dbac565acacfb21ca3e175bc8598cc184c336b8e2d735d896723429d0818b0cc

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2024, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241102-dcxedazldj
SHA256 dbac565acacfb21ca3e175bc8598cc184c336b8e2d735d896723429d0818b0cc
MD5 bbc53ae97792e01a59f15c720e3c795d
SHA1 527f1a54af96340f7ba550490baf0bcb8a3c9ef7
SHA512 2b2994b35ababc1d626f587d6bd552d7c288b674de673703de2f28163bd6b3c475393e5c85d4f30d92bfc0d3c1962d20b918caba92f36e26aa839dffc16f5d13
SSDEEP 12288:TqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/T3:TqDEvCTbMWu7rQYlBQcBiT6rprG8ab3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4192	taskkill.exe
3896	taskkill.exe
2196	taskkill.exe
4064	taskkill.exe
4200	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2104	file.exe
2104	file.exe
2104	file.exe
2104	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4192	taskkill.exe
Token: SeDebugPrivilege	3896	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	4064	taskkill.exe
Token: SeDebugPrivilege	4200	taskkill.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
2104	file.exe
2104	file.exe
2104	file.exe
2104	file.exe
2104	file.exe
2104	file.exe
2104	file.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
2104	file.exe
2104	file.exe
2104	file.exe
2104	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
2104	file.exe
2104	file.exe
2104	file.exe
2104	file.exe
2104	file.exe
2104	file.exe
2104	file.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
2104	file.exe
2104	file.exe
2104	file.exe
2104	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1800	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4192	2104	file.exe	84
PID 2104 wrote to memory of 4192	2104	file.exe	84
PID 2104 wrote to memory of 4192	2104	file.exe	84
PID 2104 wrote to memory of 3896	2104	file.exe	93
PID 2104 wrote to memory of 3896	2104	file.exe	93
PID 2104 wrote to memory of 3896	2104	file.exe	93
PID 2104 wrote to memory of 2196	2104	file.exe	95
PID 2104 wrote to memory of 2196	2104	file.exe	95
PID 2104 wrote to memory of 2196	2104	file.exe	95
PID 2104 wrote to memory of 4064	2104	file.exe	97
PID 2104 wrote to memory of 4064	2104	file.exe	97
PID 2104 wrote to memory of 4064	2104	file.exe	97
PID 2104 wrote to memory of 4200	2104	file.exe	99
PID 2104 wrote to memory of 4200	2104	file.exe	99
PID 2104 wrote to memory of 4200	2104	file.exe	99
PID 2104 wrote to memory of 2520	2104	file.exe	102
PID 2104 wrote to memory of 2520	2104	file.exe	102
PID 2520 wrote to memory of 1800	2520	firefox.exe	103
PID 2520 wrote to memory of 1800	2520	firefox.exe	103
PID 2520 wrote to memory of 1800	2520	firefox.exe	103
PID 2520 wrote to memory of 1800	2520	firefox.exe	103
PID 2520 wrote to memory of 1800	2520	firefox.exe	103
PID 2520 wrote to memory of 1800	2520	firefox.exe	103
PID 2520 wrote to memory of 1800	2520	firefox.exe	103
PID 2520 wrote to memory of 1800	2520	firefox.exe	103
PID 2520 wrote to memory of 1800	2520	firefox.exe	103
PID 2520 wrote to memory of 1800	2520	firefox.exe	103
PID 2520 wrote to memory of 1800	2520	firefox.exe	103
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104
PID 1800 wrote to memory of 3892	1800	firefox.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4192
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3896
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4200
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {397be52c-d46d-46ae-ae66-e6451d40b5bb} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" gpu
      4⤵
      PID:3892
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2384 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29743c73-2cca-4a17-a280-fa1904d064d6} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" socket
      4⤵
      PID:3100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3060 -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 2964 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba301172-58ec-4616-a154-cbb9da6b07be} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" tab
      4⤵
      PID:3348
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3892 -childID 2 -isForBrowser -prefsHandle 4000 -prefMapHandle 3996 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86e9aeea-6ebf-4d2a-a575-0b7db3e90e7e} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" tab
      4⤵
      PID:372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4860 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4944 -prefMapHandle 4940 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {605fd58d-a017-4ab2-8ed0-3ed96aadb539} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" utility
      4⤵
      Checks processor information in registry
      PID:5336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5408 -childID 3 -isForBrowser -prefsHandle 5392 -prefMapHandle 3992 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1871a3b0-3645-4e7e-80b3-ea513e32c2c3} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" tab
      4⤵
      PID:5996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 4 -isForBrowser -prefsHandle 5556 -prefMapHandle 5560 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {012f5712-e4a5-4749-8f1f-43fc03a927c1} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" tab
      4⤵
      PID:6012
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5740 -childID 5 -isForBrowser -prefsHandle 5820 -prefMapHandle 5816 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4be8bc27-5bae-4b8f-b5ab-62f23f711902} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" tab
      4⤵
      PID:6028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json
Size 24KB
SHA256 d87bb3ef4c487d8d77cbe7c89f94fa3ab9005f38d6edcb2f0b3b8eed57db22a5
MD5 1b6889ea5def3f03e8dbf38d8beccfc6
SHA1 89ea2dcc888bf6aa4ba3c064ba922a71989528ab
SHA512 b7a8ffbf7d1085eaa29cae10cd8d9baefbe250684b301b0320157ccd3356a040b1de0979054d6baa566dfdca12b4b9d5c175ae61e07039efc9db010ee4f64592
SSDEEP 384:L0YH+gu9H9Wz2GNej4o846tByLgyausJt5:xzoj4T4sogydsj5
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 1bab13b15322259b8542f0ba7e6f347257c2ca4cc7e22d0cfc8af7a55325f0ca
MD5 36678483942a7aa97005b1ba49edce7b
SHA1 0eefb0c3228339f603a9b27e5acc4ad949cef3f5
SHA512 c3e943894311688eeef9179e20c9a36448751381e61767756f14d2917f760847f94833ab70e0b9cd7e31acea48279c8ca351523dc9942d0db6b8d9a6747cc46a
SSDEEP 384:H/w5Iu9fiGLm4pUnA+Q+4IYKgH4Zv+3yPrIVy8eTl+:8Bi8mCUnxQ+4INy4ZcyzIVy8N
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
Size 12KB
SHA256 f329ace8ff676b17d20665b6ca559bd155ca63e4ef0a2baba3d233c2326dc1b8
MD5 5adf77c056f8b01271184300a2877463
SHA1 7fccc15ed17720a84312cdaad09fb2683cd68f51
SHA512 05912d1855b0e841cd4a6ee09085d8a509fc32bca319227a765390e89b003a88f380a7d38239711843de414bda8d6179c4e3c3bc5e1266c41249378848ef35ff
SSDEEP 96:M5oxebVKKb0ebOJKbupebvpf+KbRgbgzXbIbkb:M5mu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
Size 18KB
SHA256 de4a466115b5bd5a3b7f206dd5d4bd23f4dadbeaf1fc98202d57bb560a3c7b1c
MD5 190302e8fd5f56150b3445986f224112
SHA1 f9ee4388e60a4e395a0edb96414a9f6827daeff4
SHA512 7c3c253260d3ef1b0fb86b419120005989c0976ce98e7b38c00d1b5ff400f688e4e01521b1c596bb2d39ac20b6c35c11bc618a252cf80adcdd3785f07817cc7b
SSDEEP 96:w5oxebVKKb0ebOJKbXpebvpf+1bRgbgzXbtb1bDVbxboeb5bHbvb:w5vup
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 154d548dc36ef5ffd4a1a3e4d877173dfb67cb9ce4a7595dbc803d0f544fcfe6
MD5 b822f3c40dd484163e466db7d152cf6e
SHA1 b36ad4928625569f8cc82282e9f4919ea8d14f13
SHA512 9d581af012009c932b422ff70745471e6700ab8a200a8d5d6ec58de2b620c294185dff2a69b5b5d99ea67917e32a4422b27733d4770a00557e1907caa1eb8988
SSDEEP 384:R/66JozGzgC1bzKG0fnZZ9G21DhP6Pps3aMU01+bEbPbMbUbqbAbzbobIeW4zNBy:UEKfZZ9G2HP6Pps3aMU01+bEbPbMbUbv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 93215261eb01b11ff7b5061773514dddf23343839e3fa6eaba6e89705696c5b8
MD5 67bb0f5a0be446bb1b5116320ff9ffb9
SHA1 98eaca4a1a3cc704937eade3f11b30675b793cdb
SHA512 59cf10468d4451073ee6bb4544cc8183eecdcbbaf7f015dd28888d5c09d729d53533afe6dfda6b5059f6e5e18e9b6170e0a57d3d1c6fd75b0bbbcbfee6151eb2
SSDEEP 384:0boSXPy/66JozGzgC1bzKG0fnZZ9G21DhP6Pps3aMU01+bEbPbMbUbqbAbzbobI4:81HEKfZZ9G2HP6Pps3aMU01+bEbPbMbB
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 6fdcb918741ae15cd005f7d656826cd31e29c0d9ffa8916934de7f310db28f99
MD5 657b7f8967798dcce305a3b898d082f3
SHA1 88a54a92d2b7badb896f1f7f213ca3aeb26537be
SHA512 5feb20ca529b8054de7cf184e966d6de9c48704617166b7c40d05855a75e8bf26af205e81092286480d0e89f3fed1960ee63c4d05c26a94ac714a4a2ecfc0eb4
SSDEEP 768:1tCEXkRoNkZD6PB73aMU02ybEbPbUbdbqbAbzbobM5RUPg:oRoCQXUPg
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 d74b25bd73f14448c7ec55c00cd649938ee7514b85d970097a7b286066b6ad52
MD5 3c6385089613f66120bbc58d41fe8a63
SHA1 3d9bc0f21a0f3f72f2619628f3a9fb64c6625dfe
SHA512 646ce7f3e0447dfc44f83ff8d19b194362b999e04b0088f64562fa878ed798c0ede57f49c435d34d69ea718c99f067c9660487000f7ba9a13a7d0519bf4e8b4e
SSDEEP 768:c1CEXkRoNkZD6PB73aMU02ybEbPbUbdbqbAbzbobM5RUPg:7RoCQXUPg
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Size 20KB
SHA256 410962805441fcac75e67ddbcb24297c742cb3ed25abb8711d06e251446742f8
MD5 61fe42e08587e633ac2bac106d1b377c
SHA1 0615b37b55ff38f34bfdb2272ad2a53a0ffaa5ee
SHA512 54d1ae803d5e87d31e46a4c33064807c6ae3c680a940551bedc6456c01c5a63cce6046636912beec9502b1fd842e48f804edcb976874865626aa99dbbf005912
SSDEEP 384:3boSy/66JozGzgC1bJKG0fnZZ9G21DhP6Pps3aMU01+bEbPbMbUbqbAbzbobIeW+:LVEAfZZ9G2HP6Pps3aMU01+bEbPbMbUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

a298077c-f970-4fcb-8836-7d2d4964cad9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\a298077c-f970-4fcb-8836-7d2d4964cad9
Size 982B
SHA256 4f5e34315578f4a585e3ece73e4f55655a4372ae5e7fdd04b17ce4010e325af7
MD5 513d93ec0cd9a721caca15b54a65448d
SHA1 d487760d407e7358dd587df6795b5774d83d085c
SHA512 f1b0fa765539c27050a7e31259fd3cc912a67b349e13d61c12c0510c619f7d34da38e8b574161b289c34d91df8a77c27f600b294b767cd3eb04d8785e0500b31
MD5 SHA1 SHA512

Submit Download

da69d85c-8b98-4b0a-ab70-d1f91ee11def

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\da69d85c-8b98-4b0a-ab70-d1f91ee11def
Size 659B
SHA256 f669bc990fcbe592fcc868a79999938537879259154d7a7254bc3ebacbb7ff29
MD5 aa12ddd7d96b18d7c3e316dc1bea2fba
SHA1 1f8d8b2f021c00a14057ac53432fb09af00aa5f2
SHA512 a6a61fe960db80cc361ec33c6cbe55c647570442755adacfe36e90bc170ca9e38047bb2b1b9a9bc074f66545bf8595467b5b90349fb09c72ea4677399d626eaf
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
Size 13KB
SHA256 ca54a2e2220449d3e5bb0788e687daba45b5d43b25c248752f179fdfb0bbd4f6
MD5 c29eb012fc7fd1c687491c5bc1cb58df
SHA1 8a7234acd1e226e172b94f8982ed5fa33ca02453
SHA512 5ad77a43acc12add9fb6d426076545473243f24044cb1d29d61f955b15d2ad367b78699cecc56f3ec4686d7f694540158639bd397dbbc28c22fc55e4398446b8
SSDEEP 192:E5n0RGf6kLIL+fJ/EACt5WddKfnZJ3AKaX1K+9ayBw8HO9:om+B/7IRAK1Aw3
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
Size 10KB
SHA256 cc8f12ed6b0126c7db6e5a5ea83770ff3ce04a933f6bdd94774b52ffc4e182aa
MD5 f37a5368d68e640a03ee94822d81de64
SHA1 236ed062fd21b19588b5b6c4ecc3a5c0ffb445be
SHA512 5a5a8c6599a33d3fb30fa4baf10fbe3ddaad54ecce6b71fa32f56f3a988f144c4f747872a799380094c930f3520795e7ac70359efc68ca1461d2023f3f124756
SSDEEP 192:X5n0RGf6kLIL+fJ/EACt5WddKfnZJ3AKaX1K+9aWBw8Hn:rm+B/7IRAK1UwC
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
Size 15KB
SHA256 cb11c011665a724a96063fd9209fa882307d71a499e6c3becaeebbf309a20c78
MD5 3a0494b0d8fcb84c092f59bc2e7b2cd9
SHA1 2cec687c88ac798e40a4f3d79378a826a2ebcdaf
SHA512 4f39d02c3155088337ae621551a4d92ac087e11ce2c6630ed20d973c4ad2d9b02e5299ab381d4016727936da8e8c650861dec8c872268497aa597948289feece
SSDEEP 192:E2V+5VNEn0RGfGkLIL+fJ/EACt5WddKfnZJ3AKaXP+K+9a6iBw8HeTz3MW:va+B/7IRdK1RwDL
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js
Size 10KB
SHA256 2955880f06d0e2f96b582f57102d48946c64c0bac22b02e1ea6598174aecc885
MD5 7b04c63b0f943845891cc9155e2bd5b5
SHA1 64459d35351af172b42a2561df640bcd18481987
SHA512 e7bc98eaac4ec2fdaba6c589ee09b10bdd4a636f4069d3607b8cf2cc78bd91ddca18184ef4ad3b8d65a2f5637995a3954dfd5fa4190d0f87da08f0e4cc2ded6f
SSDEEP 192:X5n0RGf6cwAVofAHBtq8prddx9y1ZO43GaXWK+9aWBw8Vn:rXVoIbpd9y1ZOBK1Uwc
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.1MB
SHA256 8ae5c22b42765f2b8ce624ec9bf4c6884c98ed0eceefdc1e031f12f8a6769b30
MD5 b11d476fab2f9f4a0948d60e07fdc999
SHA1 a3764f2bee36b17a31f3b8cb333411e6b7ce102d
SHA512 136443a5e19f3774724c402757063deeb86ef4d7d5847d87f5e10d2de271e0831a9f6c324cea635e24f533650e81a03a6f5a0bc9e04fd40226b1d01d29875acc
SSDEEP 6144:U7JQH3U3V393z3+eHc6uhlKmsCGUZOvUO6Zmz0Pu/elDLjUDz9h88Y0dTHf1HmcE:h8msCDZxOiM0aqLXqn6
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.1MB
SHA256 1a8a60feda7a5d47282e08483205afa65c094c168209a69d694d6c09798cb2ff
MD5 433b01f77f3f2d69e6df8f21c0434ec1
SHA1 d0ced8744dbd8ae534127e985e712d63729774c7
SHA512 c79214118088e1da8c7fb5ee44b246bc28b56449b24ba751c0404bd099a7ef59979fa71e86ebfc8aabcd197aab12e96a07c523ef7c149e64b82cc6d58836c98a
SSDEEP 6144:q7JQH3U3V393z3+eHc6umarmms1lUZn7UA16Zmz0Pu/el1BjUDSM1h88Y0dTHf1r:Ikmms1OZQA1whrVqLXqn6
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.2MB
SHA256 7958fca8ae411042c8b68fdfeb870d895f83595f6b106b456a792c9a07c99329
MD5 a086b341a306d7e8e897e0c9108541e6
SHA1 a7b86802e828fdeffa185e43c9f680caf07d8cb4
SHA512 0bda7d3383d9c13dc21c6b6afa1f10c679d0a3838dffc51d78da97449b7da2c975b2760752b8384848080a74a423bb04a6e775bd46f719bd95098e26a0d2d3e3
SSDEEP 12288:qcS6G6tztYo0qn6chl8ZxEpuVxdLp7z3yGIA:qcxttY66chl8Aax1BL
MD5 SHA1 SHA512 SSDEEP

Submit Download