f22051cac3756c4080ff376ec42c58dc6352e35c4c10efbe658770b9a54374ec

Analysis

user interaction
yes
max time kernel
290s
max time network
289s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
teste.exe
Size 431KB
Sample260424-2ahefaes5n
SHA256 f22051cac3756c4080ff376ec42c58dc6352e35c4c10efbe658770b9a54374ec
MD5 901738d877b097a95809a88979681a3f
SHA1 54ef88933423dbc091169c9f3e747ccbc1cb9496
SHA512 9f6b9f45c4e677fd45bb1b5b479da04cd439449c09eed4e419b38e8f9cf50caaca4c99db1131944ef36f56105dccc42209a00d765a4c3945cdf90e1a42f3412d
SSDEEP 12288:KYT6tYsmHR3KqZX0aQPRU7jUTiuG+qEM0n:SSR3KqZX0aQmfUTkbt0n
TLSH
T10C94C5B66EC7DDD8C302487D22E5D238AB2F9BA3091E4D529F653290BA71C4D7D81E07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 34 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	firefox.exe
Token: SeDebugPrivilege	4196	firefox.exe
Token: SeDebugPrivilege	4196	firefox.exe
Token: SeDebugPrivilege	4196	firefox.exe
Token: SeDebugPrivilege	4196	firefox.exe
Token: SeDebugPrivilege	4196	firefox.exe
Token: 33	4580	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4580	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe

Suspicious use of SetWindowsHookEx 53 IoCs

pid	Process
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
4196	firefox.exe
584	Lakeside Bar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4196	4944	firefox.exe	80
PID 4944 wrote to memory of 4196	4944	firefox.exe	80
PID 4196 wrote to memory of 3360	4196	firefox.exe	81
PID 4196 wrote to memory of 3360	4196	firefox.exe	81
PID 4196 wrote to memory of 3360	4196	firefox.exe	81
PID 4196 wrote to memory of 2592	4196	firefox.exe	82
PID 4196 wrote to memory of 2592	4196	firefox.exe	82
PID 4196 wrote to memory of 2592	4196	firefox.exe	82
PID 4196 wrote to memory of 2592	4196	firefox.exe	82
PID 4196 wrote to memory of 3820	4196	firefox.exe	83
PID 4196 wrote to memory of 3820	4196	firefox.exe	83
PID 4196 wrote to memory of 3820	4196	firefox.exe	83
PID 4196 wrote to memory of 3820	4196	firefox.exe	83
PID 4196 wrote to memory of 2312	4196	firefox.exe	84
PID 4196 wrote to memory of 2312	4196	firefox.exe	84
PID 4196 wrote to memory of 2312	4196	firefox.exe	84
PID 4196 wrote to memory of 2704	4196	firefox.exe	85
PID 4196 wrote to memory of 2704	4196	firefox.exe	85
PID 4196 wrote to memory of 2704	4196	firefox.exe	85
PID 4196 wrote to memory of 2704	4196	firefox.exe	85
PID 4196 wrote to memory of 5724	4196	firefox.exe	86
PID 4196 wrote to memory of 5724	4196	firefox.exe	86
PID 4196 wrote to memory of 5724	4196	firefox.exe	86
PID 4196 wrote to memory of 5724	4196	firefox.exe	86
PID 4196 wrote to memory of 5276	4196	firefox.exe	87
PID 4196 wrote to memory of 5276	4196	firefox.exe	87
PID 4196 wrote to memory of 5276	4196	firefox.exe	87
PID 4196 wrote to memory of 5276	4196	firefox.exe	87
PID 4196 wrote to memory of 592	4196	firefox.exe	88
PID 4196 wrote to memory of 592	4196	firefox.exe	88
PID 4196 wrote to memory of 592	4196	firefox.exe	88
PID 4196 wrote to memory of 592	4196	firefox.exe	88
PID 4196 wrote to memory of 5344	4196	firefox.exe	89
PID 4196 wrote to memory of 5344	4196	firefox.exe	89
PID 4196 wrote to memory of 5344	4196	firefox.exe	89
PID 4196 wrote to memory of 5344	4196	firefox.exe	89
PID 4196 wrote to memory of 2716	4196	firefox.exe	90
PID 4196 wrote to memory of 2716	4196	firefox.exe	90
PID 4196 wrote to memory of 2716	4196	firefox.exe	90
PID 4196 wrote to memory of 2716	4196	firefox.exe	90
PID 4196 wrote to memory of 2680	4196	firefox.exe	91
PID 4196 wrote to memory of 2680	4196	firefox.exe	91
PID 4196 wrote to memory of 2680	4196	firefox.exe	91
PID 4196 wrote to memory of 2680	4196	firefox.exe	91
PID 4196 wrote to memory of 2028	4196	firefox.exe	92
PID 4196 wrote to memory of 2028	4196	firefox.exe	92
PID 4196 wrote to memory of 2028	4196	firefox.exe	92
PID 4196 wrote to memory of 2028	4196	firefox.exe	92
PID 4196 wrote to memory of 5148	4196	firefox.exe	93
PID 4196 wrote to memory of 5148	4196	firefox.exe	93
PID 4196 wrote to memory of 5148	4196	firefox.exe	93
PID 4196 wrote to memory of 5148	4196	firefox.exe	93
PID 4196 wrote to memory of 5060	4196	firefox.exe	94
PID 4196 wrote to memory of 5060	4196	firefox.exe	94
PID 4196 wrote to memory of 5060	4196	firefox.exe	94
PID 4196 wrote to memory of 5060	4196	firefox.exe	94
PID 4196 wrote to memory of 2120	4196	firefox.exe	95
PID 4196 wrote to memory of 2120	4196	firefox.exe	95
PID 4196 wrote to memory of 2120	4196	firefox.exe	95
PID 4196 wrote to memory of 2120	4196	firefox.exe	95
PID 584 wrote to memory of 932	584	Lakeside Bar.exe	103
PID 584 wrote to memory of 3876	584	Lakeside Bar.exe	106
PID 584 wrote to memory of 5908	584	Lakeside Bar.exe	108
PID 584 wrote to memory of 5704	584	Lakeside Bar.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\teste.exe
"C:\Users\Admin\AppData\Local\Temp\teste.exe"
1⤵
PID:4988

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {3252e45c-5146-41ed-ad10-f07f781a3098} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {6ccbc3aa-70b0-46fb-a68c-aeba2390a86f} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3756 -prefsLen 27323 -prefMapHandle 3760 -prefMapSize 270279 -jsInitHandle 3764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3772 -initialChannelId {d9746435-f052-4dc3-b3f5-4fbfb25dae96} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27323 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 3764 -initialChannelId {391a4087-c539-4b6f-8483-76830ff768ee} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4572 -prefsLen 34822 -prefMapHandle 4576 -prefMapSize 270279 -jsInitHandle 4580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2688 -initialChannelId {604e09b6-c3d5-4c78-abe7-0437f2e481cd} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5076 -prefsLen 35010 -prefMapHandle 5080 -prefMapSize 270279 -ipcHandle 5088 -initialChannelId {476ec9c0-76ef-4454-81fc-2d5839c752da} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2772 -prefsLen 32952 -prefMapHandle 2776 -prefMapSize 270279 -jsInitHandle 2780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3152 -initialChannelId {ed469afc-0df5-4b9d-b634-f96652e32da2} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5576 -prefsLen 32952 -prefMapHandle 5580 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5592 -initialChannelId {7a09101d-959d-4d2c-bda7-2ebdd4c9909c} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5764 -prefsLen 32952 -prefMapHandle 5768 -prefMapSize 270279 -jsInitHandle 5772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5780 -initialChannelId {91571f28-7c2a-49c8-abea-fec751887788} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6208 -prefsLen 33071 -prefMapHandle 6212 -prefMapSize 270279 -jsInitHandle 6216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6228 -initialChannelId {bbcf5e0b-e90f-4aab-88d8-40da52ab967b} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6208 -prefsLen 33071 -prefMapHandle 6656 -prefMapSize 270279 -jsInitHandle 6348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6740 -initialChannelId {79867c2c-4f03-4347-96ca-a291c60ebf82} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6624 -prefsLen 33233 -prefMapHandle 6208 -prefMapSize 270279 -jsInitHandle 6656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {23dcd163-f58f-4478-986d-f187220d2832} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5860 -prefsLen 37248 -prefMapHandle 5872 -prefMapSize 270279 -jsInitHandle 5876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7428 -initialChannelId {05fe4938-a884-41c6-8713-3d8df8934fca} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5808 -prefsLen 37248 -prefMapHandle 7364 -prefMapSize 270279 -jsInitHandle 6688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3400 -initialChannelId {3c5102b8-d2e4-43ee-9bf2-5391d24e4fbe} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3060 -prefsLen 37248 -prefMapHandle 7152 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7384 -initialChannelId {340a0085-2dff-4909-b606-a15eea61c780} -parentPid 4196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1824

C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar.exe
"C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\UnityCrashHandler64.exe" --attach 584 2145925337088
  2⤵
  PID:932
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Cant find the exit.mp3"
  2⤵
  PID:3876
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Cant find the exit.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Cant find the exit.wav"
  2⤵
  PID:5908
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Journey to Botswana.mp3"
  2⤵
  PID:5704
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Journey to Botswana.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Journey to Botswana.wav"
  2⤵
  PID:4396
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Journey to Caracas.mp3"
  2⤵
  PID:5896
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Journey to Caracas.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Journey to Caracas.wav"
  2⤵
  PID:3956
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Leisure Day.mp3"
  2⤵
  PID:392
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Leisure Day.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Leisure Day.wav"
  2⤵
  PID:4884
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Moonlight Reverie.mp3"
  2⤵
  PID:2184
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Moonlight Reverie.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Moonlight Reverie.wav"
  2⤵
  PID:2496
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Skinny Sleaze.mp3"
  2⤵
  PID:5344
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Skinny Sleaze.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Skinny Sleaze.wav"
  2⤵
  PID:5900
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Sunday Stares.mp3"
  2⤵
  PID:5540
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Sunday Stares.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Sunday Stares.wav"
  2⤵
  PID:2620
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Unseen Stars.mp3"
  2⤵
  PID:4448
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Default\Unseen Stars.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Unseen Stars.wav"
  2⤵
  PID:2032
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Obviously Evolving.mp3"
  2⤵
  PID:5584
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Obviously Evolving.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Obviously Evolving.wav"
  2⤵
  PID:2700
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Outrageously Timid.mp3"
  2⤵
  PID:1648
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Outrageously Timid.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Outrageously Timid.wav"
  2⤵
  PID:4628
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Predictably Distinguished.mp3"
  2⤵
  PID:2832
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Predictably Distinguished.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Predictably Distinguished.wav"
  2⤵
  PID:3136
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Sensual Room.mp3"
  2⤵
  PID:3676
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Sensual Room.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Sensual Room.wav"
  2⤵
  PID:1728
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Shared Sojourns.mp3"
  2⤵
  PID:1492
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Shared Sojourns.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Shared Sojourns.wav"
  2⤵
  PID:1860
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Shared Statements.mp3"
  2⤵
  PID:448
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Shared Statements.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Shared Statements.wav"
  2⤵
  PID:1328
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Speedy Moment.mp3"
  2⤵
  PID:1760
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Speedy Moment.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Speedy Moment.wav"
  2⤵
  PID:3060
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Welcomed Glances.mp3"
  2⤵
  PID:6124
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Falling into Autumn\Welcomed Glances.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Welcomed Glances.wav"
  2⤵
  PID:1132
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Big Dude.mp3"
  2⤵
  PID:1952
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Big Dude.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Big Dude.wav"
  2⤵
  PID:2388
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Dope Laugh.mp3"
  2⤵
  PID:3488
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Dope Laugh.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Dope Laugh.wav"
  2⤵
  PID:336
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\False Commotion.mp3"
  2⤵
  PID:3728
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\False Commotion.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/False Commotion.wav"
  2⤵
  PID:1560
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Perennial Possibility.mp3"
  2⤵
  PID:6068
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Perennial Possibility.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Perennial Possibility.wav"
  2⤵
  PID:6136
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Smitten by Angela .mp3"
  2⤵
  PID:2816
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Smitten by Angela .mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Smitten by Angela .wav"
  2⤵
  PID:6072
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Tuesday Moments.mp3"
  2⤵
  PID:5908
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Tuesday Moments.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Tuesday Moments.wav"
  2⤵
  PID:2720
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Unrestrained Eyes .mp3"
  2⤵
  PID:1748
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Unrestrained Eyes .mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Unrestrained Eyes .wav"
  2⤵
  PID:4432
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffprobe.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffprobe.exe" -v quiet -show_entries format_tags=artist -of default=noprint_wrappers=1:nokey=1 "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Violet Luck.mp3"
  2⤵
  PID:3516
- C:\Users\Admin\Downloads\Lakeside.Bar.Build.22225425\Lakeside.Bar.Build.22225425\Lakeside Bar_Data\StreamingAssets\Music\ffmpeg\bin\ffmpeg.exe
  "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/ffmpeg/bin/ffmpeg.exe" -y -i "C:/Users/Admin/Downloads/Lakeside.Bar.Build.22225425/Lakeside.Bar.Build.22225425/Lakeside Bar_Data/StreamingAssets/Music/Songs/Amber Winter\Violet Luck.mp3" "C:/Users/Admin/AppData/LocalLow/BITCOVER/Lakeside Bar/Music/Songs/Violet Luck.wav"
  2⤵
  PID:2176

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cant find the exit.wav

Path C:\Users\Admin\AppData\LocalLow\BITCOVER\Lakeside Bar\Music\Songs\Cant find the exit.wav
Size 13.8MB
SHA256 4e0e2ac92389e17ae9ae8ced562fbf85bf06d293860f392c1032adee3264652d
MD5 27eb0fc0c4f46a209e57887d1d81f405
SHA1 199c2da0274d4ddeecca2a690e03b82033e15660
SHA512 2640ae06e8cd3ef6def3243035f7d49cad29d292e42262ddbc8d1bde2dbc5995e49f306c759b655b21ed6fc8d85715e49a8aa51ff01a3c8e505c61792fb4c8ae
SSDEEP 393216:AjHZpM47T9aMAnBPqsH3He95z32IWxVbe34JxmamUMiBJe24:oHZpLlqkKgz/Ki34Jw7Oh4
TLSH
T1E1E6239AC232B640397D830596C49E1C1B45F79F28225D7E663DCAC2B11235379F8BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14312ACF355D665A80DEB74939210882430F9543

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\14312ACF355D665A80DEB74939210882430F9543
Size 63KB
SHA256 a545d0333aa3f8fa781714690b00b737f72160206daefb88d23723cd5c206aec
MD5 9592bce05b0ce2d92ca26fc596b7145a
SHA1 19715f55ff58b2cfaa133e6b5a1b4673ae78c660
SHA512 40042361216ca2f5990fe8404fa6b67febb6c9723aa0d89a0ff875a387e8f506be4557874276abccaf715cd78ec3c0187a946945b83e2184da3d2ff56d1994ca
SSDEEP 768:X1cMwFK60LP3m4qJ+h4MpyPE2vTNT9HXUmSf6v+nUhtHhXJItRa13sv:KUrP7Q+hKPEqTNlXUvf6vjVJIn
TLSH
T1E3532A2ADE565F23C82103B550F7A3373AB1D0861BE7E32B5B8F7022B81E7B90D55958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1A7A6E142AC90772583AC37FA57412677543CD88

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\1A7A6E142AC90772583AC37FA57412677543CD88
Size 67KB
SHA256 04ac249a129f81cfe79db847704e83781fa03f51204866eebd7758aa78239c8c
MD5 f0d28ced2ef44795c9a89cab62a1f49b
SHA1 5156bbccc9d47df61fd9b4094b31699fb07613c7
SHA512 bfcac465686fe8cae525f005e104c59f544f021076b8e720d72b045e5901131c2189cc67a5abd0659ade64912cdbdaf585191b730f6b2298dd9d41c32c1aba4b
SSDEEP 1536:0jEEJVvDeI5u9knIy26E3wdHW0wNjW+zCylpz+MYL+SG:/iuwd2RxCVtyb
TLSH
T1EB633B34DF2D5A3BC12511BB48665279723DC0739BC2D623BFAA69287CA4B321D25DCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46FC295B112DF4650D30AF2E5825ABE899DF0AD4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\46FC295B112DF4650D30AF2E5825ABE899DF0AD4
Size 59KB
SHA256 085f3cdcd14ce2ec7222a61ba5c212579010688d97c238428c2d1c25724c910d
MD5 0922b65e8e4040be4ae59ddd3e10e228
SHA1 f5f2c0cc9e45c9479b75d744a58e892b4224ea01
SHA512 71ada4751455a0cbf277d3194f2fcaeacf6f33ee3ee01cbcaeaf378e224a70ac584f67341b87f8bb40a21485d3302977c7e509ed8ae723266c9bb50e7c3eeeb6
SSDEEP 768:oNUztTJcfX6U9Uh3o//YrXgAGfACfaU9Uh3o//YrXgAMfSaWCrAtSV9mV03a13sX:odPXnAMDaazAcV9zX
TLSH
T1F8430E5BA33A4F8BF43E3BF78D928F5DD999514322C0F179DBEFB28168901568660C84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4F63F49EE115D1274F4DBCA2F44C10B3F9F8597F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\4F63F49EE115D1274F4DBCA2F44C10B3F9F8597F
Size 410KB
SHA256 e8ff69d064ebf5b1996af05c6fe0b79709d5f2484ce3f62748b2e3cf465159e1
MD5 b0516f78216ed75c9352a1938a04253b
SHA1 3abbb66ed1fa3b138b90cbb24f24afe2fcedd3b6
SHA512 74028f0f6efccc741c574c82c18c1f574beca84be329b7e044136b3037c3a5a0fd3d8d7e276ed59b2bd83176de24dec86a7635c373b7232e3ad8cd2b73b6a3e5
SSDEEP 6144:0twG7se447K6HWK9VCZ8UBQ47GKcG1UUhrQbGmL/nyrhQY6yJX7oX5nRFK:0CM7uK9YSU2m1hkZ/nYoHg
TLSH
T14694E767FE866A23C92502F140B723363B74D4865BD6F3172ACF7526BC2A3790D518AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 7c41e37d6a219af0f4f8c5b6d494f6d94d74e0e9fc92cd91a3984684d4de2412
MD5 45f80c21a54fd1fb6139f5a7f9291b4b
SHA1 28589fe9e4ab880862c23473d40ac23bb214a433
SHA512 363f84ad715be2d3feb445ffeb62168a871cc96b23037c23e2b46f60d5fa91f5ff56e443617c7729d01d339914dfffc9bb33c862216eb6fdab984b2f681fc169
SSDEEP 384:HbaFrLiO024YVFuhw+5EL1pPsac4j0lpDII+KK7:7aAZYVFuK+5EB9sac4ID8Lz
TLSH
T1D8527E7EAF0138BA1A2BD1D4D9ED9215CE08A5BBEEE2D16605143844C68037DB4F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D079A7B69D465045C956CBB52E47C3EC0EDA0AF0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\D079A7B69D465045C956CBB52E47C3EC0EDA0AF0
Size 11KB
SHA256 96faaab945f0ff1e70acfbbbdb289b48c017dad43aa7731da804d1317847af86
MD5 8cd9de7cc274eefae60bb26bd4bbbe6a
SHA1 7e15a53228f7b17d2029b08fcc2d9b31a14ff663
SHA512 8950601e667d007ab412622fc855f819f65f73a5f4253059f7067afe04af26b9c912f4a5f7ccae0750a59fb3884063b5c170293b98d72554185b7e93e4102ee7
SSDEEP 192:7qm6O3B4mgDfm1qiEzNMa/yH4R3QZp/UBfdaalv9tIappXuhkBbS3st5bGNRtBbz:7qpOxzdYMaKHZZGEa13ss/G7TGC
TLSH
T19742BF370F32391D85FB03E7644F59A7AD52B95BE4F656FD1605270189D81B0B8DB0C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc42a3cb-0604-42a8-ab5b-bb2dfb793f10.zip

Path C:\Users\Admin\AppData\Local\Temp\bc42a3cb-0604-42a8-ab5b-bb2dfb793f10.zip
Size 3.7MB
SHA256 41f88315ccb5feca6d1f0ca29ee131700bfe0f0a4a0cb4cc56912f7525275fab
MD5 3161f12ccf7dae28d5ba50957dcb38ab
SHA1 28750e8ab50cbeb7918f8b0e2c64df1d12a6f7f5
SHA512 f8a64ea32e684e0c7ca84f7faed743c74b31f194a8f8412cc41162c89e6c7a93dfbb90dc8041ce8e5dc101522c06ac68a4a57c12ad68baaa26072a9327b452d3
SSDEEP 98304:yLr0Cmjpv8wpUBBQBMEfINmTn7ylp5MAU:ewrtUQBMEfINmT7+MD
TLSH
T17E06E035DE9C1E08C98F83FA850C2FC29B4C4F668054A95B7E6A9571DFB31A21B47B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-tca.xpi

Path C:\Users\Admin\AppData\Local\Temp\tmp-tca.xpi
Size 4.2MB
SHA256 f2730d2877005763a45d765749892e936f49cae713d28f7aa6ea314454b89cf1
MD5 de8cd70311f2490e4255b37602274d4e
SHA1 7a06c7c384e341ba1bc80fa91065f079731e8002
SHA512 ad1d1c2a60e5912ec50b4b4f7318526a7b43919a2cddc73db097497c4de21b03c57e860e1d21414443d49b92ab18e4352e7b3480f173b44af61a27ddf1543e82
SSDEEP 98304:lrT1EE6yi6MfW84NsME5xXq+tkw4u+vo3I2JH2jo7PiV:9T1EE6yFS3BDmla3jWjec
TLSH
T1AB2633EAEF225C76CA3B9031A1538410E5654581A392F11EA506B2BDECC99C14FC6FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configs.user.ini

Path C:\Users\Admin\AppData\Roaming\GSE Saves\settings\configs.user.ini
Size 422B
SHA256 46b8a6dfc3b77fc42540c1bbe9d39bb60edf02b953cf10645ee770edcf762394
MD5 0ba4518bcd688b60ff7292fbce1016d1
SHA1 dfbea366eda0e025bedd2eddb788bbcbc870bd87
SHA512 33601b6c5f3346feae66ce39bf7ed78433fdc86dbb843e2c1f3f9e6c679fbad1298de03875fad80f0e82a1cf24ddd8166c772d7e6a66c8f25b3891e02aee7890
TLSH
T16BE0F126580719B71FB20AA178D57EEE4F0F92DC09403D9D33C127065192CC28822B44
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\AlternateServices.bin
Size 20KB
SHA256 e26bea0cd239e38e8cf2e0c59baf9834fbe9b797d75340dce58c046fbe6acf60
MD5 125614fe32ea919a7441df23514dc63d
SHA1 b05e59e1e71e8a6f5d21ecd64935a29054d4c5be
SHA512 08285c517f409e4715ef399b2b7944ef346fa77bca6d38c2c17564fae5a36043230eb6f138d1321d53585d7caeca474749f4e9cfe6e68772c221820a35c06642
SSDEEP 96:M7uMRwsRsoRgBkRnI56xRUGRDNRgM/pzRUMxmMtMCTmMtM+TmMBjMMhTTmMrLQGl:M7JH/vLvfGQd/n7/dhXFLff
TLSH
T1709282FB7B726462F1928FB1907C764C8C73061628ACA594DB1494EB07C17D5A0BFBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\AlternateServices.bin
Size 21KB
SHA256 eefbf1fe8b7f64a684f765ed70affc8aa5d4fca965624eca01be5348ee9095e8
MD5 871ccfcd612fd0608815bfa59e0363d4
SHA1 26bc131eb500f45c5d102c0132247cd9b9ec0023
SHA512 c129c775ceaad155d11b940e99ef0d5833e3e78f5f14c8a5c40ba40662b85cc7b23d068a960043146c3a7394b70303c00932211c8e9c8863378a88568b99217d
SSDEEP 96:M7hOiuT0FSd0Bryd0Cr0WGuCmd0l/YJld0hM/peRHnznhnpgMFmMbgMpmMvnS49/:M7hVIFdVdbtdNdWQclzhpdTFnvLb
TLSH
T1E2A2D0FB67F25462F1B74F70907A368C987305561DA88488EB14D4DB17C27A1E0BEF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\AlternateServices.bin
Size 22KB
SHA256 9a280eab3ce51d9f3138f7212efa4e96819c5e82a43197794bf6160af29ec2b0
MD5 cfbe688282e0127508f3be4f63abff5c
SHA1 b3182cda0d07b51f67868d09e63cfdd5ea8f6d2c
SHA512 9515b0df2e0bdd6854d4bc2b2184241629f35163af53c489cdef69b0d052491e34fcefadcd36d1a6739126bca97ec87f0c7f585815284340233f78d0fa5b3066
SSDEEP 96:M7B56T04dai0mr6i0mQi0DGuCGi0y/YJFi0hM/peRHnznhnpgMFmMbgMpmMvnAHu:M7BCkicioiMiUiWQclzhpdTFnQILbc
TLSH
T1C7A2D7FB67F15462F1B34FB080BA368C986305161DA89884EB64D4DB17C2791E0BEF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\AlternateServices.bin
Size 10KB
SHA256 6390c7cb84fe5e139b8e7a632b29bcd75aacc1f13c657cf749320a8201d82500
MD5 0ec89970322e19fd23ead25465d581fe
SHA1 0edf525547244fe5a4b348c3325d3ebf462b6527
SHA512 a0b71641e2e0dd79d5529509fdc1184d4b97c318a3f52182c72db966d036a2c491a9b531fcebd3729073e8507f64abb05cf2ed56e5fcd449662469ddfda82c9b
SSDEEP 24:hRuhMZIf91VRO9xaRGP9BGRS9VvoRR5q9F55A5hR29lARd9BbnPR:uFrRUgRG10RABoRPI56hRsqRX9PR
TLSH
T1A52263E72B726472F092CFF04069768C9C73032A19ACA184D65484F706C1AD9A17FBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 63933d76ef30e3cf713c6747ffae9f1bcc529090b4ef2d0b1e34b7e633964c28
MD5 6422f2b805a696fa5bcd648a494053b3
SHA1 d2f6eba573fc62582507aa4b9309b880fa7f2cff
SHA512 38ad9b172033892333d41f85ee60ae998e16d2cea5f742eea177066a3213f20b0fa01871296ad8a5209a150b681bac0c6865ad6637efd1627545490849662cb1
SSDEEP 96:t7SdF95/7bkW6QXjrcE3hyUR6Jzx2WZJFN2FwF0FwFm/dd66Joz0dzgClKtmc0dz:t7Ov5zboob3hyjfxE1d66Joz0dzgCl6s
TLSH
T11FC1FC24F6394A3BD409023BCDB61F500F35384A988E3F1932EC645D2D562EE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 33947141c385b0e3d8bbb9563b70c0f93f34868e5fcb05d834966cdac89d46c0
MD5 4d9e0a0edcc63fd1ab550540ca83563a
SHA1 f2b073718774c2f3e961b6b88d755165f4119145
SHA512 68994c950b3aff8699d8b850ba50c9206ae765825af8bae9a6fe3db53107c1a32d4283969c8a5d6aa520f314d5c4297773cad30423d5df995ec2ead163bc1982
SSDEEP 192:27Ov5zboHL3hyjHh11d66Joz0dzgCl6mc0dz:Tbor3hyjVd66JozQzgC1jd
TLSH
T1D1F13064E639863BD00512BBDD622B450F39789AD88E3F1936DCB44C2C572ED368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 77KB
SHA256 e99d311e07edb3f1fe1cd32c9f483e7f659e6705e8441f23fc122f06532bb797
MD5 64f29f6d5251a4d038467136f9c44817
SHA1 5085a8dd8f0c341a304cc312d6bcda2d49862047
SHA512 cb350be8776fee6ddaa005f3f7f019f2f4279032be9aa0f75c8032d8dc0af21d0404b4e2c12e76d5fe77ed0537294493d92a200244fd8a87b27e727592244739
SSDEEP 768:9m+VfwFkQKxEjxv6ceS4xNqGcmhu3izK4XQsQYkbTbNb7bzg9M/ff7FnLSh:ZwF3KxEjxvMS4mizWOM/ff7FLE
TLSH
T19A73AE94DB1B407BE81085FFB495673C1625F82149599B0F3AEC04662DCB3FF2D0EA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2dad00a8e5a1becd055e4ecf8a0431d2ab447b458f48aed352561e8cc1c12873
MD5 dc94554af06e1b082ec6746fce54b21e
SHA1 c0669ea7ac481f924d74bb6a43222b6e66fc981c
SHA512 f7a9a4fd56764b59059fd2ba8deb8900bbe8145ddb5dfbb23ed6a218ec956bbe8ce6634e3f976bf5ff336878974acbf4b5655ee18f364a0203e4f98d14b687be
SSDEEP 192:l7Ov5zboH0Z3hyjHh11d66Joz0dzgCl6mc0dz:2boUZ3hyjVd66JozQzgC1jd
TLSH
T12AE11F64E628863BD405027BCDB62F450F39388AD84E3F1936DC655C2D572EE3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 77KB
SHA256 24accba2848f14fd3a993fd662ed95a7b6869852573fea016a654dfe1be5c775
MD5 9b0516d3fb864e51ffcc1b0833d2f73d
SHA1 acb88685da46cfd37471deb5cb87d9ea766b479f
SHA512 23e477cedf7683438c66f5f680632d5b663c05b6a37a4147a6807dc281d55e90c97d97c0822c5c17927ea22aac0541612e30488423fcb3fb9d58e4396b76bf88
SSDEEP 768:7mDwFkQKxEjxv6ceS4xNqGcmhu3izK4XQsQYkbTbNb7bzME9M/ff7FnLSEVk:YwF3KxEjxvMS4mizWbM/ff7FLc
TLSH
T10773AE94DB1B407BE81085FFB495673C1625F82149599B0F3AEC04662DCB3FF2D0EA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 1ed2175b379339b973a0d6f28b3c0621da696f72f78b10c4d1290c66d501cf8d
MD5 bc8a2c962205b9de2211c3720253eeed
SHA1 a7e7c8f0b7935938d356abbaf8bf27851ea3db07
SHA512 1c2190fcc743b2b0d8843c75e41ca32d1b4a5a9b393f20fcd5d7e68e0bcb30b281945a3f85376f521f04a0dba0180769285b4b6d80709230a6d3dec59e8cd5a0
SSDEEP 768:+wFkQKxEjxv6ceS4xNqGcmhu3izK4XQsQYkbTbNb7bz9m+Vk:+wF3KxEjxvMS4mizWi
TLSH
T106232444EB2E513FD42802BADD951B102F78F889591A2FAB3B4C55686C872DC3D8E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 018cb5607a8a80098731bf6d228deb0f495c9432a0871c5c123a183eef91a445
MD5 6c3cb5bbb0df5efacf2cb6a526138e1f
SHA1 6d9b463924da703ded20642db80a452eae4dbd96
SHA512 def51970a60d5710e3c52dfa3a4cd47a8b810bf2dc04296339eadd68009db4abab6b9cb2908bc21f45b91411d0f7420bc97db5de17aa06801e5e5b557d0c3e7e
SSDEEP 768:nVEwFkQKxEjxv6ceS4xNqGcmhu3izK4XQsQYkbTbNb7bz9m/:KwF3KxEjxvMS4mizWm
TLSH
T1BF232444EB2E513FD42802BADD951B102F78F889591A2FAB3B4C55686C872DC3D8E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 34c0376bbc63356b816b2836082b841ecb13c2036e2e1cbcda5753dfc7ec23aa
MD5 868dce071f28fc7e9c67a5d564603f65
SHA1 eb7640c70938e0e2cced1622711d84d36815a035
SHA512 9323366c41866e721bf79888d72cc509c17352261d65c52aa21d979405adc2d3484e7d3a0d044144239a7d02c3fe68b1f75c50bee763967b2105752891657a52
TLSH
T1E321678C3BB84D6AA89BE2AC7464138E53914E0708C71C4B8D42DE8DCDC5AE9326E538
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 5KB
SHA256 0640ea554d51662a841013c9a77ad594b1231b7922f4bddb124dc7d09c7972c6
MD5 becb9800c94640782719deaa3c31c3a0
SHA1 2e94f21eda38f2ebd7d2a9e20b8473a5c34d1c2b
SHA512 805dc6752c292e230d601a9bf0c9c5b36902e2cebf23f0685566816d38b0bf42cf0e80dfb7f5bc60f60d505aa40babfb345191cc310220717b8ac0b3d2323f64
SSDEEP 96:Dv5BYpV3poolpb4m7ldBO4adZG4msSK1qcUplT:DvobP7LBO4cZG4cNcUplT
TLSH
T16DB1111C76A94C7E69DBD39CB855038D42C94B0388CB2D4B8DD7DE4D8CCA69A321F639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09aa6b72-93fb-4793-a0bc-1d8beff88c23

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\09aa6b72-93fb-4793-a0bc-1d8beff88c23
Size 2KB
SHA256 d261b01f018753a8526b12df484d0155e040cc1fb203b94089dc69723fb46de5
MD5 6ec45f846f7ff6baa732494bdb678a76
SHA1 f20cb320e859d99b3026e8ba05757baaf565cee8
SHA512 31e85ddbdc5e567153d004312958ae517e1fa831175618705ffa7a5ec2a1542199f93a7ec6d5ba7981bdd2acd08777ff356ed967788b696fee0e8bf90cec802c
TLSH
T12041532C35789CBB5CCAF19E9452338E53644A0240C21C832E91DF4C8DDA7DAA36B427
MD5 SHA1 SHA512 TLSH

Submit Download

45c53c09-5863-4187-a316-08cb83626c1f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\45c53c09-5863-4187-a316-08cb83626c1f
Size 886B
SHA256 4bafa984b7a23a690fcde5b0d9989575b3c7e6726b82720e8b95b331639cb166
MD5 84e6dd7bc2d02aeac9116d3515976306
SHA1 e3e70cad24863145c4431381af19af3ddf69b20b
SHA512 7c33636fa7829cb5e43429a2c1afdd75e7fbf7cfec412f4ab305b5339d04ad84aca8e5ba280da0ac755056b79f9b37d51ebc1cf146f295f20d37f4dc5376b9f2
TLSH
T1581104518534B8F2DC28D2DB89A17B5287A47413C0C549083FA09E180EAA56EA35B717
MD5 SHA1 SHA512 TLSH

Submit Download

5df64a42-2efa-4b71-9740-1dd32f33f222

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\5df64a42-2efa-4b71-9740-1dd32f33f222
Size 16KB
SHA256 ba814234893749412f4d7d0f66229366828dde07f7cf106fb75a26d709b6c354
MD5 676795733370f5a3cd346817f31af6fd
SHA1 f52a84eb2449ceeaf61fd004ef572b6648b0dc2b
SHA512 185f6746c7dda644208ceba9afeab7c0eb1645cc65bf0bedc906a6f6f11cb50558b0cd8ca2c7dc78080c0f32fcb6ba0b138e5ec95fbbdcacc7eacc1503f454ad
SSDEEP 192:H0DrBNJuCuq4Ka8k5YxYTXhS4ZB2k7niNe3d1rfonYuidwB01+DFzx6iRJbK1CYg:UDrBSKkaGGY5w5l6iRJbK1DkYSEZW
TLSH
T15C72C916186049BA9251E3A894FC7FC3E6F538CF4C418FC99BE4BD486DDE06D512788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f94d759-6af8-4e5e-a41a-e0bcf8272b87

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\5f94d759-6af8-4e5e-a41a-e0bcf8272b87
Size 10KB
SHA256 56ad820aef5c7724843ec43f48ff001537695942bb49d0071c481b97bfd69b33
MD5 1af198d0b653e2927175d3b1ea574843
SHA1 04cc1427b0bc6831a5ac38a88bead6f83d244f52
SHA512 af4c6a0cbfb01d1a620179f9c390e96cc974610a3f0b1c8ff60178b78bc8908c2e4f02641e20833b4664bbbc0c9136a01e91e2635b47c03ae3389d96041bd050
SSDEEP 192:zS1dqbBhLbO4yZ44UhccpNr/W/VkjH6nQjVF7XX7ws:yORqUhccpNr/W/VkjHgQjVF7XX7L
TLSH
T1F322321D72794C7E689BD69DE456038D83894B43D8C22C8B8DD7DE0C8D9A69E321F236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dbea80f-89f0-4767-8c0e-c923db96f113

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\6dbea80f-89f0-4767-8c0e-c923db96f113
Size 235B
SHA256 4c0b5c3f963551fc47df32fc28eeb2143a8bef120379b41a9dfe0cae284d0d26
MD5 98a27779d8f8ffe18236011e492c4e4d
SHA1 11c30bb8cb8394839ca0b103f53a9d8bd9db0049
SHA512 38a8b27ce801b808ae41dfa91ec34e766b7effeb393468219eb22e5d20b7c530526b9dde0a9c6fdde1927d16d97036c3955cc9db16d4f08c44d8debf02637c9f
TLSH
T145D0978324E8232D0C002F0BB0F02AC630648C3310B07C1089A241B8CAB9EC842A3826
MD5 SHA1 SHA512 TLSH

Submit Download

6fb8f31a-4a12-44f0-8353-5a4b3089a61c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\6fb8f31a-4a12-44f0-8353-5a4b3089a61c
Size 235B
SHA256 1ca8f11c2daed396b35f16a7df6325dcd15798ca99c57d0cbce263d8c8c19978
MD5 c366f99776009f49d133238a6a3c4934
SHA1 8b7fa79a83c7c0610e84a0e2a4809205331a5ee1
SHA512 30f3215f5a6f58bf8b8765864705e55bd6e7ab2d517a49f73cff0db7c71b9adaf7e5aed2312ab0b9e30c943eb6ca347e7796523084889a528f8909b6ed7d4d77
TLSH
T1CCD0978024A8A31D88241F06F0A02DC270888C3320A89820EAA08634AFBDACA9225D1A
MD5 SHA1 SHA512 TLSH

Submit Download

9f3c5aaa-473c-4642-8539-da5c7eb58ea2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\9f3c5aaa-473c-4642-8539-da5c7eb58ea2
Size 1008B
SHA256 ec0dd50eed8a320f195b19fe400e04413e91b39d0ece0129f71b25f121b4eb1b
MD5 d9e0ba9bbbda741bf71f55ad8ea87609
SHA1 ddd026bec407e7eaa77888a9189fd5a784a82665
SHA512 ed18a3c85eb3ae1b0f87ed0539579d12475d5cff4d355bc80af057a0f852da9f62c95c559f535190182df89d252600d0cc6af64142b537bf1a74cb84c3357e94
TLSH
T1961132918520B8F29C7CE28B95B0375397F47113C0C50D083FA06F080EAA92EA79BB07
MD5 SHA1 SHA512 TLSH

Submit Download

d129f807-a70f-450d-8781-5e409a5a8da2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\d129f807-a70f-450d-8781-5e409a5a8da2
Size 281B
SHA256 882a59eb7d6bc42745ce16724666eb2f134e4d305607d02f6ba7d308735a3f13
MD5 391f2951ed123622c8d81f030d908f00
SHA1 13fc5f5e3ba6fecd5ec86b6e489353c71537debd
SHA512 ddb1e0e9a086e1ad950337d3cf4f97669aa2bbefe4ae5f453ab042cb0f07e5a491a1ea0947a1c05ccd90e4b0f9fac8785e06981dc9df98374d6b7ac01ae19807
TLSH
T113D0EBC0AC98636D0CA81F1FF4B838E330AE4C3322F60810958006B465FCED8420482A
MD5 SHA1 SHA512 TLSH

Submit Download

f360eb21-188f-4d97-9e08-518c1f802a3a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\f360eb21-188f-4d97-9e08-518c1f802a3a
Size 883B
SHA256 85a21e6c17abff03070b55db27afc5cfa37a9afcb103d2aeb99046e4ff918eb7
MD5 e428b64b7e5835ea9ef1c8e799cde80e
SHA1 202d82c5f67442945622568c69f8c81d3b6033db
SHA512 2faf77803d961f9d9cca050251acbbb15c18533467bc09f19be6d3bd933ab6067a524c0df31abcfbe3cf631a01d55bf3894bc1651444f085694d34a437f3ec96
TLSH
T134110081D630B9F2DD78D28B8A663B129BE47523C0C544143FF15E080E7A52AE35B707
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\extensions.json
Size 16KB
SHA256 b49d1b6f6fb074a46d76ea93534b5a7eaab342c228277a8e5dbe9309a74f77ea
MD5 540e92b43197a14c507be43a8b1627da
SHA1 55decdfc3bb8f1cf96bd651068ece31a9231317a
SHA512 09bdee9b72c7fbac15efa2a5329c1e443fac40ec6b1d03688abe23f6f96c0a5231be855c956fe9f3de3001ced8fc3d225146214804c3066c27631e64f8b3535a
SSDEEP 384:CkI4vDUmldvG8dhWa94zY96oRL4H5L4P1L4HtQL4HVL4HgV4ho:1I47RfrXX4Y6y4R494NS414o4a
TLSH
T1C372421545048EB8298FA79BAA367E01C37D473B60855C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\places.sqlite
Size 5.0MB
SHA256 5b7773d90032dcc8737d2cd7c283bdf44aacbfe454caec1e3beefa25c570845b
MD5 e04cb11ebdc249e99b14be9e46aa843e
SHA1 79a4f3fbac323873cfa10ee30cb8ebe6ed039d49
SHA512 a2ae179bd2f33c8b826e781672a69fe9761066dab4b8276997ddec710914f388d962fc0199d6431a1d356d35a062371f3406092835d902702adef220f81541eb
SSDEEP 384:M8r54w0VW3xWZhTxsH2WCA9nb3hdbNGbT:rqVW3otsmkzG
TLSH
T1C136C75B79619041C4EA9632BCF32B18583B6116CD3376D23D94252E0DE0B63B96CCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 6KB
SHA256 52ac0b0ad0133361493063f3b79943f1fc65396d41e17c35bff3d400b7793c22
MD5 fbf1d327e3114d9ca8dfd286e83e498b
SHA1 45255642b342a572b9ef96eb2534c0a262db2818
SHA512 640defb731fbd8a90d8fe73b214d4d558bc78e66d6fda0e5f063ed35324288d34f4aa2f6ec5d7b12927cd938861a9463e0a589f3ef4f4887af2b37eaeffce083
SSDEEP 96:xHiUTUAPqGqcUfCtBkzS5SSlrdv9jsnnHHCriDYzMgBw88H8L4cnHVjkGS:UwCRvfCtBXSSsCaYzMgBw88qM
TLSH
T1CCE12E3895088B7F74B6776C6C6888716AB2413BBBBF28C750B954C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 6d805916b00197b2c51f601ec831ed5734bdeb08e5ffb9750b44988d1252f977
MD5 f542e58dbd8809434bbdc03104e193e4
SHA1 8157d1d677a2261fe22406ee38e9f443f7c46942
SHA512 7a940bc976d59574f7e10a82a87d0d8e1a1bec8b87cf5bf27dfdf47dadc202f9eeb2aa57e661720f6a73165f2caf8e20e55394f3b0f68412911511e379ae705c
SSDEEP 96:xHiUTUAPqGqcUfCKjKnjs1zSPvsISSlrdv9j9nHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCNgavrSSrCaYzMgBw88qL
TLSH
T181E11E7894088B7F74B67B6CAC6888316AB2413BB7BF68D750B954C4054CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 12KB
SHA256 a227c9be1c2e6e4e7325b44f50ea5c1f39aed8864394d95ea5351978b8eaa639
MD5 a3b97ac7a637487a9d97539efacd2543
SHA1 0adf43d46b9b6df9a654ce0d192acd23c4374d06
SHA512 989fb2c0728a3923c1ba9be7effd1fe9e8de31af74ab23c4bcf8ccc59bfc05a80f6e5974a2c0b27553aaf5074e7777d56109eaae23e5f6ee69cee411dc800efd
SSDEEP 192:UvCRvfwtBTySwLR/T1aYzMMgBamA3Jw889FENiHuE:V9R/T5HgKZwHxz
TLSH
T12E42DD3C6104CBBF34B7727DAC244AB059610137BABFBCD641F98895099CF2451EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 13KB
SHA256 a4a6e250f876a400d214d8bb61baf729e97e86b94fa87adf65a38b62a594cb87
MD5 445ad5905ddc33bafe5c56b26816ce14
SHA1 f32e6ff611e2746426ebd341e516b1ea3257ba67
SHA512 6adca8b46aba7c30ebed78ef2c89dad95a087720914f59e38f65a5730e2cc016357a355d5ad243f327a1581d5f8f70c59effc3b338dec6f59819fdf21a1ff0e9
SSDEEP 192:EvCCROfwtBTySwLR/T1aYzMMUBamA3Jw887dENiHuE:f9R/T5HUKZwZxz
TLSH
T16352DD3C6104CF7F28B7727DAC244AB059610137BABFBCD641F98895099CF2451EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 12KB
SHA256 febb793bc90344712d7259ebab0e6dcda7e17d2a7277c8bc38c2d79c5525c425
MD5 9457eb9fb444d41a5a828d135a021f2d
SHA1 b59b49707bf46c9d25842f0f01220667b4f23f84
SHA512 409fe772ee6a52ecbba983b75ecd482df7122a2187f030a45d0a11fd24b7c3bc1b0f055416e286fe9439f193e806757d39a65cfa130866f3e285cdf80d91ae0f
SSDEEP 192:UvCCRvfwtBTySwLR/T1aYzMMgBamA3Jw889FENiHuE:m9R/T5HgKZwHxz
TLSH
T19442DD3C6104CBBF24B7727DAC244AB059610137BABFBCD641F98895099CF2451EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 7KB
SHA256 1d655afbe015583014adbe6beee52fe35289ef3363e5c9f83b2d5243bc232250
MD5 976f47c60d8a57c0c1dda265833b1598
SHA1 120ba90832a81cd1d0b349512c18f971b40a101a
SHA512 0113680207546ee9b313a56ef5ac9f921cf5441a79735fcde1af5170ce8464d573486aa4e3bf8c6468d0546ea1a8fdd2e68dc5dddf0785fb275f014370915d1d
SSDEEP 96:xHiUTUAPqGqcUfCtBNbzS5SSlrdv9jsnnHHjHhriDYzMgBw88H8L4cnHVjkGS:UwCRvfCtBESSsjBaYzMgBw88qM
TLSH
T165E11D3895088F7F74B6776CAC6888715AB2013BBABF68C650B954C4055CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 8KB
SHA256 1ff8e20e9fb0fe212b14a91da8f87d75e4178ba93dfba68e6d8692ed5d83db3d
MD5 ae16e4bc8f091bf350318b58342b4942
SHA1 959461aafe7d0e477d313a183b643ce9ad89b977
SHA512 e17022c3942dbf7439ce85b0ab68ed174546d684b39a3c462b1cdb2bbb274a5ff3916cfb1230ea5604d82659d38fada945b09b907874fa9e07c3ccd199e17475
SSDEEP 96:xHiFTUAPqGqcUfwtBNbzS5SSlrdv9jsnnHWR9BTHhriDYzMHBw88sG98L4cnHVjS:UvCRvfwtBESSZR/TBaYzMHBw88dgM
TLSH
T155020D38A104CF7F74B6767CAC2889705A72013BBABF68C650B984D50548F3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 12KB
SHA256 da4d11527e4e4ad5d0524cff2158f800aa4fdcbc297b1f7ba3c9b6b38f05d590
MD5 5be93fe2f97c19a2fe4eb91b9f85eaaa
SHA1 0bfd9f7ea8d44bd91b542cdeeeafbd527707a0e8
SHA512 5e4dd80a75d6ef13c18a5b3b09b05f09dba5fcbbd5897db61f3323bc8080cb79a5709525a78ab78efc8d96d5850b6aff156f2f773f834035b5413f09c3b96669
SSDEEP 192:UvCRvfwtBEySwLR/T1aYzMMgBamA3Jw889FENiHuE:VsR/T5HgKZwHxz
TLSH
T10E42DD3C6104CBBF24B7727DAC244AB059610137BABFBCD641F98895099CF2451EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 12KB
SHA256 6a3314c34ea33f6a47b22f1824dea02d9f375ddeb864518ac39670a596f15896
MD5 b8542b33b12970eea0d861690ac3f5d1
SHA1 558b0bd12c8a7f060e43c25642ebd44028abff40
SHA512 8c7dbb398e5d8e427dbd3c52e6592dc558b0e7b58ad1ad94f7c5723081453fccae125aa8bcef3a45f4366798723758c2bdb8b1e6bc7aa07725b272f3570e5b0c
SSDEEP 192:UvCCROfwtBTySwLR/T1aYzMMgBamA3Jw889FENiHuE:P9R/T5HgKZwHxz
TLSH
T14352DD3C6104CFBF24B7727DAC244AB059610137BABFBCD641F98895099CF2451EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 e64491b6e78766b1016ab2f795dd2fc4f75217cdddbf45e28763ec465c16c730
MD5 7ee7fddca9e06151f29c20ef818c0825
SHA1 074762b17eb06f7463da4afa2a9cc217c643ffa4
SHA512 55d68004744275f54f05a37a0d0e4fb7f324e3484efcbd72ca05dad55c2435f5e5d97b92fa17bf9d19b56a3998a28b74ce13282a0bf610f7cdf8aa57c2325c7d
SSDEEP 96:xHiUTUAPqGqcUfCtB1zS5SSlrdv9jsnnHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCtBQSSsCaYzMgBw88qL
TLSH
T18CE12E3895088B7F74B6776CAC6888716AB2413BBBBF28C750B954C4054CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 12KB
SHA256 c0103c78d19b1ba09b5c663784187cfe02b2118c06ac662c2ffa0b165f4c0f39
MD5 fd3465a5f3348a9ffb2fb3160159f584
SHA1 9e951592455360161b28f8567781b84159ea92cf
SHA512 19dbda4f0dd878c1e11190c30842fec8211d82227d389195c11208d8bcbdd274647cc32f6bd94e5a0182c15b4b3f96dc277dc038fde601b1895deb4762fe1a3a
SSDEEP 192:Dfh99ijAY8sntkkW0fzXnJHr3vDdXLa15sDzl/ybQoefw93OnNcB85JttnTZxc:bh9UjAYQU7ZT7daL0y2w93OSSzDc
TLSH
T1AB42C079B30775CBA520E1484D6A085049B23A07CBC80AEC960FBA3D8F76F177C7C265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 13KB
SHA256 7388c5bd8204c2fe1c7f03d02838710d5d8c9a1eda0944c3cbfb67e7e3f34ae1
MD5 4c328df16ac96409482c14e8132b5fb4
SHA1 5f6bb429e3b789850bb5903068272549148eeea5
SHA512 9796432b1f2590890d64de2b253c120ba1759f31e0347938f249cf67f57773a1719b00c3dccc79d8765830fd6ad9322ab6b39ff6fb66ed77b3f3585139fdfe15
SSDEEP 384:mh9UjAYQ6ABt3T7daL0yy/+2KOSSztjPh:BA56Y5dEty/+LOTZPh
TLSH
T17052D07DB20671CBC517E6148D6B1C4485F23B02CAC80ADC914FBB398777B1369BC659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 13KB
SHA256 f128e588ede8001af2ec5fd75ce34f123cd40388b5caa50b82a32a4b4cd96606
MD5 dd0f0615d7649c68c0ea1bc2642d3fba
SHA1 4e3ce761b9b2e96deb327f618e4b702126dd311f
SHA512 6bf7777f48877363e8922d68ba18541eb9d391ea67bb748b39e453fabf91339c5dae7ccc5983dc6152020fdb3cc157d0b416373a97d984bbbdaff9e83d980d3a
SSDEEP 384:Dh9UjAYQ6Ast1T7daL0yHHW2OSSzqR+Kl:KA56X/dEtHHbOTxc
TLSH
T17052CF7A730674CB9416DA044D590844C9A23F0689C806EC954FBF39CB76B4779E8269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 18KB
SHA256 c0e5d08e96732d72c283d41e255389a85ded72f9e2aa8aa771ff14aea46e4cf3
MD5 e499149cea3c80eb13767f8381bbcc09
SHA1 0cd1509fca523f373817ea0158717e44371ccdff
SHA512 2d226aa42dabb30accdb01223c1a12c1f25daf35d1cd0333f0c63b722512a35772d932ae924435e3f15bea4e940e02eae58a0cac61255d2e7ccc491af99e5603
SSDEEP 384:Lh9UjAYQ6A6t1T7daL0yQ+8QE3Z4qjJHAVTCNLOSSz1wxh:yA56v/dEtQpZ1gQ1OTZwxh
TLSH
T19C82D03F725771CBA503DA148D8F08098A712F43AAC409DC560E9B3D8F77B632A796B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 b93d2ab073e36cc00cd06a79e8402a512e7832014e7d25770533f12e2ade38de
MD5 43215da77a225261bcbce905254d9b6f
SHA1 6967302804473637a738ae509e5147628c39ac2c
SHA512 fdc8f1147fdbd335e3f04f07deffa737c40c3f0d4ed520da670eb5d7955d9664216cec3dc01e517f5fbc0879392e8604f1373d7fcd07c3d5bb73ccc7e03f375b
SSDEEP 192:0fh99ijAY878Iqlv/VnJHr3vDdXLa15sDzl/ybrnD:Ah9UjAYPlH/T7daL0yfD
TLSH
T17702AF7EB501B6CA0270F50089952A5C8BB25F43CAD806588B1F793E4BF4B2B7E68609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 d608aab9b38511a2957604a3af919905815bb3b96dd4f7ea8fe8b21a51b8a278
MD5 982ab16bb8b422b64658ab1b88a617c5
SHA1 de09cf3a291e038f7af71f01223b8d3287954430
SHA512 73c5a554dc7aef7cc616b2cc8c5c6e9b39e6abc489c9681ec6993d7fda8dbb518db3326e3c16c0f0da083c79c3bb51aaba0bf551457543a486a11dca80db202c
SSDEEP 96:y2729lB6DVIMiO/PRsw3v5dQFQXLep75z5sIYzlRMMv7pKrbjcsyld:y19lcnJHr3vDdXLa15sDzl/ybS
TLSH
T12AC19E6D721825E59A00A314415A15C8CB335D539AC82DFCFB4FB93D8BB8F277DA8709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 12KB
SHA256 3850f5b60ca3dc4665d84c59a1b362b1f4aa74bed9d5a2ab9ee4f815d96aef9e
MD5 23614a078fef6195b197f5de6935cff6
SHA1 a9d540d4645e14e8f0a9aae656af660efd4b0253
SHA512 94949b04b8e757338635daeec69c05ce932e38ed5cf128ad245ff1fd86afed77f8771df63634e05abadb605a64be39f0fc40b79bdfee6903313290d4a97fcbe2
SSDEEP 192:mfh99ijAY878Iquv/LnJHr3vDdXLa15sDzl/ybRSh0ZOnNcB85JttnTZSk:ih9UjAYPuHVT7daL0yFa0ZOSSzQk
TLSH
T13742C175B30775C7F571E0048D9A08644BB22A0BCAC809EC964FB63A8B75F1B7D6C266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 12KB
SHA256 bee34c8a71410bd188c5cc0a6db4b0bdab8869e7cbfcd0385eccd7522c7e05d7
MD5 de9a0c5e77f4f6dcf101d003b18dac4d
SHA1 db93f079a5f7a78b0f4f977846d2fb515d35de86
SHA512 71db81201fbc88a677ac0509c97a7dbb08d9d75a0c144f0a82a57204d90c6b6ae5dac49ea60c6aefa6a2990a9719d5716cb685116a4c7a10ad61ad2d43076aa9
SSDEEP 192:Dfh99ijAY8sntkks0fzXnJHr3vDdXLa15sDzl/ybQoefw93OnNcB85JttnTZxt:bh9UjAYQ+7ZT7daL0y2w93OSSzDt
TLSH
T15442C079B30775CBA520E1484D6A085045B23A07CBC80AEC965FBA3D8F76F177C7C265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.jsonlz4
Size 22KB
SHA256 e2f225e3c048b1ae93d65fb26766a2b3640773063622a4f65dc99257b5ff9634
MD5 fede95b5302b302197a86bfd65c349ff
SHA1 5865c4c49a00188ada19306ee6debe15d446fdad
SHA512 08fe72254c5e0025ada27103f2dd1878f6082e0a285df34fe7fba0b2091be2105dcf42afacdf2e9f35bd8ef20c735377488480b0b467687125f7ac3ad2870f9c
SSDEEP 384:Vh9UjAYQ6A6t1T7daL0yhsy3I9JuVbdCNNZ4qjJHAVEGjAOSSzUX:gA56v/dEthjIzuBdO3Z1gWKAOToX
TLSH
T162A2D03AB19B21CAE5065554C8870C1C89B33D4392C48EECA54EAF3B4F3672339726B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.0MB
SHA256 74cbc0aa78d349330949b8b96064805160d85f857cf23828f3e07f470655f74c
MD5 0fa6161cf5a5bf747d7216e59f3acac6
SHA1 f7d89298a51f67758dbd821d3c24e6e010cdfb5d
SHA512 7507fc211fd65654152c653f9a6a2d480419f7100899ff233a2e05866977f057a14d3b6e658b78017aca0167b1eb810ea37bc021c9821d672bf2e58a652c06db
SSDEEP 49152:3mkHRVaAIoW8zN6wlTpxnlxqLNPapTi82wRIKQuqSq4AuYzIYtTNZeafURMyTyJH:VbMOyTMALp3wzrIx
TLSH
T1D0565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 680c77e6c92e149291f828a4c67d71561a559c356c429724e0e8b3204c4acdff
MD5 4415adeb514f42698f3f097cca6d4175
SHA1 59ebd071b4de4e197d7cce29f024c34795d6f903
SHA512 8fa0afa8d59d1a63a3d08329ff63e82f55abd13538667a530a4877d83f5192b1007dd25f71d207eee44acad98367f5e32ce518c9e7ae77806d4ecf23c85d2b26
SSDEEP 24576:dCW++tIdfnUarz63BDcYrVQpQ9pyi9P28lQyzH:djUvUs6pcYrVEQ9p39P2+Qyz
TLSH
T1F7F53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.2MB
SHA256 ac4f9e953c7f51366ffd1c9c7b74d748df08b42088cedf0e230d17da02445ab4
MD5 c158e1860fb542d7fa4ceefe94743a31
SHA1 a75352e2ad6eb910d0ad4c100ade160462f0e28e
SHA512 83738c99eaadfb3a5dbb6967da3a2b7bf3ff2b91b8b206dcf636fdb66f879253816ab77746e463f9ac92eb09e26ac570f70628842a334ed2b2fe17030bbe830d
SSDEEP 49152:li8aYUOH3TyJVMAL4Cr7pbwfYr6pJsEXBNAd8:A87jyTMAL4Cr70jsg
TLSH
T13F464CE860D1A243F38580B3B58993EB21FFC00C60779E4457A856A9E574CEF8E177AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/584-5611-0x000001F3A3330000-0x000001F3A3450000-memory.dmp

Download

memory/584-5695-0x000001F3A3330000-0x000001F3A3450000-memory.dmp

Download

memory/584-5701-0x000001F3A3330000-0x000001F3A3450000-memory.dmp

Download

memory/584-5703-0x000001F3A3330000-0x000001F3A3450000-memory.dmp

Download

memory/932-5612-0x0000021D08C20000-0x0000021D08D40000-memory.dmp

Download

memory/1824-1904-0x0000019107E50000-0x0000019107F6E000-memory.dmp

Download

memory/3876-5615-0x00007FF620A10000-0x00007FF621A10000-memory.dmp

Download

memory/4988-0-0x000001B067D40000-0x000001B067E60000-memory.dmp

Download

memory/5908-5617-0x00007FF7E92B0000-0x00007FF7EA2B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads