ed2da9b6055690c5086b520108d1a1b4b736367d558850ae484fe8a1d84bd580

Analysis

max time kernel
124s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2024, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 900KB
Sample241123-ry5jrssqhl
SHA256 ed2da9b6055690c5086b520108d1a1b4b736367d558850ae484fe8a1d84bd580
MD5 6af576da82f8f0fb7902fa3ce4235e02
SHA1 50b419ba7eae5134087ff07933e0863431ec2f1f
SHA512 09da84d1558f4c11f16a4c758a66411ae396d8c2c5dd6286289416556390a3711ebdbb5e5c264f192d67ab1f818df034a46ace4a6bb4d724b455c4ee9b2cf9f3
SSDEEP 12288:FqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaYTg:FqDEvCTbMWu7rQYlBQcBiT6rprG8agg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3948	taskkill.exe
4868	taskkill.exe
732	taskkill.exe
992	taskkill.exe
4952	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	taskkill.exe
Token: SeDebugPrivilege	4868	taskkill.exe
Token: SeDebugPrivilege	732	taskkill.exe
Token: SeDebugPrivilege	992	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	4332	firefox.exe
Token: SeDebugPrivilege	4332	firefox.exe
Token: SeDebugPrivilege	4332	firefox.exe
Token: SeDebugPrivilege	4332	firefox.exe
Token: SeDebugPrivilege	4332	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4332	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3948	2536	file.exe	82
PID 2536 wrote to memory of 3948	2536	file.exe	82
PID 2536 wrote to memory of 3948	2536	file.exe	82
PID 2536 wrote to memory of 4868	2536	file.exe	87
PID 2536 wrote to memory of 4868	2536	file.exe	87
PID 2536 wrote to memory of 4868	2536	file.exe	87
PID 2536 wrote to memory of 732	2536	file.exe	89
PID 2536 wrote to memory of 732	2536	file.exe	89
PID 2536 wrote to memory of 732	2536	file.exe	89
PID 2536 wrote to memory of 992	2536	file.exe	91
PID 2536 wrote to memory of 992	2536	file.exe	91
PID 2536 wrote to memory of 992	2536	file.exe	91
PID 2536 wrote to memory of 4952	2536	file.exe	93
PID 2536 wrote to memory of 4952	2536	file.exe	93
PID 2536 wrote to memory of 4952	2536	file.exe	93
PID 2536 wrote to memory of 1684	2536	file.exe	96
PID 2536 wrote to memory of 1684	2536	file.exe	96
PID 1684 wrote to memory of 4332	1684	firefox.exe	97
PID 1684 wrote to memory of 4332	1684	firefox.exe	97
PID 1684 wrote to memory of 4332	1684	firefox.exe	97
PID 1684 wrote to memory of 4332	1684	firefox.exe	97
PID 1684 wrote to memory of 4332	1684	firefox.exe	97
PID 1684 wrote to memory of 4332	1684	firefox.exe	97
PID 1684 wrote to memory of 4332	1684	firefox.exe	97
PID 1684 wrote to memory of 4332	1684	firefox.exe	97
PID 1684 wrote to memory of 4332	1684	firefox.exe	97
PID 1684 wrote to memory of 4332	1684	firefox.exe	97
PID 1684 wrote to memory of 4332	1684	firefox.exe	97
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98
PID 4332 wrote to memory of 4260	4332	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:732
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:992
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {997596f9-9a49-47fc-9a5c-72f08d05c08a} 4332 "\\.\pipe\gecko-crash-server-pipe.4332" gpu
      4⤵
      PID:4260
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d57c08e1-3987-4989-94cb-a4fac8759fb7} 4332 "\\.\pipe\gecko-crash-server-pipe.4332" socket
      4⤵
      PID:1248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3112 -childID 1 -isForBrowser -prefsHandle 3152 -prefMapHandle 3096 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c219145c-d8a4-44b1-a1f3-b18915c7dad8} 4332 "\\.\pipe\gecko-crash-server-pipe.4332" tab
      4⤵
      PID:3768
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3968 -childID 2 -isForBrowser -prefsHandle 3992 -prefMapHandle 3988 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c97f0b67-ce93-474a-9c9a-11fb10cf5685} 4332 "\\.\pipe\gecko-crash-server-pipe.4332" tab
      4⤵
      PID:3036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4732 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4724 -prefMapHandle 4720 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d774b558-584a-4817-a8d9-7ab5c4c0317c} 4332 "\\.\pipe\gecko-crash-server-pipe.4332" utility
      4⤵
      Checks processor information in registry
      PID:1756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5248 -childID 3 -isForBrowser -prefsHandle 5236 -prefMapHandle 5192 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eaa2e075-99b1-4f1a-8f31-4f8587781fc2} 4332 "\\.\pipe\gecko-crash-server-pipe.4332" tab
      4⤵
      PID:948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -childID 4 -isForBrowser -prefsHandle 5388 -prefMapHandle 5392 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39a309c4-392b-44be-9c7a-b2935bc00aac} 4332 "\\.\pipe\gecko-crash-server-pipe.4332" tab
      4⤵
      PID:1740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 5 -isForBrowser -prefsHandle 5660 -prefMapHandle 5656 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a814955-e77e-43dc-8450-8179f8135a14} 4332 "\\.\pipe\gecko-crash-server-pipe.4332" tab
      4⤵
      PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json
Size 25KB
SHA256 ee029400329f36df9ecb06384433c95227ba1336800bb9964c3f68e95cca5aa5
MD5 4273915e9c8f150e0db016bf7ff596a6
SHA1 625fbf5be1a72affdc27004bf98188c4a819b660
SHA512 58b27fa4770fede4676e6a29c845db5a86c3ef5947ebb916ee747ddfe44c3ef336aa8f9cdeae4452cf0b4be86e0d194bffcc02bfd803b2079792d917598dc8b4
SSDEEP 384:rPaiYnxnOR0GrGQywro5k86pFS1N526yauJEB9g6WfBHG:BYZA0WGQyx6pU/ydGB9g60BHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 a127f86743e516b7ec1aeca1698cc427a055d46aa01efb1bd1f4ff3bd5f74072
MD5 cc2c9d7fe85e351924a05f1f0b961ae5
SHA1 8e86cad6addb63531d44036f8c6ec4f102b94429
SHA512 891c294a20d5f03dbcffe7381a1fa0351b12d3e905a6e15c00cc6c9b49d4b7045aa11361bc45d1ac8ab5d9ff265381b23ad0455bc1383693ab3072d7ecdf91a1
SSDEEP 384:HfNIu9fiGLm4pUAA+Q+4IYKgH4Zv+3yPrIVy8e/7g:llBi8mCUAxQ+4INy4ZcyzIVy8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

F8CBD54DDA10F4286A41EC6A537240712D6C2308

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308
Size 9KB
SHA256 3fd173b0ec1d91e91e3e6e25910d08a765effbe882e62e75230293ce6a3adafd
MD5 e5e436090cb26d2fed741e77118a9dad
SHA1 68c864340c2489a3712297123c73f63868260ab4
SHA512 93bb71c25079550fc801d8c924d8d932413d840a3f7dd4794adb945cdbf91e51c724f2e946cdd3a92e0ffe2607d20529822bd40707ab3964a9b1d324208116ec
SSDEEP 192:69eeV+rGuJRI/PQ7lrR0993H8HPJJwD3H14TnFA9P+ABoRMe3j5cdSkdSU:69ee1ufiohrR03H8HPJyD3VonFcP+AWc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 6KB
SHA256 ed334f8a398cc6cc849ea5f9a2cda620d081222047c6902cbe5259e405bd9bbe
MD5 568f19e8f53cae0afdecb3998c09b379
SHA1 853f9315605e7a457747f56bf2871d9b8532255b
SHA512 e63e0aaf05d2a129d726797e620d5a57d98197fe6a3ae568bd9593ff92914474a5dad5ad1c3cf51d3f469e72cb362dd81ea34eb2f16dfbbd902c2e4cdbae2944
SSDEEP 6:JO0gidpq88gidydgid8QWLb4URTHgidpqs7HgidBgidwO5Fb4:RgQpB8gQWgQ8XP4rQphMQSQwO5d4
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 10KB
SHA256 d73ae0671847ddcf4a242d3e12cdd3a6114edd7c539fee23afd47ea6557b5bad
MD5 bf5fc73942d774ce8716c2c437f10e9d
SHA1 67f1a9da2d6be9fa599e6b9be4ab29d1efb5b6f1
SHA512 7d921a08d3f37b7d9a0ba6373fb3a5a2d216b994339452cbc2a3a29b309cdcd8e749f7e42be3d2e39f7b433a96320533f3ff4490243b1dca03038d72f60eba07
SSDEEP 48:s3ebVKDbU5oq9cOSFebOJDbLpebvpf+Zb:SebVKDbU5olFebOJDbLpebvpf+Zb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 db5235bea1deb009e327480e74e668fc095f72f7162076c808db97f5f93b6ea1
MD5 4a0e1f683e41ffb3e908b2ff706103f8
SHA1 b8f5f7c873b63da1bf88ea6cf842ea5fb3c93d55
SHA512 3ad5b431d1853430f2212e61c6bfd644d78703fa1a8f04affa43051d4bc503f4793da5c433426bed2aac6efd74e56c79dd7660ddf8b72a288e8336eda8c593d6
SSDEEP 96:KLQ1H1QY1xFl66JozGzgClKtmSSwzvSMF9ZbkW6ShmOrPP/PrWZ:N/66JozGzgCl6mSSEvrvZboShfDPC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a9fdecf024f0f4008eadf5ee7bd1eb88788266bd8bb4f72b0c0bc77eee9a26ac
MD5 dea868a145e1f2d800b9fb703b2d7f96
SHA1 5026f8983cb5ceba714ad885247fd8090d4be1fc
SHA512 9f279783559040244f0c3908cbd55d4982eb5d2b3e298eabcfbda0c5c0315778e8810826c2f067da3fc5334d13eb7725b9ab4f062697b5b3ff0b1578e3d7d961
SSDEEP 192:2vrvZboPZBhfDPDWl/66JozGzgCl6mSSM:2FbohBJPE/66JozGzgC1bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 e493ca08b0d638000dcda49f906b2b9f8793651c33d2f26c657eeb52090965d5
MD5 28f32426c78b88bab7a7959e35544b8c
SHA1 f2ff357614817799bd0e8c56321fef1e6922f34d
SHA512 b9366ad2074616e050f948d9e7626804f569c17b5edc52f8713adcea022fe77f6372bd26721e375f46b1d965978a253039a76228345e6f229d75f5cac054078e
SSDEEP 384:npbohBl7P3YHXX/RG+DK70ybabNy/66JozGzgC1bM:pOgHJ3DK70ybabNvEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 762fc1e8a0cbc21e0b03843a543177a0155ce9040143399da035fb511e64c172
MD5 2ce3d3c5e655164b5faba188c958af95
SHA1 1671b707cbc06094cac6cd2046d6c367444561b4
SHA512 257b841650d59aa84e69822154478d53fad7e9b53010fea0a4807ef6dbea68f94dfe93f13fe9ac68abedecfa879e4f4ce662ba205a46d02367227c6d409dd32c
SSDEEP 384:gpbohr7PC/66JozGzgC1bMYHXX/RG+DK70ybabNj:8mXEtHJ3DK70ybabNj
MD5 SHA1 SHA512 SSDEEP

Submit Download

6ea4088c-d16f-40c4-a313-4069f045ed67

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\6ea4088c-d16f-40c4-a313-4069f045ed67
Size 982B
SHA256 504747d628698b9745ef62252fb90dfda96691d604cf266d388a276774922e4d
MD5 97c3eb428b340967a029199a9e9fe12c
SHA1 17dd4d79f2c07a908e0716ed4212873d3b7c9929
SHA512 5ac3523eaddf533b54241a853564acdd76679ea053f0303363c9a1aad376728c9b745de84a3878a557714753bc16fb2fca1bafe85d76414d3f65a918f66e41e1
MD5 SHA1 SHA512

Submit Download

7c02b6c7-d270-4043-bfb2-3691ad639ec8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\7c02b6c7-d270-4043-bfb2-3691ad639ec8
Size 671B
SHA256 ef0fe5903e7dd3bb504895d6c5d433ba4a460696906b653bbafeac1872172c64
MD5 8cc0aa737419a1c1cc953e0a48f0f3dd
SHA1 81299c6469983cb69bc1c63ba0843c3b94d55d7f
SHA512 44f6df1151b97a87965e5812c49616dff5de2d6bfac13ad3ceb4a38f022abcd11de6d73574bf8af12e57bfd543214e27b46ead05b11143dea9b8fc800fa47d90
MD5 SHA1 SHA512

Submit Download

e0a03eaa-745a-43f8-bf22-31cacf30d9a5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\e0a03eaa-745a-43f8-bf22-31cacf30d9a5
Size 27KB
SHA256 2d388f2b5eb17ae58c3a434c99521d926932ed1ea654b18242d784086e7ec067
MD5 5de52fe49906b57c998c477b303c2bb3
SHA1 5e54ec87b491184a3797340754ae5a095e65d4e3
SHA512 dce555c4f315d85416864d856bf4dc18da59c42a4a5f9e5208de44e8edb4c1159af0b045a3837343a4e034914efae5ea1d60d1a934038c56e4d991d1dc4121c2
SSDEEP 192:QFOFiraXGWmzxzKrmp8zeuYXpaONGzz3U1iUsMG/rKjCZ5yelyrfMpHe6SUpAkOc:SKirVWmlzKfckPucZUAz+4hrS8hN
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 11KB
SHA256 a00a415a3ba6d8ff8a28457b06e6207ec0eca53c9a9adbd5178c2542e8440ab3
MD5 2c39258b1fc7d07c07c2b25d7f8196e1
SHA1 981030001e40b50966b76b67e1407ce6d7bfe6d9
SHA512 d134048e704b5d87a6905552355f2ccce7df9488a0b26c17e7e40e695e70a048d106ca5356c4fc952179918f5d6a72f7dbe3d9d3236953fc7c88f3c5847e7eb5
SSDEEP 192:R5noRJfSc//yifyRL6UCdY6gddUy1SqjaXhoVU68ECBw8Hm:uvyiqVsN7y1GoZQwF
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 15KB
SHA256 673f2dd82f08e0292ca9b8997c9e012bd146c17e3532853f0e58cca215c8c21f
MD5 f98165012c33155d011756e341003ba7
SHA1 e0124eec337a4daf50042b6c59aa405bf30f74ac
SHA512 cc133472db794fcff8e3f8da9a6272da4a3ba9067a2725419f73c6e34f64d65111cb64ed3978acd9bda572c23f68692c0f327ed370acd41bf029d4d3fa4ac8c4
SSDEEP 384:aqvuY4eZNyiqVsN7y1boZ5wXQiAde5ZR9LgM7cSGq1SXFgk4k6FbzYyNC:aqvuY4Cg1+N7+4QQiAde5ZR9LgM7cSGz
MD5 SHA1 SHA512 SSDEEP

Submit Download