c73e4f4bc52e74694831e982b5592fd194376e981174a1a6b99f7a21c3345e60

Analysis

user interaction
yes
max time kernel
121s
max time network
124s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
03/05/2026, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3.27.0.exe
Size 38.0MB
Sample260503-jjq4tsdv21
SHA256 c73e4f4bc52e74694831e982b5592fd194376e981174a1a6b99f7a21c3345e60
MD5 a87ec1ed0bb4be89949915621f399945
SHA1 cc83b08d9448edc00448c89fe1cb1fb911e02dca
SHA512 35bde2f26315aa9ca350bde751adbf2e2790843aec0e1920d8c2b99ae7fd0f5f63e845b7bc2d1f2d6b1452867c7cf908af93b72cafd1821d02a8549fd7717d54
SSDEEP 196608:NfTCiRPUgD15Ex43oy3TEGe/q2MxYSWkVbj0WNqQAGG:NJBUoUSqJiL1AWNqcG
TLSH
T1AA976A47FC650CE1E5ADD134C66295167B713CAA8B3063CB1B20FA246F7ABD05EBA314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	firefox.exe
Token: SeDebugPrivilege	2024	firefox.exe
Token: SeDebugPrivilege	5992	taskmgr.exe
Token: SeSystemProfilePrivilege	5992	taskmgr.exe
Token: SeCreateGlobalPrivilege	5992	taskmgr.exe
Token: 33	5992	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5992	taskmgr.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
2024	firefox.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe
5992	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2024	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 2024	1608	firefox.exe	99
PID 1608 wrote to memory of 2024	1608	firefox.exe	99
PID 2024 wrote to memory of 2416	2024	firefox.exe	100
PID 2024 wrote to memory of 2416	2024	firefox.exe	100
PID 2024 wrote to memory of 2416	2024	firefox.exe	100
PID 2024 wrote to memory of 2744	2024	firefox.exe	101
PID 2024 wrote to memory of 2744	2024	firefox.exe	101
PID 2024 wrote to memory of 2744	2024	firefox.exe	101
PID 2024 wrote to memory of 2744	2024	firefox.exe	101
PID 2024 wrote to memory of 4136	2024	firefox.exe	102
PID 2024 wrote to memory of 4136	2024	firefox.exe	102
PID 2024 wrote to memory of 4136	2024	firefox.exe	102
PID 2024 wrote to memory of 4136	2024	firefox.exe	102
PID 2024 wrote to memory of 1544	2024	firefox.exe	103
PID 2024 wrote to memory of 1544	2024	firefox.exe	103
PID 2024 wrote to memory of 1544	2024	firefox.exe	103
PID 2024 wrote to memory of 3572	2024	firefox.exe	104
PID 2024 wrote to memory of 3572	2024	firefox.exe	104
PID 2024 wrote to memory of 3572	2024	firefox.exe	104
PID 2024 wrote to memory of 3572	2024	firefox.exe	104
PID 2024 wrote to memory of 4372	2024	firefox.exe	105
PID 2024 wrote to memory of 4372	2024	firefox.exe	105
PID 2024 wrote to memory of 4372	2024	firefox.exe	105
PID 2024 wrote to memory of 4372	2024	firefox.exe	105
PID 2024 wrote to memory of 4220	2024	firefox.exe	106
PID 2024 wrote to memory of 4220	2024	firefox.exe	106
PID 2024 wrote to memory of 4220	2024	firefox.exe	106
PID 2024 wrote to memory of 4220	2024	firefox.exe	106
PID 2024 wrote to memory of 3988	2024	firefox.exe	107
PID 2024 wrote to memory of 3988	2024	firefox.exe	107
PID 2024 wrote to memory of 3988	2024	firefox.exe	107
PID 2024 wrote to memory of 3988	2024	firefox.exe	107
PID 2024 wrote to memory of 3312	2024	firefox.exe	108
PID 2024 wrote to memory of 3312	2024	firefox.exe	108
PID 2024 wrote to memory of 3312	2024	firefox.exe	108
PID 2024 wrote to memory of 3312	2024	firefox.exe	108
PID 2024 wrote to memory of 4192	2024	firefox.exe	118
PID 2024 wrote to memory of 4192	2024	firefox.exe	118
PID 2024 wrote to memory of 4192	2024	firefox.exe	118
PID 2024 wrote to memory of 4192	2024	firefox.exe	118
PID 2024 wrote to memory of 1176	2024	firefox.exe	119
PID 2024 wrote to memory of 1176	2024	firefox.exe	119
PID 2024 wrote to memory of 1176	2024	firefox.exe	119
PID 2024 wrote to memory of 1176	2024	firefox.exe	119
PID 2024 wrote to memory of 4444	2024	firefox.exe	120
PID 2024 wrote to memory of 4444	2024	firefox.exe	120
PID 2024 wrote to memory of 4444	2024	firefox.exe	120
PID 2024 wrote to memory of 4444	2024	firefox.exe	120
PID 2024 wrote to memory of 4700	2024	firefox.exe	121
PID 2024 wrote to memory of 4700	2024	firefox.exe	121
PID 2024 wrote to memory of 4700	2024	firefox.exe	121
PID 2024 wrote to memory of 4700	2024	firefox.exe	121
PID 2024 wrote to memory of 5680	2024	firefox.exe	122
PID 2024 wrote to memory of 5680	2024	firefox.exe	122
PID 2024 wrote to memory of 5680	2024	firefox.exe	122
PID 2024 wrote to memory of 3004	2024	firefox.exe	123
PID 2024 wrote to memory of 3004	2024	firefox.exe	123
PID 2024 wrote to memory of 3004	2024	firefox.exe	123
PID 2024 wrote to memory of 3004	2024	firefox.exe	123
PID 2024 wrote to memory of 4592	2024	firefox.exe	124
PID 2024 wrote to memory of 4592	2024	firefox.exe	124
PID 2024 wrote to memory of 4592	2024	firefox.exe	124
PID 2024 wrote to memory of 4592	2024	firefox.exe	124
PID 2024 wrote to memory of 4140	2024	firefox.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3.27.0.exe
"C:\Users\Admin\AppData\Local\Temp\3.27.0.exe"
1⤵
PID:3552

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:636

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5008

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27100 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {875e6c56-343e-4494-9276-cda32bce46a2} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27136 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {22dbb209-361f-459a-8579-dc0ac20b4dcc} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 27277 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {6b5a6b93-e09f-46cc-9c9b-165aed375e7d} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3924 -prefsLen 27277 -prefMapHandle 3928 -prefMapSize 270279 -ipcHandle 4032 -initialChannelId {d82c1eaa-69e4-4100-bd0f-9541d905c846} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1632 -prefsLen 34776 -prefMapHandle 2976 -prefMapSize 270279 -jsInitHandle 2980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2828 -initialChannelId {88e3758e-78de-421e-b955-115a2d7012f7} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4904 -prefsLen 34960 -prefMapHandle 4908 -prefMapSize 270279 -ipcHandle 4800 -initialChannelId {e9e6d862-d09d-4f44-b8c6-8bcbe9b30cbb} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5224 -prefsLen 32952 -prefMapHandle 5228 -prefMapSize 270279 -jsInitHandle 5232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {310ed26d-a174-479c-a816-583b6a88d43d} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5432 -prefsLen 32952 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5448 -initialChannelId {1a99a96d-5cd9-4d09-bf1f-18ac3563893d} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 32952 -prefMapHandle 5628 -prefMapSize 270279 -jsInitHandle 5632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2880 -initialChannelId {090ffcae-2758-469d-b4f9-e37ad1116558} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6252 -prefsLen 36621 -prefMapHandle 6304 -prefMapSize 270279 -jsInitHandle 6268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6080 -initialChannelId {0d32e58a-ced0-4457-9f5b-76e42a81febe} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6132 -prefsLen 36621 -prefMapHandle 6204 -prefMapSize 270279 -jsInitHandle 6196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6148 -initialChannelId {d99646d9-21e4-4227-8763-02b06424e526} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:1176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7452 -prefsLen 36621 -prefMapHandle 7456 -prefMapSize 270279 -jsInitHandle 7460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7468 -initialChannelId {4da00f03-f9ec-4bc1-9eda-f6ce4827e4b5} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7496 -prefsLen 39713 -prefMapHandle 7072 -prefMapSize 270279 -ipcHandle 7340 -initialChannelId {1d1333fa-f435-4d48-8935-32bb7a8acc39} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:4700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7080 -prefsLen 39713 -prefMapHandle 7124 -prefMapSize 270279 -ipcHandle 7440 -initialChannelId {d0692952-70cf-4868-b5a1-49b1ada53e54} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    PID:5680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8356 -prefsLen 36621 -prefMapHandle 6276 -prefMapSize 270279 -jsInitHandle 6264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6288 -initialChannelId {6410302f-f751-44b4-a26c-c943e8e21162} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:3004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6028 -prefsLen 36621 -prefMapHandle 6016 -prefMapSize 270279 -jsInitHandle 6008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8376 -initialChannelId {431d93c3-afa4-461e-b644-2ecf3695c79d} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8572 -prefsLen 36621 -prefMapHandle 8576 -prefMapSize 270279 -jsInitHandle 8580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8588 -initialChannelId {6d7ac88d-3c49-47e8-8937-302d01ae03f7} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:4140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5720 -prefsLen 36621 -prefMapHandle 5732 -prefMapSize 270279 -jsInitHandle 5724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7844 -initialChannelId {75e67e63-0bf9-453a-88b1-d0099ff1c8ae} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5712 -prefsLen 36621 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 5692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8512 -initialChannelId {e80400fe-8c23-4bb3-b09b-aa8b6b36ae2f} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:4656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1652 -prefsLen 36621 -prefMapHandle 5712 -prefMapSize 270279 -jsInitHandle 5688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8512 -initialChannelId {006d49ee-3c35-484d-b35c-23b1dd9bdec6} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:5860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9132 -prefsLen 36621 -prefMapHandle 9136 -prefMapSize 270279 -jsInitHandle 9140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9148 -initialChannelId {4fce13c4-8caf-4df4-bba5-a0428eb0f9f4} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9164 -prefsLen 36621 -prefMapHandle 9176 -prefMapSize 270279 -jsInitHandle 9132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9140 -initialChannelId {6ec17a3a-0dbb-476c-aeaa-a573818a6c3e} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9640 -prefsLen 36621 -prefMapHandle 9644 -prefMapSize 270279 -jsInitHandle 9648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9624 -initialChannelId {d8120610-4a98-46c1-82f6-4a447efcc1fc} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:6192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9320 -prefsLen 36621 -prefMapHandle 9316 -prefMapSize 270279 -jsInitHandle 9628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9848 -initialChannelId {a4170e01-6c35-4d5d-830e-86fa1e12f991} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:6200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9984 -prefsLen 36621 -prefMapHandle 9988 -prefMapSize 270279 -jsInitHandle 9992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9964 -initialChannelId {ccc008aa-7664-4e97-8aaf-b21be4635d2e} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:6208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4924 -prefsLen 36621 -prefMapHandle 4884 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9848 -initialChannelId {45a92673-b1b4-4857-a92a-0be1376021d7} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    - Checks processor information in registry
    PID:7056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10392 -prefsLen 36621 -prefMapHandle 10396 -prefMapSize 270279 -jsInitHandle 10400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10340 -initialChannelId {37fb3fa9-6f78-4f03-acf3-9d453bff9975} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    - Checks processor information in registry
    PID:7064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10528 -prefsLen 36621 -prefMapHandle 10524 -prefMapSize 270279 -jsInitHandle 10520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10416 -initialChannelId {4a7d7d25-e31d-4558-ad01-d48206fcac5a} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    - Checks processor information in registry
    PID:7088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10656 -prefsLen 36621 -prefMapHandle 10696 -prefMapSize 270279 -jsInitHandle 10416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10764 -initialChannelId {c0f77fb6-0315-48b0-b0cf-5de71c5a6a4a} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    - Checks processor information in registry
    PID:6884

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42wc9zy9.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 4f08e04f6eb006e9ae59ef74c077972578fa17f532d1e1ff370b760999a20891
MD5 4e81ef2173b0b576c7224fcbb3a55bc3
SHA1 8a88ed4e239dc6a68f600f05dda57f688eb3a986
SHA512 0eaeea41f99d4f8c3548324f45c64bed249759a241e1f8ada03364dbd9dc311ec9c70cd738da2b0eea4cdc496e276cec861753855fcc052021bbf565beec728c
SSDEEP 384:HHMO0iO024Y3Fuhw+5EL1pPsac4j0lpDII+C868d:nrZY3FuK+5EB9sac4ID8L9
TLSH
T1B8527D7E6F1138AA1A27D1C4D8AAA218CE04E6FBEFD2D05615043C45C684778B8FA4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\AlternateServices.bin
Size 37KB
SHA256 aea79f1eca862adcc8c0a98602db68d0f4882df1394ac865abe7595df51b0677
MD5 0e539ad3d940323804643517f14e0a12
SHA1 7126a3fa00fea2a3796bf4058c1e89d2102ec5eb
SHA512 6013ab820bf35de54b2f63ecab9d7e2005196fa0533b50e2ab72d3198a2be8c3a10606c0d1d1efeaa2dbeaeafb312cb9ea57862bcbf8fcf3291651e595ab108f
SSDEEP 96:b4L2uOMSnziBeGkyuLZFuDtRpiczk2Ze7Kt7ZdEBEbELyg:kVOYILZ8Dt5k2ZeWt7ZyugLyg
TLSH
T1DF03C3FB82B26252E1E54F70049E75ECC8330B0A98A452C99B24E0D706D27A4F17FF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\AlternateServices.bin
Size 10KB
SHA256 42d82aa92fabe951a243ac3f186ca6de8b1e1cd166db045888306789f668a3e1
MD5 5f415675c0d675341828e48551eb1211
SHA1 ad1ec2a1146e39e6adcefc37a3460c08b1800e98
SHA512 591afedd5f5a2b5131a3743a5d99ab6ded8aff26be3825dcc53f6f15eea43d9db81f43b81044c56d7e862781813cbe805db1324799fb53d8ba13aa9aea85a5a5
SSDEEP 24:BuhMZP+lzDGo8hUGn5GlKR5qVez7BBxUBB3PFgf:b4D2uk5U6nzTEa
TLSH
T10A22B2F783B35291F0A54FB054AD74DCDC330B1A58A152C58B11F0D60AC1AA4E17FF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 8d33033fc9e26ff2bc9682a072d6ed2badaa7ddedaf78348bb459fd67c90c7f1
MD5 6edd5c2c6e36e11afbce2b2c07d39ad2
SHA1 a16fc282782ecf23439041ae8505a563eff23554
SHA512 a79e028eb5c19ed4cbf18a1ceb14ac58e9841d9fc2a955b8811ce6b5d459ddb4a215912ac3f074c0a9870fc52375df63701328d92e4aff7a79808c3b7d63e377
SSDEEP 384:QbCijL9Qhg78CtGcmhuP5ONK1CrrYb8bGTUd66Joz1zgC1jMbonyvyjW:Qbx9kMGcmhuPCK1CrrYb8buBPuBJ
TLSH
T193D21184EB2A953FC41513BBDCA55B002F79B88A581A2F573A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\db\data.safe.tmp
Size 138KB
SHA256 9966671b6fc4a7e2949a68eaed97054552d63ebba1cb8afda0201e4e95788836
MD5 169c7ddcb74ed8c75412ce1469e46dcc
SHA1 257937ff5e09789655b01c0a0adfeb13ef2c63c1
SHA512 671a5dc74e56713f07f3c6776c59bab707782657164691b9c9c0ef4a329b4f3a793745342cdc628b9cc03d287156cfcb56be0dddcd1b9b69d998964829135569
SSDEEP 3072:mjMrEjwYaL4U0zX+eGHq/KjNsDkat96094eWM2:mjaEjwYaL4U0zX+eGHq/KjNsDkat960q
TLSH
T1EAD35AD4DB27407BEC1085BFB495673C2625F4314A599B0B2AEC04721DCB7BF2D0AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d5bf3f620dd74ad745aa0da22e74dfcc3e6bdcfb194154657dcf88d2fec32dfa
MD5 f7f00af7905b416aea1f3e8e25c09dcd
SHA1 720a4a79efaf12096147dc4861e9bb989dcfe28d
SHA512 bafa60fad9351a16e0943f903aaddeac678bf78f006ce72bcb89ebda081b41061efb6f2dab87d33e78ccef7f09b647238fcc239b2c2c719b25c682bfe8d0a8d9
SSDEEP 192:ulWOv5zboFZIzvyjBkxg1d66Joz1zgCl6mc0dz:EboFZyvyjnd66Joz1zgC1jd
TLSH
T1F4D1DD68E639963FC414023BDCA51F410F76389AA84E3F2631DC640D2D972DD7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 622f234e4dbb3faab346b26f33f978209f269cdcdf0615c06aa20b2f1869e00e
MD5 8258c18d588c83f1bac539ad283c2b25
SHA1 8786494c9cec8a0e2bde5d46f82d6a03c5a28433
SHA512 94a71b7da2ce130c03a4c78c8c0f9cab10d7f9be3e97b12f6cdd717492688d5753daeb3b698b6f71040da9f99361fcef763ba34a0d31685af7d88ac551384947
SSDEEP 192:21d66Joz1zgCl6mc0dClWOv5zbogZIzvyjBkxI:Qd66Joz1zgC1j2bogZyvyjp
TLSH
T185D1DE68E639963FC405023BDCA51F410F75389AA84E7F1631DC640D2D972DD7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\events\events
Size 1KB
SHA256 696c017a6fa5fb9077dfd1cfc6a832ea7d28e93c926a76665a5bbf1b02595652
MD5 e84913f01ee74b45c779023f19ddcfb1
SHA1 b6b27aebb89b8f34d9dec2954700b03c517780dc
SHA512 edda1c171ed8ac5179e43ccff41d2a571c310d074f3de8c75ce9d0e8a4f13c88cd9f55e7c41b36308f1f14300ef5d8a4e02b780b506e6be2b0b1059fc51974a9
TLSH
T112216D6C3DF84DAA9C9BE26C7846029E53104E0648C71C830D02DF8CCDD6AD9316987D
MD5 SHA1 SHA512 TLSH

Submit Download

03ba637f-aa82-47d2-a9f3-63a8193aa247

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\03ba637f-aa82-47d2-a9f3-63a8193aa247
Size 2KB
SHA256 0369e0feed37866c8d9a8b22fd147217ec2b5148b19f58eab17ca13f1e8ae7e3
MD5 323e25db429541bd460e0609275cd31d
SHA1 08653611b9c11ca2571986d51da83d2f870c8925
SHA512 1a6aaebf4b5ba9247308b1bc2077d74c2dc113861d8c03164df54c9e781effbafce26cbedc6db39a85c8a939a40ba8b295ffbf63649214fac7773395619241a6
TLSH
T13941445C35B48C7BAC8AE55D94C2368F53A0492710862D431E51DE0CCDE66DD73FAD2B
MD5 SHA1 SHA512 TLSH

Submit Download

09a970a5-9ffd-48d3-8406-ef302013bffa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\09a970a5-9ffd-48d3-8406-ef302013bffa
Size 235B
SHA256 e69c68b7ddd8afecbddea39e658f1277549619e229601d1f5b845bc487ff3197
MD5 ae559f62442eafebf6e3b229dab44487
SHA1 d42cf3718580602d0ba0353de045815e43885fee
SHA512 200ea5705e911c0f630e8043eeb69cbe7ac8800ed905c815ef3ff4b13bb8dad4cd2830db739772c9ada3ba1f6dee818d1577fc37a60c36b74b35e98cc5c74883
TLSH
T1F9D097852898AB3C0C100F0BB8A068C630C44C331070E810999142B8D9FA9C80122C0A
MD5 SHA1 SHA512 TLSH

Submit Download

0a1d5a53-5494-4b5a-a52e-150f6a25399c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\0a1d5a53-5494-4b5a-a52e-150f6a25399c
Size 886B
SHA256 b3ebf36db087ee05dd0b17af5fce10efbd0f32f70b106bd62ce76c216fb769c7
MD5 a936386e92d15f495bcdb00601237e86
SHA1 17dc12bac4b03b3801f93521e9f9b4f59539c068
SHA512 49299f0909f1984b1a93e93f682ea2f197fd1883b0ff3ba9616e8d777d0ca1c40895cd16b613abe3ffc8312e4e61dd5147683d8df1c18ac288d5f21e5ebfeaf8
TLSH
T19E1123908675B9B38C2882AB95E17B534BE4313380CA5B147EE15A184CFF12DA76664B
MD5 SHA1 SHA512 TLSH

Submit Download

1b63d83e-7c9b-4b59-8f32-264f5447717f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\1b63d83e-7c9b-4b59-8f32-264f5447717f
Size 2KB
SHA256 ccd9d09534d0ac58e1f8b2eb0615cac03570e2382b1a8444793a33e20795be61
MD5 33ffd91a47946903351b33e0d4ead233
SHA1 d5e5bd475d7245f537f08a2a48762837b211a484
SHA512 28d1228e0a986e459cbe269e03cbff11898f90d39f72dc5cf427e53133effc43dcdadbd5630dc71644ed464c2169f7ae01830a6d2ed4191d78defade40735043
TLSH
T1525195658160D87EC86DA31BD8603B838BF2140A508F294EAEECAE0A157FD1E9359645
MD5 SHA1 SHA512 TLSH

Submit Download

6cca6762-dbfe-4f7d-8a8c-3b8ab54fcc5f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\6cca6762-dbfe-4f7d-8a8c-3b8ab54fcc5f
Size 883B
SHA256 04cc264fb2629416e67c0f4824d05aea732e4218ee673c6a0dbb7a5258ac461e
MD5 b2df9be5307fd1514693642b9a1ba8eb
SHA1 7cfc08e5ba93a3f44b58c571be36cea83ba9dfed
SHA512 bab6a43a5ec48db4cd14b803d607f9267065e46eef5bb2b2afaa5c1dfe48865b5b86cfbb001c9767e19db422220125b36a5bb5dbbd14d4f82b66f0d9ca6f7d10
TLSH
T1CA11C0C09631B9B6CD68825BC9D57B434BF4752380CA95143EE15A080DBB52EA35A68B
MD5 SHA1 SHA512 TLSH

Submit Download

a9c2ed14-09a1-4b29-abe2-847fe24efd27

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\a9c2ed14-09a1-4b29-abe2-847fe24efd27
Size 235B
SHA256 129444c41134464800e0647745256b0c398e67cfa1acedf33264f3567f8b9726
MD5 df329ae19b5d675cb2dbc04b25ce1e44
SHA1 9bfb9c9eef1fc5691b9e2850306373e99aee916a
SHA512 ff9ec331ab22ca8f9b145f3115f1b5d404d7def9b0a3b569fa5ab8f841e5742306a44a73f9548954bafc22898b2c5d15066c64d809b727f0f77a206c89b06fe3
TLSH
T141D097C064AC6BAE08100F07B1E079CA31888C3318A05850CA9180B88ABDACD415181F
MD5 SHA1 SHA512 TLSH

Submit Download

c291ff1c-098f-4528-9acf-b67245b978c0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\c291ff1c-098f-4528-9acf-b67245b978c0
Size 17KB
SHA256 e9c99c764ae88757c5da7cd1f83c8798492dafdfb171a3477bb84819397ddd91
MD5 b8b788d4ab7c71a13cbd72d8cdea84bb
SHA1 4eaab089133a620b07fec81e87285ebebc0dd130
SHA512 f83817ff52053bbbfb4084f242e020cd73ca5db4540e51fcd5ce98b0d6e815fc60b3273ead3b1ec080bc859e9385d706c535ee45938155fd4670c43ebda5e3c7
SSDEEP 384:5a1IU9XBNAtcNi/oXGNWf4iyEkbjPPP2wO6KdOdqsSAxE:5a1IU9XBNAtcNi/MGNWf4iyEkbjPPOwI
TLSH
T17882F3EDCD1300573E65E52DF1A6AEAB2057293149DCC7CD6AFC083A36D69BB4223358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\extensions.json
Size 16KB
SHA256 18538585815366ad7c401c476073bbff636cf38360180da3ae3adf7d0df4ef24
MD5 8631a019858ee04f482345f4f28c6021
SHA1 8f4c04b359c2deb9b475a8bb739815f614e2aa15
SHA512 1e8793989889e73b3c18399ddce002a58ce8d00f78af8f3bb598a2b75b6ebf932cab85fd9a1a0d52ab8759bdcdb24ea0fa2cc477e73bb2fbe6a2807abb08e5b3
SSDEEP 384:ZkI4vYUmldvS8dhW+94zg96orL4HIL4PpL4HnL4HQL4Hwx4hM:6I4ARfHXD4I6Q4q4J4r4y4k4G
TLSH
T10C72321545049EB8298EA79BAA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\prefs-1.js
Size 8KB
SHA256 1f5198373f45f046db714e4dbd4edcee4a10f3960168dba99fe64e42e14a0bd8
MD5 7e3b45e3d02e6b7f119289c39de0891e
SHA1 4fc3023206a7e734841d49ffadefb6ab12b153c0
SHA512 846aac1067f70745cbb10054d7156268c5bd27353e8d811d3db647bfb836e3476ae0175f3dcc2c892cdc4ac2f9aae576278e43706f00c935e8e629ebfb1a9cc8
SSDEEP 96:xHbh8pTUIJqGqMfeTeObzSlUGdSSladv9j1nnWRZxhI639LvBw88vUFZ8L4cn+VY:1h8ARMfeTenUkSSDRd5LBw88kdJq5
TLSH
T14C02EB385014CB6FA8B6367CAC698D715A72013BB7BF68D610B944C5058CF3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\prefs.js
Size 6KB
SHA256 ec195d7bae997bb7d24b247c3fc1e9afff9a3a1d186624fab587a89477f12435
MD5 8b34232c10a05e3c1d6686cf26bc0782
SHA1 089020279497ade4aa42cf706f030a89b1a19494
SHA512 8ff6611ca36d5ed2ebb298b8003b5081bda5feaaf4f64392dc0a1815436c3b0ea1a27213904774d831027e8e762c771ebdd595524b56156673f5e843d042121e
SSDEEP 96:xHbh8UTUIJqGqMfZKjenjh1zS/9mSSladv9jInnHNhI6395Bw88P8L4cn+VvfSAv:1h8dRMfZttQmSSvf55Bw88DJqK
TLSH
T168E10E789008CF7F74B6776C6C6888715AB2417B7ABF68C710B54484051CF7842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\prefs.js
Size 6KB
SHA256 a28d9fd193e610f5a53cd5322eaadf44f43156df279a05e4d9299b8fe50f354b
MD5 fdc9f4599b8e9dc894b9d66bae44cc23
SHA1 32f5fa0e9e3459b59841d475a36a0442261e0272
SHA512 f57540db6f977050ea3d528f055ed0f6c6d9d8f33d93af7a03027b34a55040d2a6e1153328b9faee89de10fb40830032ff8c8a675367004958e790c782efb003
SSDEEP 96:xHbh8UTUIJqGqMfZTe1zSlUGdSSladv9jInnHNhI6395Bw88P8L4cn+VvfSAv:1h8dRMfZTewUkSSvf55Bw88DJqK
TLSH
T174E10F789508CB7F74B6777C6C6888715AB2013BBABF68C750B54484055CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\sessionstore-backups\recovery.baklz4
Size 928B
SHA256 75f1a7f769dc023d7e58dbe311930276db391e12ede2abf88d15106472b4b877
MD5 baaf7bbc74a8afad651fcf8a05a01eb9
SHA1 a5d91fc989bbd6e471d4e5ea3c3614273496abc2
SHA512 f8041b8d82295edd2f8d0f6a25209acfd65fb2494d68568b4387e5af4d5e1aab3d871f59b89c7a1c664148898318008378d2ab5bf3d6f91b032892ddf12aaf0f
TLSH
T1531184DABF7F6C621A55D00688892BF4CAED205312AC54E0F50E6112578C25FB4AE28B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 7faeb225e56ca758ca252a60222441b7e0906947c35921b2aa3673555a7afbee
MD5 323883459e1270dfe13025a617d6aa51
SHA1 7f6b81a382af01e0065c2562e008f48ec00ac409
SHA512 bf7a2160e8cf6bdfda7dcf65f833826648d70af0f26c1426b516e2ef66c9e133f1b5dbc7f7c6d8f9a63dd9ce2fd4e1fefa05759bae21671f7f324c640f53811b
TLSH
T1E9613D87F5D65E9285C6E402E4CA81A1FC8B0456A32405D8FD0AB210C64C3FFF1BF389
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 61d78b728cb6116969cce2a3c04281c6ecc48f5474593d1eb5b5b59212e2eced
MD5 445767082d29dcad5dbb81d2a0facc4c
SHA1 80f06d16b2a9e8e77436ed91365713fbea7b4906
SHA512 92acb4e7add7b231cd569945eed617c76f5b7bb54e3889d329ec3beb9544e74be12e7faee7737e1df4c7db83343cfbf10cb4fe0a261721000367ab135ece853a
SSDEEP 192:37vMz2hj8KeZixVdFk16TE+woeXCOVZGyMO+2jF7W:L0qhYKeZT1qwocZGyMc7W
TLSH
T198E1AF47F69ECD93C5CD9827405B5142BD9B049783090388D286730745EEFAD94BA3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usage

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\storage\default\https+++www.roblox.com\ls\usage
Size 12B
SHA256 9f6f414faee8eb1932409e6daeab173a56a7bcf5ec4eb784b41ed60aa1d69975
MD5 da9ff369a2d857ee2ed2be560208725d
SHA1 171972998a3e1db18abd49531bf8efa8d1747023
SHA512 59da772e6f984df166e8c6552374afb5e87a22a18ed3e05b22d994d99d671a182a49922ff7ec0d739bcf995f563202a02fde92cce082df0ada3c6e9a2909d6e2
MD5 SHA1 SHA512

Submit Download

memory/5992-343-0x000001F0568A0000-0x000001F0568A1000-memory.dmp

Download

memory/5992-342-0x000001F0568A0000-0x000001F0568A1000-memory.dmp

Download

memory/5992-527-0x000001F04E260000-0x000001F04E6CE000-memory.dmp

Download

memory/5992-340-0x000001F0568A0000-0x000001F0568A1000-memory.dmp

Download

memory/5992-352-0x000001F04E260000-0x000001F04E6CE000-memory.dmp

Download

memory/5992-339-0x000001F0568A0000-0x000001F0568A1000-memory.dmp

Download

memory/5992-338-0x000001F0568A0000-0x000001F0568A1000-memory.dmp

Download

memory/5992-337-0x000001F0568A0000-0x000001F0568A1000-memory.dmp

Download

memory/5992-341-0x000001F0568A0000-0x000001F0568A1000-memory.dmp

Download

memory/5992-331-0x000001F0568A0000-0x000001F0568A1000-memory.dmp

Download

memory/5992-332-0x000001F0568A0000-0x000001F0568A1000-memory.dmp

Download

memory/5992-333-0x000001F0568A0000-0x000001F0568A1000-memory.dmp

Download