Analysis
- max time kernel
123s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
24/10/2024, 04:38
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 898KB
- Sample241024-e9eq9swdqm
- SHA256 aed0680db6a0e1b19d12ce2f2d82238c843ea971b2b2457068c144b9505e9431
- MD5 e85ca06680b57a87cd1fd08d0ff2fa63
- SHA1 e0c56a73d310046a9489e9923b5bf3b7582cdcdc
- SHA512 b2d5ec49d50b0386ab0f6cb6bb114a7e221b989a620a7c4d01c7a9f1a040ea96485a953ca531c3b2575ef40a9f4155c21ba883f8a1ac366421f2b57ecc775064
- SSDEEP 12288:bqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TN:bqDEvCTbMWu7rQYlBQcBiT6rprG8abN
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Kills process with taskkill 5 IoCs
pid Process 1328 taskkill.exe 1828 taskkill.exe 1880 taskkill.exe 1488 taskkill.exe 3700 taskkill.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings firefox.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 220 file.exe 220 file.exe 220 file.exe 220 file.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1880 taskkill.exe Token: SeDebugPrivilege 1828 taskkill.exe Token: SeDebugPrivilege 1488 taskkill.exe Token: SeDebugPrivilege 1328 taskkill.exe Token: SeDebugPrivilege 3700 taskkill.exe Token: SeDebugPrivilege 2680 firefox.exe Token: SeDebugPrivilege 2680 firefox.exe - Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 220 file.exe 220 file.exe 220 file.exe 220 file.exe 220 file.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 220 file.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 220 file.exe 220 file.exe 220 file.exe 220 file.exe - Suspicious use of SendNotifyMessage 30 IoCs
pid Process 220 file.exe 220 file.exe 220 file.exe 220 file.exe 220 file.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 220 file.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 2680 firefox.exe 220 file.exe 220 file.exe 220 file.exe 220 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2680 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 220 wrote to memory of 1880 220 file.exe 84 PID 220 wrote to memory of 1880 220 file.exe 84 PID 220 wrote to memory of 1880 220 file.exe 84 PID 220 wrote to memory of 1828 220 file.exe 91 PID 220 wrote to memory of 1828 220 file.exe 91 PID 220 wrote to memory of 1828 220 file.exe 91 PID 220 wrote to memory of 1488 220 file.exe 93 PID 220 wrote to memory of 1488 220 file.exe 93 PID 220 wrote to memory of 1488 220 file.exe 93 PID 220 wrote to memory of 1328 220 file.exe 95 PID 220 wrote to memory of 1328 220 file.exe 95 PID 220 wrote to memory of 1328 220 file.exe 95 PID 220 wrote to memory of 3700 220 file.exe 97 PID 220 wrote to memory of 3700 220 file.exe 97 PID 220 wrote to memory of 3700 220 file.exe 97 PID 220 wrote to memory of 2508 220 file.exe 99 PID 220 wrote to memory of 2508 220 file.exe 99 PID 2508 wrote to memory of 2680 2508 firefox.exe 100 PID 2508 wrote to memory of 2680 2508 firefox.exe 100 PID 2508 wrote to memory of 2680 2508 firefox.exe 100 PID 2508 wrote to memory of 2680 2508 firefox.exe 100 PID 2508 wrote to memory of 2680 2508 firefox.exe 100 PID 2508 wrote to memory of 2680 2508 firefox.exe 100 PID 2508 wrote to memory of 2680 2508 firefox.exe 100 PID 2508 wrote to memory of 2680 2508 firefox.exe 100 PID 2508 wrote to memory of 2680 2508 firefox.exe 100 PID 2508 wrote to memory of 2680 2508 firefox.exe 100 PID 2508 wrote to memory of 2680 2508 firefox.exe 100 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 PID 2680 wrote to memory of 2412 2680 firefox.exe 101 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1328
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking2⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {955fce87-afaf-4be4-a13c-c79b3e479394} 2680 "\\.\pipe\gecko-crash-server-pipe.2680" gpu4⤵PID:2412
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c2534ec-3d22-4d6b-8ab3-f6687ed9bbbe} 2680 "\\.\pipe\gecko-crash-server-pipe.2680" socket4⤵PID:4936
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2936 -childID 1 -isForBrowser -prefsHandle 2840 -prefMapHandle 3288 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f807c84-3629-4d4a-98d2-26c17d7120f7} 2680 "\\.\pipe\gecko-crash-server-pipe.2680" tab4⤵PID:3788
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2788 -childID 2 -isForBrowser -prefsHandle 4112 -prefMapHandle 4108 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a33ec8b-2696-43b3-a7b8-d2713c17e2f7} 2680 "\\.\pipe\gecko-crash-server-pipe.2680" tab4⤵PID:3376
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4756 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4800 -prefMapHandle 4796 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b436d184-5984-4039-998b-fe557357d05b} 2680 "\\.\pipe\gecko-crash-server-pipe.2680" utility4⤵
- Checks processor information in registry
PID:5236
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 3 -isForBrowser -prefsHandle 5308 -prefMapHandle 5324 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fb88153-e51a-4c9a-b7a2-fbb12f11cfd4} 2680 "\\.\pipe\gecko-crash-server-pipe.2680" tab4⤵PID:5644
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 4 -isForBrowser -prefsHandle 5480 -prefMapHandle 5484 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9c4b13b-333b-466f-b9da-ae4fc83f6369} 2680 "\\.\pipe\gecko-crash-server-pipe.2680" tab4⤵PID:5656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5468 -childID 5 -isForBrowser -prefsHandle 5696 -prefMapHandle 5700 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ab7ccf1-9abe-4fa8-9a9e-82bb56567421} 2680 "\\.\pipe\gecko-crash-server-pipe.2680" tab4⤵PID:5672
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json
- Size 22KB
- SHA256 4d7a8a01b21d1f01f4ac113811db63aaebabbced2fdba6f60407d7b314ac6218
- MD5 4030e03225c81dc0f44690b035ae52b9
- SHA1 70fdafbe0fc663487374d8cfd0fc40e29d896ebc
- SHA512 6b48e96aae913eb519b4b4f019021325ad2eba24309cb120e999f9b02f9b7beeaf53441865e012ee00a272949f908ff889b926f3d5b5eaf40cab18edc31bc91b
- SSDEEP 384:4zH5C6gMbniSx4CwNpZSBF0V9d+YllqGKlHkj/ZXSngyauBN+G:cQMbiSx4C8pZM0V9jlAG6Ej/6gydBN+G
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
- Size 13KB
- SHA256 7f438f5654613ae7bd6d1d2a859795f3012695aabc26744cec8bcdfff25b4269
- MD5 3d0e68d37248d2c9c1057e339d32eddb
- SHA1 b70bf87606d1c4dcdc0b2faa03cd7e204e128078
- SHA512 88d0df6a321761c35b730cf1b1e92f5770d3e0057c307f9c517bac4e3f6417001617987dffbc5ce9a5bfec08a27abdbbb0140f0315a9e5f91c3a05ce3f6ea026
- SSDEEP 384:H/w5Iu9fiGLm4pUmpHLFoCr/E8HPJyD3VonFcP+AWRMAC/Z4:8Bi8mCUmpHLGCr/E8Rg3V/+hRMF2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
- Size 8KB
- SHA256 48ab007a7d64cc90603c400cfe329f527a0014d52ad6adaa3551b49ea8dc5535
- MD5 d7a5d795a8fffcbbe451ffe86f5a2de9
- SHA1 f14bb09a44ae8a0d499e55ea486c9c92ec881727
- SHA512 c5d4f14d60fc3ef2075cbd87a6aca80ff0b7064ead20398e3d5c195a5f09147732ee9d90acc405701cae02d164aa70d747ebd37764d1ad3fc740a3ae054a6581
- SSDEEP 24:CuB1ozxFsh2F3LFklgu1xgRbWRpR5cODQruhMZ8AsJblLKkJibcvsJbF0JkUib:s85oa9cOU+AebVKFbcvebOJ2b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 3c17edadfad884d0f868ae60b126e78c8df468dbea7f5a707dd9553a8630881f
- MD5 cbc7e9a8e19711efba32b594a3836900
- SHA1 6915d41268eb998d65895180884c08cd49f850ae
- SHA512 0270f5539ddedb4bf77ed4aa3ebf5592068e434876fb906bc61038ab42fb833e8919aeea49f3ef3b406ffeefe8922fbd969f18963d71644b5732f8a22c7f2c08
- SSDEEP 96:NLQ2RV2i2GFl66JozGzgClKtmSStcSMF9ZbkW6ShmAt/PP/PrWI:R/66JozGzgCl6mSSCrvZboShRRPCI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 d51d6d0330ccc17357ebf32ed20b04fa14cd4bf0eae3e3ac4875891a85d962a9
- MD5 9ebbd8c77f3068f0d2100555e1e03ba2
- SHA1 d1c46fa9c55cfa2ed53fba7ff317a02d26590bb1
- SHA512 0ebb589e79d77a8340cb8930d3ec283bad541d0bd882c78acbbaa581d9b7f86b353b03fd09a9df5c4f603deb9e172ea3c57903e8223a7727d9b86267eb2440f3
- SSDEEP 384:n/56inw9JDnMWZb3bogboPnoPS/66JozGzgC1bM:00kDnMWZb3boIfXEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
- Size 14KB
- SHA256 f346ee7479a119351caa792640eedae370c34645360d9492cb521a767c70b26f
- MD5 2dcf037f4d10bd1fd778ef37f9c40bfd
- SHA1 c7182111171b1584cc4def2b276b30680e9f1620
- SHA512 54d822ca476b265c354483c7cd2da68c55c2870e7ed01d959637438033ea4a063a164b39e41a3f9580419763d14bea923d6c46af927dd65097dc0eb518fe167a
- SSDEEP 384:GboPEPm/56inw9JDnMWZb3bo1/66JozGzgC1bM:Kx90kDnMWZb3booEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 918cc91d007e57edeb46b392bd9f162d78a32fd5824e1e3c2e1730819b83c445
- MD5 2178e05efdf2f183dd0529dee56a2865
- SHA1 f899e675cca1f7917ae754c3fa49571c001611cd
- SHA512 d4b6c9fb79db3fe535be3e32a1f6094acff186c882d8269c959873aebede081c4af46bcb5eb4304b680151dc322a86ad97d4173ddbdd13160ac63368350ddc22
- SSDEEP 384:g/66JozGzgC1bmboPoPp/56inw9JDnMWZb3boL:NEYXW0kDnMWZb3boL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\97565436-fc7f-4d67-8ceb-c34468caac73
- Size 27KB
- SHA256 2b8fc660fe32de15a49540bc90cb63e292adb9be4767900977b49d535251abf4
- MD5 16322c82acf6673a95daccc93b15ca67
- SHA1 3de98150dd00992c86d4bfe7e83e750fce86ff62
- SHA512 a26ef8d9eaf3fb4732e0f1203b5f30f5ea132d65d4905f6420abb05a9e4ba6b2e030db1b0a548f986d119d782c754698c8a67160224ea1562e1939a0a9f1775a
- SSDEEP 192:bx52Z3RWeLhLAcs5D81s1rJ5j1ZwzEJqnEkZ83lw1ayGqJ4NjHxFKl0FaURKC1UW:b/2r/Ie1+KzmUdN3BSlLLoobSm2Y1QFI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\d30dafcd-f7c8-4608-8190-bdbf16c374e0
- Size 982B
- SHA256 60e03e33af5291510cb71e965a3fbcb0fe1aa5d19c621e87477bd13b764f4691
- MD5 fbc10721d038d4eede0c41de994467ff
- SHA1 562dc69ff21d6da484c8c710d966d0daf3059db5
- SHA512 6c7e30a3c31145fddf2326a4207b5c9c4b39bb1dfc3c199c35a3a0412aeafb19af0d912d68abe13e74df065ff3469e5a338ad70ba8be98d4110549f0b3ea05fa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\f456e9a3-b614-41ef-aa61-5d3f0dd1137f
- Size 671B
- SHA256 f1e59c5577c46e5a1206eb282d9656e494aeac7321470ce44f9d405ade954916
- MD5 493043e96e2d26904311e1fc70929e34
- SHA1 d03d90bf415a75735e8af5188ebe8544631baca5
- SHA512 ef0d15edd6bcedb9dab87b4cafa07e1b015ff8b11825e04e5dac8372f66a8a8fee68e8da4479426e22dcb831cc9a87a6c18b7d6cfdc43a6ddfdcd0a61350a356
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
- Size 12KB
- SHA256 865f367b2efe91671b169e2be77b16fc0201cf2ef0a1784c3d7e7710e4354568
- MD5 6778caa19e3dad4f5854bae9b51fc0d4
- SHA1 be4f26b74a97e894a37ca3b46f51a98aeee7034c
- SHA512 8d91c6b31b56396ab6dd15b57c70b07dcc32280d2f48c4077880e6dc944c63d63642993a3481e5422b00eef899393fc1d8763a58f1f9e6791748c43a858ba926
- SSDEEP 192:R5noRJfShcsBfHKOuUGty88ZddIy1Zzh3DaXGoVU68ECBw8HD:uqBfKOW8Cy1Zz5oZQwG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
- Size 11KB
- SHA256 28f3e6f1b0c4ceebf07ae634b958a9f596e3dd1ccba7057576fea59d3460afa1
- MD5 660e088a9619b37da999b57139972e6b
- SHA1 34f3967929ee737c6715446c3a2061ce3502418e
- SHA512 18d85b6e05bdb7da37b127f8126c6ac46544a84021eb6638208088165e6ff8e708a49bff7856af7fc2e444126d33598583eb932798b2ce7ffcf30a89bcada149
- SSDEEP 192:U5noRJfShcsBfHKOuUGty88ZddIy1Zzh3DaXGoVU68EkBw8Hg:nqBfKOW8Cy1Zz5oZqwt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
- Size 15KB
- SHA256 3414223566b469ebf11689018477fb3f46e5ff5eb9aa43c27070e93c08490d74
- MD5 b5f98138880ef6ffd07fc6788bc41bda
- SHA1 cafd2fc8560cc46d68970954a3c34fae18e13d15
- SHA512 966fe552fa5f668e083511b5aebd318b3d29da7554a92ce23a89200d76c6aeae32d47dbd548068de63a3e8b39634d7512fe3882d15c6decfa8c798edc74629ad
- SSDEEP 192:R6noRJfohcsBfHKOuUGty88ZddIy1Zzh3DaXC+oVU68EPiBw8Hwh05O2:fsBfKOW8Cy1ZzSoZ4w7s
- MD5 SHA1 SHA512 SSDEEP