size 12KB
SHA256 13761a5a564cebf1f36fe5a458240658b957896ad596c2e09ede12ab3d71108b
MD5 7e6d64946d0753d786206d8b098b25d8
SHA1 1f195a10d326760f76f8bfadae767a7a1219d943
SHA512 2412dd7917985df2f4ac3bd919b2445bc161e38a2ff1e90f9eef03c45a42db464278166038cd6cf3a207c51bb981220d24495fef4b7ac4467275071bf219c58a
SSDEEP 96:z5oVebVKzbvebOJzbdpebvpf+zbjbrb1gbgzzb:z5qu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 7ad4e990b08f62a99a85639c9e92b533d6c74c0402f2c1b09d47007cda1c792a
MD5 6a0cbe020fd892abbf8151cbe3b18ab3
SHA1 2d81d45c2a0c3f7a7b799e0c48d9460e3790b6e2
SHA512 6161a618392fb71c34f1e1f1c139739fd8a8cce1d58de8aecb03aed1fc42164e33c91258d443e946ec312a0146cdc1dbcfbf0bf7c57f288bf4947d8a04213b33
SSDEEP 96:2SMF9ZbkW6Shmd9PP/PrWZyMQ/5w+Fl66JozGzgClKtmSS:2rvZboShIhPCY3/66JozGzgCl6mSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1730343bdf0d6bce6ced17db8e997afa33855c63d6b95422cc8598d9fa8d7538
MD5 57ee48cf250646a301226200304030f4
SHA1 706467420eded80d5885e7a90bd42ffbadce8571
SHA512 f10df7f09301d68fddac3b38d227c7194c1a4d727620a386b86db838e1868921a8cc221985ac9745c8d1967a5f6be3d8fc748d9260cf4c0bde9d1c834140125c
SSDEEP 96:zB4SMF9ZbkW6rBB9hmJ9PP/PhxnWmuMQ/5w+Fl66JozGzgClKtmSSM:mrvZboP9h2hPDWp3/66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 86083639a0e476e5c8632f7b0c0ebdf5d6123008760ba7ad3c288e23cf6d1b55
MD5 f3282a405705831d13009703c4fe420a
SHA1 2bbe2c37082ec87334b2461f94ceb99f4cdf5e48
SHA512 34faaba967e1959e6afd8e1bae58831cc91999d2c56600a48816b047fbaad420b6fb3b19da4511c5bc52f76e4ae2f76e03df98e9ca2417cd9a21403594a9cec8
SSDEEP 384:nrI+nQbDxGmJbeb9y/66JozGzgC1b9bo19uPXS:rh0DxGmJbeb9vEDdvS
MD5 SHA1 SHA512 SSDEEP

Submit Download

4c98146f-b451-47a3-afc5-6689c4983db3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\4c98146f-b451-47a3-afc5-6689c4983db3
Size 671B
SHA256 f20c75ed39d13c5abaf6dddc62b4d94003545be5c66d93a662e57f2d3555eea6
MD5 91a27538096dcbaa5334e9560073ce70
SHA1 9c5a5d068dea890b62236b2cc3b052ba8a8015e9
SHA512 cbf138ddc889c0787b821ff4ae99b2c524a43f51303f759dc48258a5f2101628be3b6bd0bca2a11b1b8a04c4c85ed1b200b2d09116fc3d4255185befc95e0d48
MD5 SHA1 SHA512

Submit Download

ef14bdbc-d978-42cd-b4c2-7101d907d897

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\ef14bdbc-d978-42cd-b4c2-7101d907d897
Size 982B
SHA256 c228e0a8ac860b0c3b1d250e6cf861a084b625da888262d2dcb99bfd86a7d324
MD5 a1759b32c90139f69910f8b599562893
SHA1 eed3dd4a2c0ddce722cc8923f7bf10af9e0cc768
SHA512 d1e311dcfef48374a4ac9ef1174eef19acb1754919baf812acaaaaa66291560cf4c01579d34bff619ebbf4d10cd98ab157e51df19e138aea3915c257332941de
MD5 SHA1 SHA512

Submit Download

f1c97f96-9b7b-48e1-a06f-15739aefccb7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\f1c97f96-9b7b-48e1-a06f-15739aefccb7
Size 26KB
SHA256 085b46fd2b8fcf0efa1f3da952fc21c3e0715c595765ecc8ba50ebb0366b2257
MD5 90b7ef8f26fa708eb1ed587d094f2c7a
SHA1 2a263f2e88644db7b05f948ee982e53824a3b6e9
SHA512 b0c1f98dfff76bc01abb1d5504a2229feba20cb511c2d57015c55edbc41ea20d88339c00666c4513487cfecb055b401321fc1f6f24148d4436758aed5b39eeb2
SSDEEP 192:JDO7zyIw+NVR4MDYYSH7bmMtUOOmpqryFEiqCw2+5yoiNZrxNvJ1/JDSX44PpKzJ:JAiMDgZIwqCDpDw1pSKCRHBLT
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
Size 12KB
SHA256 e457c80dcef1ff9a3ac620a08312f09636b4f37e5d78e1b4a4eb0d754db608b2
MD5 54516fdb33cbb78c10d9d927aa70de7d
SHA1 41f3bfe2b3ba68d9491b087812314e4be2e49103
SHA512 041dc0335632343fec5fdc246409190f7e79d7cdf5a18526fb79c341eba36b907f3b47474d79464ab6cf504f2e0ae92d78a23a1cdccd3336c666e9e249920dc6
SSDEEP 192:Q65n/ReMYfMaAAm+rZflWFJlt9TdZyjb+JRVkNaXBXdxpSG6Bw8HIZa:QFzM+rZNWRzyWJRWeNx8wZa
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
Size 15KB
SHA256 c97debf4a20f4ac3639ee380735a73f76a116958f42466ad3364818f2cad9944
MD5 f2907538791c20e4fae8845585fb4c3d
SHA1 54ef66da026f30fd9a1cc3f0ac809aa3ba3b70f5
SHA512 d15322417462528412729e2bcad71f3b7e5e69d2b52274aae4f39f66498c58a127042b67e9452cdde006327442b512ff82c69a57b94688304181bef8a5e4ca55
SSDEEP 192:Q6un/ReMYf7aAAm+rZflWFJlt9TdZyjb+JRVkNaX7+XdxpSGiiBw8HIZp3vRa4:QYzZ+rZNWRzyWJRWDNxtwZ5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js
Size 11KB
SHA256 3c3a56551559f71127682f470dfe6bddc92ad49afe8e3ac30df3d31014d4040a
MD5 6aef432798d0100bb5899c6e644622d4
SHA1 47ce6ad2d82d07724745c16b6afdc747b0acca11
SHA512 80a3d88ef73fdd007d61932aa4730ea95c81f86206b8ebeb6120c3d22d14b47abc9e5e9f64c62569f07f4b1e4e9d7e45f4ebe1a76a353df1c87252b616743308
SSDEEP 192:F65n/ReMYfMKNK3psxnHd3LtVNUnNt+8+V0tDsS3GaXrXdxpSG4Bw8HG:FFzAuxxLtuzDPNxqwP
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js
Size 10KB
SHA256 8cdf33a36e9eddd520d218dfecdc7df64a58123bdcdab6bd85667d379e3c2325
MD5 0a9ba8888d22fe27be7bc546639518dc
SHA1 5204f3213f90bbcb4594f61bd9676f45548e9641
SHA512 88cbc859af47309f18c39259b6fb407b4ee9597fce27a65d6b0455cd9cf1950770dbf09c7d53d205d0ac8629086f91a972e76be8836937aa330b36f45ba6a375
SSDEEP 192:F65n/ReMYfMKNAm+rZflWFJlt9TdZyjb+JRVkNaXBXdxpSG4Bw8HG:FFzl+rZNWRzyWJRWeNxqwP
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.1MB
SHA256 d62f2ba88a0bd0f3c8736fa4f18da4e798088eb37c345178f7eedf1e93e8af78
MD5 6ada2255cb5bcb1d6b8c2efcb04277d5
SHA1 b3bb6da76f61932b927d09b21f99f1071a35a977
SHA512 947930497ecdc6531b3004a30892506ca45261561102326ebf70cce698f31c91ddd9f1684f8aa69ec68683b2226626a0599ba8449b0c102c760fdf029e79f484
SSDEEP 6144:967rIAt3e3B393z33THlaeMsmVUDj3Z9UlCpio1PtdzejkwwrleHN1HmcH11HAZ4:9rnMsm+Djp2A0UprkM0zlbpF
MD5 SHA1 SHA512 SSDEEP

Submit Download