275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f

max time kernel
163s
max time network
144s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-de
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-delocale:de-deos:windows10-ltsc_2021-x64systemwindows
submitted
23/03/2025, 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EICAR.txt
Size

68B
MD5

44d88612fea8a8f36de82e1278abb02f
SHA1

3395856ce81f2b7382dee72602f798b642f14140
SHA256

275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f
SHA512

cc805d5fab1fd71a4ab352a9c533e65fb2d5b885518f4e565e68847223b8e6b85cb48f3afad842726d99239c9e36505c64b0dc9a061d9e507d833277ada336ab

Score

8^/10

defense_evasion

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
203	3156	firefox.exe

Executes dropped EXE 1 IoCs

pid	Process
6032	TaskILL.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
202	raw.githubusercontent.com
203	raw.githubusercontent.com
204	raw.githubusercontent.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\TaskILL.exe:Zone.Identifier	firefox.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\TaskILL.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4288	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe
6032	TaskILL.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	firefox.exe
Token: SeDebugPrivilege	3156	firefox.exe
Token: SeDebugPrivilege	6032	TaskILL.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
6032	TaskILL.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3156	636	firefox.exe	88
PID 636 wrote to memory of 3156	636	firefox.exe	88
PID 636 wrote to memory of 3156	636	firefox.exe	88
PID 636 wrote to memory of 3156	636	firefox.exe	88
PID 636 wrote to memory of 3156	636	firefox.exe	88
PID 636 wrote to memory of 3156	636	firefox.exe	88
PID 636 wrote to memory of 3156	636	firefox.exe	88
PID 636 wrote to memory of 3156	636	firefox.exe	88
PID 636 wrote to memory of 3156	636	firefox.exe	88
PID 636 wrote to memory of 3156	636	firefox.exe	88
PID 636 wrote to memory of 3156	636	firefox.exe	88
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4728	3156	firefox.exe	89
PID 3156 wrote to memory of 4748	3156	firefox.exe	90
PID 3156 wrote to memory of 4748	3156	firefox.exe	90
PID 3156 wrote to memory of 4748	3156	firefox.exe	90
PID 3156 wrote to memory of 4748	3156	firefox.exe	90
PID 3156 wrote to memory of 4748	3156	firefox.exe	90
PID 3156 wrote to memory of 4748	3156	firefox.exe	90
PID 3156 wrote to memory of 4748	3156	firefox.exe	90
PID 3156 wrote to memory of 4748	3156	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\EICAR.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4288

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27100 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {06778084-27bb-4540-a053-2f43c50d2097} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27136 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {c2c27384-ef8f-4cec-935a-086f4682969e} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3956 -prefsLen 27277 -prefMapHandle 3960 -prefMapSize 270279 -jsInitHandle 3964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3972 -initialChannelId {80968f5d-b471-4e01-9098-b59949512e6a} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4144 -prefsLen 27277 -prefMapHandle 4148 -prefMapSize 270279 -ipcHandle 4240 -initialChannelId {b323942e-e509-4f2c-8c8d-47d7fdfc9b31} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2832 -prefsLen 34776 -prefMapHandle 4592 -prefMapSize 270279 -jsInitHandle 4596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2804 -initialChannelId {36f865fb-df3d-4398-b7f0-c2e5e6ad4814} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5208 -prefsLen 35092 -prefMapHandle 5212 -prefMapSize 270279 -ipcHandle 5220 -initialChannelId {661f59be-4dc0-49c5-b51b-bb596bf7b9a6} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3324 -prefsLen 33031 -prefMapHandle 3328 -prefMapSize 270279 -jsInitHandle 3052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5756 -initialChannelId {ad916896-252f-43aa-b017-79063b9047c8} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5888 -prefsLen 33031 -prefMapHandle 5892 -prefMapSize 270279 -jsInitHandle 5896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5904 -initialChannelId {188ea653-9e9b-4fe0-b84e-c5e75b24960b} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6100 -prefsLen 33031 -prefMapHandle 6104 -prefMapSize 270279 -jsInitHandle 6108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6112 -initialChannelId {b49c5c81-d1dd-4ea9-9835-f23fb198cd86} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6088 -prefsLen 33071 -prefMapHandle 6392 -prefMapSize 270279 -jsInitHandle 6488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5812 -initialChannelId {c4873574-1e39-4968-b80f-f74f5521fb4d} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1152 -prefsLen 33071 -prefMapHandle 2748 -prefMapSize 270279 -jsInitHandle 2752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5912 -initialChannelId {7c2d1090-28a1-4431-acb6-be0c75c9c995} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:864
- - C:\Users\Admin\Downloads\TaskILL.exe
    "C:\Users\Admin\Downloads\TaskILL.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:6032
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol c:\ /d
      4⤵
      PID:4248

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ptqf56iz.default-release\activity-stream.discovery_stream.json.tmp

Filesize
19KB

MD5
3dc90ea0a7a151be045fb43901a88c6d

SHA1
17a8ff398d24bf1e3381cf24aa74ad21b4900cc9

SHA256
6757f7bea7073ecd54230abadf55a17fd024d1606c77f9782094b41aa4e96001

SHA512
e05f1387a550e2afae077f911a1e9fd514956167f9b2d5a60bc0d5d3131f43e96c43bcb4babb24ee35264b0b247e5c84cdb634fb74a86b250228625c79fb2fc3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ptqf56iz.default-release\cache2\entries\5ACB46A5A72DCA2C675A19F9DCC5C68E4EEE16B7

Filesize
34KB

MD5
9ba53961f79357a484721ada6a3e78f5

SHA1
5103fb14df55b2d85ff703371206cdccce2064c4

SHA256
0db41b981b976108905922aef52f08aed8006e90218fece6253a7a06acac2df6

SHA512
f75907c0be3adef6c9c526a840ef1d6f4dc790722559f0bf2429eae9d2b5aae518f556ee474342b54d874f90fe397484d2ee78e586720327ed55022f79544931

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ptqf56iz.default-release\cache2\entries\8D11864F69B6D9276086D87F1C72386DC26A1DF7

Filesize
47KB

MD5
f643732860f5642b12f38fbf579fb7cb

SHA1
1381f4836cdd83156b59a04fd800a014613a6e66

SHA256
f527f7521663eca4b20f8029d5e3d642a6be4af7b3f6bb39f1bfdec3c58a61bd

SHA512
7e3bf5cb55c70691650726c5c6b8f0f8dc32fb55b3daccabf66fff0ff4a64ff61e4fea1bed87377ef6bba5d69f722b222cb504443632b9814a39fd7bb0af5678

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ptqf56iz.default-release\cache2\entries\956C138E7E189A8F1B675B499ED2D87604EE6E73

Filesize
47KB

MD5
70e9dcbf17e3e0a7c2505190fce5de66

SHA1
e82dc1c693b15edffbae3d4fccf7cb467d4338f5

SHA256
54c7011d46185ead5e7b4a51f42f4190a48d5f39bd843ddd030686d248b29a2d

SHA512
bb0c331593a341c73ea03046edab8cbf0103fe5b16258cd7d8ce4b80f6e4aacb680ae1da7435b0ebcce9de0d3dfd17a10c612c087adfd87d9488f263f022fff2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ptqf56iz.default-release\cache2\entries\97AFFA25C9ED84269BA5F8059413E057B9831B3A

Filesize
41KB

MD5
385a09164f92d79061c14d90b793801e

SHA1
71e4f26596dece957af0ede33d7c789511268ed9

SHA256
9604923a1ce3210e3664e353be953760de4b96eab073704308d68f1e90345940

SHA512
84cbbee0a4958d6d3af813c6d1ba1b30b9ad1553f4ef864f6b62e5541a93f9efaed7f0192c69722114af272be0baad13f7aaa99065f7088db6d65550099031ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ptqf56iz.default-release\cache2\entries\E19316B1CDA62317F9DA2551F9B56E711FCC77AD

Filesize
13KB

MD5
c30ae08e072145fff5c306404eefea57

SHA1
aeff590a453e58b6891ccec5888e11d4b5d646a8

SHA256
8ebb4de266fba146b06b262233af8d0ac1cb92dd13c9d12dfc493503c4454317

SHA512
50d189a6d7310f66151d70f59f1d5e68312a8600a7e6b6596335acdec72d0689977cf8cff1b95304225678c750928388dc5db2786347332b5b93aeba9d142993

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\AlternateServices.bin

Filesize
6KB

MD5
6df724f0d8a0a64581ba267b75225eba

SHA1
61380068eb06afa200271818c040687af7ebe88f

SHA256
05f5616909f9e045f33ee2f835c93288a98ad4185a3fdbd69f636ec33342e95b

SHA512
d6b268335e411fbe66cf39319d41de89e556b685313284e7f7a29e7d92ac51a77474cc6aa48a55cf3033b7e2d1d81e2fe55def4f84ab5ab1fe3c5d2b9b834cbb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\datareporting\glean\db\data.safe.tmp

Filesize
3KB

MD5
39e1e46ff19859d36ff5206eec4873a5

SHA1
06a235ed5ff8e08514c5d1e83a045af2b0aefb63

SHA256
39cf5f8a1382d1243838418f1d85d9f4166ddd652cfcac49f634cad8b7bdeee5

SHA512
3b55f79994b9d6cbcdd0d87e3c83536d2742876b78d5f069929863064acb3295f4845f494209c2a1a9157697809d18c2eb2992a03d5dd4bebeca151db4d6667f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
709a242a77d44d418f73c72f4a8c18ac

SHA1
f770367bc24bcf208d942dc637530ef18f8cdbb0

SHA256
8a0674eeb980aea11614f5973e3b38e99385b3955c677b63ccef899817aa9f3b

SHA512
3b57661ea158dfa356a236e480a77a65264814c3f020f4f0f2ab2d980c5fdb9920680042cdb682e4cf1ad66943b44315e6afd4674c2971dc88fdcdaae28851eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
e81f00bbbe5c23073ebaa54b9fa93c68

SHA1
1cf3f8a1609a1805b3af2442c831abaaaadb728c

SHA256
392a3d79b0646a9a5d403fe1e9298ad20f3c4e377954a810798910e356fef835

SHA512
d5053b7603be46ca1e1586839a199a610ca67971be9026a38765d228a8adc7b953d2223d2f016aadad98a90c9008f700be02499b299c00dc91ff30824fa1a995

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\datareporting\glean\events\events

Filesize
4KB

MD5
337f43545554402ec7adadd08ecb6ce3

SHA1
4ae0b38405d8a0a6c9a82d0fa39cb16032043ed1

SHA256
55ee0b5f8ddb6fce79bb3d58f6be6d55508c4b2634282c31139fbb01d2f08911

SHA512
a14140e87f34b03823243ac7dbadd76469ad0b390044653614118aa458190099c955c1e851c68b2fe4748342a5e2e80783ed0e524eff40d38bc1b0546b75b1c0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\datareporting\glean\pending_pings\6b02b93d-7597-45e5-8a61-2b58d55d4557

Filesize
2KB

MD5
04f55f1c286689afa56ac8bde5d39235

SHA1
a7bad51b896f0b7e30b5a56a808669279128158b

SHA256
34d0eb62e36deb833bdc2555e2f83671ab1565492a0f1039e6a9c5224605bf10

SHA512
1ef3f1d5b623fa098734851d37a0beec03d54c5f933f500367a294163c1b3ec8ad668f784b8348eb988a12a4c955b805db43428283d51a09583520a764fed805

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\datareporting\glean\pending_pings\8b74cf06-143c-4940-a60a-0f7ecd0d59f5

Filesize
235B

MD5
8ff2532e5b7ef11dd0a63daea719887c

SHA1
a6d20467a6085adbb6091765b8089e4d8ca27e3a

SHA256
874956c36db7aee9473432d34c67333fec57d04ee20e07fbb95828647ea7c16e

SHA512
e8269d95d9fd2468cf70573d8984052aa65f411637dc16b35c741c37425c4fb31d08d82fcf69ab129228dc1515cf9e6f296ee26de34f3dd5388866c74a066569

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\datareporting\glean\pending_pings\8c106a7e-9194-4a1f-aca5-baebbda6af6a

Filesize
17KB

MD5
8ecab377c9c9bab5596cd93b39c5c187

SHA1
a130393d6a025e6369ce47949d681dacad35f7c8

SHA256
0b7dd7a091b3e2f77d0b0a810780d164d3e8c5eddfcf3e4ac9b880760f85c353

SHA512
fd1dda9500ee7006b617e4066fe3082581a63f89241b3e399021ed929badbe396070feef858690eac5564486cdcbf2708f09c19734015b781cb8c1b0b608935a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\datareporting\glean\pending_pings\cbf954eb-9979-42af-82b0-d310156aeb67

Filesize
235B

MD5
be88bb01af0010c7a1b7c61b2c77cf39

SHA1
4ce0f1bebfe83eb024679a8e34e6ebd24efefc52

SHA256
28678e75ad9e45d21e875c6e64efc9efed63b228833f35ccb10d8be4c41767b9

SHA512
dd00634cad84c13dafdaf65bd2d9ba0f4b1951b2bea4d6fc61c323a9e39df2be1f08c7524903f8dfe09b02dd9e63e366f25a528ead5aa601f0780715b326145f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\datareporting\glean\pending_pings\f09e6e33-7da8-44bb-8c7b-8869d9943814

Filesize
883B

MD5
5eda8f4089059baeb899bba1ed88569d

SHA1
98d9d716b96f8d68f5660749aeb85df250756afb

SHA256
23fdeddb23dda7d7a6615c5ea91b216fe2ce5f7a5604f09d4f428abeec7a180a

SHA512
3af77c5e6600491ed0ea40adff3358b18c5f958d12f1d8ea05c111c7af5b9102e5ae9574610e09f61b2f09ab1831ee8e1c4cc4d6f047cdce0cbbf6b2e72796cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\datareporting\glean\pending_pings\f3a41836-e5da-4c6f-bb44-3332251cceea

Filesize
886B

MD5
2a7c975201eadb07e6ea01023c80b73b

SHA1
2be64a38016771a7bf4bfbe71f2d99abe2cf085a

SHA256
9977833623f5ab402cd137ecbeb8a39adb3fd17bf2d3c4ff53e4544361ab5509

SHA512
f7601fddbced56dfa5b9347e78b0e58310f89189b27e428ebb4d20870945328f04bbc9c1ee95adf3ada253eda154e0d816ff5d31b0ca1fe58c5022f1e2b38a47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\prefs-1.js

Filesize
8KB

MD5
881ef0c2b64b02046cb8c5e4dbb8b1af

SHA1
c03a464e617a7e05b80d962116db22fee3024131

SHA256
dac0469da9b414f8daae6bb28b30e05e179383192eee11e54dc7deff917e855d

SHA512
c2e61fd801b1388c7876916f4d4f1cc7d35779e442b7f1a9667aa3e148b255427fe8aefa982aee899dedd5a9e1dc0a990013c50f5e9e62ddd9987eb24577db57

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\prefs.js

Filesize
6KB

MD5
e3c0b54ab8536b720df90806a4793041

SHA1
ea24b7c8d67ea1d60f5c1f88d3da275088341a1b

SHA256
9cab62359ab98ddd585204511726f60cffb9b2fa8d547e57df8c144f98c45800

SHA512
7eb8e1449074d3d5a62ab6cb40d595849de32339b6c0e5588345853ecb4f5fab18854268e38f04cbf74c68953163422c069cb98287213f88853d072ec1376eb5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\prefs.js

Filesize
6KB

MD5
cc63b01f1c14dae3995bd82fde9b7a1e

SHA1
c1845c42e194ff338a0f9183b4ab834651a3c670

SHA256
3baf6d17ef55df12c1de925d2744c6ef6149a4250e08eb1ea663368bf11a7e40

SHA512
072d8963eeeb0ccbd0c4588e2ac1a4a404d230764c0ebfe00cc6b9cf395b43b866b15c05a1527c3ec3b581231c327484a9cf63e21d1aef3e1386b92f9df7f08f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\prefs.js

Filesize
7KB

MD5
0d3ac7024395191593317ae11d781cbe

SHA1
3f456fd4e5bc251fd3a37aa22c0e9c9054741f6f

SHA256
fb7e2c1e479a5d265fcf9ef39a402bfc9d8079393181b8bdc8f95d1cf268792b

SHA512
361ed577551969a3400b8837aea84d7471d8cd9855ebe7455aa189f0f0cc914166a029b3165a91875740e7e1618249d1ccb7a5674dab2497a27b6a09b6ba3348

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\prefs.js

Filesize
6KB

MD5
21e0dd21b0713a2049049f4bcda4fd70

SHA1
268a9820b75f32fb803f0ef69259aafd40c98743

SHA256
03e3bc946c936ab90763bfe2576651d6fa2523032a0135bbe028a291c5aa477a

SHA512
e3cf93e1148c5bd3ca953e6082be2d94ab449bac467a35e7ef6bf1e795b3bb56b6808e43c535ef912a947aaac472d26dab1af3a48f8c979b887edd74bf563cb7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
ec19ca258916e01dcd962777d1406945

SHA1
7679165cc951e233c2e179a67b3f0398bc460923

SHA256
2ac5ecefcb63c62b52085f2f00f1d8de85efdd0604bc8dbda833c5f2a4aa527e

SHA512
dfa652534f69e75522c4b1107eb96a229ae2fdff3e0436790728d65c2ad21e4b78193203e978729f061166ed03f8f1fe040fedb28421eaa2a297d096c76e34ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ptqf56iz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.8MB

MD5
9325d237ec69c705a9b681e0785e753e

SHA1
0a172e73c99f83b3751de710732b98adff65ae12

SHA256
971f630b6cd4832d360e4788d07530abb895d4b32b83d82ada5c92eeb1beaf95

SHA512
a9f2de67c63ff56afa3dbf8a7585f443337a7b4dca18595c0961da9496c27a608117e853085f219365fb9eb027159057e18a68e8e9359959ec07926ba43c9fbf

Download Submit
C:\Users\Admin\Downloads\TaskILL.fPnOiM51.exe.part

Filesize
31KB

MD5
c261c6e3332d0d515c910bbf3b93aab3

SHA1
ff730b6b2726240df4b2f0db96c424c464c65c17

SHA256
4663715548c70eec7e9cbf272171493d47a75d2652e38cca870412ea9e749fe9

SHA512
a93bd7b1d809493917e0999d4030cb53ab7789c65f6b87e1bbac27bd8b3ad2aeb92dec0a69369c04541f5572a78f04d8dfba900624cf5bd82d7558f24d0a8e26

Download Submit
memory/6032-1012-0x00007FFAC5B93000-0x00007FFAC5B95000-memory.dmp

Filesize
8KB

Download
memory/6032-1013-0x0000000000E80000-0x0000000000E8E000-memory.dmp

Filesize
56KB

Download
memory/6032-1014-0x00007FFAC5B90000-0x00007FFAC6652000-memory.dmp

Filesize
10.8MB

Download
memory/6032-1018-0x00007FFAC5B93000-0x00007FFAC5B95000-memory.dmp

Filesize
8KB

Download
memory/6032-1019-0x00007FFAC5B90000-0x00007FFAC6652000-memory.dmp

Filesize
10.8MB

Download