e4382e61bb61863bb13058748f930ceea95a3a611fe94bdf997b176debdf90d0

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2024, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241101-thk7assgnj
SHA256 e4382e61bb61863bb13058748f930ceea95a3a611fe94bdf997b176debdf90d0
MD5 931f93466b9d9c7d6cd3979bb981de38
SHA1 58c1373f91df45e01d89bff790dc6982a9434e19
SHA512 d93dc93d183f77744376dadc100b2433114a1ab58e2d22614bc62d16542391b2769ef5bca214f9a7383ee859def5e64eebf5cea2cee8628671b6756632e6a663
SSDEEP 12288:kqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TL:kqDEvCTbMWu7rQYlBQcBiT6rprG8abL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
864	taskkill.exe
5116	taskkill.exe
2228	taskkill.exe
4792	taskkill.exe
1916	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	2228	taskkill.exe
Token: SeDebugPrivilege	4792	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	864	taskkill.exe
Token: SeDebugPrivilege	3404	firefox.exe
Token: SeDebugPrivilege	3404	firefox.exe
Token: SeDebugPrivilege	3404	firefox.exe
Token: SeDebugPrivilege	3404	firefox.exe
Token: SeDebugPrivilege	3404	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
3404	firefox.exe
4672	file.exe
4672	file.exe
4672	file.exe
4672	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3404	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 5116	4672	file.exe	84
PID 4672 wrote to memory of 5116	4672	file.exe	84
PID 4672 wrote to memory of 5116	4672	file.exe	84
PID 4672 wrote to memory of 2228	4672	file.exe	91
PID 4672 wrote to memory of 2228	4672	file.exe	91
PID 4672 wrote to memory of 2228	4672	file.exe	91
PID 4672 wrote to memory of 4792	4672	file.exe	93
PID 4672 wrote to memory of 4792	4672	file.exe	93
PID 4672 wrote to memory of 4792	4672	file.exe	93
PID 4672 wrote to memory of 1916	4672	file.exe	95
PID 4672 wrote to memory of 1916	4672	file.exe	95
PID 4672 wrote to memory of 1916	4672	file.exe	95
PID 4672 wrote to memory of 864	4672	file.exe	97
PID 4672 wrote to memory of 864	4672	file.exe	97
PID 4672 wrote to memory of 864	4672	file.exe	97
PID 4672 wrote to memory of 1228	4672	file.exe	99
PID 4672 wrote to memory of 1228	4672	file.exe	99
PID 1228 wrote to memory of 3404	1228	firefox.exe	100
PID 1228 wrote to memory of 3404	1228	firefox.exe	100
PID 1228 wrote to memory of 3404	1228	firefox.exe	100
PID 1228 wrote to memory of 3404	1228	firefox.exe	100
PID 1228 wrote to memory of 3404	1228	firefox.exe	100
PID 1228 wrote to memory of 3404	1228	firefox.exe	100
PID 1228 wrote to memory of 3404	1228	firefox.exe	100
PID 1228 wrote to memory of 3404	1228	firefox.exe	100
PID 1228 wrote to memory of 3404	1228	firefox.exe	100
PID 1228 wrote to memory of 3404	1228	firefox.exe	100
PID 1228 wrote to memory of 3404	1228	firefox.exe	100
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101
PID 3404 wrote to memory of 4516	3404	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:864
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ef60de3-f106-4d6a-91d1-099cec8dcc66} 3404 "\\.\pipe\gecko-crash-server-pipe.3404" gpu
      4⤵
      PID:4516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d283caa5-8fd4-4fbf-acd9-bc2f4ba61683} 3404 "\\.\pipe\gecko-crash-server-pipe.3404" socket
      4⤵
      PID:2308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1448 -childID 1 -isForBrowser -prefsHandle 2724 -prefMapHandle 3008 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {211297ff-a4e6-42ef-b1e4-8a2557c6e3da} 3404 "\\.\pipe\gecko-crash-server-pipe.3404" tab
      4⤵
      PID:4656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4092 -childID 2 -isForBrowser -prefsHandle 3128 -prefMapHandle 3336 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20c200ed-fc8d-4125-8536-f825acde0f35} 3404 "\\.\pipe\gecko-crash-server-pipe.3404" tab
      4⤵
      PID:1036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4708 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4644 -prefMapHandle 4664 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f181b219-6fbe-4c94-920f-24e02934256f} 3404 "\\.\pipe\gecko-crash-server-pipe.3404" utility
      4⤵
      Checks processor information in registry
      PID:724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5424 -childID 3 -isForBrowser -prefsHandle 5452 -prefMapHandle 5448 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ba29e92-9007-4980-9652-35386450341e} 3404 "\\.\pipe\gecko-crash-server-pipe.3404" tab
      4⤵
      PID:5444
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 4 -isForBrowser -prefsHandle 5660 -prefMapHandle 5656 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8da324a-1906-46b8-94fc-29bc1385ca7e} 3404 "\\.\pipe\gecko-crash-server-pipe.3404" tab
      4⤵
      PID:5456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 5 -isForBrowser -prefsHandle 5852 -prefMapHandle 5848 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3bdd4e3-9aeb-4ce2-94aa-29b2445bf24e} 3404 "\\.\pipe\gecko-crash-server-pipe.3404" tab
      4⤵
      PID:5468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json
Size 19KB
SHA256 0c438cf6ed962bdd30e10e7cc12534788eb407444e95063970c58b1f954ba296
MD5 2b2205f3f254720caba3c9c23596d920
SHA1 5bbf5afafda283baaac9099e930a301eac733f5b
SHA512 473e81d9d833d54356519059f69ce41e6a420a2bced61331afab29f1bd4af10c645807da40e5920959c93e54a1eeaf79a05859c95745f45f4fdd48449b73cc78
SSDEEP 192:z0f6hoE5wDCbZ02AEyzmY22UUaij7BgmX3i0eWH6MAAF8nX5G8wa687jhlUKwlaI:Wl0t6F9HbPI48pQc6a7OQj4hEMyTyaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Size 13KB
SHA256 3e76e4128d2835c99a91c16c7a8c029f1be8d7534ea0afd60adc6baadaef49f7
MD5 97b43226056d473d4a4bc37100b0a4fa
SHA1 4140c4e1527fb1c871ad2a2f8b27b861d21b2192
SHA512 f90bd0ff2c061785935c095158ab8252947478f6427af5c8ae1ad2e6b72fd536485c15937f5b877775a48f568f242cad3baf34d135efddd459a372ed99a9a407
SSDEEP 384:H/w5Iu9fiGLm4pUkA+Q+4IYKgH4Zv+3yPrIVy8eo+G:8Bi8mCUkxQ+4INy4ZcyzIVy8d
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 7KB
SHA256 85bc5bd0d7210a3357f490e88a9e0d92ca57e6d1952350eeabc5e6f151b6bea3
MD5 0dee769fc8aca83aed32e85f9211d02a
SHA1 183f39d186f8d2ac01e01fcce7db537dae005ca0
SHA512 b7f67415dd1391a659632386164bf17ddfef937b963527d2be59d18574ffaf5169784a45e34615ed64ea8426fffa11e571733d426c30cab01ff1d6d307413294
SSDEEP 24:CuB1ozPFsh2F3LFXagu1xgRbxApR5cOLquhMZ0sJblLK0b:si5oFA9cOLFebVK0b
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 18KB
SHA256 1b47c3c18346dd42d82ddf8f5a6fdce812589e39fb696af14b9931350ad1f84d
MD5 8523d0959837eb767e7bee213666bcf0
SHA1 8bf5f3354f61aea8b39ae02cda51bdf32513decb
SHA512 5cb3026009808adb239ccd102f02593669d7592d8f4642b1eb7655c958a763119ebae7751c5c99e41a0cc03f648a539c8a9c8f04bd433f68231fadb1fdcff892
SSDEEP 96:X5oAebVK0bZebOJZbypebvpf+mbpgbgzjbKbSbbbbbibeboWb3b:X5VuM
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 8KB
SHA256 68916b2753ff058a4560c4c1da4214940de60afe01a51f58201bb7e60a961592
MD5 11b8382db84287c8e8962d3062a10d59
SHA1 8615e8641857002c84c2e5d8b78f42ba7be74d1c
SHA512 9eafb6b7c9aa54807bdd2a67a04157354d8699ce491f38d57fde9686632b234082549f3decbfa0bcfbcbc1044a870f1a189cc70f297678ce2a20ae06aeaeba43
SSDEEP 24:CuB1ozDFsh2F3LFegu1xgRbzpR5cOBuhMZ6sJblLK0bZsJbF0JZb:sa5oH9cO2ebVK0bZebOJZb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 14KB
SHA256 12f18dd77af4ff6c7df43b3fa797a3687c6b2882c50f6b7105fd3f6ae2c83284
MD5 38ee6c01e9020c9c93d00476b7695b03
SHA1 5c1a35fca8db5b0c807d450062bfcf6492e2d45b
SHA512 78250e9605e3b5c832476493bb7785dd77077d6b5450bc7885048a1866b3c50b7fcfea72269edd121a0fd321a945723f49dfe022d40a86344c4b1d1540493181
SSDEEP 384:SboCgKNPjFD+xC/WDCKx2bVb6+/66JozGzgC1bM:WS0LxveDCKx2bVb6bEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 c953df446e67a3e67be21160b659c0c6aa1a3677c627587b316b2017f326370c
MD5 e175b5c37a02df49f6bf04cf1963ef4d
SHA1 2815136580956a8b4ee09bbfed317bdbc157a3e0
SHA512 7e155d3dd34d0674bef3555683dea96500a056c857d719aa5c100e15c1bf37cb8e9fdcf36208eb89c19658d649ac8352cdbccdfe0b800209d5cd6aa054c1e02b
SSDEEP 96:KLQRcRkRWRIFl66JozGzgClKtmSSjUSMF9ZbkW6ShmNoPP/PrWI:/wISI/66JozGzgCl6mSSjUrvZboShYeN
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 14KB
SHA256 5870eb3531313d35d57945f137e7663f2a84c36812ce6d82f33c38dbfb3d8338
MD5 69c53d5e9aeccf277ccb9210dcf48dc9
SHA1 3eeae91406ecdd78a4fc86e535ed42e175e63d54
SHA512 d54a90fd6d36a3428ee8532a95cb574d99476ede6bb9edc409352358ae3ab69e66b56e4fcf033ba817404f22f9371d98d298870268bd4d7c42e54f2848187e5f
SSDEEP 384:Z/66JozGzgC1bdFD+xC/WDCKx2bVb60bo5KNPq:cEfxveDCKx2bVb6860S
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 14KB
SHA256 8cf98ef95352127b87cf6a7e98b4a15042536c368a486ba8108d486548e02be9
MD5 049f169bd0e77c792d49dc718eb40cc1
SHA1 d93770b861178487bc7a1f35428e7cf55b1d1b2e
SHA512 b67fa349c77580d97cb7b83e3145c537db44d8f3b7cfb6eb2f80fe00b002f969813a72eef1a10e3b82e4cae1384697ef40d4bb6eb90e07b10aac855e2a45cf26
SSDEEP 384:7FD+xC/WDCKx2bVb60bo5KNPR/66JozGzgC1bM:7xveDCKx2bVb6860MEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

adf32303-787f-469a-a2cc-f36a6f8f6649

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\adf32303-787f-469a-a2cc-f36a6f8f6649
Size 26KB
SHA256 215e788730ad7568ed7a8b68d834b53f25235236dd950db374a9f62a3c309948
MD5 503ac354cd092a5683e0e24d10930a79
SHA1 5652058640db08a998806977af6805eadaafa412
SHA512 9997ffe5f34bc3a8387095622468205f2c5d70a8d4775bdbf94f9bcd1195df0c1d75c2001a7a0968a592bdf20a3a4dae574d4be0e56329007c4433d361c886c7
SSDEEP 192:Ogc3JYKmwPQR7PBzDZJYiUdHwkJHZ0n13XiGNGzxAMbJEuleyg4mdGfA37FhfKDx:eSKmd6dhs1niGIlvbNleyBhmmdFh
MD5 SHA1 SHA512 SSDEEP

Submit Download

de08ca33-ea77-4a1a-997d-3f9eb7f50d41

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\de08ca33-ea77-4a1a-997d-3f9eb7f50d41
Size 671B
SHA256 094d61cf80c622eee86de9a4c4dcfc84ba5eb516c18492d4d15caef8d73e0831
MD5 f971eac9bf765bac3d62bc6982f12adf
SHA1 c3e7a0aed996b3784a3f26629b18ed8aa0dd7166
SHA512 df9d13c31e922b98f1849c449552ededa71526889b1af2aec5b49efc6aa312f8289a815462206da37aab511398e9bef754ea87079ef7ac40a7f25b930fd47b2b
MD5 SHA1 SHA512

Submit Download

f9148f8e-df5d-4dd0-b59a-2f8be73568eb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\f9148f8e-df5d-4dd0-b59a-2f8be73568eb
Size 982B
SHA256 eb6afac0a7b1558875ef3e8fc79fd74dc4ef1484e0de1ce63e85ee5d4e760f64
MD5 77bf9216e025854a15cc548d0cd73c82
SHA1 5ff90073457692679d8dea95cbf38486f864533b
SHA512 a556923370ccb92a950998431508620c3ab750249a6ef67ca8cdf077448b31a1f92f4e0e72a022a7a8e4fb152dffa06df52a116134cd0a6146dcc10f16235459
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 16KB
SHA256 137ff377b47ff2f1698494d4cfe07ed2b8778372c6ec66f6648bd44ce6103eca
MD5 78ac1617c36dbbf1c30177cccccdfb64
SHA1 a0706b21083d271a274199fd47d117b87725f9fc
SHA512 380ffe013f03e5142e1ec0fb1783811cf6571ca3654b278a05997f18c7177530128852dda28c0d43ef1a0744968d70954540235bf8959bd9ee8c583450d7bc5e
SSDEEP 192:RFRI5PHpnoRJfMG9kURSfz6UctbH8e2dRot5BcU9Ti9xaXMY+oVU68EziBw8HxZ0:3RI5PHcUWcL6WeOMvX9TmVoZMwczm
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 12KB
SHA256 fc9d6d480c74c01f1e02b79c81ba05ed761e4971dfe51282f139e0c2e44858e7
MD5 85ca7de4ec205d8e9a449b2ccf5cfe6b
SHA1 c16a733d3995f9cd7c1e2f4e17f84ffe705056bc
SHA512 817dd7dcee38fbbee7f40beb078f84d31f70a89e13104805606b1caa3ec013ab4c585e2221ee10bef697d0aa3f9f55af56cef56c4cbe9f7593dbd0afb9c8ca50
SSDEEP 192:R5noRJfS9kURSfz6UctbH8e2dRot5BcU9Ti9xaXMUoVU68EbBw8H7:uScL6WeOMvX9TmooZ1wq
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 11KB
SHA256 9eeb8269549fa2990bf26248106ee9a2e3954b0e2453491ebbb1a8a36c6b1a0c
MD5 d05cd649bbc79e880444dee942bce7a7
SHA1 14d5a0e5f774a4b8eb22e050418b1bb0f3ab754d
SHA512 e89eda7082f28234cbd3296cd9bae18a2a847c3222468dc0030717bd69e74f33e765ad1e16a3916324e98de315e8323d2e51ef87e3a2ceb732304287190a7011
SSDEEP 192:U5noRJfS9kURSfz6UctbH8e2dRot5BcU9Ti9xaXMUoVU68EkBw8HE:nScL6WeOMvX9TmooZqwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 10KB
SHA256 267fe2c2ee4cb72486b3174152dedeb9596908eafd93aef46a48aaf18934baf6
MD5 8d8e018c23f4650ade20f7ca93fe3bbe
SHA1 b868ec722e888b4f0b87e7955a99e5c61e887320
SHA512 5f508c898d043dbf9fa5c7454d6c812b6d26dc20fb23bd66fd0a8a45b6961db2bac127641496bf36f8e4a237cc9a3c8327ba8425509bf4e5769d154fbc325391
SSDEEP 192:U5noRJfSrVjVofAHBtq8prddx9y1ZO43+aXUoVU68EkBw8HE:n2VoIbpd9y1ZOHoZqwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
Size 10KB
SHA256 3ea91ffadbd21999a12535515ba50d2b0fbb83c2f285c0dd04d1a33a87535747
MD5 7487347538b9bc1e70bd4cd89c133069
SHA1 e923a9d9df1fcdf77aa8b06cfb0f5accc1ea3b99
SHA512 44d36bff0a8aadb4b15b69afabac50e85c4b1ae3181293d15c16e0ea2c3b6b21d42bb050117681f3edae4ffab6c53460ee8fef6e7f8ac63ed087e5c7b9712566
SSDEEP 192:U5noRJfSrVjVofAHBtq8prddx9y1ZO43+aXUoVU68EkBw8VE:naVoIbpd9y1ZOHoZqwb
MD5 SHA1 SHA512 SSDEEP

Submit Download