5f699f0fe9b262ef2967b81dad970b247cab89d660aaec70c12133cbb19985ee

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2024, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241027-twcr3szamd
SHA256 5f699f0fe9b262ef2967b81dad970b247cab89d660aaec70c12133cbb19985ee
MD5 0a550a9db28d90a37c57e53aa1460157
SHA1 66635ba8a896ec7a793ea8ca277b64dd046720b3
SHA512 b9e3c0dac1d2381a89faa6ba7451de4485bc4c5830b298038711977642abcdf65d4a008b843737665fe0c7da7b5200b70534a24dda959b3bc052c40c4a9dec3d
SSDEEP 12288:DqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Tc:DqDEvCTbMWu7rQYlBQcBiT6rprG8abc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2264	taskkill.exe
4868	taskkill.exe
2552	taskkill.exe
1472	taskkill.exe
4712	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	taskkill.exe
Token: SeDebugPrivilege	4712	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	4868	taskkill.exe
Token: SeDebugPrivilege	2552	taskkill.exe
Token: SeDebugPrivilege	1460	firefox.exe
Token: SeDebugPrivilege	1460	firefox.exe
Token: SeDebugPrivilege	1460	firefox.exe
Token: SeDebugPrivilege	1460	firefox.exe
Token: SeDebugPrivilege	1460	firefox.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
3684	file.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
3684	file.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
3684	file.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
3684	file.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
1460	firefox.exe
3684	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1460	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 1472	3684	file.exe	87
PID 3684 wrote to memory of 1472	3684	file.exe	87
PID 3684 wrote to memory of 1472	3684	file.exe	87
PID 3684 wrote to memory of 4712	3684	file.exe	90
PID 3684 wrote to memory of 4712	3684	file.exe	90
PID 3684 wrote to memory of 4712	3684	file.exe	90
PID 3684 wrote to memory of 2264	3684	file.exe	92
PID 3684 wrote to memory of 2264	3684	file.exe	92
PID 3684 wrote to memory of 2264	3684	file.exe	92
PID 3684 wrote to memory of 4868	3684	file.exe	94
PID 3684 wrote to memory of 4868	3684	file.exe	94
PID 3684 wrote to memory of 4868	3684	file.exe	94
PID 3684 wrote to memory of 2552	3684	file.exe	98
PID 3684 wrote to memory of 2552	3684	file.exe	98
PID 3684 wrote to memory of 2552	3684	file.exe	98
PID 3684 wrote to memory of 2556	3684	file.exe	100
PID 3684 wrote to memory of 2556	3684	file.exe	100
PID 2556 wrote to memory of 1460	2556	firefox.exe	101
PID 2556 wrote to memory of 1460	2556	firefox.exe	101
PID 2556 wrote to memory of 1460	2556	firefox.exe	101
PID 2556 wrote to memory of 1460	2556	firefox.exe	101
PID 2556 wrote to memory of 1460	2556	firefox.exe	101
PID 2556 wrote to memory of 1460	2556	firefox.exe	101
PID 2556 wrote to memory of 1460	2556	firefox.exe	101
PID 2556 wrote to memory of 1460	2556	firefox.exe	101
PID 2556 wrote to memory of 1460	2556	firefox.exe	101
PID 2556 wrote to memory of 1460	2556	firefox.exe	101
PID 2556 wrote to memory of 1460	2556	firefox.exe	101
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102
PID 1460 wrote to memory of 4992	1460	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb5c9053-facf-4fa6-af55-1323a624610d} 1460 "\\.\pipe\gecko-crash-server-pipe.1460" gpu
      4⤵
      PID:4992
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2332 -prefMapHandle 2340 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05a7a86f-09fe-428a-8907-4706dc1c5bb9} 1460 "\\.\pipe\gecko-crash-server-pipe.1460" socket
      4⤵
      PID:1232
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3188 -childID 1 -isForBrowser -prefsHandle 2992 -prefMapHandle 2852 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28e7002c-5a25-4859-96dc-95b60ddebca0} 1460 "\\.\pipe\gecko-crash-server-pipe.1460" tab
      4⤵
      PID:1260
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3984 -childID 2 -isForBrowser -prefsHandle 4164 -prefMapHandle 4024 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c644d06c-f9e3-43bb-8a54-021e0fce9243} 1460 "\\.\pipe\gecko-crash-server-pipe.1460" tab
      4⤵
      PID:1612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4832 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4828 -prefMapHandle 4824 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe6e663f-e21f-4956-a1ac-3ab24531a07d} 1460 "\\.\pipe\gecko-crash-server-pipe.1460" utility
      4⤵
      Checks processor information in registry
      PID:5432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2824 -childID 3 -isForBrowser -prefsHandle 5156 -prefMapHandle 4652 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {123d5b61-1eee-4cca-8ff0-c0e6523f9485} 1460 "\\.\pipe\gecko-crash-server-pipe.1460" tab
      4⤵
      PID:728
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5264 -childID 4 -isForBrowser -prefsHandle 5248 -prefMapHandle 5236 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a1a0853-3d63-4c4e-a6ac-64e101e5d6b1} 1460 "\\.\pipe\gecko-crash-server-pipe.1460" tab
      4⤵
      PID:4628
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 5 -isForBrowser -prefsHandle 5500 -prefMapHandle 5128 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90b8fa66-6f73-4ba5-8096-b8c380a312d6} 1460 "\\.\pipe\gecko-crash-server-pipe.1460" tab
      4⤵
      PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json
Size 28KB
SHA256 c3e21d0c2b7c43c853c27bb8b0d62de33b63cb7959e72654274f896a541ac768
MD5 21ea40ccb90bf394e3ce19e84f3d3414
SHA1 a13e3a9467e792138b06f4d1c8dbab22d700715c
SHA512 1eef5f8aa41d2f076ffecac5d45e6f4a4d359316c481622a70c1dde4a0e7fdad9eb9314c773d5787d025b7b060bc0f1e459167d27b647c42da8a4dd79e181b6a
SSDEEP 768:oL8xuoOF2X9Pydw50N0sGaueuu4YT0s0uT5:nR82X8K5A+aueuu4i1z
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 0645fc7f8b09f2b77a8b6167cdfbb6c29ea1010b4a28a3ed568fad82e60d61cb
MD5 04e3c284b097b53ff22e9237f0dab723
SHA1 431a261100afe6dec6ac305880e29697bd750d2e
SHA512 8345fd5ac0cf258d11f08525af455c5c9084fbe571af673bbd43ae1d0a50382263583f5403706f479a6b8982d5befbe8f96937d172b3243e9c3adaee2b3047e1
SSDEEP 384:H/w5Iu9fiGLm4pUJA+Q+4IYKgH4Zv+3yPrIVy8eQ1V:8Bi8mCUJxQ+4INy4ZcyzIVy89
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 10KB
SHA256 f0a886514e95233f575cbf8d582beeeade05acba1023e23dfa3c4139b46d6e22
MD5 4518e3b4795866b431c2834fbd2c0f05
SHA1 63e509efade6aa7890de24f7672f2dfd6b959a35
SHA512 7984a17cd682189c8a88ca1d148cab73b12b38e4d8440f16cd10f19ea26dcbdedbf0c0f9f7f1f00a68d438d8adfe85654a6c9975f626ac893bee1a3069acf95c
SSDEEP 48:sll5o/q9cOw+ebVKrJbuebOJ8b8ypebvpf+bb:El5o/6ebVKrJbuebOJ8bhpebvpf+bb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 bfdfa821d91ace8dbffee0f3ff92fc8c65d06907ff9269cf8eab5c32fd3bcf42
MD5 c6302be7db6cafd32796380f7574bc9b
SHA1 fda5791930c7e024413ba874066f357e3919b741
SHA512 9542e61f9aa967ab6200d0e3203b875900c3e3888c93462169795d21c687619c117c6307302a50e4177399b7200a2ebdf1ddb06894c892c7fa39f2253f569a03
SSDEEP 96:KLQALeLFl66JozGzgClKtmSS7SMF9ZbkW6Shm7RPP/PhxkWv:f/66JozGzgCl6mSS7rvZboShelPDfv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 eaf547c3802f1369264e1fe9e9f6e8c8fe6e3853e612e87dfcee749c9f8c3844
MD5 50ba63c4ad34a4a8f44e67dc5fba9fac
SHA1 358424b350e18d060ecf56222783d3b3c337dd23
SHA512 f69db1b98bc0e145fe338bc1c8b0f9d394e8d12b0a4dcb8a39a23e3a51ead051733a82a13e9899d65b3459efa3bf7b32b5c2fc74c347f088b3c611e3e903e250
SSDEEP 96:KLQALeLFl66JozGzgClKtmSSgSMF9ZbkW6Shm7RPP/PhxkWO:f/66JozGzgCl6mSSgrvZboShelPDfO
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 a0f297d8b1f8b6d0dbd6676b81fde0d08bb62a609bbcf237e3f45d4a3dc5141a
MD5 51899036bf5c71e19860136f73e1296b
SHA1 cf63bcb1d1a4899aa3ef4a38d3b58b8438d93b7e
SHA512 649b65752043dba3978b5816c8f71a4451866706b89dadb7c3e927c9524a247c972441a37718a47a30c4833a35fbaed6e29e43615f78195c6a98235047243599
SSDEEP 384:fboBXHPYPloCd9CfNDw9rdbRb8I/66JozGzgC1bM:DeIfdIfNDw9rdbRb81Em
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 ec993bef7f5f1b897ea32b79c255837f42c16d614356cf68a05f8c72d37b2c71
MD5 19853d80d1e35b72805ea5a27637454e
SHA1 62fbc21d8d2630386d91683177fde9a37b38c7d8
SHA512 20a2be01a199a3d05f45f44cd4e57f870949e9ae7bdfcad41c0e9856f3fa0f30a4b396d8a77bdc5c18be6ad776015534ae8e65a8570f4c36ef40972c88b185d8
SSDEEP 384:XPloCd9CfNDw9rdbRb8PboB4Pq/66JozGzgC1bM:ffdIfNDw9rdbRb8TzfEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

208f7011-6561-406d-927a-35db577d9b08

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\208f7011-6561-406d-927a-35db577d9b08
Size 671B
SHA256 ebb5e367bf7c527a5ea01802e7c0515e50166a3e2a1534d27a420b2da12f4c92
MD5 7d1cc7ff64e9f58ea0cbf9f25e5c0d78
SHA1 d030a2b931a391b556eeba1296a9253c29864700
SHA512 f1101fa9ab7a2307d433baf1d956fe2ef03aba6cb29e93ba4cb31e62840d14c575e65499c38e5c11056c8e1e8d5fc1159cab69ac4e92c244f49b4fb3e7f0b79c
MD5 SHA1 SHA512

Submit Download

6a4bad1a-288c-4c66-bf80-fbf046ba7195

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\6a4bad1a-288c-4c66-bf80-fbf046ba7195
Size 28KB
SHA256 c533bd3a8e6ad36c25ebd92b6bbcecbfd5b295c02c021f4dd5576a81ec45f910
MD5 92f7097150d00841171ae0aa614c314c
SHA1 92359f29213d77dd5b9f3912e56c97350f79ba40
SHA512 3314aefcd9acedc8a3d6b2f28e1c7989b5810c04865db2cb501c7756b926b289eb4438282b7972d9e29fc0263d16c5192d62e9056df574c1d4477a249c5e1f53
SSDEEP 192:2/LWmKDz75dYzSUcKR7k/IxuUzr9Gfv6RJ35mHZ7GtfbOis9nZaF4pjcFO1KFwYh:2DW5z7HYmUcKRiE9ERQtYFwQuZMkMoN
MD5 SHA1 SHA512 SSDEEP

Submit Download

de049659-a284-4fed-8bbc-f011c237d898

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\de049659-a284-4fed-8bbc-f011c237d898
Size 982B
SHA256 592aa2a9a32f28f93e72d731119e771d1fa10edc9853471777ec4d58bae1c690
MD5 e53edec95c171cd7ff0e92f892d46e39
SHA1 72c18baa6fd50b256d72a91954df569300098198
SHA512 55d0b54d0e2b1e70da4124e295e8dc6e587cdac1a8f689130b8f1d5a46c82b53efae43766cb19514c615a63e44f4d2976f9fd591f709e228e7e209fd9d76811e
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 11KB
SHA256 a0c43b0f7fb9e928e05b5c74b81fbe9576d0b1c2b91aff75ee41180b526522f1
MD5 7803dec3bb164515cd816e523aa7ab3f
SHA1 64e781a8e1ad8f4f9f8813554b731604c4d04fc2
SHA512 309b01a85bf709d658e163f0b67e23f9018520a665a41b65c081a634d233a8cce03c953a26f8a9eb656cb8250acdee526ee8077c90d825686ab2529dec0cbf9e
SSDEEP 192:R5noRJfS60zJWfeSB56UctV8bpddLy1Zz+3qaX1oVU68EMBw8Hka:u6JWWSB5pbdy1Zz8oZywBa
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 14KB
SHA256 91bd623a4b46d8f9c899194956f4e1042b706d287b3a04eefa5fefe7dbbce6a1
MD5 1c4089271286f00a35d196f16005fe96
SHA1 744262c292cfc615e5a3d381d254d1357c8ad86a
SHA512 9aa017d62224efab2f7dc56215d483276a03ab9505fd004afddf6e6df1164324c7257136a23c7d8c782f82b5f70f703a73e739d25d5f6177d74f551d1da71020
SSDEEP 192:RmnoRJfd60zJWfeSB56UctV8bpddLy1Zz+3qaX1oVU68E4iBw8HkUA:TfJWWSB5pbdy1Zz8oZ7wB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 11KB
SHA256 be4bdfa6da32f1b182f839e1f2b3a115554dd22c112c4cfc3c818d752912e182
MD5 4ced698589bcd3cc4f626fa2c3a84021
SHA1 f1236e6037db6fca2bb878118420d19c7e3dbe2a
SHA512 d8794d45054a24e1c525582116eeb05db4f4b9c7809acf6a16846ed6b5e3141891ad53ea989861be12c092e98d6866f897c481f8feb383073400517d9bc82ea9
SSDEEP 192:U5noRJfS60zJWfeSB56UctV8bpddLy1Zz+3qaX1oVU68EkBw8Hl:n6JWWSB5pbdy1Zz8oZqwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 11KB
SHA256 99a49a165c8a84d50f9267fd20f924ed8406571ce0d92b1658c4e79c69173dc5
MD5 44d30685aa94ac5fd56f9d227fe13c03
SHA1 df5707d6c68d28501b716efb4eb558f29cc14997
SHA512 33abd1c84c7e68bdc74511df0513779bed5621efa72c5aafca6ef605506be6874ad9987a6e72a1417336c4a9ebd794c43a6c3412a9dbd0d1dbea438cf335ae1e
SSDEEP 192:U5noRJfSrVzJWfeSB56UctV8bpddLy1Zz+3qaX0oVU68EkBw8Hl:nmJWWSB5pbdy1ZztoZqwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
Size 10KB
SHA256 2d29b885a026d30984e0882b058310ef4f1b36666513cf009844b314f06cf38e
MD5 989553a7a6fbcb9864bff59ec57b7ede
SHA1 edcbd21926d4357daff263fe0bebfde5b194f004
SHA512 7bbca24093a2b8aa27c5c49eb0a0ae899aee47bba6cc20b08bb23374bb3eb3262103dd09a50cce9bd387281ffdeb69bb8afd1e83d8f31bf9725cc62db68f720f
SSDEEP 192:U5noRJfSrV9VofAHBtq8prddx9y1ZO43daX0oVU68EkBw8Hl:nEVoIbpd9y1ZOMoZqwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.1MB
SHA256 77395f637b8f3948fd363569284b118f4acd5a9b0a84ef23e31031894189198e
MD5 17939d70028faaeda63f3ced08eae484
SHA1 b21309dda499e177cf9ff038319830efab696ffb
SHA512 b4b42b4d1962713f5ea53f5b1f90573ca3882fb23ab195cf7c6954a1afd74002cf1c0452b1417388f6404da6ab0bea4585650d8f0ce412f8422f395871769246
SSDEEP 6144:DIoI+43S393z3m3aTHT6uwCNciYYqU3Dg6K+tmZmz0Pu/el7ULzwuc1UdLo1eRhr:umciJv3kYJLz7gU9JlGuwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.8MB
SHA256 5bf2b2cedf32afcf2d52a6dc291b19f10187713b409a1039042898a8464368dc
MD5 ca0c897e337737f0e28feccdc91b30f6
SHA1 49b0a01ef06b4eaf2151d40eb9b958a508d298d0
SHA512 d6679e2133d4e410c4e36bd416e8d470b53018c77b7604a4b40d387c3318a84670bf13647300536a37b4a1b21cc50648ea44f6c9df575886b8271138ffcab52e
SSDEEP 12288:xtvAkLr68Ml19JlGuwbTDxyVTVol4K+n:xt3a/19nGuwXDEVKllq
MD5 SHA1 SHA512 SSDEEP

Submit Download