3b810d20ec3ba5ed39ea4c81664fad1092190888e77f26f4bedc904129562147

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2024, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 897KB
Sample241007-2sagjs1bpf
SHA256 3b810d20ec3ba5ed39ea4c81664fad1092190888e77f26f4bedc904129562147
MD5 81ff8e876c02843bb3b16b403c4faa8f
SHA1 c73050ccf9d35a209c03aca6732f683a55dfd125
SHA512 a4e52bb05c798cbe3a5639a99402ec593464fbbfbc90547dcbf90771b4842a249a2bb7ccaab55f7c3a8675b94c76e06c4912529c814f0b360f09cc571a1fb491
SSDEEP 12288:CqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga3TY:CqDEvCTbMWu7rQYlBQcBiT6rprG8ajY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3132	file.exe
3132	file.exe
3132	file.exe
3132	file.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3132	file.exe
3132	file.exe
3132	file.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
3132	file.exe
3132	file.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
3132	file.exe
3132	file.exe
3132	file.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
3132	file.exe
3132	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1356	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 2252	3132	file.exe	84
PID 3132 wrote to memory of 2252	3132	file.exe	84
PID 2252 wrote to memory of 1356	2252	firefox.exe	85
PID 2252 wrote to memory of 1356	2252	firefox.exe	85
PID 2252 wrote to memory of 1356	2252	firefox.exe	85
PID 2252 wrote to memory of 1356	2252	firefox.exe	85
PID 2252 wrote to memory of 1356	2252	firefox.exe	85
PID 2252 wrote to memory of 1356	2252	firefox.exe	85
PID 2252 wrote to memory of 1356	2252	firefox.exe	85
PID 2252 wrote to memory of 1356	2252	firefox.exe	85
PID 2252 wrote to memory of 1356	2252	firefox.exe	85
PID 2252 wrote to memory of 1356	2252	firefox.exe	85
PID 2252 wrote to memory of 1356	2252	firefox.exe	85
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3192	1356	firefox.exe	87
PID 1356 wrote to memory of 3076	1356	firefox.exe	88
PID 1356 wrote to memory of 3076	1356	firefox.exe	88
PID 1356 wrote to memory of 3076	1356	firefox.exe	88
PID 1356 wrote to memory of 3076	1356	firefox.exe	88
PID 1356 wrote to memory of 3076	1356	firefox.exe	88
PID 1356 wrote to memory of 3076	1356	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1928 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ad82a79-5e44-4cb1-b460-6895894bef8c} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" gpu
      4⤵
      PID:3192
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2444 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ab360ca-d909-4c4b-b5a6-d0a68a34636b} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" socket
      4⤵
      PID:3076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2832 -childID 1 -isForBrowser -prefsHandle 3128 -prefMapHandle 3204 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1088 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb0482db-a6a8-4911-ad26-81fbdca8eae8} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" tab
      4⤵
      PID:5000
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2776 -childID 2 -isForBrowser -prefsHandle 3652 -prefMapHandle 3648 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1088 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ee05114-2a58-483e-994d-b1218285d073} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" tab
      4⤵
      PID:4612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4748 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4740 -prefMapHandle 4736 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e020f53d-1d58-4817-a151-30bf76b425e9} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" utility
      4⤵
      Checks processor information in registry
      PID:3776
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5468 -childID 3 -isForBrowser -prefsHandle 5624 -prefMapHandle 5616 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1088 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44a95a99-9cdd-4bee-a44d-1876d733166e} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" tab
      4⤵
      PID:956
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5528 -childID 4 -isForBrowser -prefsHandle 5636 -prefMapHandle 5632 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1088 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57c71f61-93ee-4386-9231-dd9d0295bf4c} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" tab
      4⤵
      PID:1952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5828 -childID 5 -isForBrowser -prefsHandle 5912 -prefMapHandle 5856 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1088 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d7272d9-ec31-4a17-b938-401c9347dea7} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" tab
      4⤵
      PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json.tmp
Size 22KB
SHA256 40a6ee412486500ebc4ff1b9f78280ece6a5a39ebfdaa8fa258ffdd34fe4a6d1
MD5 dde47ebe7bc375bb188ebda2dc6e15f1
SHA1 01cbffdbc006819ff418089dc3f850a439de8712
SHA512 276cac6442ea2df236e4e115a113b96335fe206394c9fec1ab2e0b6f2f1e7d2182eb62c7219dbc505bca5976f226e15fe1a88e5e241b6795efd243e7326ece34
SSDEEP 384:Ujn6Y6IW20ueP9LGx0Lks52VGai1Xyau5KoK75:UjnZnFY4xu52Axyd5KoK75
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 ecd192bf089bb2cac2c003673ff704d87767898825c5aae538fb633391374976
MD5 9828183f263d80034d4c5f906d545cdb
SHA1 d37dad6e1ddfbefcddb4c1a3c1a2b63da797b282
SHA512 86248bb1862b938c45d4d7d0be97af40f2dfb77a98ffac10804eb541b2c14a41726a1a07b31550cfbbbada48ef7237def44d99252974c77b21596417b2f548cd
SSDEEP 384:H7C9Du9fiGLm4pUypHLFoCr/E8HPJyD3VonFcP+AWRMAC/Uyp:bbBi8mCUypHLGCr/E8Rg3V/+hRMFZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 8KB
SHA256 51b5b5363055e414bcc342d7de256a0b0f25425eed979a3065bec2fbc346c206
MD5 97fb412fe3c34b2e96ca14a691bcf4ff
SHA1 a932ba3af989c65cd4ddcd542a6bb63dcce52ac5
SHA512 b3001802f6af95d1a1c933db6499297aac13db49b194bb81fc2800980a94073a677eb6799078414fd9d6c8b13dcaac2ab5d58d08f9528e2e8b1b6c5b03d8f33d
SSDEEP 24:CuB1ozEFsh2F3LF3Wgu1xgRbOpR5cOWTuhMZNNsJblLKMbvsJbF0Jrb:sAW5o69cOcNebVKMbvebOJrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 13KB
SHA256 7e75b6a7e7a75880cae00556c2495d5c82d6655bb80619de9c69be6a33175279
MD5 7c297164d03adbc1a89e486022b0969a
SHA1 eecb61926bf5282a83ef616523cf21f61b4f474b
SHA512 e7507f895473ae9a0ee9c2327cdf2c8f2a8200651419084b40782ee0b01df57e082814052135b8586a5a3c7ddea737a4333868276d29c0c03ab64e489d1417f6
SSDEEP 96:V5ooNebVKMbCebOJMbIpebvpf+MblbJbIgbgzWbFbNb:V5hru
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 fcf696fd3931dfdf4741d2967f09ea171baa82a05de3e1ceec12cd32d78bf670
MD5 cfddde938f43b401aaa409c5342ff4b4
SHA1 6a83b174a777aa067646219359c91e5fc8dd5c72
SHA512 96a1af51c233f0e8c4dcb3906adafbf716a2f3fe97836ab352ebd3c5391ee9365e04a827f3c20ec831fe28f3f2df8e533a507aef388fe3be7807ec1067224279
SSDEEP 384:ebo+Y/5PeYyZLzzuNDzfXeb5bAF/66JozGzgC1bM:SwhydyNDzfXeb5bAYEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 c966deb217bcfbebd08553195da757f2fd9bc0133ec24e7b2d49a783a7dfbcb1
MD5 12bad7ba42973aa49fc7867ec7ae37fd
SHA1 3e834e967e879bdd21ce9325eebec214ebd6e6a9
SHA512 b14896623354fc63a21e962d32b167daf6afb904cb0da4458fa4811cc7cba83063a3005340e127fbd80f07aadc52bf80af11f78dcaa41134ff2522c14c19ce16
SSDEEP 384:5/66JozGzgC1blYyZLzzuNDzfXeb5bA7bo5/5Pr:8EEydyNDzfXeb5bAfQz
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 14KB
SHA256 59efad6fde6ce700ee7df54f57803514f0c222b32c7d37650a31346bfc2b1ce8
MD5 b7cde8e6da0f0d5a8725146c962fc613
SHA1 9596566232cd310488d6cba2632d4840aa571ff0
SHA512 93d1735b283f52eb5f2156fd6a2652c0301780df34dbd38b6bf6511990155b2104b2dd23ff4ee8d4004b9e01a1275aeec91792fc02e2b05c10fba3b900ac510e
SSDEEP 384:Nbo+KePk/66JozGzgC1blYyZLzzuNDzfXeb5bAO:tfpEEydyNDzfXeb5bAO
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 9a6ec7c9018dd8478ba123e010e6bafeb1443bdb76b4aee428c4b7a7338e42b5
MD5 12cd0d5f5065041a8c6738f798808f92
SHA1 8fef8346bbfc797be301c83973724639529e21fb
SHA512 40f3a968fb14c6da36a8fc5b46b80415d598b13b57702ec80550d27b8e034b042fb4fc9db7ad65bc4cc05e3fa55cf417b758a8fcf2d949c5c897e6682942aaa8
SSDEEP 96:6SMF9ZbkW6Shm0WPP/PrWZKLQCwMAFl66JozGzgClKtmSSM:6rvZboShBYPCz/66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

582cd8df-e275-4725-b740-a2314791aa83

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\582cd8df-e275-4725-b740-a2314791aa83
Size 26KB
SHA256 e38e2db5dc4e635165c8f9443ac4b195102a76ec1edcb15ba4a9afaeafc115ad
MD5 f2379844a2ffe45a8a96c87f80197493
SHA1 92de455dd63e2f9527c905799127d4a76e224ce7
SHA512 d6eff58e54b634bd0335b7ae62756eb4d9001fcda062b5da6a454f7df25c7c9c7559c9268952550202b510384caa01ab4826bb1414daf083b295b184c8067aee
SSDEEP 192:pzgJUPHY6rJ9CagCWsIDVGcmEPNTrnjEb2NLBFCJBJpdLRjB+0noiDRkRanqip+I:pW6reSdTcHFjAviAiRqeFl1SMP5RTT4T
MD5 SHA1 SHA512 SSDEEP

Submit Download

9c7e4ad5-5465-4fe5-8f78-8d94c94da504

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\9c7e4ad5-5465-4fe5-8f78-8d94c94da504
Size 982B
SHA256 bcabe4337e6a1ae1965ed469330699422f59c3654098dbc36b3db7b193d679a7
MD5 63551508cb7308bc87d36d322a2cfaae
SHA1 3a5d9944a4bc275f92e612a869f130c63d764c1d
SHA512 3940c9fea8c57e1c30480b7de2fcf1f0ce993d22bd42f59675ecd80b8b88a112dd069818f628be3750810b5150399531c4a6a78408a1c78a380382292892d9f5
MD5 SHA1 SHA512

Submit Download

de00f745-15aa-40d9-9b51-864da76edd6d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\de00f745-15aa-40d9-9b51-864da76edd6d
Size 671B
SHA256 f9cfb66155a9e4cd8cb9d45352048dd9b00d1b2802a38743ffdfa4d0ba74ce8a
MD5 4c6127a7035d2f8862d13c36222a5a2c
SHA1 19a77b176ef7020d0d3f3562a3f95224d5ffd99d
SHA512 8ac8b7bf7f78e1d1a7d38a5efd54c6d0281871c449f7a36d5be8315e59b221e5da70e13dac55c83b03aeee06686d0e3ae6fb500320c7263fdc49321fe31dae58
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 13KB
SHA256 cb7fbf8890f81a71a616c273a71360ade403243c47778435b1d199c7ecb95011
MD5 55dd5b0b2a12c0304f6eda6dbbb02808
SHA1 88e4f1fe3649b7470c0935a80871e430391fcb40
SHA512 9de044b46a76cc57267cc8f7e06baf1f2031638953d016de4251098462b43c0cb2066f3a5d58d42980640d47dabbdf71f304ddcde1e67a2b735011afaf45276d
SSDEEP 192:R5noRJfSuxaWfI4IZJNtn8ANBddMuy1ZzE3taXVoVU68EHBw8HUf:uSWfSPUMCuy1ZzJoZhwX
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 16KB
SHA256 bca6b9e318ec05d8b24a6bfd05b74a00bf7225356db0a4dc5608475b93ef3405
MD5 f5c18034a73dada3d64f3c8c39c5a960
SHA1 7111a23d21f1a788906eb4ecfc3565e2e0f3222f
SHA512 d17539d67c68099e236ed48a47b1a2f4948a67ec14489a19734decc8585222957e14523f482b1e96664c0200931ad0767a07b54db07028730c74d4b8eadd1e8f
SSDEEP 192:RynoRJfSuxaWfI4IZJNtn8ANBddMuy1ZzE3taXv+oVU68EfiBw8H7fjnAE:fSWfSPUMCuy1ZzCoZIwcx
MD5 SHA1 SHA512 SSDEEP

Submit Download