7f883df6d5ecb81f05a243d43863cc177cd9057a1e67a521e8d82b293f7a46be

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 900KB
Sample241019-ccn8bsscml
SHA256 7f883df6d5ecb81f05a243d43863cc177cd9057a1e67a521e8d82b293f7a46be
MD5 9fc08cc63d96f95e7879f020104fe48b
SHA1 5e4fc5db6dcab9421a215c3b2c2415e0cdf3abff
SHA512 36ec2a5a3c482076f8cbec8ba953125e2358a18c3a5953dd859882265ab3d40c57e41c83d4d356f87434bd55ac65c0f19895ae06181cba2ff5c73eb94bffdc8e
SSDEEP 12288:qqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgavTc:qqDEvCTbMWu7rQYlBQcBiT6rprG8aLc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3380	taskkill.exe
1960	taskkill.exe
796	taskkill.exe
1584	taskkill.exe
2524	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1868	file.exe
1868	file.exe
1868	file.exe
1868	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3380	taskkill.exe
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	796	taskkill.exe
Token: SeDebugPrivilege	1584	taskkill.exe
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
1868	file.exe
1868	file.exe
1868	file.exe
1868	file.exe
1868	file.exe
1868	file.exe
1868	file.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
1868	file.exe
1868	file.exe
1868	file.exe
1868	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
1868	file.exe
1868	file.exe
1868	file.exe
1868	file.exe
1868	file.exe
1868	file.exe
1868	file.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
1868	file.exe
1868	file.exe
1868	file.exe
1868	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2448	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 3380	1868	file.exe	85
PID 1868 wrote to memory of 3380	1868	file.exe	85
PID 1868 wrote to memory of 3380	1868	file.exe	85
PID 1868 wrote to memory of 1960	1868	file.exe	92
PID 1868 wrote to memory of 1960	1868	file.exe	92
PID 1868 wrote to memory of 1960	1868	file.exe	92
PID 1868 wrote to memory of 796	1868	file.exe	94
PID 1868 wrote to memory of 796	1868	file.exe	94
PID 1868 wrote to memory of 796	1868	file.exe	94
PID 1868 wrote to memory of 1584	1868	file.exe	96
PID 1868 wrote to memory of 1584	1868	file.exe	96
PID 1868 wrote to memory of 1584	1868	file.exe	96
PID 1868 wrote to memory of 2524	1868	file.exe	98
PID 1868 wrote to memory of 2524	1868	file.exe	98
PID 1868 wrote to memory of 2524	1868	file.exe	98
PID 1868 wrote to memory of 2508	1868	file.exe	100
PID 1868 wrote to memory of 2508	1868	file.exe	100
PID 2508 wrote to memory of 2448	2508	firefox.exe	101
PID 2508 wrote to memory of 2448	2508	firefox.exe	101
PID 2508 wrote to memory of 2448	2508	firefox.exe	101
PID 2508 wrote to memory of 2448	2508	firefox.exe	101
PID 2508 wrote to memory of 2448	2508	firefox.exe	101
PID 2508 wrote to memory of 2448	2508	firefox.exe	101
PID 2508 wrote to memory of 2448	2508	firefox.exe	101
PID 2508 wrote to memory of 2448	2508	firefox.exe	101
PID 2508 wrote to memory of 2448	2508	firefox.exe	101
PID 2508 wrote to memory of 2448	2508	firefox.exe	101
PID 2508 wrote to memory of 2448	2508	firefox.exe	101
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103
PID 2448 wrote to memory of 832	2448	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3380
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:796
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {242c1adb-1cbc-4b35-bbe6-31dcb91626de} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" gpu
      4⤵
      PID:832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2448 -parentBuildID 20240401114208 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8b42f91-bd4b-45a5-8e8d-86123681ad85} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" socket
      4⤵
      PID:3256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3032 -childID 1 -isForBrowser -prefsHandle 3308 -prefMapHandle 3280 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {daf8eb87-44f4-43e1-a40b-d50357aada44} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" tab
      4⤵
      PID:4128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4164 -childID 2 -isForBrowser -prefsHandle 4156 -prefMapHandle 4088 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b56adf3d-853d-426e-aa31-0605125f3678} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" tab
      4⤵
      PID:4180
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4988 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4852 -prefMapHandle 4848 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a49b1a1-6605-4aba-bf80-2ee09a0979a6} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" utility
      4⤵
      Checks processor information in registry
      PID:5216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5280 -childID 3 -isForBrowser -prefsHandle 5272 -prefMapHandle 5268 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7748850-1231-4550-ba11-828ee8ba9fc2} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" tab
      4⤵
      PID:5632
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5412 -childID 4 -isForBrowser -prefsHandle 5420 -prefMapHandle 5424 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71e53c8f-7355-4ebf-9537-e4efecedad31} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" tab
      4⤵
      PID:5644
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5608 -childID 5 -isForBrowser -prefsHandle 5616 -prefMapHandle 5620 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9260e30d-fb58-44c2-a538-663c77dc138d} 2448 "\\.\pipe\gecko-crash-server-pipe.2448" tab
      4⤵
      PID:5664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json
Size 27KB
SHA256 71cef5cccf4e814c136ed67b9fbdf747f62368bf0a3a0413efb52d833b61add0
MD5 2c1493afd6cbd4fd9230e4788b397af5
SHA1 58a711b24dc5ea9bd24551eb6e356554fac969c8
SHA512 9d4cecbaa3ab797e302304f201d3ee1f2b44b06e37d3dce677351b7ef78f859a3d81c0e1679c1b6627a3abac56a9d61ff0dab9e1ec7eca612f1ac23baff9887c
SSDEEP 384:whIS0RsiUv5Y+/sPfiZzltfKS2PRgyauQx4Hx4/DEBHnW47JPH:80RsiUv90yZBtfKgydN+/wBHH7JPH
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 e3dcb02498d34eee5eb5bff96bbd9f91c4fd75b937373b926f56fdc10a9eb9c7
MD5 e84bf849f3501e0db9e7be84ab848a02
SHA1 992d84f6b8710b850b351b8f7d93ee7feb56eaa6
SHA512 afb0a97febad7b1218c16b9003d20f44e976fbf5e94e15708eca98b34a894cccc98853a591fe5f43d1a87312e57f87565552a1c778cc90891db845b744f63a43
SSDEEP 384:H7C9Du9fiGLm4pUNpHLFoCr/E8HPJyD3VonFcP+AWRMAC/ip:bbBi8mCUNpHLGCr/E8Rg3V/+hRMFQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 8KB
SHA256 072814caeb3a5f516123d71bf61ec553fd98ab86cd0d617d723c3bbb62449589
MD5 fd27291dc2ae53863ffc5fb7da1abd74
SHA1 b42290d4e70ca3bc634facf55893c9bd9e84860c
SHA512 3afbb2cdbbd65557172e04351e18b2afa8cf270ac5cfe66eb9412990a6126c79f232cca9aed09b1a5feedc99748cf83ac4179ba98c0f7c9e64aef8d19e569437
SSDEEP 24:CuB1ozQFsh2F3LFcE6gu1xgRbiEcpR5cO9EvuhMZiEk2sJblLKcEObvsJbF0Jrb:s9/5oWD9cO9TiebVKcxbvebOJrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 a6bc63da0149a9dca4b13f5dbcb72e0ad503b4bebca5a15724ebaa31ca661441
MD5 948c3abc2e3007a20af1eb50adbcc56e
SHA1 001500dd8b3456903205611815f6e47080d8e747
SHA512 1de11143f3f8a2946248fbbc8ced7385f05d71ba25c7a9c93bcd15548ed03d166af746a5c701e56d3b496cc7e999d8da72f3a8becaa62731c28a26042de7b15e
SSDEEP 384:q/66JozGzgC1b8boSbPiQoNhBIhTcCsf5SPfvMyIi8Uf53bZbLbkb5bUbMb1bCbI:HEGFaNhW5cCU5SPfvMyIi8Uf53bZbLbm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 4697b781006bb0dc6dd416b070c31cf25db7b36114634bf3f66d483d7cc43c16
MD5 1a0232aa80f2ba973654b5301bfd0d6b
SHA1 2b0647c85ca18badce0f11aeef69e0612501868f
SHA512 27ef035ed937cb78a920f2c75fd2e59ec7038276adb8ef240a5160982fe27545ac403ff53dea977aa853d0e82c4811e1236e51a63a6a3c3ef5e1ae97f470f78b
SSDEEP 768:JDDEam/C92c1jBDfv+jIi8UftxbZbLb1bMbUbMb1bCbat3UMZn0ZQ:Lm/C2cxnt3UMZn0ZQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 73a846ae0c6a47f696368e6ba61f55cd8bafb8e966f39acfb77ad17a13f3935b
MD5 c66b86334a843f817c3d2db05db6d17e
SHA1 7ab07e9b2ee05b765742c2a3d61cde8401b6e6ff
SHA512 40a150db360475b3f424c3c7848c6fd36519bcefbc435e50262b7c982ca78b15da462bcb0115c505975e237639ad094f1d31c4ed31f3ee10936aed8d16f29a09
SSDEEP 768:+m/C92c1jBDfv+jIi8UftxbZbLb1bMbUbMb1bCbat3UMZn0ZvFDEm:+m/C2cxnt3UMZn0Zz
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 ce8f87e4cfdee82d74649c036cc4e8dd8ef48c54fcb9f45bdc651d3a3732d02b
MD5 52c457308011ed50d8ccf0f66dae30db
SHA1 9eccfed8aee4ace0538d5672bf75ed2f54c31617
SHA512 f5ab5eae4be7b41c042f321f40ae12186a1bc1b15a0360fb0eaeb0ebf6d5092cd044c6c3794ae76598ca84e2113865a3a0aae2ca03a9a39a1e74ffa272c28870
SSDEEP 768:4rDEam/C92c1jBDfv+jIi8UftxbZbLb1bMbUbMb1bCbat3UMZn0ZQ:Wm/C2cxnt3UMZn0ZQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

b7d9eb0b-1a43-4dfc-8e67-4460ab556cf8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\b7d9eb0b-1a43-4dfc-8e67-4460ab556cf8
Size 659B
SHA256 4038a5d22d228ec34cce78d319711e81af7cedb8a4c62dc69a2bdabb60d6195d
MD5 647ceffd7e1c4bd9e1b4dd6148261c59
SHA1 516d27e239c76a7dd2fa98d996a6f0ef4de6d2fe
SHA512 89357103907792bc42d2ec7ead6bd251ca5ffa7e1fc3d3afb8ef2d84c4186e2a67dbab3f408a5654edbb10aa952384a4d7cad89fe5f80c54054a9734b275be0c
MD5 SHA1 SHA512

Submit Download

ba9f2c6a-6df7-46cb-a860-402a1d218e21

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\ba9f2c6a-6df7-46cb-a860-402a1d218e21
Size 982B
SHA256 453112fcf272c68a33bad7b995095e65c4663f9977929ba94df24684f51aa89c
MD5 98d8f02a37090af6fa9736823a970344
SHA1 428106c552d9dbf20774fb5faa123b4487eb72d9
SHA512 c1955acd5077dbaa6b1f152bf4652a149d6ef0a0032d0cb29316e6a2b2776b5d502b36a879e0270e6866a53b1d27161eaae8566f9e6a92ff2748debe47ef0468
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 13KB
SHA256 9a27fc435cee25e1a7ee05f217b97e9315620e0817d1b3aa11063f2dbce03f54
MD5 ebfb5a8a4ce43eddded4527b2eb7e7ed
SHA1 70b80cc8df81376aa2cca29f503b95c1042ad8e0
SHA512 0ffb0db8e6af2b34e7830b0130f8fde722584ffbf2c44ac513454dbd2fec188cecd006b659c49deaaef354102051e64a450af36e0d8832a07657a4f2a0a0cc33
SSDEEP 192:R5noRJfSL22S8I4lxgtc8F9+dd6y1Zzy34aX+oVU68EXBw8H7:uQdTSF9ry1ZzdoZxw8
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 16KB
SHA256 537a804baac1325204bdc48f36fb2fd445f1de186ef32bae3257c083a124134b
MD5 b0fb6d2b47141bf6e67784227c458535
SHA1 46147fe160579bae26ced9bcc0725d969669c0bd
SHA512 e3f0bbe2db8fdffa2f73307a0145f02e60a4e9efec0a663929e0ccbaa3fcf488030851217e638cdf449a6c3fd584859ad33ff85a3619ef978b2399e653f5fcd7
SSDEEP 192:RinoRJf7L22S8I4lxgtc8F9+dd6y1Zzy34aX6+oVU68EeiBw8Hupl0DK:XTdTSF9ry1ZzuoZFwB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 11KB
SHA256 14b8f2e95b79cb2609b78ea6f4612da7778785f3349629eb008c6673f3d5431c
MD5 c7b783d3ab4845c5f5d3f13fd5f16fbf
SHA1 8142aca5e37f34d416ff84c6eb72d06c7e2c65ed
SHA512 31508e1efb5a84a521a14ca2500e26ad09e5b79b014fd382469a1e06f0bfbae5c33ef238306b37543ab1b036ed049ab52a1b3b9f7023690d6413802cc7f19320
SSDEEP 192:U5noRJfSrV2S8I4lxgtc8F9+dd6y1Zzy34aX+oVU68EkBw8HQ:nTdTSF9ry1ZzdoZqwp
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
Size 10KB
SHA256 ab0200ce35418cb40f9914cd73832b297fec778930ba869ff3a4b9eefa80b582
MD5 7316597151925d46238514daed6d44ae
SHA1 6aed2a81119433d195ca88d58c7c3b6e00ff0b1a
SHA512 3c2d4e60c4692c0d487a4459b419f8bbdc2af5b2f41b3b8e2498e4b6c2d32aebf4c8961804bc9517bc6c334a474cbde1dcd1afc5c2096db706135b836427acd7
SSDEEP 192:U5noRJfSrV2f3psxnHd3LtVNUnNt+8+V0tDsS3caXZoVU68EkBw8VQ:ntuxxLtuzDzoZqwf
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.1MB
SHA256 dca2cd4b54cb9e36398bdcc624f962d731e8ced13cc066d62ff41e42d21ee089
MD5 fc93d0ce856f83690cbdeceaf951fc94
SHA1 ed282057fec2ec5f5144641d31dccc6c0ea0273c
SHA512 35d177bc95745359a434e6e1abec52f9a26989975bfbd3e773920ef55980a7ade2cbe0e9c48e9563ae5c16153eb59704869b41f5915b1e0f139d3e11605ac59f
SSDEEP 6144:lIoI+43S393z3m3MTHx6uwCNcxF0qU3u56iXimZmz0Pu/el7Uyu4tKGpC/o1d2e2:OmcxCv3MxsyuIHIem0z2mo
MD5 SHA1 SHA512 SSDEEP

Submit Download