bc233c32ba47fd2a8263c05e09b1e89161e8246dde1d5ab414799abafc5e0388

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2024, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 900KB
Sample241123-ek72hstpgk
SHA256 bc233c32ba47fd2a8263c05e09b1e89161e8246dde1d5ab414799abafc5e0388
MD5 aa5563565633d4840ce5e8d9a0cba6ba
SHA1 c4b113360ec7fd89010a667ba35afbde80174c10
SHA512 92194c45321a73391cbd4a0a07c239a0d841a9d2e913d2196dd2fb8b4fa060841069d6282ab09f59d4190fb566bab78220679609df020a21192cea6f889b161b
SSDEEP 12288:mqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaxTQ:mqDEvCTbMWu7rQYlBQcBiT6rprG8aFQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2684	taskkill.exe
4364	taskkill.exe
2708	taskkill.exe
1356	taskkill.exe
1224	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
776	file.exe
776	file.exe
776	file.exe
776	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	4364	taskkill.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	1356	taskkill.exe
Token: SeDebugPrivilege	5032	firefox.exe
Token: SeDebugPrivilege	5032	firefox.exe
Token: SeDebugPrivilege	5032	firefox.exe
Token: SeDebugPrivilege	5032	firefox.exe
Token: SeDebugPrivilege	5032	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
776	file.exe
776	file.exe
776	file.exe
776	file.exe
776	file.exe
776	file.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
776	file.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
776	file.exe
776	file.exe
776	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
776	file.exe
776	file.exe
776	file.exe
776	file.exe
776	file.exe
776	file.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
776	file.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
5032	firefox.exe
776	file.exe
776	file.exe
776	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5032	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 1224	776	file.exe	82
PID 776 wrote to memory of 1224	776	file.exe	82
PID 776 wrote to memory of 1224	776	file.exe	82
PID 776 wrote to memory of 2684	776	file.exe	87
PID 776 wrote to memory of 2684	776	file.exe	87
PID 776 wrote to memory of 2684	776	file.exe	87
PID 776 wrote to memory of 4364	776	file.exe	89
PID 776 wrote to memory of 4364	776	file.exe	89
PID 776 wrote to memory of 4364	776	file.exe	89
PID 776 wrote to memory of 2708	776	file.exe	92
PID 776 wrote to memory of 2708	776	file.exe	92
PID 776 wrote to memory of 2708	776	file.exe	92
PID 776 wrote to memory of 1356	776	file.exe	94
PID 776 wrote to memory of 1356	776	file.exe	94
PID 776 wrote to memory of 1356	776	file.exe	94
PID 776 wrote to memory of 4296	776	file.exe	96
PID 776 wrote to memory of 4296	776	file.exe	96
PID 4296 wrote to memory of 5032	4296	firefox.exe	97
PID 4296 wrote to memory of 5032	4296	firefox.exe	97
PID 4296 wrote to memory of 5032	4296	firefox.exe	97
PID 4296 wrote to memory of 5032	4296	firefox.exe	97
PID 4296 wrote to memory of 5032	4296	firefox.exe	97
PID 4296 wrote to memory of 5032	4296	firefox.exe	97
PID 4296 wrote to memory of 5032	4296	firefox.exe	97
PID 4296 wrote to memory of 5032	4296	firefox.exe	97
PID 4296 wrote to memory of 5032	4296	firefox.exe	97
PID 4296 wrote to memory of 5032	4296	firefox.exe	97
PID 4296 wrote to memory of 5032	4296	firefox.exe	97
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98
PID 5032 wrote to memory of 3464	5032	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2036 -parentBuildID 20240401114208 -prefsHandle 1964 -prefMapHandle 1956 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b14f4aa9-5efe-4e52-9eda-714dff9e68b4} 5032 "\\.\pipe\gecko-crash-server-pipe.5032" gpu
      4⤵
      PID:3464
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2e30599-d817-4bd7-a299-30804e18ba7c} 5032 "\\.\pipe\gecko-crash-server-pipe.5032" socket
      4⤵
      PID:736
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3008 -childID 1 -isForBrowser -prefsHandle 2760 -prefMapHandle 1516 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {146d3f82-e40a-4260-b89c-56a1b804a8f8} 5032 "\\.\pipe\gecko-crash-server-pipe.5032" tab
      4⤵
      PID:4476
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1716 -childID 2 -isForBrowser -prefsHandle 3668 -prefMapHandle 3664 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5de066d4-3150-4532-b5d0-d66a200f604e} 5032 "\\.\pipe\gecko-crash-server-pipe.5032" tab
      4⤵
      PID:3000
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4848 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4792 -prefMapHandle 4780 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {151a62cb-d4b3-4c5f-b90e-203c2eeb41d5} 5032 "\\.\pipe\gecko-crash-server-pipe.5032" utility
      4⤵
      Checks processor information in registry
      PID:3596
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5304 -childID 3 -isForBrowser -prefsHandle 5344 -prefMapHandle 3656 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96553df7-2986-4558-be7f-151e93d8b001} 5032 "\\.\pipe\gecko-crash-server-pipe.5032" tab
      4⤵
      PID:4156
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5476 -childID 4 -isForBrowser -prefsHandle 5556 -prefMapHandle 5552 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3843b8b9-927f-4ccf-8944-f979e7bc3949} 5032 "\\.\pipe\gecko-crash-server-pipe.5032" tab
      4⤵
      PID:532
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5676 -childID 5 -isForBrowser -prefsHandle 5652 -prefMapHandle 5464 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1144 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38c4ca38-0e37-48fa-8d91-8d339fc8874e} 5032 "\\.\pipe\gecko-crash-server-pipe.5032" tab
      4⤵
      PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json
Size 27KB
SHA256 22515aa14e6ff10910b482ad889d0a9503a8621f18bcd0e5dab33f83991c902c
MD5 746373f87713a47704861947fe37f63e
SHA1 da90a4ab9a1a2dc0ae41fc15871c6ba302657482
SHA512 b828c0e325885a16e5a02c3f3886da2d922c6b83826040d8596d27206a304881c5e16931354f64ce746572ddaf1ed041c3f278e3cb6ed46be9bab63dc7f11c27
SSDEEP 384:zF7ym1NKT8a+Qro55dNG+tuRvlYv+fsFVyaueGhEBdaZG:Bym2Tb+RRNG+ivlYvH/ydeGuBdMG
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 8d536b0d2f2ba01c2bec8c16fe75dcd32731650d7f3d7aa3ad156049c4586d2e
MD5 2bd1743c344f0dd299b2c37f78fb77fb
SHA1 126777e9378b5a8e4bbff1a7eff395ae7a9af41b
SHA512 e7708aa079757fd8e297aebaa6d0ee295e60b277a905fba475219f1a120b27ffa8ee0730f781335f749504561794d5b8c537bb2e8c4b2db74ada7072316ad921
SSDEEP 384:HfNIu9fiGLm4pUGA+Q+4IYKgH4Zv+3yPrIVy8eoIHIx:llBi8mCUGxQ+4INy4ZcyzIVy8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 6KB
SHA256 9a741427175134bc700b0c73456b5f11a450368a114d875fe7de00307869b087
MD5 a6fa1860ca57b8bf23f65ef8d59f4ad1
SHA1 6690513104187ad201b46fde2bf0f59206fcc161
SHA512 1a4d95ae4960741b011ba9872e0c4fb17eff1b11ae6a79834325cdb8b8857768dc40fe2544269d6289619d6846c66d1d64a181f674ad137471b5b10d5228478b
SSDEEP 6:JO0gidpq88gidydgid8QWLb4ATHgidpqs7HgidBgidcsb4:RgQpB8gQWgQ8XP4bQphMQSQd4
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 8KB
SHA256 9df2857042c25e67d7f71dfc69a411030bf2f4955a5747006afc7bf65f1f198a
MD5 b455f364fbd6ddf113d7d8206e418aa6
SHA1 415b97b13a553ab9b3c3e988423493537ca8ede3
SHA512 9ccec028892bc2954b2e1f3a4a93cd3d4592ba1d1bda923b15a9a3824723c3de59d0a4efa4d46e91c93ff30f091b1a59eccf56fbbddedbe8e714e1487ee6c7af
SSDEEP 24:CuB1ozOsJblLKe7vtbgFsh2F3LFe75gu1xgRbs74uhMZYpR5cOH7CsJbF0Je7vtb:sOebVKeJb3V5oI59cOHmebOJeJb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 18KB
SHA256 3770a7dcfc5647cd98baa448e0827acc234e4ae9a410cb7483b4b49228fab6d9
MD5 9a30136fc886302590faee8f6bb84e40
SHA1 4ecfac586e1c98e12ad065f5ebbf6e0f5997e882
SHA512 d3acf66013ea2aecec4baf9daf6f80e57329a684050a2e858bb2674ec678906f7a382132730f8377bbd9cb1c01c1c6f20eff04f3ce74c1fb429f968fa08e8ccb
SSDEEP 96:TebVK0bF5onebOJ0bBpebvpf+DbMb8bMgbgz6bkbgbCbYbcbMb:g5Vu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 4dbaf7826303f571b761ca9e97461b51439a6d227be61a265f72d005488d8e5f
MD5 64b0d579b98b751f5d8a93248be01837
SHA1 d4fe9e30dd6f38b3a530f7c4f159916d22882de2
SHA512 3bd091ea2cf28677d643dd52bf15071803ff4c60bf712e6cfd69f2eeb83e65fdd5aaa496ef137f26a1bdeaf486ad754e6326304f8a61dbb6711b9b378b4fb2a8
SSDEEP 384:marG6xDDz2jfb/bqObowuhnPe/66JozGzgC1bM:HK65Dz2jfb/bqigzEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 f5973026464fae22a3bc48e157fa5cfb6111cca0b5fde0558105745a74538d4d
MD5 ec5eff4a177d306b52f7abeca76e1633
SHA1 db3b8a6ce5beb0c307c67c3df626304af539f936
SHA512 0fc50d65176490ced8ce9ca4822ecb9a7ea7cd4c6fa0338ccb5211dc849a56bf0cf18abf582195026b5cad61dce3ed1e996666c361acc96f66bbc0bcee80db97
SSDEEP 96:KLQ1Yz1l1x13Fl66JozGzgClKtmSSfSSMF9ZbkW6ShmpsPP/PrWI:sp/66JozGzgCl6mSS6rvZboShAyPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

00017888-3a7e-4421-9287-d37d159d9c2e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\00017888-3a7e-4421-9287-d37d159d9c2e
Size 26KB
SHA256 86b39cc460663cd4338190fa47ce88bd109a7494cd46216f4b959517950e52d2
MD5 842545b8319eef783922cec954f0c24b
SHA1 60cbaebd61a27ec3c94a7929f7a1f47f39879ee7
SHA512 5afe33f063a596c84da5df28ecd6c8aed60e34c33f09a20f9e7d427c3c620863040e6f317ef21a5428274b6bb6f24e508cf2b2cecc3aa301f8c2ac2c5d2d70de
SSDEEP 192:VPCs9ZACJJu6QJg3wVM3P67JR8FT0pSUjmbEXGVmLlRQzn5RT2nZxIRfXmI9I0//:gs9KnkC4FYXjmbXVqlRQjPoonaeDFN
MD5 SHA1 SHA512 SSDEEP

Submit Download

3edc8f54-7e44-4234-a6d6-81ebb83fc7ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\3edc8f54-7e44-4234-a6d6-81ebb83fc7ef
Size 671B
SHA256 626cc124140753cd21b1b8b31a9cb97dee609217c82ddb23da225091a98f22d0
MD5 4dc3c4ee018d5b4f56e8f96c94b39032
SHA1 c5b10660533429ac72a376f812a3bf0ee1060952
SHA512 8079f6335d7d6e1424a44f2de67ef1dbb8b9f3fd04dd302cfeebc0d0d4ed3ea6a5a0ae90ffd7ab52d1462c520d59143a21ae8efae0cdf105952badaf5061ec39
MD5 SHA1 SHA512

Submit Download

80c8abaa-519d-4936-9323-986a6c9995b5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\80c8abaa-519d-4936-9323-986a6c9995b5
Size 982B
SHA256 8a15797bcf6e4d4ac4c02ec5fcc1736e15a95a26de2bad2d01f4ebd73d6be813
MD5 4103776de9daa2b5f12f5a76a8311145
SHA1 db6e0b126c7274a491bb070c64fb3a4ad31e61d2
SHA512 2aba09dc092f4970c74cea9b846ca9be636829da4b1ad9e6e5e51df772bff0003d1bedf206c23f4542aecea30b9d1a59690595a53ea31ceb9990169416cf9ac6
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 12KB
SHA256 342f1156b2c1d90bba70382de0e6c1cbfb747ccec1e0716fb83a97b79b8bf719
MD5 29a36ba5d2ca48b8f959b0170e2da044
SHA1 c33b156879410b339c933d7121d248496208da25
SHA512 6f3585546400ff58ec60eff815f9bc770306d97f0255851e03884685b4b534638d60ac809e8bcf4fb07518627bd69cd2ebefac6e3220e436c4728bf2a4a6f6a0
SSDEEP 192:R5noRJfSb6UmH7fFEp4xUG7djP3dd2y1SkIMaXzoVU68E0Bw8HV9:uBH7Ns4L7dWy1BioZ6wS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 15KB
SHA256 f35a35002b0d3e273489e44f551591233d37d104f519bd5ab6456812effac1d7
MD5 22263839e9cdc7bd7067f0f8d2afe662
SHA1 4b8e1ec2c1207ed2f947d745d06d01d057511611
SHA512 4402388d75b6067ec7a302f54e967e65fde37f83bab11085df007a312fbd014302c2a032a0c50c24c0faa6127a80c009f6ea863e0ae8061a7227869efa56c346
SSDEEP 192:RynoRJfhb6UmH7fFEp4xUG7djP3dd2y1SkIMaX1+oVU68EAiBw8HVPP/DYN:XAH7Ns4L7dWy1BfoZjwSHA
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 10KB
SHA256 a29a6feb0a4c0b1ce40005638927b7f4f651139e877c36db4c7eb2f659bdcddf
MD5 98166d0706428852c8c59993ff3659cf
SHA1 8114ddd25d0a599af0c975957af7122b3ba7b8a2
SHA512 f348b1bc86f761b8f8b8476bfe6bfff55bd833f80b60e2972c86565a5e8e9ac5dd1babcf7e4167d5548c120354771042373049d0d56203c3072c08fa91611409
SSDEEP 192:U5noRJfSb6UmH7fFEp4xUG7djP3dd2y1SkIMaXzoVU68EkBw8HD:nBH7Ns4L7dWy1BioZqwa
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
Size 10KB
SHA256 3ab0a27f127ae96c493376abebe17b32857945b57ba691479c81ca563612504e
MD5 671f6dae6d0142a8c8bbd0061cf794d8
SHA1 fa427c0ba1865a0ae94e2d91b7d9c109d309f080
SHA512 ad5654f318a5a3c7419a0a577e1b34871746e0622511ecbdc022e6a32d2b53d476a20c2280803b6a00ed052e2f4fb430d798f61d3e9ccde84282aacb98061169
SSDEEP 192:U5noRJfSrVUVofAHBtq8prddx9y1ZO43taX2PoVU68EkBw8HD:nBVoIbpd9y1ZOaPoZqwa
MD5 SHA1 SHA512 SSDEEP

Submit Download