ed5f05b07d5767ddc471c2ba8bd4dc2d84343121a16bd5746fca1aef99c90d3b

Analysis

max time kernel
126s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 900KB
Sample241122-bndejaxmaq
SHA256 ed5f05b07d5767ddc471c2ba8bd4dc2d84343121a16bd5746fca1aef99c90d3b
MD5 971c61ce1e35a0a341d69c352841ea4b
SHA1 bf74441e20477625a08a5b80c797d7579c9da733
SHA512 96794646a075b2302557ec2f4a8ebf2e1bc25865cd780ca7992c793dfeb28d4b0a7de68f02fc4ae8d19069b933b2e067a25474bd47b267b0828602b941ae7fa8
SSDEEP 12288:kqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4TO:kqDEvCTbMWu7rQYlBQcBiT6rprG8aAO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4924	taskkill.exe
4368	taskkill.exe
2224	taskkill.exe
620	taskkill.exe
4420	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3512	file.exe
3512	file.exe
3512	file.exe
3512	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	taskkill.exe
Token: SeDebugPrivilege	620	taskkill.exe
Token: SeDebugPrivilege	4420	taskkill.exe
Token: SeDebugPrivilege	4924	taskkill.exe
Token: SeDebugPrivilege	4368	taskkill.exe
Token: SeDebugPrivilege	2920	firefox.exe
Token: SeDebugPrivilege	2920	firefox.exe
Token: SeDebugPrivilege	2920	firefox.exe
Token: SeDebugPrivilege	2920	firefox.exe
Token: SeDebugPrivilege	2920	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
3512	file.exe
3512	file.exe
3512	file.exe
3512	file.exe
3512	file.exe
3512	file.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
3512	file.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
3512	file.exe
3512	file.exe
3512	file.exe
3512	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
3512	file.exe
3512	file.exe
3512	file.exe
3512	file.exe
3512	file.exe
3512	file.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
3512	file.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
3512	file.exe
3512	file.exe
3512	file.exe
3512	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2920	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 2224	3512	file.exe	82
PID 3512 wrote to memory of 2224	3512	file.exe	82
PID 3512 wrote to memory of 2224	3512	file.exe	82
PID 3512 wrote to memory of 620	3512	file.exe	85
PID 3512 wrote to memory of 620	3512	file.exe	85
PID 3512 wrote to memory of 620	3512	file.exe	85
PID 3512 wrote to memory of 4420	3512	file.exe	89
PID 3512 wrote to memory of 4420	3512	file.exe	89
PID 3512 wrote to memory of 4420	3512	file.exe	89
PID 3512 wrote to memory of 4924	3512	file.exe	91
PID 3512 wrote to memory of 4924	3512	file.exe	91
PID 3512 wrote to memory of 4924	3512	file.exe	91
PID 3512 wrote to memory of 4368	3512	file.exe	93
PID 3512 wrote to memory of 4368	3512	file.exe	93
PID 3512 wrote to memory of 4368	3512	file.exe	93
PID 3512 wrote to memory of 3308	3512	file.exe	95
PID 3512 wrote to memory of 3308	3512	file.exe	95
PID 3308 wrote to memory of 2920	3308	firefox.exe	96
PID 3308 wrote to memory of 2920	3308	firefox.exe	96
PID 3308 wrote to memory of 2920	3308	firefox.exe	96
PID 3308 wrote to memory of 2920	3308	firefox.exe	96
PID 3308 wrote to memory of 2920	3308	firefox.exe	96
PID 3308 wrote to memory of 2920	3308	firefox.exe	96
PID 3308 wrote to memory of 2920	3308	firefox.exe	96
PID 3308 wrote to memory of 2920	3308	firefox.exe	96
PID 3308 wrote to memory of 2920	3308	firefox.exe	96
PID 3308 wrote to memory of 2920	3308	firefox.exe	96
PID 3308 wrote to memory of 2920	3308	firefox.exe	96
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97
PID 2920 wrote to memory of 964	2920	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:620
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4924
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4368
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f213e257-7351-4d7a-b9e6-17eea07a4329} 2920 "\\.\pipe\gecko-crash-server-pipe.2920" gpu
      4⤵
      PID:964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {010a37f7-d309-4579-a333-7006e8468fb1} 2920 "\\.\pipe\gecko-crash-server-pipe.2920" socket
      4⤵
      PID:4076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2648 -childID 1 -isForBrowser -prefsHandle 3364 -prefMapHandle 3248 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d11bd099-8818-456f-86c0-eb8872e0913a} 2920 "\\.\pipe\gecko-crash-server-pipe.2920" tab
      4⤵
      PID:4056
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3912 -childID 2 -isForBrowser -prefsHandle 3904 -prefMapHandle 3868 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab929572-45b6-41c6-b258-c796a6d665a6} 2920 "\\.\pipe\gecko-crash-server-pipe.2920" tab
      4⤵
      PID:2684
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4724 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4712 -prefMapHandle 3880 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46d73f8f-0483-47c8-97c3-022cc41db9d8} 2920 "\\.\pipe\gecko-crash-server-pipe.2920" utility
      4⤵
      Checks processor information in registry
      PID:2800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4732 -childID 3 -isForBrowser -prefsHandle 5196 -prefMapHandle 5164 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {048c8fef-03f5-47e7-8da4-0a3196e62a36} 2920 "\\.\pipe\gecko-crash-server-pipe.2920" tab
      4⤵
      PID:4968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5352 -childID 4 -isForBrowser -prefsHandle 5360 -prefMapHandle 5364 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {117b119f-3b72-42d4-860b-526fe16946f1} 2920 "\\.\pipe\gecko-crash-server-pipe.2920" tab
      4⤵
      PID:3928
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5624 -childID 5 -isForBrowser -prefsHandle 5700 -prefMapHandle 5696 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {595851f9-caa6-43e3-81d2-23523982c448} 2920 "\\.\pipe\gecko-crash-server-pipe.2920" tab
      4⤵
      PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json
Size 27KB
SHA256 88d04052617208a6a86175ed05fcb540c0508995c4fc429b2433b242b0c06b75
MD5 bc3df9de68840016682584fd874eeb59
SHA1 4aad915a14ab3b0a669af108e7b17cb8d38471f2
SHA512 100b707820dc0d5204b99dc805f44b8a03acac1762c529ca59d38966c211dc87849134fb6d349ee5f59c331d1aa48215c4de51565ec0b3a69e54afa7c60744b2
SSDEEP 384:YNmm5sBlXrEU6FFyV2hatAIjJh8pIf3w1yauNgRgNrIRzBRhdsRhRp5:am6OlXtWS8pIo1ydu6NgnhCbp5
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 854b77c757d653800079fcf4df168b64f72b93c96f5c23d9babdcf44c9f2f678
MD5 b5fb4c72c492ccbb4379dde355530ae1
SHA1 aac3a8f9968844e69f65a0d0fb37ed906410f120
SHA512 49e6d165727b89e0e9a3fbad6072397431fb904cff03a333d5a70654ab9f56c89e183a24c08d8f783b264583a4cceda751c8d3c9511e74b4d6d3a9266c497728
SSDEEP 384:HfNIu9fiGLm4pUKA+Q+4IYKgH4Zv+3yPrIVy8eKZf:llBi8mCUKxQ+4INy4ZcyzIVy8N
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
Size 8KB
SHA256 4a901a6ed769373a5a9aa7e0561383498f0ac0c3914ecd12bbfab660752be43f
MD5 d58b68cc3aa0b876a392ca19db368f3e
SHA1 835018e4170dee28a75b916d534e8fc0350e8873
SHA512 ea68256887220c8c734ddc8a84e907833651cb528dab521910da07ef6b91bb4aa6131974b23cfbc2a6e2aecf0554f4007f93a8eeeca0eae1853f15f545ac17aa
SSDEEP 24:CuB1ozUsJblLKh4tbmFsh2F3LFh4gu1xgRbrQuhMZwpR5cO+sJbF0Jztb:sUebVKh4tbs45onR9cO+ebOJztb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
Size 18KB
SHA256 c382a102e8503305c9d787a6adedce2c39aea05727c0717f330abf9d8c036a4f
MD5 1d65c8cc88eba91cf7bd9fe1e3a08f8d
SHA1 8c8d44c40dbce8f114ebab6026a9572c68f663de
SHA512 41944c8175688984fb4bcb2c3c0018fb71c43db562690e468b3c883f11664557c0e53ce1bb52c1448a243626835a28ddf66319d5f4068ab16594de6b93325f98
SSDEEP 96:tebVKh4tbs45oneebOJztb5pebvpf+5tbVbDtbxgbgzxtbUbktbdbvtbEbQtb:rZ45O2u
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 ef179214ff6098b46f6c4d919c416edde1b15dba16276477c2a095ad8c04c6c7
MD5 295ab5ab095dcedd87b043ba2f2e8551
SHA1 bb5cf483f5c5a991eee9542ae22730ed8c014172
SHA512 b60fb17515a2a75ca7adae1a0bc8e695dcef90b3e81177d634ec6c344ca95de9bc3ef63133f899e10c4f5f2d24d957bfb8f41b7d6ace8fdee17258bb74c8f170
SSDEEP 384:g1WEqFsBa4ADbGP60hdhN3/0KPbXbPb5b/bDb6bzb2bTWr5Sh16PGMHm+/66Jozx:vtF4a4AD6P60hdhN3/0KPbXbPb5b/bD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Size 23KB
SHA256 01532a9c3af82c9f7891fa743c4055c58c18ea46234781ebcb5f4513a8caedd1
MD5 8bc053ff80df9e87825bd95be30165e5
SHA1 6262f822eddb4b479762fe6bb400d554cdedef2d
SHA512 bb42a1b94e43825d131efde486ef9a8e0b2c2e5b91ae55fdae6e24648fa26ed9b9605bf0a70df3cbd45bd4ab07dee0cc37a4dd499e3a67183dd4772261e9017f
SSDEEP 384:g1WEqFsBa4ADbGP60hdhN3/0KPbXbPb5b/bDb6bzb2bTWr5Sh16PGMHm+/66JozL:vtF4a4AD6P60hdhN3/0KPbXbPb5b/bDf
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Size 23KB
SHA256 5e219c2d3982ecc75d39836891259cd058749d03824d1c16ed31d150142be271
MD5 6f92ea58b811fa7b79ac445e4550b673
SHA1 0e8eeaf12b44dfcef3a4dcd39e9a6ec576653eac
SHA512 64fb8aa1b182ea750fa4212ab5da6b596ef2e6f5b9683961e0936626eefc9f72ba1c98f1ba4c5fce913a97ffb3377f309a86a6ad1f087d26a7a22b9ddaa45a1b
SSDEEP 384:2/66JozGzgC1be1WEqFsBa4ADbGP60hdhN3/0KPbXbPb5b/bDb6bzb2bTWr5Sh1m:zE7tF4a4AD6P60hdhN3/0KPbXbPb5b/C
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 bdfa9e8e9a9d16363876abb16039c2d2e27a1e0c10f2c7eb63f9b691b594859b
MD5 8c5a5abd6d2f05b7f98297fd774a2ab9
SHA1 f185093b5f655ff6609cd1c78d4211a5854f1275
SHA512 0018e0e3d9c0d2ac1644297f2d6a00b336d90d8fc3cd19471cb80990b82a8308c991a75e0c898987e6dbb08051e098746a4c23c898a14266854125a9a050dc8b
SSDEEP 768:zEhQowOCKMQ4kD60GShN3/0QWbXbPbWbqbDb6bzb2bGkwZqVo5v:3rO1MX0kwZqVo5v
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 0dd431a1b6ace71b79fa87271c39f2fdec664a7c9198380075b1104f6f48cbf3
MD5 5cee6a05116058489c9d782bd25e1c5d
SHA1 d53f161887b53210939b98e28dc64dd0cf2bca31
SHA512 f5d2af70b2b9f73c906a811fdfef57b73f184d242ae6c7a3818a08ab0e30cc6ae9c6c269c6652d483af590b30ad279bc1b855387a9a242f812d90837fa2b668a
SSDEEP 768:EQotEqOCKMQ4kD60GShN3/0QWbXbPbWbqbDb6bzb2bGkwZqVo5v:NaO1MX0kwZqVo5v
MD5 SHA1 SHA512 SSDEEP

Submit Download

54ecc191-50c3-4adc-a91a-339da431b263

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\54ecc191-50c3-4adc-a91a-339da431b263
Size 982B
SHA256 6e3d35e5212fef3a9c7763b2ef0dcd80458e8349437283d6f4b0dba47ebdb3e6
MD5 ed94d0e78a663e9cc8b09c79f41e63ee
SHA1 ce631034bb82f9567d77614b0a55612cf05f325d
SHA512 45fea525278a9c07e94ba2206e92e91f5d982ccaf00317535b084b5f4c5fdf619ae3c5870f12e346d52da347c1ef3c1ed378d07b6205527d6415dce7f5d38559
MD5 SHA1 SHA512

Submit Download

9f2c9f23-f05e-4862-8413-5b1c0419ab58

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\9f2c9f23-f05e-4862-8413-5b1c0419ab58
Size 659B
SHA256 17aeb342faf90cf3fb3ca988ce060c9064c44eb0b4a2ca7a95a2c2bcc5d0804a
MD5 6c38dcf18f586d9127641111d2025e60
SHA1 a79dcc78104165e9267b8e0525b01f2d012c14b8
SHA512 4fc13e7dc1af3e17df99c7fa8e69d7362ce20df4f9a64cabe798414377cd3f6ff06ad2064e114a2707495bc4b3f711716fdd48b03106be9123db1e9a05544028
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
Size 12KB
SHA256 4ca0eeccd899b64a03388924a84131f36c421003c885bfb8b18339de70aa3e1c
MD5 1b7cf60b8ae5fbf3c453f7907cf7b71a
SHA1 4a6191d51db8896eca09f21d99fb9219bb008e47
SHA512 33f4914fc98a0c704770044f1252ff2e2df6632aba6404e906cdb87345f32fc9efc4b2dfae3a0f2a01fbd3dd1bdd276e632afe2d17b63b33be09282f9a51cc46
SSDEEP 192:E5n0RGf6tZ+jzHI4zeScz9dGTYddyy1S4EdaXEK+9a71tPquBw8HNm9uf0FcD:o1jzHxUz9WZy1IDK13wq
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
Size 15KB
SHA256 7f5d4bff248085dcc105e170458617917b71098cd81d066794321c23eaea4762
MD5 f6eb8b248af084b074b5366cd785564e
SHA1 49a74acc44e87b6df79a60a572d279fd009a705f
SHA512 3a3eb266228a6a2b9727e4937e47d09f76a5d00909c50e2be4c15e4487a9479e046c99c239528ec160e846a4ceaf4f84a4a9c98a3d5d5ad4680c931d139a9c94
SSDEEP 192:EKn0RGfBtZ+jzHI4zeScz9dGTYddyy1S4EdaXI+K+9a71tP1oiBw8HNEfD0T9c4u:3AjzHxUz9WZy1IsK1BwSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js
Size 10KB
SHA256 54d288f8827949baab7915a8c2c3e8aad56efbfd40a08d9c9ea04892dd2a63e1
MD5 3457813c324558643605d204e0d0af5f
SHA1 347d0d7b9cee96724dce4f334e8c50aaad484400
SHA512 5e30383aa28df5a37331beda193d5cbc9622c41909a1de7f865f0a9e18df9c91bd05be67e9c050321815471806095138917251de8aacba300ba239ef296fb2f8
SSDEEP 192:X5n0RGf6cwfOVofAHBtq8prddx9y1ZO43XaX4K+9aWBw8VE:rBVoIbpd9y1ZOKK1UwH
MD5 SHA1 SHA512 SSDEEP

Submit Download