25f9676582ccf0fe537d0578f8b74a79b1bd35e77230d569515fab286d1eb535

Resubmissions

18/04/2026, 04:40

260418-faqvxsgx718

18/04/2026, 04:36

260418-e8epwagx3z6

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AndroidSideloader.exe
Size 1.2MB
Sample260418-e8epwagx3z
SHA256 25f9676582ccf0fe537d0578f8b74a79b1bd35e77230d569515fab286d1eb535
MD5 6decf1931e93a52d7f97ab33ad04a21b
SHA1 da1e93135cee8b7059252403bc1e7aaed3333660
SHA512 5f9a52cfe4e038702b522583d302a7e2b8c576ee93f853d1a8358d6e8950a91b7bf7f63db9b362454daa9c3dce4c311ae896d525e4ee7833c4bd6498244a001f
SSDEEP 12288:ufL9RNaQELDUZ7R53a0cDJ76U1Dq5kqjVnl36ud0zR/6CtQ9PUHIG8DVJqTgzo/z:Ol+evtcDJ7bdukqjVnlqud+/2P+A0X3
TLSH
T1A345AE4433F48A16E5FF5BF0683398904BF5B843A9BDDB8E4C85A0EE15D2B449D62363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AndroidSideloader.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4616	AndroidSideloader.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	AndroidSideloader.exe
Token: SeDebugPrivilege	3364	firefox.exe
Token: SeDebugPrivilege	3364	firefox.exe
Token: SeDebugPrivilege	3364	firefox.exe
Token: SeDebugPrivilege	3364	firefox.exe
Token: SeDebugPrivilege	3364	firefox.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 3364	872	firefox.exe	87
PID 872 wrote to memory of 3364	872	firefox.exe	87
PID 3364 wrote to memory of 4120	3364	firefox.exe	88
PID 3364 wrote to memory of 4120	3364	firefox.exe	88
PID 3364 wrote to memory of 4120	3364	firefox.exe	88
PID 3364 wrote to memory of 400	3364	firefox.exe	89
PID 3364 wrote to memory of 400	3364	firefox.exe	89
PID 3364 wrote to memory of 400	3364	firefox.exe	89
PID 3364 wrote to memory of 400	3364	firefox.exe	89
PID 3364 wrote to memory of 4296	3364	firefox.exe	90
PID 3364 wrote to memory of 4296	3364	firefox.exe	90
PID 3364 wrote to memory of 4296	3364	firefox.exe	90
PID 3364 wrote to memory of 4296	3364	firefox.exe	90
PID 3364 wrote to memory of 3048	3364	firefox.exe	91
PID 3364 wrote to memory of 3048	3364	firefox.exe	91
PID 3364 wrote to memory of 3048	3364	firefox.exe	91
PID 3364 wrote to memory of 2004	3364	firefox.exe	92
PID 3364 wrote to memory of 2004	3364	firefox.exe	92
PID 3364 wrote to memory of 2004	3364	firefox.exe	92
PID 3364 wrote to memory of 2004	3364	firefox.exe	92
PID 3364 wrote to memory of 4860	3364	firefox.exe	93
PID 3364 wrote to memory of 4860	3364	firefox.exe	93
PID 3364 wrote to memory of 4860	3364	firefox.exe	93
PID 3364 wrote to memory of 4860	3364	firefox.exe	93
PID 3364 wrote to memory of 5016	3364	firefox.exe	94
PID 3364 wrote to memory of 5016	3364	firefox.exe	94
PID 3364 wrote to memory of 5016	3364	firefox.exe	94
PID 3364 wrote to memory of 5016	3364	firefox.exe	94
PID 3364 wrote to memory of 1560	3364	firefox.exe	95
PID 3364 wrote to memory of 1560	3364	firefox.exe	95
PID 3364 wrote to memory of 1560	3364	firefox.exe	95
PID 3364 wrote to memory of 1560	3364	firefox.exe	95
PID 3364 wrote to memory of 4156	3364	firefox.exe	96
PID 3364 wrote to memory of 4156	3364	firefox.exe	96
PID 3364 wrote to memory of 4156	3364	firefox.exe	96
PID 3364 wrote to memory of 4156	3364	firefox.exe	96
PID 3364 wrote to memory of 2524	3364	firefox.exe	105
PID 3364 wrote to memory of 2524	3364	firefox.exe	105
PID 3364 wrote to memory of 2524	3364	firefox.exe	105
PID 3364 wrote to memory of 2524	3364	firefox.exe	105
PID 3364 wrote to memory of 4780	3364	firefox.exe	106
PID 3364 wrote to memory of 4780	3364	firefox.exe	106
PID 3364 wrote to memory of 4780	3364	firefox.exe	106
PID 3364 wrote to memory of 4780	3364	firefox.exe	106
PID 3364 wrote to memory of 3824	3364	firefox.exe	107
PID 3364 wrote to memory of 3824	3364	firefox.exe	107
PID 3364 wrote to memory of 3824	3364	firefox.exe	107
PID 3364 wrote to memory of 3824	3364	firefox.exe	107
PID 3364 wrote to memory of 5832	3364	firefox.exe	108
PID 3364 wrote to memory of 5832	3364	firefox.exe	108
PID 3364 wrote to memory of 5832	3364	firefox.exe	108
PID 3364 wrote to memory of 5832	3364	firefox.exe	108
PID 3364 wrote to memory of 5264	3364	firefox.exe	109
PID 3364 wrote to memory of 5264	3364	firefox.exe	109
PID 3364 wrote to memory of 5264	3364	firefox.exe	109
PID 3364 wrote to memory of 5956	3364	firefox.exe	110
PID 3364 wrote to memory of 5956	3364	firefox.exe	110
PID 3364 wrote to memory of 5956	3364	firefox.exe	110
PID 3364 wrote to memory of 5956	3364	firefox.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AndroidSideloader.exe
"C:\Users\Admin\AppData\Local\Temp\AndroidSideloader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {343f33b5-8eb1-49c8-a0a3-abe02931ac80} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {f3a82f9d-9e45-4a2d-916c-145e5b5c0906} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3756 -prefsLen 27276 -prefMapHandle 3760 -prefMapSize 270279 -jsInitHandle 3764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3772 -initialChannelId {4b073ca3-a6b7-4a74-9ce0-25b0b515ae87} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3920 -prefsLen 27276 -prefMapHandle 3924 -prefMapSize 270279 -ipcHandle 4028 -initialChannelId {1bacbfd4-7f2b-49c8-b2ea-825b51a37968} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2744 -prefsLen 34775 -prefMapHandle 4340 -prefMapSize 270279 -jsInitHandle 4344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4352 -initialChannelId {1d376db2-dd04-4da2-8897-97c26e2be33e} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3424 -prefsLen 35012 -prefMapHandle 864 -prefMapSize 270279 -ipcHandle 2612 -initialChannelId {9f9ff149-448f-420c-a95b-cd967364a180} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5340 -prefsLen 32952 -prefMapHandle 5408 -prefMapSize 270279 -jsInitHandle 5412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3296 -initialChannelId {6fa87d4c-1d4b-415a-8ba2-caf281b5e7ce} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 32952 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5360 -initialChannelId {4255bf02-41c4-40f0-adac-a0118ae134c9} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2892 -prefsLen 32952 -prefMapHandle 2896 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5748 -initialChannelId {833992b7-90a9-4453-8bc9-a5a202ea7368} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6296 -prefsLen 33031 -prefMapHandle 6292 -prefMapSize 270279 -jsInitHandle 6288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6280 -initialChannelId {23df2a19-d76d-4432-9836-71e3961f0b3b} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6672 -prefsLen 35160 -prefMapHandle 6676 -prefMapSize 270279 -ipcHandle 6684 -initialChannelId {ba51f684-fcba-4dad-9eba-ff536824201f} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:4780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6824 -prefsLen 33031 -prefMapHandle 6836 -prefMapSize 270279 -jsInitHandle 6840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6848 -initialChannelId {9167a1e9-4dfd-4010-963c-74c08d5fda64} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7148 -prefsLen 33741 -prefMapHandle 7144 -prefMapSize 270279 -jsInitHandle 7140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4816 -initialChannelId {7ac6f36a-a88d-4c56-8e92-6b246fdac722} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7148 -prefsLen 37088 -prefMapHandle 7476 -prefMapSize 270279 -ipcHandle 7484 -initialChannelId {7aa85a0b-c620-4b97-9393-0bfb84bf1fdb} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    PID:5264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5332 -prefsLen 36718 -prefMapHandle 7672 -prefMapSize 270279 -jsInitHandle 7656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7316 -initialChannelId {8025773c-e031-40c6-8240-f59b92e09339} -parentPid 3364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6104197E710E67C3A278065E3FA36D20D9DB50BD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\14tbp3gd.default-release\cache2\entries\6104197E710E67C3A278065E3FA36D20D9DB50BD
Size 106KB
SHA256 482a49011fe951e5f2b77eaabb94197b8158e0362598c8ab93a79cef4283b4b8
MD5 b741a978fe83421dd87cfc73674874f3
SHA1 f1e05efd85fba0e6aefcdfeefe91bae2f2d55cd8
SHA512 6c4279402aac68f83b3befe408f0963315925d22810668b23cddef477c1ac0e92bba58eb9e9398bb7e4af3b6a6de6fbf8f8263c3c34ea0519d6338aea26744ce
SSDEEP 3072:1if4EUnupQPpypvAzsO9D+RedgW5W3igzA:G4E8PpypvAYongC
TLSH
T185B3F1330F6C00590E6596D0D8BBB7DC28A4719AAAF9DCFA3535B6096E8FE8735035C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\14tbp3gd.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 8ada1629c1fa1e168709551174390b6aa4dc005cd10391681409540dff1a64e7
MD5 6d2044f3fe19afaff1fab18d07059e59
SHA1 5fe816e487e25e870b6c7832acfb9fabb08a7f96
SHA512 1b67a2039f172fd5118bbb2576c129fd2b5c738dfd50586398c044bc28a2b9aea72f52c276487ef72a6b58999cde71e1bebd9fcb9f537d318bf11efdee5deed5
SSDEEP 384:HbaFrLiO024YyWFuhw+5EL1pPsac4j0lpDII+ILf:7aAZYNFuK+5EB9sac4ID8Lq
TLSH
T12B527D7D9F0138BA1B2BE194D8AA5304CE04D6BBEEE2D05605143849C6807BDF4F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15440d2a-cd1a-4767-be54-2db3fb0b227c.zip

Path C:\Users\Admin\AppData\Local\Temp\15440d2a-cd1a-4767-be54-2db3fb0b227c.zip
Size 3.7MB
SHA256 4ef536eee4ee7d4cdd8b9b1e02b3e7e02ab0135bd8f3dbb2d6d0863bbc0776c6
MD5 5dd6349d9a32d4a7fc1cc2f4fa2378e7
SHA1 8f904c028538264430d13c1686873937e31edd7e
SHA512 68e2cbda16f2ca30d6fd2a16fa7994e45e89753ec000087fd83fd094c1aa568dfea5eaa38b6274219648bf717c55f6451d1421db42ae2d5ebf083d5a13dbf12d
SSDEEP 49152:zz74wVQbxlLuLqrGj+ds6YMLzq6L8LswjSyrhM8LnkTbLR6d6iyPc3kii72pdVX8:zz7FqEt6YMV8FtrhMsnk96IP/apdVkJ
TLSH
T13F06E035D69C1639C9CFC3BA850C2FC2984CCFA6805CAB6F6E6A9D7D5CB31E61B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\AlternateServices.bin
Size 22KB
SHA256 7f28701715e4128d611f3d7d94f3f3431f28984a87822bb7aa5b7343c6637936
MD5 8aac3d775d740965e2a04e69fc905a1d
SHA1 90f48850fd81c25fdb5a4e77bca43b2bff74f01f
SHA512 084e73e41f4f7c0571ddb799c0353069a59e50fb83b26aff6af5a00075c895231cf745bba36a17581b9e96fb738627c5616bb1c205ca118585bdfaef4a70bdc9
SSDEEP 96:d2W/AxDLU82F0rPNNVBVxVdk4Yf/Dq9dU80mk/UV9swTLlzjsEH3DxPz:7Ixnb2FDfbqzX0PsVO6L
TLSH
T128A2B3F707B66521FA2B1FB184683689DC73063D689885E4EB50E0D202DE6E5E07FF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\AlternateServices.bin
Size 23KB
SHA256 db0822cdcb7783adc02db586822e3a4dc8680140cc14c7543ce1cda1330d7db9
MD5 3c41f95d54ccfeef3e0ea30777f0bb6e
SHA1 b29e831f0efd63167155ff1e10a5810495fb509a
SHA512 52ec14ee53a724e895a6e3fdc930110263b3a3bd886c837de27272bb3b6b38963789b57b070001ec3a3ea960da61ad43f313229b33b7c11b2fc5f92b06148199
SSDEEP 96:SDl/AxKoU82FZPr/bXnVxVdk4Yf/Dq9dU80mk/UV9swTLlzjsEH3DxPz:YIxfb2FGfbqzX0PsVO6L
TLSH
T1B3B2B5F707B66521FA6A1FB190683689CC73063D68A885E4DB54E0D602DE3E5E07FF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\AlternateServices.bin
Size 10KB
SHA256 b0dd280d279db85d8422408df6283be5d09c38e1f0d2af4ddb67242225fee4e3
MD5 b316165f65384cdf181ad31c74d828c8
SHA1 aabf401283c9a478a726faca6cb96470e0f8e993
SHA512 1fe5ad061ea46de334f837f71bab05ac48b43b08887ebdfc675b44b8080ab760a21e2fb2edd8edabcd60a21f85ff779233b593a764523e8b875c92c7408f76db
SSDEEP 24:vuhMZ/GBwlcuwWuBw1WB7RuwL9BwFW2FwuwnujBwBluluXuw0Bwx9uwsBw1tuwqU:d2W/AB7DLU82F0rPNNVBqux
TLSH
T1652285F707B76521FB6B1EB044687289DCA30639699884E4E750E0D206CE6E5E07AB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 ef66fe1b2cc81076a707dcc93de3b433947a46c20e9b10677f6e29eb56cd7751
MD5 807c192365aeedf58b0fa88ccd34f4a1
SHA1 40b26377014cf314fb4f7bcb8bd50804f53a194f
SHA512 0239f94364e764788f688522cf7ea4e86266ab60c8646e49791fb8655ba6bc56ddf28bff6848889a544b0e5ded75200a1d2d5a8d526d9edf758cc1445813c180
TLSH
T19B61D958F6288A3FE445813ACC921F412F343442A8AF7F2A35AC618D1E5B2CE76CD03D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 e5547f58bf14205496823ca48f2f4b623d2a89536f405ba00b08df780e3208b8
MD5 5386d9d7e60342b7b0af64b64b428b00
SHA1 b7bc9e9ddb126f37ce5e2067719cf74254719012
SHA512 0cb69514d094d61a6e0361cf21f60d336e33d09c2b0f42509db0c363ddd99c4f9b5735776f5ea86fe2f5e0cf8d9d0b688db94d93c50c55a3139093b37ca235fc
SSDEEP 192:1Ov5zbowZ8Fyje6mjW1d66JozGzgCl6mc0dz:qbowZ8FyjXRd66JozGzgC1jd
TLSH
T158E13EA4EA28463FC405127BCCA12F404F39399BD88E3F2535AD619C2C5B2DE768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a63ad91b5f3137d0b2d608043f49e2f72df0297eec4cf93abfb13d6ec80a8263
MD5 45faed0300d48d30ffe6c9e57799e913
SHA1 44c25d830aaa75b3473a8f5653b554be6cce0594
SHA512 7cd0d64bc7312e169767d86399d59b8d464511ca9547ee254094920641c5249a0eb4e71cd1dc4d63acad26ba4ec6e0e2aec02b79042871a0ad86e8c530995b91
SSDEEP 192:1Ov5zbowZ8Fyje6mjW1d66JozGzgCl6mc0dR:qbowZ8FyjXRd66JozGzgC1jX
TLSH
T144E12EA4EA28463FC405127BCCA12F414F39399BD88E3F2535AD619C2C5B2DE768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5d0646a905a1f7228c6845f3315517c7d1714227dfd7983d8296c7b9009a3b5a
MD5 dff50ff5d07e350b42464fbabd0f1f31
SHA1 71a16f39b070fbab31a058d0a8f90b263adeeda0
SHA512 79dedb322002794d0527720a7cb112202f621c0a4f91c7454949cfbbc3118c60e76a48b4ebdc437a107836b6723ce04ee81e902eed3f413d55f5912f3d8a0368
TLSH
T18321489C3AB84E2AA897F69C745002CE53674A5F54871D430E43DF8CCD95EE9316A438
MD5 SHA1 SHA512 TLSH

Submit Download

1d983509-85a8-4475-b792-9047ec00c5a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\1d983509-85a8-4475-b792-9047ec00c5a9
Size 16KB
SHA256 62ba4f0b7783e321945f3a2a81c52efc7a0809a3b665b553e6dc2018a0aee6a9
MD5 48c9ce1d29b6d8ea5900e431ec8d9155
SHA1 7d8325c68b1299749aec0123c454c3882d410d05
SHA512 793b01b7488fe6c29fb590f4d58df86f341fbf62c7ca769e2dfc9eea36ebe12904c416c1af58b1732dca82d712bfbd0b9206810696caa14c9fbb80be6b1b771e
SSDEEP 192:qUmsuBel75uWdpluH/JjqKevlJGwcTkdfwJS97kSC2Gti1OSR7ieiSyZzm3KBvEV:DuBq4WdpUJSrySR7iLSyZmKdpHegC
TLSH
T19B72DA56586049BA8291E3A894F8BFC3E6F538CF4C428FC997E4BD086DDE05E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fd92494-96ff-418c-95cd-7cee54125d6b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\3fd92494-96ff-418c-95cd-7cee54125d6b
Size 883B
SHA256 d279a12779be458fac40c6c4a4d892b5122cc38b8886239f53dd88122dbaa1ae
MD5 cfc0f5d9e0f7dafd1dec9bd2820e4636
SHA1 00e20d0987be8ec6c34de687fb72d3cf9125c778
SHA512 e8fbeaf12c24a35d882627650c66417962c007d11c3bf09b4e2acadc4a11b628b542c93c83499e4ecba728a0a59fa7d9380d9fe3f80cd69166bcfcfdde3e9eac
TLSH
T1CA112391D63079B6CE68E29BC5917B0287F83523C0CB45147E714F180D6A52FD3AA64B
MD5 SHA1 SHA512 TLSH

Submit Download

773187d6-5313-4df7-bc96-ae2436c3baa9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\773187d6-5313-4df7-bc96-ae2436c3baa9
Size 235B
SHA256 314e7839cbe2532096516367a2180514650b556636e5cbc3ec28898827df74ee
MD5 77989506ea49887cb4c3c4d0b8e837cf
SHA1 5d1f87c6cd866694a88087198edf4b3e85d32e09
SHA512 6442792370a718b3577f8b67ab42294091a940b71f286043499c5c7fc9547b78b17175989d479bf7f6592c7837269a39a673afac12b2a7301c5a84d56bd0d99b
TLSH
T11AD097C02898B32C88240F07B0A068C630444C3324B8AC24D9624138C9BA9C81121D0B
MD5 SHA1 SHA512 TLSH

Submit Download

9c34cda3-1c39-47e5-b6d5-518ed0f0bdce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\9c34cda3-1c39-47e5-b6d5-518ed0f0bdce
Size 886B
SHA256 5d9922e04f62477cef306f54238a2b7839acfcb6a25c0b86686cb461776ddd7e
MD5 f17f73e20fb1c69aaa989ac6f93d1be6
SHA1 f24a82771f5348c315e2d5c5ba8b5a27c24cf46e
SHA512 1eefd219f4608b3a526c6e17ba76b26809a85c6ce55a3d1bef536bf3ced07605b90eb0931a352d89a4ddda5cec601722c2aa617d8ee249f1e66ca1a756d5e685
TLSH
T1CA112381CA247AF28E69F29BC4A5774287E43213C0C749147F750B1C4CA702FA3AB70B
MD5 SHA1 SHA512 TLSH

Submit Download

b3726685-0d42-4e94-ab0c-1c154b55c979

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\b3726685-0d42-4e94-ab0c-1c154b55c979
Size 235B
SHA256 4166e46a0629632bdf7561ec5ae79b3669a11973b3d9c78499cadff24d10226a
MD5 8a6e61d5f09183e95de3eedae99ec4bf
SHA1 87ff6ffaa4d1157dc2420d63cc7a18e7e55c85a3
SHA512 27996bff97f06e1561e0431833da8008a159381ba7c34707ad7f305560878a9db62e94bd4b372d714605b14ac9bf5e09b4df445c9a41e6894ea2116924d362ff
TLSH
T175D0979028C8676D0C040F16B0E13AC230888C3710B89820AAA08274AEBEEC88152C8A
MD5 SHA1 SHA512 TLSH

Submit Download

d9c21397-1438-4465-8887-5f64063cb31f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\d9c21397-1438-4465-8887-5f64063cb31f
Size 2KB
SHA256 d3203ca5944a29c58ef7946bda13a4909f2677396ce6394acaff46fc50c4bd99
MD5 fe109d49d95875986bf1e96471947349
SHA1 044090b9900f75e665c86e7b404a61ce988252ee
SHA512 58b97e86b7ef1c382f5b3f89c7048717f5f1b1a29bdd82295c04110a5d96419623487f21ac35194f0606ea591faa41033c926cf688a04f4af5e6b9ad76b0c4a0
TLSH
T11641219836784DBA8CCAF55DD481338E93B04A4350C72D637E51DF4CCC926AE736B52A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\extensions.json
Size 16KB
SHA256 17394dba9b0229ed23ed0cd7876cfa25d11a8dd2cf87203d8715961aa067031c
MD5 95e44c8bb744ea79e0d26f87ab01334d
SHA1 a9949ecb1cd6df6e03edf5a1ada343d3c8fd930a
SHA512 7af885c2adf6ade70bba55a8530564b92dc4be6d6c85513c9253633e89ee6d7a7183091d688c4c1510fafc289acd797393819ea8503f56cc24dc2aee2e523561
SSDEEP 384:FZkI4vXUmldvS8dhWH94zH96oVL4HNL4P8L4H+L4HCL4HGw4hr:cI4fRfXXG4x6+4t4u4k4Q4D49
TLSH
T12F72431545049EB8298FA79AAA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs-1.js
Size 12KB
SHA256 4b91e04b8f3c2d92f7678f2ff4007f7bb9e18ff1feedd9ca32588d363aad2c68
MD5 420ec9a84c49820c7b0eaa296f7363c6
SHA1 f7c25e5ba2adfcabf2e9ad876ab101621c6a5d21
SHA512 ebd02affd6fda56b5b06d050cc530310304b2f85208d9db05cca7072e197ad205a8fef94af80636b232a0446e0fee33a7e0f8079be55187af96df2ad2dcd4d22
SSDEEP 192:PFRvfrw7ESSGHXLRuoItbmBw88BOr9+Qk:fo7RqtYwEkz
TLSH
T14A42AA3891418B3F74B2327DAC754DE019A6013BB6BFBCD706F99482084CF6455E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs-1.js
Size 7KB
SHA256 2869f6ebe625286cec77e19cea2fa029072c0129f5e68ffe21b156d3f984ac0a
MD5 85ddb25613463b84d9ce2e72dba4577f
SHA1 74a4f02aa88afbd6934205ead72b1c6525908e13
SHA512 09bdc07d84946bb6c37fb3b1039aad5ab21212c8a028d6ba5a2c6d3843ab95c8b1c677644caa9a3cfc518e948a930c4bff9368616380d93d508dd36c19a0da62
SSDEEP 96:xHJslTU9qGqvfrw7ObzSmSSl8pdv9jEnq3RWRudWG925Bw88a8L4cnAiAGS:MFRvfrw7ESSGH8RuoIABw88a
TLSH
T115F1FC789104DB7FB4B676ACAC288D715A72013BBABF68D710BA44C5050CF3445FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs-1.js
Size 6KB
SHA256 5df9f4fd6f19c7da26fccf08a277e70a35ad2d04df5f0419e593eb93512959de
MD5 54fd40202f66515d339e6fe8741322a2
SHA1 474f3263e2290fd2bb537bf6014a00753f4c75ff
SHA512 f2fa7f492eda714b64effa6c1608810782934509c3a26b5e537312d85c8cffd0e721e4c3016302a920beadbff78fd14544ae6ad693ad46b10ddedaecd77187d7
SSDEEP 96:xHJsUTU9qGqvfClw71zSmSSl8pdv9jEnq3RHKG924Bw88n8L4cnA8b1:MwRvfClw7jSSGH9KItBw88ap
TLSH
T16FE11F7891088B7F74B677ACAC6889715AB2013BB7BF68D750BA44C5010CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 6KB
SHA256 dbc1f594ec8b6c2870841528feb2314f1ade3871cd9f8ec442898c218159481d
MD5 f6a23665fbb201bce4c2fb6f28f7c210
SHA1 9df3ffcd17d9341f89d6c150928b8c3744b9fc37
SHA512 3af361c7f210434ef9e63f5f31928e07f99ffccdcabcb0985ff7d00582e0eddaad747c0b553b837d819aa06d5aa5dc667c72be14a3750d9821875bc985103675
SSDEEP 96:xHJsUTU9qGqvfClKjwnj21zSk4SSl8pdv9jMnq3RHKG924Bw88n8L4cnA8b1:MwRvfCl36r4SSGP9KItBw88ap
TLSH
T12DE12F7891088B7F74B677ACAC648971AAB2013BB7BF68D750BA44C4050CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 7KB
SHA256 7e7b253979ef14c56b84671952f703c61dbdbd74f50a0c61f4cbd3ac19f556b9
MD5 bec4d09c0aed2c1b1a4823c4292e78e9
SHA1 c9acd4b50743c97b701be443505071bfc7d4ee24
SHA512 11fa35dd94ed5d270cff5bdaa458cdab4dcbd51eb30b9e55724a77783c8c277742c9ebbb6a443760f622abfb66e994a6ccffe0a370b68db7ba6bae3357685c37
SSDEEP 96:xHJsUTU9qGqvfClw7ObzSmSSl8pdv9jEnq3RHKG924Bw88n8L4cnA8bAGS:MwRvfClw7ESSGH9KItBw88ai
TLSH
T18FE12F7891088B7F78B677ACAC6889315AB2013BB7BF68D750BA44C5010CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\sessionstore-backups\recovery.baklz4
Size 29KB
SHA256 08d23bbafc889569c6573bac2aa6c06d939831a954adce9dbe4125042c428844
MD5 4093ca1f92d694cd48980845fbc56dd0
SHA1 8b831f7d648b8718f2b302d309389560fdc6c817
SHA512 b623f1a4e3bad627023c39bf3fddc4e5adfd2898956330ee27da6ef16202ea2e8c591be5766db5f02005f3aa99f1c4ed2ee3b93194e5e3f5456dceea1b0ca5b4
SSDEEP 768:6Bux99leLWBAxJWKSQPly5rC5Yb2LLdz0kOI9kh:6Q9lIQAxsKS2QC5Yb4z0u9kh
TLSH
T163D2F1FA66076F33979B47E549CA771E514B6C771AB06B80901134841DBC40D8DBAE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 173c09e4a1d1ae82bbec7d71c5e6b787524629effbfe09e15b413e8b2a7db006
MD5 d33a5d894976e97d89f1ac5c7ab21cbf
SHA1 1df2c8f96c6b95de1cd9cd547c66fc039f146663
SHA512 42ec46f1badc96eac39f9cf2fbed4d5552a5904d0b8202e68f1333de1540ad55689450be0b51056c1b26d311f5ece16242f183c95e8e6c25dab8e0c998943dbc
TLSH
T19E31194EBE16BCA23A36D68BC4CA4F59814E1031512CD8E0FA289A207A85606376FA4C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\sessionstore-backups\recovery.baklz4
Size 47KB
SHA256 b89a61ef025d7483f3e92cc09ec8637871d946ab0670c933d759ada702574dca
MD5 a7d6366379ecda60f844f4908dfaf283
SHA1 c8aa487d16821c367185008c5479c7fd0837ec78
SHA512 981cfc8dfdcad127b86ca3fb9186e2cb5dec555149a51777251ac72cab9531c6a38120c2cbe0da0fd9f8f7e4920c4d963223a4e9dd20df4d5b3e1c643e6bf01b
SSDEEP 768:9uxw9leLWU8AxJWKSQPly5rC5Yb2LLdz0kOI9P/pzg0UVmgm3yswaXk/lYWz:d9lImAxsKS2QC5Yb4z0u9HpzjYsXsRz
TLSH
T17A2301FBB346BFB2174B469885CB2B5E224B6CB701F4D680627034C41DB811EDA79C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 0bbc9aacb942c25521d51d0f86efdba779e064d76527609f7dedaa752fd3e6e8
MD5 f8962a1483ff2fa40a977d4d14c80a15
SHA1 a71b94c55644ab69c1fa7c0aeba4b8a136324139
SHA512 8328d1038bca3d6ca4ae6e919f7879e756a4bc23f7b5f06017fba220a85555f5ef3fc4a6dfebba98afebdc8ee12286dbb19e55f1362548c83f7d77e9ef33bffe
TLSH
T19E21B78AFF3B3CA26755C141D0CA0FD496666070C25DA8F0D98A9651198882A72EE315
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\sessionstore-backups\recovery.baklz4
Size 28KB
SHA256 8dc7153ca0de46e6f519eabbf15914b59431bedfc91369b6331a37f6bbbad8f3
MD5 3dd293b3986685cfbab00bdf6190fa9d
SHA1 f754b5bfb0da368a6780dc1533539f870d256fe3
SHA512 3305ab924c8855d7e92ddd06a3e1aec113155250dfd3eba68c1e1fb0d389225d7e6e68427ed7f580cbc3fddec37487ad3ba1a4fd0f59abc61e5740cd869b3eab
SSDEEP 768:fBh69le+WvIAxJWKSQPly5rC5Yb2LLdz0kOI9t9:e9lvqIAxsKS2QC5Yb4z0u9t9
TLSH
T129D2F1FEA7077F67A79B8BE809C9761A110F6CB76AB156C0403034906DBC90D4E6DE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\sessionstore-backups\recovery.jsonlz4
Size 47KB
SHA256 a7237bd820334b6c1b6bc24bfc904b62795db29de8f2c2fc5c7bf17fad4e75d9
MD5 98bee8be5608fe4a1caf64c61934b763
SHA1 401152203dca98d5375675cdf105969f2dcfe23e
SHA512 24f5c66a2a417ac63e42f3324e7a192a256e5d280c2311b734b1cb56dd0845adc5ee9e3297a4a0a3f9d0bdb20bc353553b0d5251b9d6e525e85a3d6e4696490d
SSDEEP 768:jppOU9ledxSPs3AxJWKSQPly5rC5Yb2LLdz0kOY9rZA+TGGGgTcmgm3lswaXk/lQ:bH9lI3AxsKS2QC5Yb4z0i9++TGZuHsXN
TLSH
T1D823F1B6B246BEB2874B43A885CA675E254B5DB711F09680B23234846DF8109C73EDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5b194bbc-13ec-4307-8eed-74678049c574}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\default\https+++www.reddit.com\cache\morgue\116\{5b194bbc-13ec-4307-8eed-74678049c574}.final
Size 2KB
SHA256 c96e0a307efe4c9c677b46c2c4ebd8f869aed566cb0836b36866b844d523c6f3
MD5 7655592bb59772630f71e2065322ddff
SHA1 9082d0f53b8b07764bd294b6d5e4ce3e9969f595
SHA512 8a24c01f772e746834749d32072380195da0cbe409710b4cc5f37d10f864415f3c7085d51fb5a2a67c9ee1b3bd9ca37eb4c4de0a7931f58034d158540018b003
TLSH
T1F2516DEB72E7B41336DC914EACBAD8408D6F84A60C5FEB015D70A0C0C15CC11F715D08
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.8MB
SHA256 99a77c91a5275d7fc958e8704a8dc440ef081d71142f9d0672d93f9b8c20b120
MD5 17f2085d2c5f9043dabf2b8c2ba4a75c
SHA1 d6acb300e78b12ad947ed9a77611e4317318feca
SHA512 cf1600d6d882b3ceea4c69c1e6ce9923e5c9fdd12b5b5599c1b5f797fc730e11f167ee8994f1fb8376ef6d37d50359d4a2044de76046c067ab6fe7ff553730a8
SSDEEP 49152:Tyk0RVaAIoW8zN6wlDRH/lx1IZIKku1/z196eBgyyBYNEGR5ZxIhn1Aan9bsouY1:JP2g49wo/4xZ4VJo
TLSH
T15E565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.8MB
SHA256 4261e908f03088ad9fe2fe8e70a6d0628a10b9a323363e5b3ae7b95ffa7ccc6a
MD5 db361e553ec08f7d91cb0485ed7d46c7
SHA1 54475ead41ceb4e7065598b6d3b9f0703cf4db40
SHA512 7bbece6b5acd1ba604d3549241e52ba232621ca74903a09f5ba73d0e560550e5de24d444636045a354da69fa8cdf2a655054fd6ae495e85caf524a0f8c76148f
SSDEEP 49152:MTvxI8nCFZh9bsouY4xadjyq+8suYCQeaemxDIaOtF66QhhVlijpXUHR8afqeAZL:Sv2rf9wo/4xadjY8R
TLSH
T160565DE420E2D252F38540B3719A53FB10EFC01C60768E44579896FAA5B8CEB8D977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4616-21-0x00000000051F0000-0x0000000005200000-memory.dmp

Download

memory/4616-3-0x00000000051F0000-0x0000000005200000-memory.dmp

Download

memory/4616-6-0x00000000064B0000-0x0000000006804000-memory.dmp

Download

memory/4616-10-0x0000000006C50000-0x0000000006C5C000-memory.dmp

Download

memory/4616-5-0x0000000006480000-0x00000000064A2000-memory.dmp

Download

memory/4616-11-0x0000000006C80000-0x0000000006C8E000-memory.dmp

Download

memory/4616-4-0x0000000006390000-0x0000000006442000-memory.dmp

Download

memory/4616-9-0x0000000006C40000-0x0000000006C4A000-memory.dmp

Download

memory/4616-12-0x0000000006CF0000-0x0000000006D7E000-memory.dmp

Download

memory/4616-13-0x00000000051F0000-0x0000000005200000-memory.dmp

Download

memory/4616-22-0x0000000005120000-0x00000000051A7000-memory.dmp

Download

memory/4616-23-0x00000000051F0000-0x0000000005200000-memory.dmp

Download

memory/4616-0-0x00000000006D0000-0x0000000000808000-memory.dmp

Download

memory/4616-2-0x0000000005890000-0x0000000005E34000-memory.dmp

Download

memory/4616-1-0x0000000005200000-0x0000000005292000-memory.dmp

Download