Analysis
- user interaction
yes - max time kernel
270s - max time network
243s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
20/04/2026, 12:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
UniversalTool_41354.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
16 signatures
150 seconds
General
- Target UniversalTool_41354.exe
- Size 68.6MB
- Sample260420-p3txqaaz2r
- SHA256 593bd2c56c9f8397f7a3120fbb5a6e163cc58bab2fa846e7223e2d7ea1ebe8fd
- MD5 4a9cbc780dc5a699a91510906977660e
- SHA1 b0cbc93aedf3a28210019e5f89c4f7ee9a1c623e
- SHA512 53492cc7661362ab215c42e6176aefa587937f72f0bf9049923394fc711c3a1983aadd4939961faba7ff6f080b0a90c4a8e5ace5de922c4c92bb8bf184700131
- SSDEEP 393216:bsbEPQA5hBnWO+xg5Oy2GPZj0AJqYfbqye3lL9z6xQs:bsbEPQA5hBD2mOy2GPZzq2Ze3l
- TLSH T184F79F866319F294F3115AA489683B6108FB14757BA0CC777F87A9C20A2D1D9DCB3E73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000\Control Panel\International\Geo\Nation UniversalTool_41354.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\F230.tmp UniversalTool_41354.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UniversalTool_41354.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UniversalTool_41354.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 22 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings firefox.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5476 UniversalTool_41354.exe 5476 UniversalTool_41354.exe 4992 UniversalTool_41354.exe 4992 UniversalTool_41354.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4368 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 5476 UniversalTool_41354.exe Token: SeDebugPrivilege 4992 UniversalTool_41354.exe Token: SeDebugPrivilege 6136 firefox.exe Token: SeDebugPrivilege 6136 firefox.exe Token: SeDebugPrivilege 4368 taskmgr.exe Token: SeSystemProfilePrivilege 4368 taskmgr.exe Token: SeCreateGlobalPrivilege 4368 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5476 UniversalTool_41354.exe 4992 UniversalTool_41354.exe 6136 firefox.exe 6136 firefox.exe 6136 firefox.exe 6136 firefox.exe 6136 firefox.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe 4368 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 6136 firefox.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 5476 wrote to memory of 4992 5476 UniversalTool_41354.exe 82 PID 1120 wrote to memory of 6136 1120 firefox.exe 94 PID 1120 wrote to memory of 6136 1120 firefox.exe 94 PID 6136 wrote to memory of 5588 6136 firefox.exe 95 PID 6136 wrote to memory of 5588 6136 firefox.exe 95 PID 6136 wrote to memory of 5588 6136 firefox.exe 95 PID 6136 wrote to memory of 4400 6136 firefox.exe 96 PID 6136 wrote to memory of 4400 6136 firefox.exe 96 PID 6136 wrote to memory of 4400 6136 firefox.exe 96 PID 6136 wrote to memory of 4400 6136 firefox.exe 96 PID 6136 wrote to memory of 3400 6136 firefox.exe 97 PID 6136 wrote to memory of 3400 6136 firefox.exe 97 PID 6136 wrote to memory of 3400 6136 firefox.exe 97 PID 6136 wrote to memory of 3400 6136 firefox.exe 97 PID 6136 wrote to memory of 1852 6136 firefox.exe 98 PID 6136 wrote to memory of 1852 6136 firefox.exe 98 PID 6136 wrote to memory of 1852 6136 firefox.exe 98 PID 6136 wrote to memory of 2108 6136 firefox.exe 99 PID 6136 wrote to memory of 2108 6136 firefox.exe 99 PID 6136 wrote to memory of 2108 6136 firefox.exe 99 PID 6136 wrote to memory of 2108 6136 firefox.exe 99 PID 6136 wrote to memory of 1512 6136 firefox.exe 100 PID 6136 wrote to memory of 1512 6136 firefox.exe 100 PID 6136 wrote to memory of 1512 6136 firefox.exe 100 PID 6136 wrote to memory of 1512 6136 firefox.exe 100 PID 6136 wrote to memory of 1084 6136 firefox.exe 101 PID 6136 wrote to memory of 1084 6136 firefox.exe 101 PID 6136 wrote to memory of 1084 6136 firefox.exe 101 PID 6136 wrote to memory of 1084 6136 firefox.exe 101 PID 6136 wrote to memory of 5036 6136 firefox.exe 102 PID 6136 wrote to memory of 5036 6136 firefox.exe 102 PID 6136 wrote to memory of 5036 6136 firefox.exe 102 PID 6136 wrote to memory of 5036 6136 firefox.exe 102 PID 6136 wrote to memory of 5872 6136 firefox.exe 103 PID 6136 wrote to memory of 5872 6136 firefox.exe 103 PID 6136 wrote to memory of 5872 6136 firefox.exe 103 PID 6136 wrote to memory of 5872 6136 firefox.exe 103 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\UniversalTool_41354.exe"C:\Users\Admin\AppData\Local\Temp\UniversalTool_41354.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\UniversalTool_41354.exe"C:\Users\Admin\AppData\Local\Temp\UniversalTool_41354.exe" /yqcyzq2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4992
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27100 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {99062cce-6486-4970-9757-b7e6865e6ff5} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:5588
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27136 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {8ab594f3-c1ab-41b6-a962-4288bf849ede} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
PID:4400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 27326 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {1b0bf3d2-ba65-4434-a90e-d2c929dba73b} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:3400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3960 -prefsLen 27326 -prefMapHandle 3964 -prefMapSize 270279 -ipcHandle 4060 -initialChannelId {5dfb1258-f758-4a2d-a78e-586309069323} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:1852
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4396 -prefsLen 34825 -prefMapHandle 4400 -prefMapSize 270279 -jsInitHandle 4384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4412 -initialChannelId {2f1b9d75-048c-4ee8-a2a1-1c4e7e5b2ac8} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:2108
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4988 -prefsLen 35013 -prefMapHandle 4536 -prefMapSize 270279 -ipcHandle 1644 -initialChannelId {74163d57-23ad-4589-b37a-dfdc70c1c860} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:1512
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5024 -prefsLen 32900 -prefMapHandle 3176 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {fccc6166-cba8-4289-8dff-4781d64582b2} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:1084
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32900 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5188 -initialChannelId {d8b0b359-8ea3-4e85-a439-6080b2ad29b6} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:5036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 32952 -prefMapHandle 5520 -prefMapSize 270279 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3184 -initialChannelId {bfbfe5cc-1927-47ed-b74c-13ff91b617ac} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:5872
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5128
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4368
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 46ce769ce4eabe5ace4455ba6e155d10549c9b56b0d99673cd268f0182b88f69
- MD5 de0bf5429d750fa3db9e54e40ca5c56d
- SHA1 899cf0a68e5042ef2128aacb08f1462fdb40e1df
- SHA512 71841282b642a946b028610498d48d38c1a6e75ad9d807498c8b39522c7112c55cb8dc88c5ee32cc4d6e026ccbdc224dc6db234f9a5c52a0c18701b1d83869d4
- SSDEEP 192:T1d66Joz1zgCl6mc0dqUvOv5zboBbmQCIyjfBhv:xd66Joz1zgC1jAUAboBbm/Iyjff
- TLSH T1A9D11E64E628463FC448123BDDA21F410F3A385BDC4E7F19329C654C2D5A2DE3A8E07D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 1d0a5754e0139f88e0ae166c56fa6880d78870d015c7651c33f949cef0a2d164
- MD5 70b63dcfd106caecad9b20fb266bddce
- SHA1 8cb3ed55b7d6823997e4303d275cafe162ce2c79
- SHA512 7abab12e6b0657d0cbe892469bc3c91e5e9f228c13b9a9ad784ae3a767a1fc9b86e34dd95c6c443d71159a305d8dc6ecd110a4a4e797a11e41879f6d7f1fca7c
- SSDEEP 192:61d66Joz1zgCl6mc0dCUvOv5zboAcZmQCIyjfBhv:kd66Joz1zgC1jMUAbodZm/Iyjff
- TLSH T1DEE11F64E628463FC408127BDDA21F850F3A388ADC4E7F19729C645C2D5A2DE3A8E17D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 aca08246e216d47e0584af8dc8d297deae18439490cd7b3995bae980775f84ab
- MD5 b3cb7f2acd8c4d570e43563bc2f9f957
- SHA1 b4dc07fb45b433bdb4764ebd15c2abcd3a60c752
- SHA512 61d78ab8a5054b0709fd217578a343d969cf19ad4b9f44a7ea5984dafd41697262b85488fedb7980a31d8a14e542a0599e75684ac382fc7918efac1bf3680ea2
- SSDEEP 192:3UvOv5zboAqmQCIyjfBS21/66Joz1zgCl6mc0dz:3UAboxm/Iyjf7/66Joz1zgC1jd
- TLSH T14BE11064E628863BC418127BDCA25B850F3A388BDC4E7F19729C644C2D472DE3A9E17D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 0d23c963f6e291ad0478eba7dbbd0f99eaf9d48d36e81468a7affc9c9368d953
- MD5 8cc7af6235eb5f7f7cf6ef32a9a76e18
- SHA1 fca25b7cd4f4ec6d88a5d6b21d452f00208b5294
- SHA512 1436eabc94e69d212a9499d081c4723aea39715bfa0aa160ad2a2466d30bf6839e185c59ed00deeba7aff9ceed5036a23ccaec46797b3b5ae91673bdbac4d787
- TLSH T1DC219D6C39B94E6AACD7E26C7441038D63158A4F058B1D530E12DE8CCDD5EDA716E83A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\36c1d71b-c6bb-4a56-95a0-074482d50cbe
- Size 235B
- SHA256 96cee862ef2a5abe0fbdad65f219205296cd1728d9429768df25a4e662c56278
- MD5 90386c4c5162cd59d565c61c2adec929
- SHA1 9d43629b6acee070a7603ba747a564045e0a88ad
- SHA512 b245b3948639e5056a99c0b623f16edc60756804098207061c317d34afc02c850b4ae92e2441a88e42ea3803208823abf67b6aff99917d912bc8cb577d8b645c
- TLSH T15BD0A7895498A76D08142F57F0E069D670854C336575B850AA9245789AB9FC852B281B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\4f3f8202-cb71-4fef-90a5-79d714ffbad3
- Size 886B
- SHA256 b2bbbd93f3aea785dfcc0cd13c71a458100dc03af9fd0cef93456f09df396781
- MD5 835ceec23c64b8d0537ddad37d356f8e
- SHA1 6bb1c6b46ec7b3729c0c23885910fc26a852d9c1
- SHA512 0aa4b0a6dc10fe0df0b787d9e6cd1d1e546b046662c1162585a2179f3a3eab3ed5c274f268a8eae3024b5a89f072bc9173bdd062d56a6bcaed781b1548a19ee4
- TLSH T1191100808934BDF2CD68D29BD9A1B78647E5B027C0C74804BF904F1C0DAE61EA7A761B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\50102496-eefd-4012-a484-b5251c1d9123
- Size 235B
- SHA256 23178b74c6de87921accae95fce5d286910cd01cb794a5eeeb50f7187a71b290
- MD5 a61d6ddaadf5cb4d73ab7a29ba044620
- SHA1 b112ad029d944c717ee1dc9da1026cd68bd84258
- SHA512 140cbf4c64b53905dc51d4bea29133f3dd129e69c316e09818f5856bfcdf76f551ba009c416e91a0b2d208271dba8b086ba2aacfd58245b91e8ba28d605a0c25
- TLSH T12FD097922888679D89081F02B0A029C6308C4C332474BC10DA9146B4DDF8BC98332827
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\74debf29-3b90-4789-ad23-a78a30c33065
- Size 883B
- SHA256 7c861a1740f0f576c20d75fe8cac1a0bbad77512d1c3af6bb42e5f910cf77e27
- MD5 129a1cf6725b4074518d42ee794b5199
- SHA1 cd5d1cb1ad9173b53e7e6400a75d294e692d277d
- SHA512 14e4680099f19b19e5e2a08c2b28d5ef5dcbcc933364bd5401601ec161069caeea6aa83cfb8e08571ad300f2f16ae769128c64697ccadb81a73f0e92ed732ba8
- TLSH T156112380963579B2CD7C929FC9A67B4297E8B423C0C684147FA00E0C0D7A51EA3AB60B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\758a6a7d-4d5e-455c-84f1-ee0037ed94b1
- Size 2KB
- SHA256 6df31cbbb0c8ad50606881f5e85ee9b0f9b06947ef0e9c0a779913383f4d420b
- MD5 edfb1122059c1a9f22a19febcdcd9d36
- SHA1 332afcebfa06cf5d897beb446bc7364fd40dfafc
- SHA512 4e0b5b32c68a45308c24041350baeed4f70e0d01dd0ddb1171eda562a1d2979fc0bd14217a42d9e7a5ba36ffcec7c16fa1bb22364a5eccdd4d1c47abb4fd0211
- TLSH T1B841115C36789C7A8CDAF19D9482338F67E08A0744C66C433E51DF4C8D926D973AA42B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\fc12711c-ed07-4fbf-bd09-ba9b3157cec5
- Size 2KB
- SHA256 2bf31454a4ca718e5aefd6d4309ada06459382207cdd045d6c8dbcbe3da3ea12
- MD5 fbaaaa5b6478086c9af74e21ebbbe511
- SHA1 462aa9536600436ca37e737fd1c799dadf0299a0
- SHA512 43a8950d252bd82ad6cadbd24c70a8506ca8e158b5448c95638194d8077e9bfa99e6e7bde8c147f533a2c601a28b215d43db97e4913f38ee808e7f04fadf1268
- TLSH T1215185655160CCBEC97DA31ADC217B828BF3140B408B184EAEE8AF0E257F94E9399605
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs-1.js
- Size 6KB
- SHA256 dcc77e35cfb4f1eaddb7a6fa69faf40e735854b5be9cc7a2f697b2b24fd025d7
- MD5 db2b8ff416750c0eff4e2942de53a6af
- SHA1 1a6d59a11285f56ae72243eb750996aae5754196
- SHA512 0ec83ac5671ae72c600bdb633747e0bd4e728aa70ff9362245bdb2b22e2a99550e8568cba13674133c816d39aafc3ad522211ec25d3e0ce52dccd92839cf8843
- SSDEEP 96:xHLUTUSVqGq5fxJK1zSQSSladv9jynAHVLBw88P8L4cnFs7GP:t9R5fxJKJSSsFBw88BqP
- TLSH T167E11E7894088B7F68B677BC6C6888316AB2413BB7BF68D710B544C4055CF3441FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH