Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
31/10/2024, 18:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 898KB
- Sample241031-ws6bbstlfn
- SHA256 614b14ea6d8e3a234423641b093773a72d59a2fec5ce62f013edac8a49b60b94
- MD5 6843d7f35d5182c3cca51b7f6089cfb4
- SHA1 3c9b48ba4da8a0ffbe41da4aa11872065670f6c7
- SHA512 e7053f3a55a39501d0da3bde4e87a21246234366b7643c51b4d547fb0eeded257e0b19147367cbf1f2af23f269434bce0cc4181a88b546d877df0edb9390ce5b
- SSDEEP 12288:OqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Tb:OqDEvCTbMWu7rQYlBQcBiT6rprG8abb
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe - Kills process with taskkill 5 IoCs
pid Process 32 taskkill.exe 3428 taskkill.exe 336 taskkill.exe 2840 taskkill.exe 3708 taskkill.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings firefox.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 844 file.exe 844 file.exe 844 file.exe 844 file.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 336 taskkill.exe Token: SeDebugPrivilege 2840 taskkill.exe Token: SeDebugPrivilege 3708 taskkill.exe Token: SeDebugPrivilege 32 taskkill.exe Token: SeDebugPrivilege 3428 taskkill.exe Token: SeDebugPrivilege 5096 firefox.exe Token: SeDebugPrivilege 5096 firefox.exe Token: SeDebugPrivilege 5096 firefox.exe Token: SeDebugPrivilege 5096 firefox.exe Token: SeDebugPrivilege 5096 firefox.exe - Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 844 file.exe 844 file.exe 844 file.exe 844 file.exe 844 file.exe 844 file.exe 844 file.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 844 file.exe 844 file.exe 844 file.exe 844 file.exe - Suspicious use of SendNotifyMessage 31 IoCs
pid Process 844 file.exe 844 file.exe 844 file.exe 844 file.exe 844 file.exe 844 file.exe 844 file.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 5096 firefox.exe 844 file.exe 844 file.exe 844 file.exe 844 file.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5096 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 336 844 file.exe 84 PID 844 wrote to memory of 336 844 file.exe 84 PID 844 wrote to memory of 336 844 file.exe 84 PID 844 wrote to memory of 2840 844 file.exe 90 PID 844 wrote to memory of 2840 844 file.exe 90 PID 844 wrote to memory of 2840 844 file.exe 90 PID 844 wrote to memory of 3708 844 file.exe 92 PID 844 wrote to memory of 3708 844 file.exe 92 PID 844 wrote to memory of 3708 844 file.exe 92 PID 844 wrote to memory of 32 844 file.exe 94 PID 844 wrote to memory of 32 844 file.exe 94 PID 844 wrote to memory of 32 844 file.exe 94 PID 844 wrote to memory of 3428 844 file.exe 96 PID 844 wrote to memory of 3428 844 file.exe 96 PID 844 wrote to memory of 3428 844 file.exe 96 PID 844 wrote to memory of 2588 844 file.exe 98 PID 844 wrote to memory of 2588 844 file.exe 98 PID 2588 wrote to memory of 5096 2588 firefox.exe 99 PID 2588 wrote to memory of 5096 2588 firefox.exe 99 PID 2588 wrote to memory of 5096 2588 firefox.exe 99 PID 2588 wrote to memory of 5096 2588 firefox.exe 99 PID 2588 wrote to memory of 5096 2588 firefox.exe 99 PID 2588 wrote to memory of 5096 2588 firefox.exe 99 PID 2588 wrote to memory of 5096 2588 firefox.exe 99 PID 2588 wrote to memory of 5096 2588 firefox.exe 99 PID 2588 wrote to memory of 5096 2588 firefox.exe 99 PID 2588 wrote to memory of 5096 2588 firefox.exe 99 PID 2588 wrote to memory of 5096 2588 firefox.exe 99 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 PID 5096 wrote to memory of 3988 5096 firefox.exe 100 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:336
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3708
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:32
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking2⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d0a160c-9286-47d5-b59a-23b9ea3853f5} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" gpu4⤵PID:3988
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2380 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fff42a55-3d0a-47c3-9a01-85c73ffd9a5b} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" socket4⤵PID:1128
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3136 -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 3084 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a390b9a-25ce-4a77-abda-72c7dd9f8c15} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" tab4⤵PID:1684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3832 -childID 2 -isForBrowser -prefsHandle 3860 -prefMapHandle 3856 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70253256-0710-4905-9db2-b8fea10c1692} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" tab4⤵PID:3056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4620 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4668 -prefMapHandle 4664 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4717ec1-bfef-4c05-b93f-f87d6c968990} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" utility4⤵
- Checks processor information in registry
PID:1172
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5496 -childID 3 -isForBrowser -prefsHandle 5080 -prefMapHandle 5376 -prefsLen 27025 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6a6ae3a-ea6d-470b-9798-b81061209bb9} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" tab4⤵PID:1512
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 4 -isForBrowser -prefsHandle 5508 -prefMapHandle 5500 -prefsLen 27025 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef482097-9306-426a-a1e4-9ebc31bbeaf1} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" tab4⤵PID:3612
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5768 -childID 5 -isForBrowser -prefsHandle 5736 -prefMapHandle 5080 -prefsLen 27025 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84729aea-1363-4921-80b6-e9a23f3a8ae6} 5096 "\\.\pipe\gecko-crash-server-pipe.5096" tab4⤵PID:3652
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json
- Size 18KB
- SHA256 687d04155cf45e771eac6f7b7a7cb777afca125d4c992ac70ae6168c5aa4061e
- MD5 256213ca3258da296fea1771d20cf3ed
- SHA1 a6175debf01ce062cf41706e48bab95f673b4487
- SHA512 70a8e8325ab7ec8844ce6af85a60afa087a6f78d6b095cc4052962977214f9486bcc7a391602c1abf3198cb05e580e276f60a76f514439753dcd0980e9cf4be8
- SSDEEP 384:jxrmQDabZhD/VgOCgUAYTsvMW0NxATFnHU+3IgyaE:trme2nD9gXAsuMW0nwFH/Ygyp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
- Size 13KB
- SHA256 3a7f5b13a92f65500da66b6ff2e637483ccb402ba55232b997cfa16a84fe1ef2
- MD5 36962a2e0eed0316ae10869c3b185d55
- SHA1 74c60132fdf9ecc4ec5efe47fabd19ce19415fb7
- SHA512 153c3c0ac1d42a9370cfd65cede38e6773c804a16bd48f1afe9d9e3ff83d2a462406fffe04de64d56dff2865b26bce688acf4cef887beaf0780d5bc88d960b0c
- SSDEEP 384:H/w5Iu9fiGLm4pUzA+Q+4IYKgH4Zv+3yPrIVy8erl2:8Bi8mCUzxQ+4INy4ZcyzIVy8N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 13.8MB
- SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
- MD5 0a8747a2ac9ac08ae9508f36c6d75692
- SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
- SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
- SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
- Size 8KB
- SHA256 566784c5e0b16d4812b28a553ed7cf162a00f7142e3e9c0d93e6f1591bdc315f
- MD5 bd30fe8434b406cffa74cde1a7d4d975
- SHA1 60bff7fd031214ba290274bca208e73909f359d2
- SHA512 868ff5d87eeca3d95b93a2553e7d3d6c742b9d321ad2b8b820c48ae5963b35bef2535111be78b7ee70581a6f105308ad965375a92efb339071a8847a5a8d464f
- SSDEEP 24:CuB1ozoFsh2F3LFEgu1xgRbrpR5cO8FuhMZxsJblLKYWdbhsJbF0JYWdb:sL5of9cO8ZebVKYWdbhebOJYWdb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
- Size 10KB
- SHA256 5208943cb017115326982f34ee93ef62c42a3f75e0c92c9deefae4923ffcad39
- MD5 6e9941c9531e4480ea00b724751c8f1d
- SHA1 adce57810533896519f20044d067beb3f666417e
- SHA512 41f49427541c7156c9aa7f9ebcdb1afc8b8a878a6013bfd0533705cc5e836e88d12ba08e46dfa43291dafb8ec8e96539d87086fe1bcb9bb8343b20e6b92fe216
- SSDEEP 48:sL5os9cO9ebVKYWdbhebOJYWdbUpebvpf+XWdb:y5oGebVK7dbhebOJ7dbUpebvpf+Gdb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
- Size 17KB
- SHA256 2e64c56da5eb6030a22551b905a980796b8d32774360e72e4f03461ed9f3d79e
- MD5 b0b1c57f61526eb3460d21daeb30021e
- SHA1 4a32a016458f72f631d8f6fbe717467130a14924
- SHA512 4026fafef1082d8aa8ba8ff794e275a7875728d0aa62bb10b8723c3da3932faf923e55cc52a5af170e8365b4200fa0292354da2cfdf2d0a4c987942249b15194
- SSDEEP 96:15oNebVK7dbhebOJ7dbTpebvpf+Hdb/gbgz/dbEbudbSbWdbObgdbLH:15ir5uObbzrdH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 529aaa8ef96bcf5b5affca0bfca8ef107c8c0bc6e5ba1a93a2321914489105ea
- MD5 0062c05f164054e36d5c2064a0e55529
- SHA1 913312fd8e1cce404f87a3c00210046b8bc4f30c
- SHA512 757bdec209bc1d38f0209c3616dedc6ef7ef8508b86e1364ad98974e3d4457f6872aa0e0ec4bd43c1aa011bc77f88ff2298bfddaa6a98b4a16cc228ab8d85ead
- SSDEEP 96:KLQa75SFl66JozGzgClKtmSSHvSMF9ZbkW6ShmxoVPP/PrWZ:N/66JozGzgCl6mSSPrvZboShMoJPC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 fae3d86efe3006b7f2711bccd71a74ba65b80ef5dab83061ac6e746bf1675ccc
- MD5 80220d8c84ba1fe4d304fdf949591b42
- SHA1 8b1fa4dd4721e9fe52db1527600490478163abe2
- SHA512 79dbb01c5f12e8a0f8a34778c58ada11db78c02ac0c3e6138190d23f2e1922f530e6abcd5cae96f86401406fc76b8aa0d68fa6a919aace44244c519436d5b700
- SSDEEP 384:oboQExPI/66JozGzgC1bTx1JNzdh3aKDZ/zXbEbuB:g6NEljnPDZ/zXbEbuB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
- Size 15KB
- SHA256 ff2bcc9e22cf4bfa58d1665df6b1eae5e22a9e871135f264a3335645235475e2
- MD5 57c6957dd40db76c2a9a5513cbfc6228
- SHA1 547b18494d36b99b70bdfebadb6a3b5aace582a4
- SHA512 6825ff8549a57144dbc7359c9d33ddcdfcbfac7f899684cdeb38cb62862161ecbd1fc8857fa46e71c304aa109b10679fb1f7fbb84b41fe531dd210ef2a292f5d
- SSDEEP 384:Bbo3xPcx1JNzdh3aKDZ/zXbEbuS/66JozGzgC1bM:xikjnPDZ/zXbEbuPEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 089f0c8fd7a6922187850fe9252d0356f6ec27656a8f316ba17b0fc1bdca7476
- MD5 58019868fc48020b7b7f6b16cbd84b56
- SHA1 8d7a1a64b6c2e6fbbdcf213c46311f0662171e9a
- SHA512 cd8eec10812a6b9eac4d7360e98dd3273a36f3b59f79f993fb8ad67234e5bad3107f9e766356c251fc44e11619dda607813cd6487a6f9e85b224501e8d73e08b
- SSDEEP 96:KLQa75SFl66JozGzgClKtmSSDBrvSMF9ZbkW6rBBWBhmqoVPP/PrWZ:N/66JozGzgCl6mSSdrvZboPIh1oJPC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
- Size 14KB
- SHA256 103455e29472e4923a9f4d5c2080e1d5fa023d39fd74bfc6470deacf00fc1bfc
- MD5 7c935577b3dc33ce7adccaca893ef785
- SHA1 dc4361276b0da7e8114e4248905436816ed92e83
- SHA512 cd30f80efb5838b4a5027a477399252a5c1f8a44f31741d8457ab838ce3549dc28a9ed2f0841d64e147d39639866a97f3ddbf5426220cbfaf350a62ee285ea5c
- SSDEEP 384:hx1JNzdh3aKDZ/zXbEbuS/66JozGzgC1b6boQPPD:RjnPDZ/zXbEbuPEcrb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\5db36cb4-bf99-41ae-9443-f0a7c25d8f23
- Size 982B
- SHA256 d8bb5dfce8c89cc83957364ea30a9cac861e29fe3279d04171e123228c7c1284
- MD5 03bfaf6d3bb599d817af8c35d0ba61a1
- SHA1 555b00646dd3def701704e8c7a8991fae1e16b71
- SHA512 28a409707fe5eabadbf7912d0133a608e674356b3e26428d3af83ffec63cf0b6ffcdda291a714cfdcdf27e87a90e8909c31df4c9786774d00bb55aafeba2e525
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\63457edf-94a6-4365-9790-5f685b6440be
- Size 671B
- SHA256 63ffcd913a21bb68e466daba59fcbe2d895ebbe83d464fd39f734326773c96a5
- MD5 2f9abfc424c3eed256ee334ce1a52e4f
- SHA1 0a0d47db75b6c2df31a5c783ee1735cfed7fc533
- SHA512 0a4c312ec9aa814921ecf50a407897c22b2cd562e6a0cb3aa51461feea6eb5561533360dbac75fd5f1f4253d820605b58343791c30a2f9955072322ee7f4bd19
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\d5b4258d-7a84-4003-a42b-8b2ec7d79939
- Size 29KB
- SHA256 72824c13350db583e6408fc6c4594119e10258f4ba8390d9e1d2946e8d17bf59
- MD5 9fa3cb8f9a460627d76c0c7546b819e0
- SHA1 a39e84b966ac942dcee59071d21efb5649584ed2
- SHA512 ec0846b7d3fcbfc3f85783514f1b413b4d3cca9b33eec4d9a126efa0788441418120be725fac8abb6b6e2c048b47123602d1d02e237afd48c18ff477d4dc77e4
- SSDEEP 192:VfwaJNa78YfwN1e+mDNjjGlfBS7CtzxBKCaz4qy1CRhnnu5PUE+rblww0FRITvJq:Fw7CmBGl5S7alBKC7libptF8Hee
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
- Size 372B
- SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
- MD5 bf957ad58b55f64219ab3f793e374316
- SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
- SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
- Size 17.8MB
- SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
- MD5 daf7ef3acccab478aaa7d6dc1c60f865
- SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
- SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
- SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
- Size 12KB
- SHA256 95aa449ead68183600abcc6811eb9fc6cdc2c511b9b89782ee15fc0ca9832f87
- MD5 f533e80d3e999d0fb8029195cfbf6376
- SHA1 852052fc426ffd68bce5bfe63caba61ff2b840f2
- SHA512 dae07b3786bf1aa829241719a5714326c760989a1ae3d5e012998318d6e38451ebe7d623da18fadbaa367b1afdcc193f7df52f411dac3972bb53864f6726fd3e
- SSDEEP 192:R5noRJfShen4s3HyfPreRhUXmtT8ziXddUy1ZzA3YaXXoVU68Er7Dd8uBw8HUJZ0:uU1KHyLeRO3ziUy1ZzSoZXwlJm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
- Size 16KB
- SHA256 dda4beae82ad4747623956b54590918fb043b43d36f52d64a0627650b36a0e31
- MD5 0c46b2b9c64915263f0ff85a31d6fba5
- SHA1 5f75ad349461a9dfe67f481d624fd3f69798ddbf
- SHA512 3b840cf7be852b855b5a42d96d1ec69ceba42a3786967f0e4e8bab3df860c96bb11986bbbd860780d3a3952044f64196b64f695ccb54b8545de6bbe096f60ffd
- SSDEEP 192:R2noRJf7hen4s3HyfPreRhUXmtT8ziXddUy1ZzA3YaX5+oVU68Er7DdVBiBw8HUX:z11KHyLeRO3ziUy1ZzvoZewlJKor
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
- Size 11KB
- SHA256 2beb33621192e74620c7dd0dfbe32101fd3f1a4c4b594ddbc9a87065c4050e43
- MD5 6a999a42149635ffbc615a474d03fac3
- SHA1 039014c712fd1f02d733715c1b4b7b860f102a4d
- SHA512 0398a6ee366efe8a65d720028c22c57e15a649c3f2c348e0bcadb71a98aadd4129df02d96be5d237fe0210f24a69384b20da60b898e985767f2ec51923b5e457
- SSDEEP 192:U5noRJfShen4vDxnMd3QW+YtBUNtPVdtOoV1I0G51aXXoVU68EkBw8Hl:nU1vDx8QW+YtMOoFoZqws
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
- Size 11KB
- SHA256 0b89e79db2864c17ee9f9eb0bed979723ca5a5bfb317f10dfbcc61eb2652c9d0
- MD5 b72e1bfc8f3c8451080ffda693e847ea
- SHA1 7912417210b0dc7a5a162200af325c9f48ad4c2c
- SHA512 e7f16dfbb1bb16d7e641b84ecc8579ec0941f47b4e0bc7167e7b662a8c5469276c59c1ab0380e47ede3a134ea226d608e045ee6cab2c80f2f47eae0718d6530a
- SSDEEP 192:U5noRJfSrV4vDxnMd3QW+YtBUNtPVdtOoV1I0G51aXuoVU68EkBw8Hl:n5vDx8QW+YtMOo4oZqws
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
- Size 11KB
- SHA256 8c3149aff0f31520850b70fb0b741d09f74e210168d8fbdd7f7265d534197870
- MD5 8ffc1b7791b4906e3ee2989020b281c5
- SHA1 5ba6746b4a955047be25090005e00a6f7979adab
- SHA512 200dff64014cd085a1b269f84b3676afd203858b40b52f3aa8effa36a2eb327ea6ea0e67541417fe696e23374933912f5623cff7ccb0bc70e939bd185bf0b198
- SSDEEP 192:U5noRJfSrVRDxnMd3QW+YtBUNtPVdtOoV1I0G51aXuoVU68EkBw8Vl:nwDx8QW+YtMOo4oZqw+
- MD5 SHA1 SHA512 SSDEEP