Analysis
- user interaction
yes - max time kernel
148s - max time network
147s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20251017-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20251017-enlocale:en-usos:windows10-ltsc_2021-x64system - submitted
11/05/2026, 22:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://celebrated-fudge-7f6414.netlify.app
Resource
win10ltsc2021-20251017-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://celebrated-fudge-7f6414.netlify.app
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target http://celebrated-fudge-7f6414.netlify.app
- Sample260511-2m2c3sbs9x
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1052 firefox.exe Token: SeDebugPrivilege 1052 firefox.exe Token: SeDebugPrivilege 1052 firefox.exe Token: SeDebugPrivilege 1052 firefox.exe Token: SeDebugPrivilege 1052 firefox.exe - Suspicious use of FindShellTrayWindow 19 IoCs
pid Process 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe 1052 firefox.exe - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 4080 wrote to memory of 1052 4080 firefox.exe 83 PID 4080 wrote to memory of 1052 4080 firefox.exe 83 PID 1052 wrote to memory of 2548 1052 firefox.exe 84 PID 1052 wrote to memory of 2548 1052 firefox.exe 84 PID 1052 wrote to memory of 2548 1052 firefox.exe 84 PID 1052 wrote to memory of 3408 1052 firefox.exe 85 PID 1052 wrote to memory of 3408 1052 firefox.exe 85 PID 1052 wrote to memory of 3408 1052 firefox.exe 85 PID 1052 wrote to memory of 3408 1052 firefox.exe 85 PID 1052 wrote to memory of 4752 1052 firefox.exe 86 PID 1052 wrote to memory of 4752 1052 firefox.exe 86 PID 1052 wrote to memory of 4752 1052 firefox.exe 86 PID 1052 wrote to memory of 4752 1052 firefox.exe 86 PID 1052 wrote to memory of 4964 1052 firefox.exe 87 PID 1052 wrote to memory of 4964 1052 firefox.exe 87 PID 1052 wrote to memory of 4964 1052 firefox.exe 87 PID 1052 wrote to memory of 2528 1052 firefox.exe 89 PID 1052 wrote to memory of 2528 1052 firefox.exe 89 PID 1052 wrote to memory of 2528 1052 firefox.exe 89 PID 1052 wrote to memory of 2528 1052 firefox.exe 89 PID 1052 wrote to memory of 5744 1052 firefox.exe 90 PID 1052 wrote to memory of 5744 1052 firefox.exe 90 PID 1052 wrote to memory of 5744 1052 firefox.exe 90 PID 1052 wrote to memory of 5744 1052 firefox.exe 90 PID 1052 wrote to memory of 4696 1052 firefox.exe 91 PID 1052 wrote to memory of 4696 1052 firefox.exe 91 PID 1052 wrote to memory of 4696 1052 firefox.exe 91 PID 1052 wrote to memory of 4696 1052 firefox.exe 91 PID 1052 wrote to memory of 1900 1052 firefox.exe 92 PID 1052 wrote to memory of 1900 1052 firefox.exe 92 PID 1052 wrote to memory of 1900 1052 firefox.exe 92 PID 1052 wrote to memory of 1900 1052 firefox.exe 92 PID 1052 wrote to memory of 3928 1052 firefox.exe 93 PID 1052 wrote to memory of 3928 1052 firefox.exe 93 PID 1052 wrote to memory of 3928 1052 firefox.exe 93 PID 1052 wrote to memory of 3928 1052 firefox.exe 93 PID 1052 wrote to memory of 1428 1052 firefox.exe 94 PID 1052 wrote to memory of 1428 1052 firefox.exe 94 PID 1052 wrote to memory of 1428 1052 firefox.exe 94 PID 1052 wrote to memory of 1428 1052 firefox.exe 94 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://celebrated-fudge-7f6414.netlify.app"1⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://celebrated-fudge-7f6414.netlify.app2⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27100 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {0fd2c4e7-8576-4f16-bd45-f559d110b9ec} -parentPid 1052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:2548
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27136 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {c75f739e-54a3-490d-91bf-e1c7ebf89f0f} -parentPid 1052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:3408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 25213 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3868 -initialChannelId {eabd75ca-760e-4975-b4b2-ff2f97e2bdf4} -parentPid 1052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:4752
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4016 -prefsLen 27326 -prefMapHandle 4020 -prefMapSize 270279 -ipcHandle 4120 -initialChannelId {0e2c44ec-c084-4db1-9147-458acd29a64b} -parentPid 1052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:4964
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3160 -prefsLen 34825 -prefMapHandle 3020 -prefMapSize 270279 -jsInitHandle 3024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3116 -initialChannelId {7660bd12-b937-4a8f-aa3e-364109b272cf} -parentPid 1052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:2528
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3292 -prefsLen 34960 -prefMapHandle 4492 -prefMapSize 270279 -ipcHandle 3116 -initialChannelId {c8133881-ef18-4caf-8c74-150a8ff7b537} -parentPid 1052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:5744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5368 -prefsLen 32952 -prefMapHandle 5372 -prefMapSize 270279 -jsInitHandle 5376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2748 -initialChannelId {11a08213-212d-4c36-8565-2fdff0c76aea} -parentPid 1052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:4696
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5548 -prefsLen 32952 -prefMapHandle 5552 -prefMapSize 270279 -jsInitHandle 5556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {5938890b-0752-4b7a-8eaa-a89bfee133e8} -parentPid 1052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:1900
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5568 -prefsLen 32952 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5736 -initialChannelId {f509745b-229b-4d6c-88eb-2961f59ce795} -parentPid 1052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:3928
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4748 -prefsLen 32952 -prefMapHandle 5052 -prefMapSize 270279 -jsInitHandle 5092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1632 -initialChannelId {07a27e23-6062-4640-8df0-2560792cd4c8} -parentPid 1052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:1428
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
- Size 13KB
- SHA256 e45f13ec637e46c37299e498a49d70c2cc4db5f3a0a3d8bdf874d42e4e507477
- MD5 44ea4f98476d5d9d71e1b672bab09e68
- SHA1 69ad0abd3192d2c6c4dfc60e6eccac6fd2da90fc
- SHA512 1c1319572d7ae1232f2fb93228c91bcbb102e5d461607cbc0ebaa57360e27cb9c44e2c4d5ebb3e590d74949b429c71ae726497f26fe5ff52fac0916a71fbc3f6
- SSDEEP 384:HHMO0iO024Y/o6J+Sl1xDnZBPsac4j0lpDII+NdLXdLMK:nrZY/o0+Sl7zZlsac4ID8LL
- TLSH T1F8527DBD9F0138E91A17D1D4D9BD92048D08A6BBDFD280661A543C04CA447B9F4E64DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\28c03efa-645a-4010-919c-1bb38c59f7c4.zip
- Size 3.8MB
- SHA256 6ae235b8ff5729383d3cf219320341b1456ad9c47696a519535abde34bc06004
- MD5 22d280b2b7cf41f372676e1ad87a2788
- SHA1 c191fa824f41a7785a4e4423e3bb19debeb9fe76
- SHA512 0dcee546cd38ec992b9d4b722c96e5c20d42ec3efdf4c48b865ef1002662e6ddd274fcf259649fda5d9516e567c041e36b8bda2723a9eec852738708ec15043c
- SSDEEP 49152:5trtdv2tUMTenCTqL2NQTpkMXjumT8XwQzqiUlUsPPMLvzhOF3myTIvIeOX2hxNr:5tr1C4FtkMp89JUlUEPMZOPTLmhxNsK
- TLSH T19A06E135F67C9708CDCF83BA810E2FD29C4C5F6680D8A57B6A6AA5715CA31E21F448CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 18.9MB
- SHA256 92ac4503d850d61341c2b89b0ca25ae45a875f85e7ab7018354cef9a0b37bba7
- MD5 ca2e152cdecfec8997a5467b9c3ce569
- SHA1 abfefa098053f20577c867069ee2fa02c768c907
- SHA512 7b07d200b5a5dfa88e22cc293be9f9fe0f26e3b927ca0222958c08db650590907bba852083562577b49f58edae676594ba4a1d8163bf07f102311a77694c0c8e
- SSDEEP 393216:YD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5o:rGD+l8VmuZ/S24/junfSFwUqYg4z
- TLSH T18B17E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\datareporting\glean\db\data.safe.tmp
- Size 30KB
- SHA256 72b655aa494c30f593ffffbb8151699d7d2984a818b976068c8a5c236585d149
- MD5 271732ca524ccaf181e10508cf5a6c86
- SHA1 f12db3588331917f10a63b0b2791970a95589533
- SHA512 b8af30a54509fdba785288ef1ca7b672c708d05ec7c005b3c32a15d3787abab0fc44721ac7fd5a83e7877a6826e2b051b0a26a7a2d7c1403390cefcf4c4b0c86
- SSDEEP 768:kPPJoDv3jzAmz38V+Gcmhu9FJK+EkEqvb2bIb7SxSs:HzAmz3Y4J/A5
- TLSH T1A2E20084FB2A953FD41512BBDCA50B042F79B88558192FAB3A4C646C6C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\datareporting\glean\db\data.safe.tmp
- Size 30KB
- SHA256 26bd0ea5d402fea2da10aa84382f7338af382195865c3ed6feb7dcc937dee067
- MD5 e7c18ac01c2845ee02617a8acdf7366d
- SHA1 c46cc7e6edfc803da17ec124da81df5eb3d38430
- SHA512 fae2aecacd21b537434e6de2e8a17477570124337605c7c8994ae27d7c99c520bd98cd4807d3e152f833344a84b1468eeee097380425f1690a716c09171cff56
- SSDEEP 768:azAmz38V+Gcmhu9FJK+EkEqvb2bIb7SxS+PPJo3v3J:azAmz3Y4J/A2
- TLSH T1A9E20084FB2A953FD41512BBDCA50B042F79B88558192FAB3A4C646C6C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 d77197a99dc7fee0d1f1aaf768a51b92c380c17b221e367fca980a2492d675a6
- MD5 f3667c528e05db9b89b927037c9570a3
- SHA1 7867ddbaffea314455e4fa064a8b6a46b1aa0afc
- SHA512 4bf86605b69d71d546067e32ebfe575935576e4c033c4f59552eb77a0cb30d5fa8161f2abcd98ccdae3d432c608aa03ce24ad66418623f819a693408247453ef
- SSDEEP 192:9mW6vOv5zbozbkjdvyj9mLOY1d66Joz1zgCl6mSSdz:wJAbozb2dvyj0Cyd66Joz1zgC1bd
- TLSH T199D1CC28F629867FC454023BCCA21F400F76399B985E7F1972EC64092D972DE7A8D17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\datareporting\glean\db\data.safe.tmp
- Size 3KB
- SHA256 4c18fb33395ce4cb87bf4981d6f1ba1d1dceae86951157ae0271338eed6a01cd
- MD5 00613f7286da4c70449b25fc6e05067e
- SHA1 83f3ec41704219c634623dc88cac33ffefffa068
- SHA512 8475592bfe8f2a7e5683271ddc6590a0acb4498133f9f5475b21d44188d6d1b31ec2fbd3fefd750e4d5c08285a4c874dae3812fdfcf659ca9caf65e963c53292
- TLSH T10861A959F629463FE049413ACC925F412F347446E8AF7F2A39ACA14D1E5B2CE3A8D07D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 fd41a1786a221b9b9a88c8c2b5374b78d6c9ba9a5aaa21016c0bdf9d4130eaae
- MD5 1e23e60439de89f8a5da2d831e98bc1f
- SHA1 a5e963528b593b8be7ef2ceaa466dd833a336fb4
- SHA512 2e3fdee459872cee2a09de39848ada66541a39081bc53b861bd5cda3068659ae497ffb0729654d58912a615786f51b0420bd9c66793e45df8a5efe7782b7d12d
- SSDEEP 192:UY1d66Joz1zgCl6mSSdamW6vOv5zboALZkjdvyj9mFx:Uyd66Joz1zgC1bPJAbo2Z2dvyj0
- TLSH T192D1EE28F629867FC414023BCCA21F400F35399A985E3F1971EC641D2D572DE7A8D17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 278a1dcb7899aa50d156fe0e2904efbf43e96b658c3db908e3adc8b5e2a085ab
- MD5 96f63a640cb65e8008cf3e0f4602ce1f
- SHA1 d93e130f2c2ad55e893ce09c303df24189112b63
- SHA512 9fff65dcb0c2bd546442d407e43d0a15cf9b1016f48f6066fa53025bad5e716b8cc6b677731ce27c6d78f1a74454e2be14c637b8267aedefe20ad58b5df0969f
- TLSH T12E217FDC3AB84DAA5ACBE2ACF450128E93918D1708D71C430D62DF8DCDC5BD9326A43D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\datareporting\glean\pending_pings\269393f9-8292-435a-9066-874392cd4bd4
- Size 235B
- SHA256 2476968e3b755e40ee413c2d9adde39bdef7bf6b572c56991e82605d621b0ed1
- MD5 6bbcd59637455d34fa6cf008d4d85aae
- SHA1 a6c3929c3b4a560283c2994ba9dab483eabed423
- SHA512 4ec3da2ed3c091605c9e61105504f03dbe7e1c0051c2126feb5b652c82b9f3ee1b99ddeae1b0525d231258f9818cced24632d0fd53a460eae1261c44b03c51d9
- TLSH T14CD0978424AC235D08055F0BB0E0BDC234484C33546068A0D6A2C1B89ABFAC4429AC0A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\datareporting\glean\pending_pings\3d4ad458-c5b5-497d-a1fc-b864360c23a1
- Size 16KB
- SHA256 71ef2d3227a9ff3326498397a58336dda89a6aa999d1410300f8dc234dda3e86
- MD5 071ef821cc80df232de1cbd51d89e834
- SHA1 c5f1b68b720f7384398f7f4683e3ea8c3a0550a0
- SHA512 224b5977cf78fdf9636718f3ebad376afe8f495c35f2b4fbbb06139cfc42aae4e7afd59c899ec15a6a38fc02bd9405469d80f1faebe628c65b8ff04a54ae0f08
- SSDEEP 192:EegKez1RfGySP5R4TBBg11mvFMPwodoQZxA0y4JcDAkK0jsvBLT1+V2Se4TKVj+e:E1KeBRuySP8TjgBLgK0y2V2/4T6s2
- TLSH T19972CA166820557B8291E36894BCBFC3E6F528CF4C428FCA9BF4BD086DDE46D112794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\datareporting\glean\pending_pings\3effd656-adff-41ee-a2f6-8b4cc9c29b66
- Size 235B
- SHA256 020c67f1887237131d8c879a448b336708147f3170bfc4eb8e6562caa2295fa5
- MD5 58b25950980d43cc03059c8c7588eb30
- SHA1 7b9be07e8ea630e709ec0d70e9d44383499fab8d
- SHA512 3cee792e2daf83660a5607a36225b25ac1daa7f16e26ea35f9fc359e52670ace503bb5eef8dc0540d5ca38a1f321a543cfb9d9f9b7ef57b16ea6ff814ed50aa4
- TLSH T1BDD097846888236E48181F13F1E069C630484C3324786860EAA04638FBFADC84191816
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\datareporting\glean\pending_pings\9f7bae01-b484-45b8-9200-447c3a8188d0
- Size 883B
- SHA256 0beaa3af202d83a0cc9a604ad4f6c2c17481a111ed9a488a7c2fa7e83d20d550
- MD5 4447ca7918685b01383e37e0a1982a57
- SHA1 a415dc88395c28b5d6aedb20892d36b506394b93
- SHA512 9a42acdc51b670d318b395ceb98b1565071d04753469d75cbc97698976e3a43b25a6da5c250f2dfc6439b7b2728dea60a4ba403b5e86599b1cac71fde46d739c
- TLSH T11E1100409B34B5B3CCBCD34B899577469BF46A2380C689187CB159080EAF61E976A30B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\datareporting\glean\pending_pings\a08e6700-f0d2-4fca-9133-56bd93db87e4
- Size 886B
- SHA256 de312d15806fcef1aa09624b44d7559a881baf62014012e270fb9a344251955f
- MD5 35f06245b752fb840f3b6706a6bed396
- SHA1 16897a93b8cc5667343627c7e51f3cd677c08065
- SHA512 d24893cf9a5a83ba03fb9b091874d6275504b2e799e0c1023c094d782a07cdb4b346fc4c1e429d8a9c9122a357bef4756ddd8af5e379ad42af4617d8c3a23d30
- TLSH T10F1123519B38B5F38C78D75B89E1B7428BF46523C0C95D247DA18A080DFA11E676630B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\datareporting\glean\pending_pings\d249fa76-c838-4081-8e8b-3089e9a65824
- Size 2KB
- SHA256 ad56bbe8a9be755040eb9e70fbdfae582a7ab3309de9abe2bc58b2092d0ff389
- MD5 602723cfb524c1d40a7051465d26dcc0
- SHA1 5c2879272dbce3f2f9d6d99bf2e797410eaafadd
- SHA512 4490e7ab9bf8da7c816ff775c87f3523560e9aaaeb2f0b2dbd5170c691a83bdf055ac3a8a55ee131ce15b6e21deeb708c599fe6fb47ea2c95339c9539591bca1
- TLSH T14E41F06839788CB78CEFF55DA492334A97608B4300C26D576D92CE0CCC9679A236B52B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\extensions.json
- Size 16KB
- SHA256 33972f0fbc9387582770bb93c09d9605b41d7ecfc7c1dadd4a0d0004c51d1039
- MD5 0f3ecd5c5abfe6316eeac8e6f9572e66
- SHA1 814736c7ca3dde743ee008711a3a9faea7421ba8
- SHA512 ecb2f519e256f76b400e8fa1b4f915cdaa6dc9e59ed6c5e272fdb9d78682ece85ba6d722a39f8aa8798549752d23720824d2be6adca2d1f89bb2602866870617
- SSDEEP 384:NkI4vQUmldvV8dhWb94zk96oCL4HCL4PdL4HOL4HkL4HH44hb:uI4YRfmX64c6n4Q4V4U4e444d
- TLSH T1BE72401545049EB8298FA79BAA367E01C37D433B60845C78F4DD8FC842FB5B902BB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\gmp-widevinecdm\4.10.2934.0\LICENSE.tmp
- Size 499B
- SHA256 55064d7d8fecdd90ba36cebaff34f05583c183b34686b17b40b974442fc07523
- MD5 d8a9bfce875f2081d41dbb18dc618b14
- SHA1 5bc4e44bd455d8838fc382b5a5525aff1a117e4b
- SHA512 643b0befb7244283f08188fafb2e7f96cdf82353d06ca5c0b25ad0157eabe786809677c876faf3b12888a8c3ce38e97c8090505b06c514370a16c955db3fd8ee
- TLSH T14DF09E7EBA224772459603C7011540D47B1707FAF25422D1B358C1E4276E27982FF184
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
- Size 1001B
- SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
- MD5 580786a5ec9eb650dde3e0e75db8588a
- SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
- SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
- TLSH T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
- Size 18.9MB
- SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
- MD5 15fa9ea03f6f451d587b1dabb2f7b036
- SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
- SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
- SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
- TLSH T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\prefs-1.js
- Size 8KB
- SHA256 40ed83fcdb41853dc0e2d0164ec9e73a62b51c1fed09befb91f7c99344b63987
- MD5 524c9ace9b2131a686b7c164ab58e094
- SHA1 4576d14ed1ef5592edc5a3dd7f018703aff8589b
- SHA512 a665ed5c1c63bba539a9dbe209b52e247514b6e83b2d1cc4972725200ffc9a18ac25c14f9a07548497347b010db740afa86f507b6faa954b84be7a603a832c89
- SSDEEP 96:xHwkKlTUfqGqEfQ3GObzS+pSSlodv9jKn8WRMNauDBw88lZ928L4cn0CVrvGRGS:STREfQ3GYpSSzRniBw889TNu7
- TLSH T132022F7C9108CB7F79B636ACAC2449745AB2013BBAFF68D710B94489054CF3441FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\prefs-1.js
- Size 6KB
- SHA256 4424a20063a60c352ae1413c82df07e5c8d253cfc06ac4c82c2122cb0496801b
- MD5 db6381420822d1de5fbfae50725304e9
- SHA1 6ed3d1c98b521586395e7389fbfb2d2368c4c122
- SHA512 9f4a6ab909e11d381065effcfdfd3f1b14376c7353b358afb50e07461506549c9ddec275a23bdada856f1a528d7f741c5a7d4b3ddc7e841c35c58a9ded50abaa
- SSDEEP 96:xHSKUTUfqGqEfB03G1zS+pSSlodv9jKn8HO30Bw88P8L4cn0CVlvGU:ZiREfB03GfpSSWO30Bw88sXuU
- TLSH T199E12F789408CB6F64B6776CAC6888316AB2413BBBBF68C750B54484054CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\prefs.js
- Size 6KB
- SHA256 36ef39df5feee80f0da73400f60c7342abd0ab2e4ec980b2f9fb7e7fb948505b
- MD5 046da5e18c74cfa3a51249ca063534a9
- SHA1 3c2d6120ba6cfdb6512902489d1307e9c616f528
- SHA512 5251ec8d2296f2dd4cbcb56e8b413ddcdf2fca0f780146a3cf4ff11a2d6aa0ad6e86e214ea0e9f1483cb50097f34bd1c9d9711c08b3430e503b0a87138320f9e
- SSDEEP 96:xHSKUTUfqGqEfB0Ktnp1zSnSSlodv9jxn8HO30Bw88P8L4cn0CVlvGU:ZiREfB0GpWSSRO30Bw88sXuU
- TLSH T1EDE10E789508CB6F78B6776C6C688C316AB2413BBBBF68C750B55484410CF3486F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\prefs.js
- Size 7KB
- SHA256 2db90d58e18066c3ac2cf569c3be6a999da891b0e3affeaa4615e0100b3e64a6
- MD5 a2c12d179d4e49d1d440882e40d24439
- SHA1 a7099d95ba409d83dcff6691ec4388822c4395f7
- SHA512 9eb11c9c19a7b74c67024c87c21df5e459127e850ef75be67a9658c3b6f958efb93e44b71de7adbf0c972fdbb5ff6b0d02a22b647d8f81725780c3f17a4d0782
- SSDEEP 96:xHSKUTUfqGqEfB03GObzS+pSSlodv9jKn8HO30Bw88P8L4cn0CVlvGRGS:ZiREfB03GYpSSWO30Bw88sXu7
- TLSH T1CEE120789508CB7F68B6776CBC6888316AB2413BBBBF68C750B54484014CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 85aef6d68e6b8fb35a512bfa627fd7b8d14ee06a4b8875a000660fb2f48daa8d
- MD5 4f40ab215a87c0b23f861729b3efe7f6
- SHA1 74fe60f96561b7766e37558a195afdb5da51fb90
- SHA512 5689d94777fd7c3377218d6cf8235757f6b0ce15dedf5ed89db7986b743915549a9f21462e1b3cb6bd9e54f69ed53f0819a340702d9e5a57c1b16283c627d7f6
- TLSH T1AF21E9D03645BAF95221911CD0CEBFF5C64E212E417240E4D5656D0A476D54F72FD20D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 3.3MB
- SHA256 6723fa76739b10aefa252133a59ed2e4ca91c184fc37615d7a470ee7149af893
- MD5 f8d6b01ee894318f5f5ae73efd85f493
- SHA1 fb7616b0b7939eea20367a4c58f2f37bd6a003a1
- SHA512 0318f164b5ead3a905dcd586e00821559c2a6c6de50d0d20eeaec6750336418d2aa80956418c65fa71bd36096a769368662b518fcbd6efa5068503fe188c3fa2
- SSDEEP 12288:i+GtHTFntv3peI4Z5bjdiQ1sl3kGAFHVDl86Z6hoGAd0YjZzslbXAl6hNi0Fjg:iTtHx11BEsl3k3E68ozOYj2XAlgb0
- TLSH T1A1F53BE860E2F247F3824073B64993E711EFC00C5037DE0447A956A9A578CDF9E56BBA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 11.4MB
- SHA256 28ad92c69530a9a3f200c8ccb027a2b142ce41a1cb37daf3d662b15fbf141652
- MD5 b52d9d995585932ee8203133546d95b2
- SHA1 a40be17b4398ce5afc34dab2aeeb687785aa8e34
- SHA512 34891c794086ccda74763d9555b251d5743d89e38b195da18726f84caef28184aacd2f91f58a36c796c6106714d0096dde599fe01f515e975a9a5eb4bc3af656
- SSDEEP 49152:LkNChDswbfZuPC+SrYwCYuz2ADrZpqmhUzMg2N:wNChDtICR6zrnqmhGMNN
- TLSH T1E7C6089270E4DA92EE0086B6F30F43DB353FC2CC24D6859419B8B95C596769BEE2F314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 12.8MB
- SHA256 f1a28d83d094bf81dc3ce73761e2b71818e99254861550b1795d60dc9660de8b
- MD5 0d0f359a33c260335c369c4835a0114e
- SHA1 3e35d6ed5a336762e04cbe63d3a1298b34552d6a
- SHA512 4190f097ff91c96ec6f0349af281c26c69396d29b86703aec6eaedc38e262218689e3a6a7def500699cff67bc5af9f57f1aa83814298f0497f3fb3cc95a9db9a
- SSDEEP 49152:1MX1hDs0BZEWtTj5VY28oqpp+iD8CYsz2Iai2vidhUdMtHyKICFNxDIa+pXUHR85:mX1hDnztTtVY28oq1L12adhsMVyj
- TLSH T127D6399270E0D692EE0086B2F31F53EB313FC1DC20E689941678B56C596369BEE6F354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0t1t4qz9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 12.9MB
- SHA256 b8c6397374e97f479f5250418579f76b80baebd026796ad6d29b87b03322a875
- MD5 1f5237f5dce37fe59f3bc74103283616
- SHA1 503c84f92ccde77c838a657979e2f152ceda8a6d
- SHA512 3e1b27b5853c9358a6a3547d86794a71530b6647d8c0703ddc6da84a9b0df3fffc2a09e7ebb4d0083459f5a014b92758ab73565faf979e1e156f0ecedac14e28
- SSDEEP 49152:/tL1hDc0BZEWv3Ty5VY2jwqpp5x4CYsz2Ia+2lYdhU7AVKKC3FNxDIa+pXUHR8aO:lL1hD3zPTYVY2jwqLL92+dhmiK
- TLSH T106D6299270E0D692EA0086F2F31F53EB313FC1DC20E689941678B56C596369BEE6F354
- MD5 SHA1 SHA512 SSDEEP TLSH