hxxps://ytmp3[.]la/en-9CCY/

Analysis

max time kernel
131s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/12/2024, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ytmp3.la/en-9CCY/
Sample241216-debkpaslbp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133787913955474574"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
400	chrome.exe
400	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3488	firefox.exe
Token: SeDebugPrivilege	3488	firefox.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
3488	firefox.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3488	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3488	2416	firefox.exe	83
PID 2416 wrote to memory of 3488	2416	firefox.exe	83
PID 2416 wrote to memory of 3488	2416	firefox.exe	83
PID 2416 wrote to memory of 3488	2416	firefox.exe	83
PID 2416 wrote to memory of 3488	2416	firefox.exe	83
PID 2416 wrote to memory of 3488	2416	firefox.exe	83
PID 2416 wrote to memory of 3488	2416	firefox.exe	83
PID 2416 wrote to memory of 3488	2416	firefox.exe	83
PID 2416 wrote to memory of 3488	2416	firefox.exe	83
PID 2416 wrote to memory of 3488	2416	firefox.exe	83
PID 2416 wrote to memory of 3488	2416	firefox.exe	83
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 4452	3488	firefox.exe	84
PID 3488 wrote to memory of 1416	3488	firefox.exe	85
PID 3488 wrote to memory of 1416	3488	firefox.exe	85
PID 3488 wrote to memory of 1416	3488	firefox.exe	85
PID 3488 wrote to memory of 1416	3488	firefox.exe	85
PID 3488 wrote to memory of 1416	3488	firefox.exe	85
PID 3488 wrote to memory of 1416	3488	firefox.exe	85
PID 3488 wrote to memory of 1416	3488	firefox.exe	85
PID 3488 wrote to memory of 1416	3488	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://ytmp3.la/en-9CCY/"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://ytmp3.la/en-9CCY/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1672 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ffb1212-ee52-4d9d-94f8-78f16c69c549} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" gpu
    3⤵
    PID:4452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2448 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a02e435f-e8cc-41dc-89ea-4c5d1ff3f7e4} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" socket
    3⤵
    - Checks processor information in registry
    PID:1416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3020 -childID 1 -isForBrowser -prefsHandle 2864 -prefMapHandle 3212 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75efbe07-8cd0-4ea6-9a74-dfe5f13a01b4} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" tab
    3⤵
    PID:1640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3952 -childID 2 -isForBrowser -prefsHandle 3944 -prefMapHandle 3940 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dbe9f56-ff93-42e8-814c-c68363f6e89b} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" tab
    3⤵
    PID:1188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4764 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4740 -prefMapHandle 4744 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9df7d676-8dbb-4f9e-92b7-4fc5f7bedb6c} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" utility
    3⤵
    - Checks processor information in registry
    PID:2884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 3 -isForBrowser -prefsHandle 5328 -prefMapHandle 5504 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5fde71b-7168-4dc1-a098-a7240f66e587} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" tab
    3⤵
    PID:4824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5736 -childID 4 -isForBrowser -prefsHandle 5656 -prefMapHandle 5664 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fd615fd-aa81-44da-9227-dca224842fb3} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" tab
    3⤵
    PID:4788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5856 -childID 5 -isForBrowser -prefsHandle 5932 -prefMapHandle 5928 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef5c1bfe-48d4-4e9f-be23-224a0c9cfc99} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" tab
    3⤵
    PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 6 -isForBrowser -prefsHandle 5876 -prefMapHandle 5664 -prefsLen 29278 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8601ffd6-6999-4ca1-b0c3-bd2bd58c1bd2} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" tab
    3⤵
    PID:1332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4000 -childID 7 -isForBrowser -prefsHandle 6484 -prefMapHandle 6480 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {212ef41e-bd1d-42f4-8e9d-34e3f68ad72f} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" tab
    3⤵
    PID:1804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc27becc40,0x7ffc27becc4c,0x7ffc27becc58
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2148,i,3489218150141042768,15689068553072082151,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1956,i,3489218150141042768,15689068553072082151,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2308,i,3489218150141042768,15689068553072082151,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,3489218150141042768,15689068553072082151,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3416,i,3489218150141042768,15689068553072082151,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4580,i,3489218150141042768,15689068553072082151,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4840,i,3489218150141042768,15689068553072082151,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4860,i,3489218150141042768,15689068553072082151,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4704,i,3489218150141042768,15689068553072082151,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:1112

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a5d1503148ed21ccef8fd9fb55c2cd8465da8f88385112bf4cf48db11206bd72
MD5 8caef7ceacd3547f7cfd2cac2a5818d1
SHA1 ceb74e8f7e1a01984e6e0fb1ebb8997bf42a0ba8
SHA512 e9f96d0d50b223f85362caa06450dec0611bf8fafb9df0924fe4d5d16953f7df4733982862fe17325522fe2e268f6d85a5b9211b6346a0f97e305665a21b1b87
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 41KB
SHA256 b36086821f07e11041fc44b05d2cafe3fb756633e72b07da453c28bd4735ed26
MD5 ca9e4686e278b752e1dec522d6830b1f
SHA1 1129a37b84ee4708492f51323c90804bb0dfed64
SHA512 600e5d6e1df68423976b1dcfa99e56cb8b8f5cd008d52482fefb086546256a9822025d75f5b286996b19ee1c7cd254f476abf4de0cf8c6205d9f7d5e49b80671
SSDEEP 768:prRKpEQmW643evwSMZAg1HeX+ithD47vwZOlq+EjnEF9rPd:prRKyQoyevbmbRP4ZO3Ld
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 18d6c381b32ade29c14574fc9c30bd2a59caf45dd2d3b1b92b9676e8cd26d8f9
MD5 0a638b96e151644c13e55f8caf229826
SHA1 67fb791a36b2213632d15415b22ccb500b9fba67
SHA512 36afc3c26728b38f8cd7653fae132704fd98ae13d6d000ed4bebecfc149ef42e37f86c7542b04f42cd94f4baf4ac7d6bef46ed7e9d187a66edbe8b8c6909160d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 a4f8b433443cc7798f99ba659b16dc7e6845e39031c8aeb41e2f8b48e8ae1017
MD5 5632a42936a616f82adb54287a935eb4
SHA1 2e9bb32354e8d002422fbee7d53f66e1c99bc281
SHA512 0427b62e84c7c2aea1c34a408f4466a75152388adcde13abcc317b0e64d288c150afc617cdc455685720714606e7929223d46013f4b2fd6378ad069fd2f1069d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7486495d94ef0b83b164ef7cadc264335ac3eb18a160ce6115fe3423ee8910d4
MD5 2698b61c3576863943ed350c62687a97
SHA1 5ce3526dab7f2dd46894c863451682c5e1aff334
SHA512 ac325e02c172980232d86617e2978ab865b06c5d3bf004403674e2a0c9c679852a7b1b59935321ac496886e9ca8b5395a634b810e3c3125c10e370736d0204c6
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 381e5c781814176365aa078ef89720fce395b01b4bad6633a0a7296e0a16506f
MD5 571c3623526e283784880188d87aa22d
SHA1 f7255021a7ff054c40004fd501f6f8a2477a7319
SHA512 7ccc9f921a3185b041c0ce133c4bfb63a210b0342ec976110bcd36f77ec7ffb0c1a51a626b4e17b810ca60823b8d3ab87f097acca97443a1519f939ba8d28b55
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8d7e21a7cb4a294d8541b80075cd3b88e745f8db23da32765e6d3f8bc69acbc3
MD5 cda4f3884b1ea5886c12f2edc53a1ed4
SHA1 27fc97030f75bf576765979c82f1008bdfeda880
SHA512 666770629f725b42837fd8fa0b994f758e40b11d79fba798cd2e8ff39af69362342d8898e8c88aea1d0b4e8a8804b26bcb469bba53d8d0d297d91d5a6eed5b35
SSDEEP 192:U8QFyiBZHeqsHV+FM1k3eu2y6r53Po6yIsnVdg4:U8QnYGSkX2y6/4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 b2a9d6cb3cef9e0d817622181187ad4de9664d2696ed1e1cb3bd66a145e58c92
MD5 25c74de82c096cc71c684e04b5650d24
SHA1 c7111b687e761d3d3e55e4559f103b1224d96289
SHA512 eb3daa209b61176a61a1960667b6ad683b2e6be3eb89a5f80ee3f39995df66bd3741ab85fe52d5272a56cf82f60ed269297f7f5f7badf76b9cd41d267c335c02
SSDEEP 192:U8QFyiBZsOeqsHV+Fvu6Meu2y6r54Po6yIsnVdg4:U8Qq8YGW6U2y6u4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 731004c712d4c19e7638cdc72db2d3d208ef3f1f9ccb7dd82d3bce19a083293a
MD5 cc60af5ef570daa081c916d4ce932f7f
SHA1 56248fc2812af439fae80df1d86f3ffcabc1dd82
SHA512 6f9c024b5c9df0c3092933eb5f117e71a5e769a6a5dfde668e343e204602a3a74bfd6acce6db2388e925fc2a5fb85874925f9b972ade7f15fca994d58ed3ee26
SSDEEP 192:U8QFyiBZaeqsHV+FM1k3eu2y6r53Po6yIsnVdg4:U8QSYGSkX2y6/4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 a222b9b5776be0f2b26d9e24df8301190282d0c0ff03ab3f9219bd7b781451c5
MD5 f9f4894b848f71b0852f905be274624a
SHA1 687e8a8a9d6d9b808a29fc2183a9568e57851993
SHA512 8760528f8c2e6cd37264ad4ecdd95e732b2a08501c2e29690ecb11c29b6ca35e7655ddb429653664886921c1ae9e3d51b890303fea4c199835964ac3ab58bc9c
SSDEEP 192:U8QFyiBZGeqsHV+FP2ileu2y6r5Vrdo6yIsnVdg4:U8QGYG+iR2y6LL4
MD5 SHA1 SHA512 SSDEEP

Submit Download

f92f7c19-18e5-4587-90a9-4e041f0e589b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f92f7c19-18e5-4587-90a9-4e041f0e589b.tmp
Size 15KB
SHA256 b71ac6bf0c6c393fdddb0f54f9fb6dbb2d4da1cde4baec37b4218a50fa45194f
MD5 80bcc824a2ec52d1644c8410aae28b5b
SHA1 55f94f055c11c4cd19506494c7bec715ec56a64c
SHA512 4e239fa3e6b67150cfb0699d98f20efae2e073d5b8dff76856e5c6e4a733ef0a70f72e950c33cc391385867f5aa846a0b14a8a6a538dbb1e52b4e42bdd9f68d9
SSDEEP 384:vrUT7pLhLcGQX6X821kXqKf/pUZNCgVLH2HfS3KrUvoHGTE2D1C+:v4T7pLhLLWo821kXqKf/pUZNCgVLH2HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 5a73db5099ce5f73ab2efe41e92d26ba5282322722e11a803821782c5314d355
MD5 93ea08ce1c6f86a50d4cd754fd8c23b7
SHA1 7ee467d214d07e30d9ec3046a02dac3268ce1752
SHA512 d257c9783b8ed61023c78ea4f6a4a1bbeac8e59b255432f5f0e4a8dd2c9a43211e7270b6db57eb28b86a3f1dd27184440378370bb4213ad343a9c90788a0f0c1
SSDEEP 6144:1UoFsAThUalKuO2yp3VTANUZt46Jlxse6HWNj6YHgta9el:1UkThuR3VcNY46Jwen6qgtaM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 725c571dfb474f250e60de599b5f5f3f47356af009aad755a6e0d7075ab4ca65
MD5 3e97931e3e1e4e79f583a198cb4da336
SHA1 985bcdaa6c039c534a1728307f1cb0acf43bec4a
SHA512 988032af4273573b39d67b372bdc090cf363576bfe077c06bbf03493ff6da8ca29a40db370d798fd8e8303bb64501f7ae8879def7e69ff742e3b6a780c2e9a61
SSDEEP 6144:iUoFsAThUalKuO2yp3VTANUZt46Jlxse6HWNj6YHgta9el:iUkThuR3VcNY46Jwen6qgtaM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 401cbe63f138bb83e4f97229f4f413a44391bbe9c4595ab608e412ffaeb4d778
MD5 0ab0d600f573b7d18bf229de3d790a9e
SHA1 9bc43af0648b08ad5675e0855317747aed2e1bc8
SHA512 4abf4b570654fa9074bf61f34d54fe81b605bc7faf4b9a380ad8d947e6c6f70c142041c609a2b157e42b8ba1853b7d28a0098375e96198571d5186f5b6423efc
SSDEEP 6144:oUoFsAThUalKuO2yp3VTANUZt46Jlxse6HWNj6YHgta9el:oUkThuR3VcNY46Jwen6qgtaM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 8c16357e58525fa6a4fb5c6bca11e5f97ff3a9e418e02e885f8d56ad38efcbf7
MD5 27d3c42b4f6ef59ed286649aabdcafd4
SHA1 174463686bb811d936913dfa79d28f5e239f8792
SHA512 cacab9d33d60cba6107db5660c5b37c240fcd20794c5edc573450226dd9f8469bd5d376d6d618bcb48fcceaf64152e24bd41273582f9d4d24c951a2a79a57bda
SSDEEP 3:MsEllllkEthXllkl2zEkltN//l:/M/xT02znD/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json
Size 28KB
SHA256 f4739d014a77ba80adb38a88df3110c3f5c1605ee83125de14d3cb51305ab9c9
MD5 a963cd28ef569c06ce19a33a103ea26d
SHA1 8fc524a36d3c743995b6e29bc4ad036968fba094
SHA512 a515232dd9cf9ef4843f7afc7d28f6b0f7a4f46a1bc58f25f61676e2d6e70fea9d319bd5557fa03a90e09ad85e4c82b7033dab0ecffc2cf8931c190e061b806e
SSDEEP 768:8As9eR0UoxWMTuZeydHRcARcWqxWxZFBqKDKsi:8AgnkhRpR0EtBqcs
MD5 SHA1 SHA512 SSDEEP

Submit Download

0496E33B07BB9340090B6FF9A653DA5443DBD403

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\0496E33B07BB9340090B6FF9A653DA5443DBD403
Size 224KB
SHA256 48e2582943ac5a079b0995d38d192ba5f24f44a205aaf0888134cbe366bfcb30
MD5 8d0127b0af91dbea03ce027b99d0bb7d
SHA1 3b3a593ad2e6bc6b9c27b613cedaf4b3b1facce6
SHA512 f8c03978967b28043ae3027336e986a555fc2dc9a3e6b77a5e358a4aee724168edb8af79f93dc5c32e182bdd13c96c20c1db619a87aa712f400026fe5c10ec0a
SSDEEP 6144:boRp9xQvJu0sQM243fIWthGgn0B6kWvlGiTn:cRp9uJuDQM24PNcg0B6tlGiL
MD5 SHA1 SHA512 SSDEEP

Submit Download

37373F56CBD822F5FCF64BA01E1320A0924D8460

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\37373F56CBD822F5FCF64BA01E1320A0924D8460
Size 24KB
SHA256 32de668456f558458517b3e6bd2d57426936b33f5b83db5bb8f282b23df637d3
MD5 ebae02f602adf983e59d3b7d0dd0a332
SHA1 119b2e7de9479092c5fc579a53023ade75373eac
SHA512 2e9dab7ad56abe01c5daf5d190087cbbb6a2a7b98c952e73f3b82785a8b24528e623a14c96e000d8a1cd8065fb47a5fcf8a5252df655e5d6c0911b883660334d
SSDEEP 768:OuPgEvIzFniejWl+GwDwQvOB7eD8WyG+VGW:OuPRvIzFngWo5GQGW
MD5 SHA1 SHA512 SSDEEP

Submit Download

8E62FE1C4AC561DFBA4AC7F80730418E5CFDF8B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\8E62FE1C4AC561DFBA4AC7F80730418E5CFDF8B2
Size 61KB
SHA256 abba209a418c0af10c50666953d0ccdc2871d501781d12c556417283a3661f80
MD5 f98f7f65b14b02cac76a86c81f5b6fc3
SHA1 5847f378433a50e30e45b94e3db5b22e1fff0fd4
SHA512 516cd3e0d6d4016f911a818deb1583160cef93259ac1a215224f43c01cb706f946462be3b8aa8e326f4a02eca67ae781ccf468b2eacda67a501e20756aa2ed1b
SSDEEP 768:7nZomiL+xKzLtHfijgwgv338rae91exqgLtHfijgwgv33Wrae91etKNyCHHc4Knt:2bTI83ckVI83Kk+rAVoFE1EK
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
Size 7KB
SHA256 df43fce10347e72a222e7058c12d6f49efac3a2475ca37c6846d0d3dd141df1f
MD5 4a301b0d5d22eb987e57b8257bed29a7
SHA1 1a29579ff9253164eb628a795f36e4c19664780a
SHA512 02fc0e5a89ce2b281adcb131a824532087f4547f6bae38aec4cbe1fd6477adc039148ee74c366929b03b6bf0b3610f2756ce9ddf8cf859079e4838947fdc6f04
SSDEEP 24:5uB1oEFsh2F3LF0/sgu1xgRbPVuhMZPWpR5cOsy91Ogx:Vs5oK9cOh1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
Size 12KB
SHA256 79f1300c3ea07900b820729b19e6c7b759dfaae6be0453856f529cd0e5e6c33c
MD5 349d571c96788798b3c379421b2c0075
SHA1 d82c319be4f832cd89e889814def42449ab04f6c
SHA512 f4c43b70e5e42493695ebb43bfff672fbf40bb62cd626c1a51d676917ff2d18da07085bbc880390b5ef58f8ee02633eced2b9d1c3df5d0fb5a368ce205af0257
SSDEEP 24:juB1ogQVGFsh2F3LF0/sgu1xgRbPVuhMZPWpR5cOs6919QVgxM9BTgxI9xfgx1Ri:ls5oK9cONBx+6xC+x
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Size 23KB
SHA256 d883aea61701e0a4d496a0be661bc2be0115b2c991e88ee6cf20f04f07b01806
MD5 60d0078d86a818ffd3d6ab007cc32f8d
SHA1 5e96f0ba243de6dbe560164152383daba789e4cf
SHA512 07ba600927c5448d82b34d42ce196c23ddd8520d69f7f6cb936c6599027011a68bb40b748ea7f51fc79d2d4ae0070d47d2c3ca8fc62664d5cf109a3e5f77616c
SSDEEP 384:0boIU8PMxsd8VSwGYg5PvF3ska3E0bTbybJbFbTbPbSbabjbEP6lnvD8/66JozGO:8bExsaEwGNPvF3ska3E0bTbybJbFbTbp
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 1143b1e688a54d2e6486f13b30506d19327fe22f4ce432a2746824b358e47d68
MD5 4e862fabc0bd018ab662df560512ee3c
SHA1 cf9b0740ae374a6b2855277797fb6663b004653d
SHA512 48162987fb4435add14830453409f35cfe293530812ad2fb783d4e37233ae561ed6ed95f9eb226322ceeebf5a0f1bb1d46be6bf790be21a2a47c63dbce3bc7d6
SSDEEP 384:h/66JozGzgC1bRxsd8VSwGYg5PvF3ska3E0bTbybJbFbTbPbSbabjbEP6lnvD6bs:EErxsaEwGNPvF3ska3E0bTbybJbFbTbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 721b1bedb0c8b86f9c81bdb50137460010dc16ddd20c9788bdec7c24c50e5d24
MD5 77c1b5d0500834727c8bf0e75152e32a
SHA1 c4a05145d185e9984855678803440f53e13a11a8
SHA512 952be2c7cdb1714d52cea48c5feda519fb80ea867f22ec97a9126a2b90b0f4215b46901dbcceb64f0402bb9b95f3e25d59d749d13b6fb1fa9452539c792df3a5
SSDEEP 384:3xsd8VSwGYg5PvF3ska3E0bTbybJbFbTbPbSbabjbEP6lnvDPboSlPU/66JozGzC:3xsaEwGNPvF3ska3E0bTbybJbFbTbPbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

38473a79-81d0-4123-a9fe-2422952a6f90

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\38473a79-81d0-4123-a9fe-2422952a6f90
Size 982B
SHA256 4c8e571c9fc0901aea5198d38866ea5ea0f1910fd3f1b1349cf138725973db4e
MD5 73c067daeb256ca3c1a423fa392dc9d6
SHA1 8607ac429e53af78836819a2d190ad1eb68950e5
SHA512 5f6f66060043dbea7dece4d18cbf60f14bdea0c68cef0c1f0cdafeb8c3b6a5dbe163744d1e25ae06a472c60e9ce85b9e11b87289a4887c15bbd83f8a7f8a0abc
MD5 SHA1 SHA512

Submit Download

453ad35b-2d73-4799-9196-d3dec77a17eb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\453ad35b-2d73-4799-9196-d3dec77a17eb
Size 659B
SHA256 5c2fdb86917cc0d80069f95633131ac1c1d5ac8b61b302fee58e3d687b41c902
MD5 f78876e536b2b357fd2fea298e1d3af3
SHA1 7921772e4606e60e11408a85d6fe88f3e4e95b65
SHA512 1c46f5f141ee3a0fb6490146072bc38f7892dffaaa7413cef5c8a5bd002c598fd3e6b74aae5c0cf2bb2364b530b31a16fe1502c88b27501d3a7edc2eaa165af3
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
Size 10KB
SHA256 fb2bae7581c0b71005f88237e119ce697e6bcb13a28f34d8a53ed7c5f886f9bd
MD5 fa93a3c7610b6ccc2e55e11e019918e0
SHA1 8fb294b92940eb9689a74559b4e60733ab0834c2
SHA512 5130f1cf8b7f15cdc24317d1b4b96d59a283cc1a3362c344c9e13523831647613fd01525eac943470364fac16d8d1373cc02e272549b712722eef6ba02822987
SSDEEP 192:F65n/ReMYfMeSK7pHIxn8Kd3K8W+dvEvcVjtNnDfFvOGaX8XdxpSG4Bw8HD:FFzbZIx9K8N1FDRNxqw6
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js
Size 10KB
SHA256 64a7849cfce6a117fc08a9d5911f8e113afc03d9dca831cf09b9f48a968bde50
MD5 57ecd88e753088e0fad7e84f9d419cb6
SHA1 fc3a3f06572cfb72b37d6dcc16d1c8d9608b278d
SHA512 ea377fbef5245f95b0da669746f820cc9fd9da6091de4dc921eb66488f472dd375076418c652161785a7498139c6d5a0545602bf9c970c522d88250d5fb8697c
SSDEEP 192:F65n/ReMYfMKNZns/uI4gYcU8BtD8JJCddLMy1Zzw3eaX4XdxpSG4Bw8VM:FFzXsWuYgUJJ6My1Zz7Nxqwn
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js
Size 11KB
SHA256 75291f4be6652557a2f1ed974c4193c4b606e7b226ad3c4dfc603cf5b2fffdf2
MD5 30d5c19eb750e3a22214a6f8f80e4638
SHA1 f7f6bc4008b2907d803c4cf3fa8caa8a1d538004
SHA512 19a412f17f3cffe56e19a49fd02ae5e1146308e284056a28aff85d0760ac8c4561de6ebc66e089191bda65990a5b5f1862221b9e95cb51e63c6c8b48f502903f
SSDEEP 192:F6Kn/ReMYffeSK7pHIxn8Kd3K8W+dvEvcVjtNnDfFvOGaX8XdxpSGdBw8HP:FMzuZIx9K8N1FDRNxjwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 b626d5eb4852091926a4502a9ec360ce36183972b6f36f38baf14df64c5b2c2d
MD5 4048505d835ced756a60a60896b6de1d
SHA1 711882ea48cbedb532da6fc763f4b789fccd5d2d
SHA512 20598d1fbaa65b95ebb0139261507120e4dece0f93faf9d71afd07ab07e2a4009a8cc93ec30337a74bd05688583cfe85ade9f420d6f07212ee51342a3ea84ecb
SSDEEP 96:Fz+Ha8EMJF7VbMZk0zf8W8Qge3ZwS2tg1ILUy2maFmoJKe9EBbAzHAverZZXU/C:FQaRgF5MZkcuem6Bmapoe9EggG1ZXOC
MD5 SHA1 SHA512 SSDEEP

Submit Download