49c7fd0d8699a45e54a830e0c280666be9c6acc7356838fb3d387b2bc355166e

Analysis

max time kernel
126s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2024, 03:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 945KB
Sample241203-dqq5hsxldv
SHA256 49c7fd0d8699a45e54a830e0c280666be9c6acc7356838fb3d387b2bc355166e
MD5 a62f3c3acfcbc560647a185e4ff44b29
SHA1 219a0bddc501b2111c67aa93ce28f672e7fd4f5e
SHA512 6e7bd130df1c3dfd42ebba5ba60afed58be2a79cb7b8f4405e686591efd5314314410fe0bb7097c54211102fa12a8a24a067c0339ba54a3bf9c922c3b082d845
SSDEEP 24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8a2e7L:UTvC/MTQYxsWR7a2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
64	taskkill.exe
380	taskkill.exe
3160	taskkill.exe
2720	taskkill.exe
436	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	64	taskkill.exe
Token: SeDebugPrivilege	380	taskkill.exe
Token: SeDebugPrivilege	3160	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	436	taskkill.exe
Token: SeDebugPrivilege	3368	firefox.exe
Token: SeDebugPrivilege	3368	firefox.exe
Token: SeDebugPrivilege	3368	firefox.exe
Token: SeDebugPrivilege	3368	firefox.exe
Token: SeDebugPrivilege	3368	firefox.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3368	firefox.exe
3868	file.exe
3868	file.exe
3868	file.exe
3868	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3368	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 64	3868	file.exe	85
PID 3868 wrote to memory of 64	3868	file.exe	85
PID 3868 wrote to memory of 64	3868	file.exe	85
PID 3868 wrote to memory of 380	3868	file.exe	89
PID 3868 wrote to memory of 380	3868	file.exe	89
PID 3868 wrote to memory of 380	3868	file.exe	89
PID 3868 wrote to memory of 3160	3868	file.exe	91
PID 3868 wrote to memory of 3160	3868	file.exe	91
PID 3868 wrote to memory of 3160	3868	file.exe	91
PID 3868 wrote to memory of 2720	3868	file.exe	93
PID 3868 wrote to memory of 2720	3868	file.exe	93
PID 3868 wrote to memory of 2720	3868	file.exe	93
PID 3868 wrote to memory of 436	3868	file.exe	95
PID 3868 wrote to memory of 436	3868	file.exe	95
PID 3868 wrote to memory of 436	3868	file.exe	95
PID 3868 wrote to memory of 1196	3868	file.exe	97
PID 3868 wrote to memory of 1196	3868	file.exe	97
PID 1196 wrote to memory of 3368	1196	firefox.exe	98
PID 1196 wrote to memory of 3368	1196	firefox.exe	98
PID 1196 wrote to memory of 3368	1196	firefox.exe	98
PID 1196 wrote to memory of 3368	1196	firefox.exe	98
PID 1196 wrote to memory of 3368	1196	firefox.exe	98
PID 1196 wrote to memory of 3368	1196	firefox.exe	98
PID 1196 wrote to memory of 3368	1196	firefox.exe	98
PID 1196 wrote to memory of 3368	1196	firefox.exe	98
PID 1196 wrote to memory of 3368	1196	firefox.exe	98
PID 1196 wrote to memory of 3368	1196	firefox.exe	98
PID 1196 wrote to memory of 3368	1196	firefox.exe	98
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99
PID 3368 wrote to memory of 1204	3368	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:64
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:380
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3160
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1d08873-020c-480a-99d9-84fdf71ea452} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" gpu
      4⤵
      PID:1204
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df68b774-1507-414b-8a3c-089660201577} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" socket
      4⤵
      PID:5100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2904 -childID 1 -isForBrowser -prefsHandle 2952 -prefMapHandle 3140 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad85860b-dab4-47f7-bb08-986c19e5cb50} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab
      4⤵
      PID:1772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3652 -childID 2 -isForBrowser -prefsHandle 2788 -prefMapHandle 3640 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a961cde8-8e21-4b08-8e24-82e976513992} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab
      4⤵
      PID:1528
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4604 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4696 -prefMapHandle 4692 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f3914a6-8d43-42ac-b180-bbfab5b646fe} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" utility
      4⤵
      Checks processor information in registry
      PID:3096
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 3 -isForBrowser -prefsHandle 5348 -prefMapHandle 5452 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0cdc0a7-b3d9-4be3-a6cc-be5bb7cf6d6a} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab
      4⤵
      PID:2728
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5620 -childID 4 -isForBrowser -prefsHandle 4040 -prefMapHandle 5472 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9aad26e1-b1e1-447b-9c0f-af557d24c770} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab
      4⤵
      PID:4700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5696 -childID 5 -isForBrowser -prefsHandle 5732 -prefMapHandle 5620 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5dfbba6-aeee-4c38-823e-abfab9a81f83} 3368 "\\.\pipe\gecko-crash-server-pipe.3368" tab
      4⤵
      PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json
Size 28KB
SHA256 bd678f3566c00057f0836ba23be0496f7ad9010a1c4d7dffd23b7ea86c1b122a
MD5 b9efd53f4e1e2f051f54f27a209209eb
SHA1 1a6adf196008790560b628c18094158c735d4ba8
SHA512 4391fb5e19290333d9349b19851967ee4917496160e1c81fae5d013a389080f28e65c0b76fe4b4a7370d849911a6be48a810b535a7c3617212f545cb3482c196
SSDEEP 768:vSi8EYQycraJwMJ6lWEtBFiNydNJXSWY0el9m5:6zEyCM8lWEtnXJXnY0K9g
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 59e5fb24e32f60eead0127e7ed75849aa3c8f27aa1124d1ffa985367a564f30d
MD5 1109a25ddbfc7a849ef03ad4a39c85e8
SHA1 bdd24f6635fcce321b2160bd3b9cb6f3ef433760
SHA512 cb0071b5266565c64471294315916549e0dff86413c5ebf513f133d41409781ddcf44fcb41ce3309f70dd0edc5e6b12a433a2b86ba534f82f340a94bbdf0501e
SSDEEP 384:HfNIu9fiGLm4pUqA+Q+4IYKgH4Zv+3yPrIVy8e1uNduNU:llBi8mCUqxQ+4INy4ZcyzIVy838U
MD5 SHA1 SHA512 SSDEEP

Submit Download

92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Size 13KB
SHA256 6bb6cc692482957e642e3f276b6a599aad28ebe4c3fc37583612ef203bafaa50
MD5 ffa5d1e79b3add2db2af7515a71ced45
SHA1 adb0101a33144d7e036eff627ca18d65c34cf801
SHA512 37348685cfbf3b81211cce393e2b8c5c39a1cfa18624b110a3c039e09aaba164cc15072faa8295bf53f718a10bec1ad2c8e26ff43c669afc5b613a4570350bbd
SSDEEP 384:HFh1u9fiGLm4pUcA+Q+4IYKgH4Zv+3yPrIVy8eoNBNt:IBi8mCUcxQ+4INy4ZcyzIVy8HLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

asrouter.ftl

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
Size 7KB
SHA256 75b75eee3053cbb707f8d99ef6cbc9ac8825aaeba667f2f5308a10cf66acd60a
MD5 dd590ed49064032f1c10ec98251d3240
SHA1 3a0ed9b57af89c1640045b4853b4d79bfce8fa9b
SHA512 c21f5f5317dac584dd4dea0f13ecf7d77d482f85d700ce0dfa798a8f68f6298a60d918a5c0af9140d813ee394b14ebe770c674766eab546cbba9ce9169c43422
SSDEEP 24:5uB1o2vAsJblLK0tbCRFsh2F3LFPquhMZmrCgu1xgRbYYpR5cO:qoebVKMbUm5op9cO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
Size 12KB
SHA256 4e4c4dbea7aaee0f46053a3058d451eb9903255c493319dc46ff779ca95d49c4
MD5 534d7bb669887d6a01ff16bdb4eb555b
SHA1 9c5e21c2c8809588a2eeb0dca11239106dcfd71a
SHA512 c9ff6a9f94627f0a913ce1803b099e9c7fb7a88dcf7338a10a27952b3ffb323eb176457c7907e260c638c47d155e8e86db659bd995cbf5992f6132a0ae908504
SSDEEP 96:LebVKMbt5orebOJMbVTypebvpf+Mbcb4bCgbgzIb:45xyu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 25fa4a50f2340fac927872fd9f8b72e187821c53a5ad9579bc418355b0c61ac5
MD5 ff701514bf3f2e656dcf3c86c9c66883
SHA1 18fc1bccdfe3091058a091515c5ee161dd36beb6
SHA512 7aba7a1652d85d61cbcc6743eb885d6ca8d346abd183c71101ae0a860fd6f1edde53cae3a6ada50a55fc9a31956c67036856aeeee1baf96879a1604c0e84ca93
SSDEEP 384:Q/66JozGzgC1b+boSvPWZ3ZKf4tc/TakPIG4uHXqME0K6bNbcbybNb/bR9bkbobf:dEgROVZKyc/+kPIGDHXqME0K6bNbcbyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Size 24KB
SHA256 435c29fe6370675a33310f798b8711e727f855d9a8a6d8563526006c38b34328
MD5 eca314009bb425a64f76bf103feae005
SHA1 b71feec0202a3f66339d945b3071c31fc4c5f182
SHA512 e6f1ad87e54dad5527e10fef27cb65abb18252a664d85a519395a6dc0623232feeefefc2c0f0e4ba75b8d1bf759dc6ac50c9d19a23ef191d431478ee3aa23c84
SSDEEP 768:RQedvxDIGrwXqME0fJbNbcbXb3b/bXbkbobRC1ouNsEf+D:RQSvdqouNU
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 a3ccf4ad2f6e13e50e86fcae8986d11402a955bdc4d0a8c42ca402fd739a470e
MD5 3d9610ba3d6d7c3fb370f8dedad7cd89
SHA1 5ab6f04d5142af3554b23815df94f2360d3e9279
SHA512 41cdcf1f9c365fb1ea3bcc65f2e6f83cbe80e88b98e72af1f59f7c9711d1635ccde6253ac473fa46698cb91a4baff1121d6d4bc01a457bfba36697387fc86c6e
SSDEEP 768:dECGoQedvxDIGrwXqME0fJbNbcbXb3b/bXbkbobRC1ouNB:1QSvdqouNB
MD5 SHA1 SHA512 SSDEEP

Submit Download

65026fc2-0f02-4e32-bbcf-187ace8d9490

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\65026fc2-0f02-4e32-bbcf-187ace8d9490
Size 982B
SHA256 3f9caf7859c2d6f2e818676f6d830da371763ed8d69fe0e7fbd5603573dbcb5d
MD5 b548d4f2cce40d8a461c62841d991aba
SHA1 b13d6faeae044097b79540c29f0111b9ff081a63
SHA512 6c78202a6327e5494c71ae3adfc5bc034861b9bee63c3b5da830236f4221f8160e71adb30636bed7c95f2e554d4f058139701a543661b035bfa26d72677307eb
MD5 SHA1 SHA512

Submit Download

835f79d8-fcf1-4d92-a1a9-fbaadb45d013

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\835f79d8-fcf1-4d92-a1a9-fbaadb45d013
Size 659B
SHA256 f9b328a96e0047d559b9e40447ad0c7e90cf647b0ef8b9287c7b56b67c3a62f4
MD5 3e0579820ea45239c6c8cd7b370a1639
SHA1 7c260323f4a3c71c5b5b74a4429c90d8ea0d3664
SHA512 37bc4cfa89dc25768b1826ce310c8e7700b2a98306e6502b36117f9714dbca0778245985c0c137baeb7bc9e08fbcfce73520ab3d96d024e89921e3cf7d4807d5
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
Size 11KB
SHA256 58e5f1c84befd229cfbbd2d39f524f6faa69da4a2394160a93bacc2d4489c5f8
MD5 b5ab86b8020810ad14e49f31eae6ef0b
SHA1 051290404133fd8b641f07d5e1fdf2ede23633bc
SHA512 014fcb3eb22ecb1e10694627b5d8711766a9f68a8d85648064b993a08d4bc2a3029b2db6c618864fe019cf918a58ce6e5cb750599b0efeb79e6e53d1299efaad
SSDEEP 192:Q65n/ReMYfMDLmFKI4mO3Wsdc/d/yvtu9FaXFyXdxpSGMzbJU3Bw8HGJHzy2xO:QFzHIMIDmVyuvNxAzbJURwzJHzy2xO
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
Size 15KB
SHA256 c98e65b74b7e5f95364f950babd3b1ebaf05c66646725daa4f4e25e7a8bf599f
MD5 4f4a090617dba5bb1aaad4cdfa0a5b03
SHA1 0b18b55ece7b0529ef269490779090b16d4edb02
SHA512 611e84e3400a4ca45460b2605e99be829539fa1c582d5fe887e8319ed75665750e816afc9a317e1ed2d99252d2901500eb1ad90d01792f3d30ec2b4152749508
SSDEEP 384:QWqpqm2xzO6IMIDmVyuQNxAzbJimMzwUJJ3WdKSCWkHD8zZVFy2hwOvQT7R/xccq:QWqpqm2c62DmQuQNGzbJimMRJJ3WdKS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js
Size 10KB
SHA256 c181e0a9717137ca1d18808c9be5197608182c49301dd2753bb70bf75b8767b9
MD5 fa08ad6adb5c6f249c99b7a4b331dccc
SHA1 b70ee2fdde9ca87ebc1bdf0cc2fb1d0ca518192f
SHA512 d7951d44ffa278b01d0e1a5916c05d6344abd19406c7f4aea0a0a7671fa6b286d667f49c06a950c36b3d8841c0cd6418b2440fc4742ac85d20c785a9285e3c1d
SSDEEP 192:F65n/ReMYfMKN5VofAHBtq8prddx9y1ZO43OaXDXdxpSG4Bw8Vs:FFzjVoIbpd9y1ZOENxqwL
MD5 SHA1 SHA512 SSDEEP

Submit Download