61477c3ec5a8f73ef52b85ffabfe56e1d899f1d589daa8c713491f063ce3e42c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 900KB
Sample241201-e9dh7s1rbm
SHA256 61477c3ec5a8f73ef52b85ffabfe56e1d899f1d589daa8c713491f063ce3e42c
MD5 55f033e828bc78bc86bfcd3331417b8d
SHA1 fa8caf4486d5d9d461c1cb239cb47271a963f1d9
SHA512 d924aef82d41342cf334b5f0c27a3907e5248cce17504fdfc0098f72df51099bd517204bb935a6f4ed586aa927b589aec7e721e28b00f0b9a9414664929dc42b
SSDEEP 12288:+qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaOTu:+qDEvCTbMWu7rQYlBQcBiT6rprG8a2u
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2812	taskkill.exe
2092	taskkill.exe
3048	taskkill.exe
3672	taskkill.exe
3568	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4408	file.exe
4408	file.exe
4408	file.exe
4408	file.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3672	taskkill.exe
Token: SeDebugPrivilege	3568	taskkill.exe
Token: SeDebugPrivilege	2812	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4408	file.exe
4408	file.exe
4408	file.exe
4408	file.exe
4408	file.exe
4408	file.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4408	file.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4408	file.exe
4408	file.exe
4408	file.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
4408	file.exe
4408	file.exe
4408	file.exe
4408	file.exe
4408	file.exe
4408	file.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4408	file.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4408	file.exe
4408	file.exe
4408	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4880	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 3672	4408	file.exe	83
PID 4408 wrote to memory of 3672	4408	file.exe	83
PID 4408 wrote to memory of 3672	4408	file.exe	83
PID 4408 wrote to memory of 3568	4408	file.exe	86
PID 4408 wrote to memory of 3568	4408	file.exe	86
PID 4408 wrote to memory of 3568	4408	file.exe	86
PID 4408 wrote to memory of 2812	4408	file.exe	88
PID 4408 wrote to memory of 2812	4408	file.exe	88
PID 4408 wrote to memory of 2812	4408	file.exe	88
PID 4408 wrote to memory of 2092	4408	file.exe	90
PID 4408 wrote to memory of 2092	4408	file.exe	90
PID 4408 wrote to memory of 2092	4408	file.exe	90
PID 4408 wrote to memory of 3048	4408	file.exe	92
PID 4408 wrote to memory of 3048	4408	file.exe	92
PID 4408 wrote to memory of 3048	4408	file.exe	92
PID 4408 wrote to memory of 2076	4408	file.exe	94
PID 4408 wrote to memory of 2076	4408	file.exe	94
PID 2076 wrote to memory of 4880	2076	firefox.exe	95
PID 2076 wrote to memory of 4880	2076	firefox.exe	95
PID 2076 wrote to memory of 4880	2076	firefox.exe	95
PID 2076 wrote to memory of 4880	2076	firefox.exe	95
PID 2076 wrote to memory of 4880	2076	firefox.exe	95
PID 2076 wrote to memory of 4880	2076	firefox.exe	95
PID 2076 wrote to memory of 4880	2076	firefox.exe	95
PID 2076 wrote to memory of 4880	2076	firefox.exe	95
PID 2076 wrote to memory of 4880	2076	firefox.exe	95
PID 2076 wrote to memory of 4880	2076	firefox.exe	95
PID 2076 wrote to memory of 4880	2076	firefox.exe	95
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96
PID 4880 wrote to memory of 676	4880	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3672
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1912 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4289f2cd-748a-4313-a2ed-55c032ca3545} 4880 "\\.\pipe\gecko-crash-server-pipe.4880" gpu
      4⤵
      PID:676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d04809d-fb37-4e43-aa70-0182a9e2c326} 4880 "\\.\pipe\gecko-crash-server-pipe.4880" socket
      4⤵
      PID:3472
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3076 -childID 1 -isForBrowser -prefsHandle 3048 -prefMapHandle 1640 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17d74630-5829-46c1-89f4-e6666018c39e} 4880 "\\.\pipe\gecko-crash-server-pipe.4880" tab
      4⤵
      PID:1840
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3636 -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 2740 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14d5926f-f172-4e4f-ab02-4ee6f156b0d8} 4880 "\\.\pipe\gecko-crash-server-pipe.4880" tab
      4⤵
      PID:2584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4648 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4672 -prefMapHandle 4664 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21dc1d03-700f-4208-baad-a2db99a6920f} 4880 "\\.\pipe\gecko-crash-server-pipe.4880" utility
      4⤵
      Checks processor information in registry
      PID:2272
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4632 -childID 3 -isForBrowser -prefsHandle 5420 -prefMapHandle 5440 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04ab7526-221b-49bc-b6a5-ae84c1acd6af} 4880 "\\.\pipe\gecko-crash-server-pipe.4880" tab
      4⤵
      PID:3288
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 4 -isForBrowser -prefsHandle 5684 -prefMapHandle 5420 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7dca34d-f1b7-49d0-b116-dcdb4f62816b} 4880 "\\.\pipe\gecko-crash-server-pipe.4880" tab
      4⤵
      PID:372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5588 -childID 5 -isForBrowser -prefsHandle 5696 -prefMapHandle 5692 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76f3e22b-1e3a-4622-8351-751500542572} 4880 "\\.\pipe\gecko-crash-server-pipe.4880" tab
      4⤵
      PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json
Size 21KB
SHA256 7383331cd8aa8c2187c5415cb0a3078958c516de911ac32ee36a8729af4d883a
MD5 12898b6adbafa9515bac80f952ee6736
SHA1 90ab612a20179a4ef2129427543d5f5dc29b7551
SHA512 63ebee682144059d9c7ffcc30184c2180b057d3d968a643ddd43df2120b79eba71484378363cdfe188d1e2da808943b3ec47c47cf1361091ab2faf532187c0ab
SSDEEP 384:9hgz9DDZ3eUCC4qvI22qzedGpXSSsAcCYx5aEyaurcEcbG:vauULHvf2WCGpXbbYFydQxbG
MD5 SHA1 SHA512 SSDEEP

Submit Download

39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Size 13KB
SHA256 a3a3054bbcb1ffd4ce38770130e4a871e02fad29b1d76f1824abbbce95a75132
MD5 ec25414b7864c1f54084dbf834598a92
SHA1 53925579b1d27edf2a511ede82a73745f8cc1c5d
SHA512 5686132cd832b995895d493deabf54b3c3e8e0b79e97c6234e1abdc5c3e20be4ff9479189198d9c7e86173c8bb5c915d23c9d8331150602d017effeb38c302bf
SSDEEP 384:HfNIu9fiGLm4pUswA+Q+4IYKgH4Zv+3yPrIVy8eQX/HX/x:llBi8mCU7xQ+4INy4ZcyzIVy8Xvx
MD5 SHA1 SHA512 SSDEEP

Submit Download

92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Size 13KB
SHA256 cee2b7e50e1504e3f3495c051206cb04a4f3355e93876b36df1e493890e8bcbe
MD5 13e05f1e10b2618edc7f3152b44d6c28
SHA1 ba1cb7734a433e4dbcc4a884aa256ac11cb2dc9a
SHA512 fbc883f887d00c95466e5e683186bddb2f11bd2a9414019d4f247ccd6e6b66c56477564abbc530fbd92485eba2a4355ded78de261716c2a7a0ebcb8b52987ee8
SSDEEP 384:HFh1u9fiGLm4pU6A+Q+4IYKgH4Zv+3yPrIVy8en/l/C:IBi8mCU6xQ+4INy4ZcyzIVy809C
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 6KB
SHA256 d608701dad345d85357cea0a0faddfc0bb0a067a955b9cda6e95c4057ff1cab0
MD5 9ce3f45c49ab95f394a6137975683c21
SHA1 dcb28c5b2a8f3c830de4eb2564f66a45fd458a43
SHA512 e8a46a9f9defdb7ade75c62fdb12013a585df02aa767550b224ce42f8c4ea618546b7cda7812b2b06c7f611468ae0e2085389d355dec409c249b938689e1f2b8
SSDEEP 6:JO0gidpq88gidydgid8QWLb4PTHgidpqs7HgidBgidqb4:RgQpB8gQWgQ8XP48QphMQSQw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 8KB
SHA256 7783487c023eeba9bcc18c945b7920a25c5b52c8ecab7016dc2014b891ea1e4b
MD5 644c2116356f198ce865a834250ec2b5
SHA1 75059008e1715f91b371f7a959271c1ff71f1521
SHA512 640568ca7264f4f73af59752972090c18b84e3354d8e201d6f4794c5b0265e93b890263fef4d23f310dc23887c0001038567b86d13c1f6cba99c029417888673
SSDEEP 48:stlwTebVK2ZbbJ5okLB9cOnNsebOJ2Zb:YuebVK2Zbl5okfGebOJ2Zb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 9d2ce065c6dbbe447cbe74b5446434fd1c0928f7a650a11afe527b3abf1d80a9
MD5 e14c7ba85fb97e8700e8555f97bfb044
SHA1 8a07d730bc0f7a85c7aac7164a1691b506da5f84
SHA512 e94eda0ebba77c17839847a99a5780561e9d1f4a5bb99294521f0a2f3e5140c0241306a99b0ee3a6f20e9bdc6290823a54609276523aca6f7c87bb5808b69cfa
SSDEEP 96:KLQ7x91Fl66JozGzgClKtmSSrSMF9ZbkW6ShmkgPP/PrWI:F1/66JozGzgCl6mSSrrvZboShFGPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 2cdb9cedbfce0a6659cc03b6dceee4d8b6aac9cc5e85a10263b20c8b22d6ce87
MD5 745fd13454862b649cc0af3b894f5d3d
SHA1 10a3a3a8cc00f31979cc3d016b63f81cc6676f98
SHA512 3f97985a9f1695c90b05d378fd44c6b04b0c9acab4d1286c0d88d9ec70b20f8ab1c7741323f9b1f35bfcae28b3daf61091b09aad2c2a11e1e6a83d41ce80cc29
SSDEEP 384:Fbo/BAPoe/dr9Hu9o3DKcfwb/bAN/66JozGzgC1bM:1Bp/dr9oMDKcfwb/bAAEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 04ed78be3450c60b496e16e80b884aa90d62fcb82576c754f8729e1ace02e563
MD5 ce1c1e456a5ab8d2ce671a97c4f19833
SHA1 4c8c33032f8c2c44d7898d5b7c467f8f56d638a7
SHA512 8fc7fd0292ba2bc889475dfc85bc916a13969b59449c043673fa955d2d2eb366a1fe00401cdf8434078022b12a4f18c5e0f90591e3292ab9969581e406ead672
SSDEEP 384:me/dr9Hu9o3DKcfwb/bAN/66JozGzgC1bKboZAPQ:z/dr9oMDKcfwb/bAAEUBo
MD5 SHA1 SHA512 SSDEEP

Submit Download

427d54e3-bb00-4874-b996-59c954641b50

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\427d54e3-bb00-4874-b996-59c954641b50
Size 671B
SHA256 75f7bcda4c902b50a63a5291b75c915e3ec5fb66668a00e7ff35442087707d24
MD5 cd88914e0e7a5b75e923674858958d76
SHA1 3a3558cb6f880c4315f06767d1eeeedea7910b30
SHA512 f0ca8d4459ae4279a13b98ddef948a489db91bad1897e2f6958643e331f481b9c0adeb588923f299fc74e540a2177c82cddf5512f5e7434ac3dbadba522083b4
MD5 SHA1 SHA512

Submit Download

71c34653-2411-44b6-b36d-af2c8d321c64

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\71c34653-2411-44b6-b36d-af2c8d321c64
Size 27KB
SHA256 08fb32eb17ac775034c4dec43a47f08c20789d4f4d7f26b08aacd6204b6de1ef
MD5 66cfe1e3471f66b87511487ea82cbbe1
SHA1 6004a1966fa2ffaa3696c80b72bdb37ed2281126
SHA512 9a0707442fb57a36abea89997d123617234e3a12467e2b5190545b295ac641d8243662556f15ded62f8dde2806b932f836d1c9d4451fba97d78e6b6b331200c3
SSDEEP 192:18hyBhMteG566M5622oLBjUPqu0v6b1eQ+DZKcHpuBAQ2Mif5rDIh9LFICsWqgLd:1vB/icJf9x7jr+lIwDRvkflStRS19Za/
MD5 SHA1 SHA512 SSDEEP

Submit Download

f1b79697-a7cd-417b-a633-d200d6689a0c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\f1b79697-a7cd-417b-a633-d200d6689a0c
Size 982B
SHA256 9741a2cf93f593ef521630d46cc31d2bcd34fe6bceb5aee3968c9c8258503c35
MD5 e8c638e8c4217b50658ded95d20d2f23
SHA1 92792f33498b8ef65b410098270e71b6eb2eeb27
SHA512 8050de622c572b086c9339a4f3223af19f97d8a71d02491a68bc0b35c6875862e3c34d3d98dd58fab2656eadbb42f8676ccee9f5f598bb9ab88b6621c475a364
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 12KB
SHA256 c09bfcb4bcd353103b1a50f3c5c2881db17f18b5b62d622e571ec561876ff6df
MD5 ebac1c10a649c9bede3e27b4757ef16c
SHA1 06145e266517191dc11868b2d07074ee1a41b942
SHA512 7ff21e9ec7930b40ac03d1d53207dd258f0f544417797cad18fd12b60076494e760f64de12a4dc6fbff1e0eb020416407fc990e6d8d4a746c69ecafbcfa97962
SSDEEP 192:R5noRJfSjmlC/oI4vGpndJS3ddE+y1SI7zaXyoVU68EE5hTylBw8HIntlYwTN:umNg5GJWk+y1T3oZE5hTyHwtntlYwTN
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 15KB
SHA256 380df0c36b2218014c601c662abc8e8587e803b256508302337fcd09e999c866
MD5 edacc2ad5a406dca649d31533117fd7b
SHA1 6d136ce6e8055c7ac456897120e3be5cf5917b0d
SHA512 de3689c1dba977f4e1db33da3ad4eb8c10738e0f554ecc482b91e1d832746f037fbea1059487719d8c0d8344a3485e63c9d17bf63be7873ad469aafcdd8974ee
SSDEEP 384:N0Hgk8/KpNg5GJWk+y1TIoZE5hTYFinwQandkH40wsStNSlbD3YwH20tSbtn5Tub:YJWk+d4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
Size 10KB
SHA256 6ff381cfd4bbd9684d5d5841d844a9b4c7c2e8df2f7773cfd71e2ccfc0204f1c
MD5 e83ce4a442015fe405ce38cbd92aeef4
SHA1 a1c3fc12def7c92890e5144cffce95dce912c40a
SHA512 239669695010b9485f3fea3e0ffc404eaaec1a90769223ac2372a6dfe89ae6b5c21b6cf64f689b1c4249afe5388f54d2fb6d0450f88bf9458614cd846fb3e567
SSDEEP 192:U5noRJfSrVksVofAHBtq8prddx9y1ZO43+aXZoVU68EkBw8Vv:nsVoIbpd9y1ZOOoZqww
MD5 SHA1 SHA512 SSDEEP

Submit Download