8dac1f7daa6011af24aa06f24419d13c0ba6d9cd128dbcd6f14d0ac04acbfba0

Analysis

max time kernel
123s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 897KB
Sample241008-bp5keaware
SHA256 8dac1f7daa6011af24aa06f24419d13c0ba6d9cd128dbcd6f14d0ac04acbfba0
MD5 924783f66ec78c390df83e006b84a1cd
SHA1 595a7c09bdde702a0eb3bacb16c5f0c4d3abb548
SHA512 446b6cd623928428a9ac3882b779cffae07cbc5f8acfc39cfefeef36d5c49587ece301cd5dc1cffb149f1b1e0f1dbfffd5daf7077305c1f6865645c958e19f7e
SSDEEP 12288:nqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga3TD:nqDEvCTbMWu7rQYlBQcBiT6rprG8ajD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3508	file.exe
3508	file.exe
3508	file.exe
3508	file.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3508	file.exe
3508	file.exe
3508	file.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
3508	file.exe
3508	file.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
3508	file.exe
3508	file.exe
3508	file.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
3508	file.exe
3508	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2228	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 3868	3508	file.exe	84
PID 3508 wrote to memory of 3868	3508	file.exe	84
PID 3868 wrote to memory of 2228	3868	firefox.exe	85
PID 3868 wrote to memory of 2228	3868	firefox.exe	85
PID 3868 wrote to memory of 2228	3868	firefox.exe	85
PID 3868 wrote to memory of 2228	3868	firefox.exe	85
PID 3868 wrote to memory of 2228	3868	firefox.exe	85
PID 3868 wrote to memory of 2228	3868	firefox.exe	85
PID 3868 wrote to memory of 2228	3868	firefox.exe	85
PID 3868 wrote to memory of 2228	3868	firefox.exe	85
PID 3868 wrote to memory of 2228	3868	firefox.exe	85
PID 3868 wrote to memory of 2228	3868	firefox.exe	85
PID 3868 wrote to memory of 2228	3868	firefox.exe	85
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 2484	2228	firefox.exe	86
PID 2228 wrote to memory of 1424	2228	firefox.exe	87
PID 2228 wrote to memory of 1424	2228	firefox.exe	87
PID 2228 wrote to memory of 1424	2228	firefox.exe	87
PID 2228 wrote to memory of 1424	2228	firefox.exe	87
PID 2228 wrote to memory of 1424	2228	firefox.exe	87
PID 2228 wrote to memory of 1424	2228	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5bba48e-abb8-4491-a330-95bf1cdf0350} 2228 "\\.\pipe\gecko-crash-server-pipe.2228" gpu
      4⤵
      PID:2484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61a1fae7-dbaf-4836-a678-c76551cf4050} 2228 "\\.\pipe\gecko-crash-server-pipe.2228" socket
      4⤵
      PID:1424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3052 -childID 1 -isForBrowser -prefsHandle 3064 -prefMapHandle 1496 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {397caf9f-af9b-4ba9-b049-15c75e3abec2} 2228 "\\.\pipe\gecko-crash-server-pipe.2228" tab
      4⤵
      PID:2144
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3804 -childID 2 -isForBrowser -prefsHandle 3816 -prefMapHandle 3844 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8a8d00e-bece-472f-8402-4bd55450e57b} 2228 "\\.\pipe\gecko-crash-server-pipe.2228" tab
      4⤵
      PID:3756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4736 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4732 -prefMapHandle 4728 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {888578cf-ad1c-4551-95a3-9bb3e3393414} 2228 "\\.\pipe\gecko-crash-server-pipe.2228" utility
      4⤵
      Checks processor information in registry
      PID:4828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5484 -childID 3 -isForBrowser -prefsHandle 5564 -prefMapHandle 5560 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a9c4d76-1758-4c29-aca6-377ac66f3cf9} 2228 "\\.\pipe\gecko-crash-server-pipe.2228" tab
      4⤵
      PID:3428
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5768 -childID 4 -isForBrowser -prefsHandle 5688 -prefMapHandle 5692 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c74090f0-5294-44de-97d3-d77d0c7367aa} 2228 "\\.\pipe\gecko-crash-server-pipe.2228" tab
      4⤵
      PID:3188
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5944 -childID 5 -isForBrowser -prefsHandle 5720 -prefMapHandle 5724 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42a83ee6-d634-4e88-9570-fbd7aeea1ed5} 2228 "\\.\pipe\gecko-crash-server-pipe.2228" tab
      4⤵
      PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json.tmp
Size 22KB
SHA256 f8042ff02c9a3abe673b0c8702a59f877567e813fae97e4c52078fb7fea3dc39
MD5 e2e875bbc5952747e388775f4e5051ce
SHA1 d89a0fc1fb42896d321af1e6b7edce060c4407ed
SHA512 be292b825c2e20e8a04d1ea27e4075524d1f7842ccc18b9c29631d58f85a3dfe00ad34a2df623023eb1cb8365c6cdf1a95a5894b506c3b727506d1001c38b6cd
SSDEEP 384:Gjn6Y6IW20ueP9LGx0Lks52VGai1eyauPPr4G:GjnZnFY4xu52AYydEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 3ac437324e9db169f1784eb628aaa62ad4dd1f9297461531d820a4dde4f0c002
MD5 fde4987fb074cb563d409499fedc4638
SHA1 ef8570173084bc1ab94581fde6d4406fb5e74c36
SHA512 024bba15c2acd9e92c01fee0bb62ace53fdd3872a224f7f915c4a737c17e0ca6948c089ce9039553ada951f13dddda822b720c8a1c93164a9c831ec1980f5a9f
SSDEEP 384:H7C9Du9fiGLm4pUnpHLFoCr/E8HPJyD3VonFcP+AWRMAC/U6p:bbBi8mCUnpHLGCr/E8Rg3V/+hRMFJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 10KB
SHA256 571128257e4f84e210a94e21165d56da42872b02550bc62a0b12a2ff2b926a8a
MD5 8112318837eb6e3b041ae66710f2b0a6
SHA1 138a647129f63c933f2f19fb3ea6c127494902a9
SHA512 30aa5d03546fbc1061fc1fc6eeaf8628085a3b37a295426036298ac1d6d1582652b3a26f66c52d383a26d274e6f31a6a95183857d1b43fd2cf029906f26a6e79
SSDEEP 48:sXM5oK9cOLebVKIpbvebOJ5pb1pebvpf+5pb:0M5oSebVKcbvebOJfb1pebvpf+fb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 24KB
SHA256 351a508a81eeaf86d07336c2c8409a2e36950b902c9ab063ced966567a4ed5be
MD5 91ef128fc57014a53137a7c6c1706963
SHA1 2835de7db766a5a74a403a1374d869eb8d75dfdf
SHA512 c84155fe3b01d26792b06268342264b561b863faec0918b552452440f4932a7e2539293e8739c23f9ceddd6f00ae7a3055d2f2122ab769a90fefb1cca89a4310
SSDEEP 768:oEfnVK/WH8dD/0KpKHpfzSbibJb5b1bub5b0bptj+Z:7QWHztj+Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 24KB
SHA256 473d8e5a9502b8974693737449cf2ebd942fb160cf2f438cb8a5cb23db49f0c6
MD5 43396564c83957a807683f67f71fb129
SHA1 1a3d3a75a3fdcb1948a239b38880b3da09954561
SHA512 138bd2f4927ef5e78607ebf0f36e2ca5c5bb780ecf8061ed20ac7faeb960d0a99a12e070858956b51ec573f9ec9a6f537b24f96812de8858ef8479f3a6a6ed43
SSDEEP 768:mK/WH8dD/0KpKHpfzSbibJb5b1bub5b0bptj+d/DEm:mQWHztj+r
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 0f651424de6124fb25912ef72bf15302c2df88bbc63d1fd30d700dc566410c44
MD5 a4136bfe9232d76a5694dd0e1d0f558c
SHA1 d39f3a3db1ab5dfb54086d4075af6ca49c5b3fd9
SHA512 126277be6ef4a139fe7c18aafc506067db1714796d594fb2119f91ce8d3b0985c6bef70d2193ab1d3c98dd8775b715fbe26caf90abb23097c58e9e6dcc428b22
SSDEEP 384:1/66JozGzgC1ba7mVQAzy4nZ6P/02cKHpfTkbibJbNbSbub5b0bPsmYGlrboSVP1:oEcmuAzyk6P/02cKHpfTkbibJbNbSbu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 3819cb65ae354eeb56968ab0c178dc4ca8ca269d0022f14bafa6d8f07739555a
MD5 eebe88cd61cc6ba8bdede1d1330af172
SHA1 f9d747120412679e6273bb5c8f3f20ac1327ef6f
SHA512 0df3a366cce0647707c7e6183165223861d0a9e1f3e5540c15dd84daea82231e96ede4c3363f777b3cdd7194c77a91e3c22d72fe347563559468b1719d54d38f
SSDEEP 384:47mVQAzy4nZ6P/02cKHpfTkbibJbNbSbub5b0bPsmYGls/66JozGzgC1bvboJVPD:omuAzyk6P/02cKHpfTkbibJbNbSbub52
MD5 SHA1 SHA512 SSDEEP

Submit Download

96ef9021-30fd-4fb3-a08e-d37ab2895b49

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\96ef9021-30fd-4fb3-a08e-d37ab2895b49
Size 982B
SHA256 26bac902f0be0066c481d429515555b2b7735f65ebae4e4d96d4f94cdb7eae78
MD5 86c3010d33818312a8c7d29a245de5f2
SHA1 209d05ff96036fa0061e8382befa273bc8d6546e
SHA512 34397863abb0f348867be4ebdd7ff465ce01d95c8e42dbd3d8511ed5066396029749780fd369581613e51035d32f3c8f8dbbe23f6a4a4c3e4bde502a30d1a84f
MD5 SHA1 SHA512

Submit Download

f8086f8b-54e1-4fa6-a0e3-34082c0ec525

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\f8086f8b-54e1-4fa6-a0e3-34082c0ec525
Size 659B
SHA256 68cfdc4f9285f00215375d94f1c8cd218feda32e80674f278a0ade3ecd343a80
MD5 ad2ac0e96b4724ffe4fe0da253138c6c
SHA1 94091884ac18edd5fec6f01831df24cffd0e0281
SHA512 3e4bd51efde3337205938c882af6cf5dc2f1ee73f5e5882572bd229c519e31773a2b0416a9c6b6e303cf9d09f77c140b6a638c9c557c26f1783c4363b413dbd6
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 16KB
SHA256 954957f7fc3ac66a9c0c09afd2542cbd8e5a8a0a95cb87577f7834eade9f0045
MD5 c05a0fc984a5964cb870862319e83a59
SHA1 b67be2f9673ea590cde995c2a4e8c4152a3802cf
SHA512 aa35020a6ddd8d391fb37729fd027b5ffc1f6acd502d17f22ab96fd7ebf48f65dfcefaa5999e8111c4543bc2ff85dde7135bec18843ad65d0609108594be8a79
SSDEEP 192:RCnoRJfS1E0OIHxnyd3PW+ucAdUItB80VetysZM33aXA+oVU68E6iBw8H7JHLnVb:nUjZHxKPW+uLUHyYnoZRws1d
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
Size 12KB
SHA256 8c8efda5d0902039a65b04af4d9a00c9253418a3b0d7b7e8f1c4dc9a42145b57
MD5 11e9b26d1a371cbb0f977cb7d592f7ad
SHA1 6b80d52aeb2dc72ac269463058ac0e086fe57b39
SHA512 1dbcf0eb5d0d97ffc839bf40cd62b7bdb5d29ae4a65016284b7ce625b1c98e758669f9fecc5c7ba57e829e1cff49c16beeb0bc554bbc465b6bfc925111e3ca74
SSDEEP 192:R5noRJfS1E0OIHxnyd3PW+ucAdUItB80VetysZM33aX8oVU68EqBw8H76Xx:uUjZHxKPW+uLUHyY6oZ4ws2x
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
Size 11KB
SHA256 9d5298a8ca0e3e0f252cf0282fcc7b373473e808dc9f0288de7f9eaa55d199a8
MD5 13a6f07af21a84e1208544dc13769f5c
SHA1 ad154002129926030de86ec7b8a048717093f43d
SHA512 4599fc8bdb6f27ec57778008b78b85c805d9c052423b770aea1de9b6013d40a955166cb64afbac3458c5dafcef0ad0accf6c6a7953abc5dd0f30a74e04c30dcc
SSDEEP 192:U5noRJfS1E0OIHxnyd3PW+ucAdUItB80VetysZM33aX8oVU68EkBw8HM:nUjZHxKPW+uLUHyY6oZqwx
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
Size 10KB
SHA256 2dba1a09768600c6b89a0cbbb3a9aed48c2cba0d056c1f99e7b932d084690c91
MD5 d271bfcee7a6a97e368e7c41093e14f1
SHA1 454fc273b3e8645254ce547e4768d7fc67f80428
SHA512 bc8ebb834213ee290032d05be11391108dfb70455607f83fcb19ffe5876ffc4c17a0749e2288c00a923e24420c0bb912f61ac471c8bcc486552e02f93ca710d0
SSDEEP 192:U5noRJfSrVz1VofAHBtq8prddx9y1ZO43SaXdUoVU68EkBw8HM:nsVoIbpd9y1ZOSUoZqwx
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.3MB
SHA256 82ef338673fc0d42e5e93bdb7e511e75ec137e5f013a6b2a11ba1c0b1e768c7a
MD5 1956f9fce347ad0a333cb5b7dd62d958
SHA1 c1fa95e99d62a77056a3170974abc89bf6cd2279
SHA512 fc6236fafe0464e73a319de1767a6006e868f4edf9b3b29e83f3947d6c0796f7e7eca38de8036747ee18c1e243b6085df001cacb1883b1c8560157cb9c537395
SSDEEP 49152:VfcnC54hmBGL520yb1pRcOOAWJxROQQfgM/bkp+IsF84UtkK7Q7IinZP5gBt1RAE:KO
MD5 SHA1 SHA512 SSDEEP

Submit Download