b82d7c17ba185ba7786eed068469496a64554131007517d5b42ce4dea59705cf

Analysis

user interaction
yes
max time kernel
389s
max time network
394s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.jpg
Size 5KB
Sample260511-pyk41sdv7l
SHA256 b82d7c17ba185ba7786eed068469496a64554131007517d5b42ce4dea59705cf
MD5 a441543a5f93193a6317201df2291913
SHA1 b1bd010db11ec60fb7a10274cdad1dfa4c3183b7
SHA512 cd656aad16adf4a8ed885a79892369fc2447ed108190951c30330345e530fd3b495b56532ef74d12498aac787352267a3c5ac88351b54d9297dabbb6c4f1885a
SSDEEP 96:b4KaIAeMl1flXPCoIYkXNbXkYKlqSzLroyUhw0W1jLOrD+5M:lKeQpPCioNbUYKlqwvoyUhw0W1jyuW
TLSH
T130C14B973501433AF3E9B8F635370DE4550106A3199693DA2A7675A0D88EDD1A04CBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

google persistence phishing

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
238	raw.githubusercontent.com
239	raw.githubusercontent.com
240	raw.githubusercontent.com
241	raw.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
360	4660	firefox.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3508	mspaint.exe
3508	mspaint.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4660	firefox.exe
Token: SeDebugPrivilege	4660	firefox.exe
Token: SeDebugPrivilege	4660	firefox.exe
Token: SeDebugPrivilege	4660	firefox.exe
Token: SeDebugPrivilege	4660	firefox.exe
Token: SeDebugPrivilege	4660	firefox.exe
Token: SeDebugPrivilege	4660	firefox.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
3508	mspaint.exe
3508	mspaint.exe
3508	mspaint.exe
3508	mspaint.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4660	4560	firefox.exe	93
PID 4560 wrote to memory of 4660	4560	firefox.exe	93
PID 4660 wrote to memory of 3992	4660	firefox.exe	94
PID 4660 wrote to memory of 3992	4660	firefox.exe	94
PID 4660 wrote to memory of 3992	4660	firefox.exe	94
PID 4660 wrote to memory of 5044	4660	firefox.exe	95
PID 4660 wrote to memory of 5044	4660	firefox.exe	95
PID 4660 wrote to memory of 5044	4660	firefox.exe	95
PID 4660 wrote to memory of 5044	4660	firefox.exe	95
PID 4660 wrote to memory of 1224	4660	firefox.exe	96
PID 4660 wrote to memory of 1224	4660	firefox.exe	96
PID 4660 wrote to memory of 1224	4660	firefox.exe	96
PID 4660 wrote to memory of 1224	4660	firefox.exe	96
PID 4660 wrote to memory of 3468	4660	firefox.exe	97
PID 4660 wrote to memory of 3468	4660	firefox.exe	97
PID 4660 wrote to memory of 3468	4660	firefox.exe	97
PID 4660 wrote to memory of 5304	4660	firefox.exe	99
PID 4660 wrote to memory of 5304	4660	firefox.exe	99
PID 4660 wrote to memory of 5304	4660	firefox.exe	99
PID 4660 wrote to memory of 5304	4660	firefox.exe	99
PID 4660 wrote to memory of 3628	4660	firefox.exe	100
PID 4660 wrote to memory of 3628	4660	firefox.exe	100
PID 4660 wrote to memory of 3628	4660	firefox.exe	100
PID 4660 wrote to memory of 3628	4660	firefox.exe	100
PID 4660 wrote to memory of 4524	4660	firefox.exe	101
PID 4660 wrote to memory of 4524	4660	firefox.exe	101
PID 4660 wrote to memory of 4524	4660	firefox.exe	101
PID 4660 wrote to memory of 4524	4660	firefox.exe	101
PID 4660 wrote to memory of 4932	4660	firefox.exe	102
PID 4660 wrote to memory of 4932	4660	firefox.exe	102
PID 4660 wrote to memory of 4932	4660	firefox.exe	102
PID 4660 wrote to memory of 4932	4660	firefox.exe	102
PID 4660 wrote to memory of 4896	4660	firefox.exe	103
PID 4660 wrote to memory of 4896	4660	firefox.exe	103
PID 4660 wrote to memory of 4896	4660	firefox.exe	103
PID 4660 wrote to memory of 4896	4660	firefox.exe	103
PID 4660 wrote to memory of 5348	4660	firefox.exe	106
PID 4660 wrote to memory of 5348	4660	firefox.exe	106
PID 4660 wrote to memory of 5348	4660	firefox.exe	106
PID 4660 wrote to memory of 5348	4660	firefox.exe	106
PID 4660 wrote to memory of 1484	4660	firefox.exe	109
PID 4660 wrote to memory of 1484	4660	firefox.exe	109
PID 4660 wrote to memory of 1484	4660	firefox.exe	109
PID 4660 wrote to memory of 1484	4660	firefox.exe	109
PID 4660 wrote to memory of 2448	4660	firefox.exe	111
PID 4660 wrote to memory of 2448	4660	firefox.exe	111
PID 4660 wrote to memory of 2448	4660	firefox.exe	111
PID 4660 wrote to memory of 2448	4660	firefox.exe	111
PID 4660 wrote to memory of 5040	4660	firefox.exe	112
PID 4660 wrote to memory of 5040	4660	firefox.exe	112
PID 4660 wrote to memory of 5040	4660	firefox.exe	112
PID 4660 wrote to memory of 5040	4660	firefox.exe	112
PID 4660 wrote to memory of 5372	4660	firefox.exe	113
PID 4660 wrote to memory of 5372	4660	firefox.exe	113
PID 4660 wrote to memory of 5372	4660	firefox.exe	113
PID 4660 wrote to memory of 5372	4660	firefox.exe	113
PID 4660 wrote to memory of 2624	4660	firefox.exe	114
PID 4660 wrote to memory of 2624	4660	firefox.exe	114
PID 4660 wrote to memory of 2624	4660	firefox.exe	114
PID 4660 wrote to memory of 2624	4660	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\download.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2972

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {ff482fa5-d611-4d0d-8674-25bc8c410a39} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2364 -prefsLen 27135 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {238144f8-43c8-413f-8298-9f64b60454a6} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27276 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {0926ea46-6b25-40e4-b107-48c5b188ac13} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27276 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {dc1535d9-5727-4205-8bc2-99620a024d8e} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4400 -prefsLen 34775 -prefMapHandle 4404 -prefMapSize 270279 -jsInitHandle 4408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4380 -initialChannelId {f4829ee8-c92e-4f43-a1fb-29217c452c0e} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4932 -prefsLen 35012 -prefMapHandle 4936 -prefMapSize 270279 -ipcHandle 4916 -initialChannelId {378728e8-fa49-4762-80fb-086889a58e0c} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5640 -prefsLen 33031 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {4239fd3a-7da4-4a16-9ad4-97b32b4b0e81} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5684 -prefsLen 33031 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 5692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5700 -initialChannelId {0d160a11-bfb1-4d17-827c-a0baf88270d2} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6092 -prefsLen 33031 -prefMapHandle 6096 -prefMapSize 270279 -jsInitHandle 6100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6128 -initialChannelId {a18b6538-9474-411d-9c62-23d97d6b190e} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5992 -prefsLen 33071 -prefMapHandle 5940 -prefMapSize 270279 -jsInitHandle 5560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6352 -initialChannelId {e3c193cf-efc8-4123-8370-93466fde514c} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2968 -prefsLen 36488 -prefMapHandle 6348 -prefMapSize 270279 -jsInitHandle 2728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4644 -initialChannelId {a7780592-d995-4ff1-97ab-e8e9202c3901} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:1484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5240 -prefsLen 36869 -prefMapHandle 5732 -prefMapSize 270279 -jsInitHandle 6232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1620 -initialChannelId {8568fd85-3760-4bc5-ade0-08d440c2bba3} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5732 -prefsLen 40036 -prefMapHandle 5704 -prefMapSize 270279 -ipcHandle 7108 -initialChannelId {887c0237-84ec-4924-8fd5-0752b9186c05} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:5040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7348 -prefsLen 36869 -prefMapHandle 7352 -prefMapSize 270279 -jsInitHandle 7356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7360 -initialChannelId {6a6bf588-19e8-40fd-b223-ea07ed124d4a} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4684 -prefsLen 36869 -prefMapHandle 2804 -prefMapSize 270279 -jsInitHandle 6896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3232 -initialChannelId {7985d911-a2c5-441f-892d-9295830261fe} -parentPid 4660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2j5er2dg.default-release\activity-stream.contile.json
Size 4KB
SHA256 7e1502313c5fcae8efa626140e714f1176a50fa44fe67eb4d8eef9096f2d81a1
MD5 f9ac5911b2691c86ceb267d99649697d
SHA1 1589aaa2bce812e68db5615a9a7c219f3c099ad2
SHA512 2e7cac72460c1f101dbf9c8ff03ad3cf8c15f72a88082f24a89e7bc6fc1522ed5a12ab41f366d0eacfc3bc0832693e4db0f31d60fc84b695bf974584f24dd6d3
SSDEEP 96:K7zfq29trB7k9VwohdEVL1Z8DlKZvEotILnWBf9a56qQl:K7zxtrBq1dEDGlKEotIrW3aUqQl
TLSH
T125B12AEB8835C85F5B3057F43D5B23DDF41B72479BCA8D4AEB855C01CAF921981B8A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2j5er2dg.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 446072179bc249a3e4fd2b8766d48869dde9cb4bab483a5a4995fda8ab7d9f3d
MD5 d4bf75fd47a4c06dffe12f4a89409b1d
SHA1 9badcfbf798c9773911667594d4e295813062538
SHA512 ab75fef81416527b25183a71d3c081a01266666229070272ac36ebf434e9d97186735e97f9a5de6dab96afbe57a93a96fbe2bba9faa1abba51bf0917e4ccf57e
SSDEEP 384:HHMO0iO024Y2o6J+Sl1xDnZBPsac4j0lpDII+VdDdG:nrZY2o0+Sl7zZlsac4ID8LM
TLSH
T1B1528DB99F1138E91A67D1A4E9BE9305CD04A6BBDFE2806605143C40CA447B9F4F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 18KB
SHA256 708ae7a0f6873f15a7a2b5372a57802e123b86dff949e9aa75b93de70987c16b
MD5 09ef841a66a4ff2c525c17ddfdd2de36
SHA1 24e7dcfba7279c59807bd9558fefec75e339d067
SHA512 6d68291992606678253415b03994a1f0290a3a2ece65b270d727a2324c864fdc9cd739cfeaa94d87b15e44c7fd7274eb96aed4929ef11036f884c4632bd42224
SSDEEP 192:INw/YJ8CxT/nB2bwMby+rtjvoEvjuiDGifld8ep8eIc2A:INwwLtFstEouiaiffBQLA
TLSH
T1BF82120207F615D9F6F39A353BB1B392AB73F8015B16952E81C452490A72BD0C92EFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 19KB
SHA256 6526ec5829cd58c2323510c13a72fbd2dc2846029a30057a7e0ba50779e2b47e
MD5 0b54713a41905b133c18bf1a3a9ee5c0
SHA1 1744b2803ef31780c1424dfbe11820a58a3e7708
SHA512 45d6a35018526616a3852ade35d50889139618729925aec1b0a4c74dcf00210a81d6ab12e17f0754e7fbf52c47940a502259a9c341b0ba1d5d3c63e9fa01df82
SSDEEP 192:Z09/RnXZnMIuLRLdOPKkJ8CUT/nk2bwMbu:Z09ZnXZnMFLRLdOWAP
TLSH
T1B892110207F615D5F6F38A743AB2B352A773F8015B16951E81C462490E72BD4CA2EFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\AlternateServices.bin
Size 11KB
SHA256 c87c8d94ee0fa3f57379ad28835ef03da096759ddd513da7c23274df99f399c2
MD5 0c88ce18e11e988467185e03040c2bac
SHA1 49176d15a8e28738143e941f8cd2178368c98313
SHA512 a7ff0fc29f8215485c0a595dd5efb9d1a48d00888313545e46e37a2c6c08a016fadf1dd48e1b1937ee46829f4ede53e8bcc46f9a722f2d5fdbb6bc8b486ae7e6
SSDEEP 96:j4LOcV4lCeEie6JA/EPbEbEiIPQsi7CI6yMo:9IgFosWt
TLSH
T1AD3209FB27756452F2228FB194EC384CCC73022A8995C0CC962990EB06E5B95D07FF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\AlternateServices.bin
Size 16KB
SHA256 4715a665c06efc06f8de1b504625dfa62a658ebc60c56f7f2e706d9f03d5e63d
MD5 672618273da24cc681c85778ff520dba
SHA1 2982b32ce4635d86267fa2ff38ffd506c63c09c6
SHA512 de2985c382432a1b0c8730dcd652ec1e66fe1a6619e9f513e12101a71d0a4453ef60b17d8743625549f34500713a471e28a92c71c7317f6a9363203aec031f8e
SSDEEP 96:j4LOcV4cdv7+e6Jw8EPbEbEF3PQsF7CI6yMor5FFDgzsFPBFLD3q+F:wIgdosht
TLSH
T10472C9FB6775A452F3624FB180AC7C4D8C3302264996C1CC9A35D0DA06E67A5E07FF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\AlternateServices.bin
Size 11KB
SHA256 d057e1c0cae09f702dc49a1730dcee144848631c6fd48990ed4730b2865d4df6
MD5 139c54cded78e5aceca04361c6bcc742
SHA1 c01108ac0f714e5f8653b439a2119f12e907ba8d
SHA512 19f003522a7d9426be2519af16ba6a7cf64dcbcec908dcd5b14566460198e16a9f98b6dedc1460ddd17e1e31462204b788b33bc152e7b3cf0cb7f1d07ff43cb9
SSDEEP 24:Ij2uB1oKG9149W9xc9y9BQ9guhMZiM9Vve9g5q9F55A5Q919lz9S39BbNc9:Ijg8McggYBkaI56afnSN9s
TLSH
T1D432A0F76B726062F1628FB080B9744C9C33132605AD9188DA54D0F70BE2BD9903EBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\AlternateServices.bin
Size 11KB
SHA256 919769a79d843050f1566b11a36c5ac281d9b5402f4c24fcd83e66f4cb56e7d1
MD5 2abf338a7897abb5eb32374c34c52876
SHA1 37f585f98d1ce753c4164badb98e2bd4e020e706
SHA512 b4755f75ca2fd68a113e58bf3a4ce3b51aecbcb739888420210556d79d10d98f8758978d065f603108637b1c3d7a79032e56739e6ffbc7908fbaa3afdb376bda
SSDEEP 24:691afc9v9xkI979BwI9muhMZIR9VvuI9B25q9F55A53I9l9lGI9S39BbNc9:YJVZZlLBxKI56SPnSN9s
TLSH
T1F632C8F72B716462F2728FB0C0AC784C9C33132549AE9188D65590F71AE5BD9903EBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\db\data.safe.tmp
Size 106KB
SHA256 e7721d5c1f70a2d74b52bb3f8f642f6f41e145074bc898605db27eb8749c219f
MD5 b9be7d5e355bd987b81a901cc9c784d0
SHA1 d90475001e108ef69f2ee8cf2962845939b8b627
SHA512 9ca60121d196592965e8c1ae45a885b508955e20c4c1f7e0c3451c06ec98e700764572e44f73aa50c2528b255c0039edad976bb56c639aee7611cac288ed05e0
SSDEEP 3072:Rts+aCzDuv8Rmtgu+e1DMGjnHWUkbGWKC:RtNaCzDuURmtgu+e1DMGjnHWUkbGWKC
TLSH
T159B3DD80DB1A403BEC2446BBB8D517283735F4654B5A5B1B2AAC14752CCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\db\data.safe.tmp
Size 110KB
SHA256 85c830347baecea313fc92f751574a41cd1b13accef78fbb723d9ce20edf52d7
MD5 9d9b2fa9d618db56f2e10fbb713285ea
SHA1 d0e2acfdb6a0d944e070994a4d5c6d32c613f9b4
SHA512 ae64b2d9123e6b473b96638f92f2a7554dc22c256611ed63c8e711d2f80afbf9c824bfbc6a8b7a19ed61d6b81c19e9d0d935d4ea3af933c5241e0a2faadb596f
SSDEEP 3072:ets9w1IG0/Gq6TFx2SkD6kWE8VEsUk0GWK9:etKw1IG0+q6TFx2SkD6zE8VEsUk0GWK9
TLSH
T1C2B3EF84DB1A403BEC2446BBB4D617283735F4654B5A5B0B2AAC04752DCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\db\data.safe.tmp
Size 111KB
SHA256 aa2e71c2240c22c9c5f85c31eb5504bea2148f364e8f782a2fa7723ef06bb8c7
MD5 2a9e12d2b33fbe0804a6ab1681c20841
SHA1 eebc90e9fb4265fd4e79969b93478648f9fa2199
SHA512 f2b7ee2fa415522cdcf62bc57cebd2a9e8ad1ea48dae7e4db3976c4d8f186d82e6293ce9b523e0de31f9d96ad1953d74a31c2453f5d34233f38445bb6c3d3434
SSDEEP 3072:Ttso71k80/9q6TFxNotzFFqbCN7Uk0GWKj:Ttf71k801q6TFxNotzHqbCN7Uk0GWKj
TLSH
T1D5B3EF84DB1A403BEC2446BBB8D517283735F4654B5A5B0B2AAC04752DCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 dc1c0e6d3e144747b4445fa9a2a002a715134969b13e502c1612dca2f9af9bd1
MD5 e2156c4cc72b04c79530b92f2b37b00d
SHA1 357274879d1d05c3d7104f41a92d57b6dc3430fc
SHA512 df1c5c3c53a7ad4227bd10741db6a52a59a016f84c7a72014ce28849bde4ff32748490652cd5a445bbb57232dd750751af85e7e44b1b6110d273029e52bb01cf
SSDEEP 192:R1d66JozGzgCl6mSSdqOv5zboPyXCyji6mQ:Pd66JozGzgC1bjboaXCyjDz
TLSH
T146E11D64EA38863FC058027BCCA11B414F39399BD84E3F1935ED64182D5B2EE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\db\data.safe.tmp
Size 111KB
SHA256 9d5857a791f5c3e965eaa92c20338243be2e3bab900e750f50bfc080e57a56cb
MD5 e43df95d560fe2edc1bea07594a0442d
SHA1 34ee438fa69a54d0e640ebd664ff1d38cbf3adc7
SHA512 55c0f6c67bc3a709600854452b2f2cb04ac3a71d06b539f13482960fac3cb1858a00ac6946fb167c2d6d092b3cc2b7e7cc3159cbcf67d39348c7a5fe5387017e
SSDEEP 3072:ptso71k80/9q6TFxNotzFFqbCN7Uk0GWK5:ptf71k801q6TFxNotzHqbCN7Uk0GWK5
TLSH
T1D8B3EF84DB1A403BEC2446BBB8D517283735F4654B5A5B0B2AAC04752DCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 abad84ac4fbdf6e45e33b7d725f7fffa571de5c547b849e32a4c546ca9f93675
MD5 c66c764bfd9ba50c66dd89a95e771938
SHA1 a81916a22378efa8988d5e6a165a24a66ce3a6af
SHA512 ffa7f41bc7474a12f23378b50b114526242ae2634999fd7d65f39874ce2ebc409d2c3b429fba65adccc289c2e53fb866ea357d88a7c699bc62a26d0e76a34bc8
SSDEEP 192:R1d66JozGzgCl6mSSdhOv5zbowZXCyj+x:Pd66JozGzgC1b0bowZXCyj
TLSH
T174D1EB68EA38953FC458027BCCB60B400E36399B984E7F2532ED641C2D572DE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\events\events
Size 1KB
SHA256 88b230c44b779385c5feccdbbad301af23ef99abd9cd6aaabea206db8b0e7a50
MD5 d5d991f0c8b340645d87962de5b1635b
SHA1 c20ddea08e40ac3da11b336876edb0a61654c150
SHA512 5a573f33bb01bb2b6401b1626913be5f2db13733f18b30146e98f2adc8888d6819f00117a35f84c2ac6a4978b0596479aced90ae90c739ea3ef8ae7db87b9348
TLSH
T10421A95C3EB84DAA9FEBE2ACB445028E53424A4714872D431D13DFCDCDA5AD9326A43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\events\events
Size 4KB
SHA256 b4a670dc94b0cfebd160bb0c610e7bd1f12326983baf59ee461617c5005426cd
MD5 30d8b213d5da93a0dec07b841212a0f1
SHA1 46a79365c48d2c6112e6e8c7d52a65890f561759
SHA512 c134025676250098ae61f8cb72aa5490a945303cd6ade7c13f6c973602464e2ea0612cf3378083d67a0a6942e4485e9e3560b073196277cc24763eda9756e9ca
SSDEEP 48:Yp4HVYsgyVzdcHISgX/uIItZj0PJDC47/JjRxa4RSXcxo8dnz3yeljwUwDADc045:nRckIToJeida4RLd2rFDXzOX+9
TLSH
T194A1E11C76BD0CBE6AE7D2ACF881068D57894B0285C71D474CDBDE8DCC69A99321F439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47510a8d-b185-4a90-9f0b-d350bcdbb8ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\pending_pings\47510a8d-b185-4a90-9f0b-d350bcdbb8ae
Size 16KB
SHA256 37974ca7f2f6cf53b4ae6f009f653265c6d661cb9935c3147a9571e17fca2cce
MD5 0e9d78bb124cb50289f28937dccc40f7
SHA1 c16369e597c5af7cd2a9e664527587e26f26ffd6
SHA512 f462d81db0ab2364cead9c9b714fba97a401bc434560eb6b77b1b3b2dffa6fb989a6d464249e68caa073fa545abc0234ee027f71f1700936cc7ed52e6ad8766c
SSDEEP 192:PJySI9vT2A5OgaN4z9bGaZbFNJ4IMSB+1159HL7bNbfxgzcJ4SoeAgKkvw80UdoL:ProvaAQgaN4xbG6Fr4IxmXHL7lydhcK
TLSH
T1A472C9166860457A8291E76994FC7FC3E6F528CB8C415FCA9BE0BD082DEE05E112798B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5148d97f-e6dd-4235-b29a-f9fa44dd3ff7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\pending_pings\5148d97f-e6dd-4235-b29a-f9fa44dd3ff7
Size 886B
SHA256 456c37f82d599f7312596e01ef5ed07bb6fccb36d430549792a5eb4433bd270a
MD5 285b580b9dbcdef08a6fe4b1cc5e1e6b
SHA1 fcbab7e0aeb928f23782a273a697996f9d557a1e
SHA512 1f9e65d9e150d910360547fe21a3fc4d92e7460ff830e095ddf5708061d7436529d84425aae339346a9738e36b374f9f6f7e70857ae754674ecdc9b6b6e236ca
TLSH
T196112781C574F573887C92CF45B1770286E46113C4CD4D087EA28A184DFB51F935B34B
MD5 SHA1 SHA512 TLSH

Submit Download

5ef7273e-6f08-418e-b461-482b1856eb39

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\pending_pings\5ef7273e-6f08-418e-b461-482b1856eb39
Size 235B
SHA256 744735891b2541190ea10ecb5e4505d98b37f90fef8ed9b67ccd0019318f0eb4
MD5 a52d6b4e2cd4a041fc9f31794a9647e9
SHA1 be1b47c961d0a780cf7de07d2f02d7a521aa0cd3
SHA512 90eb2afc09946c1353c6542e815520f1016f709ca234cd6d1f0f98254ab9bbd4d4723d1b5aa6f212386285e714db0f2f3ab0c5e157681b71efbf8aa5740e041b
TLSH
T1FFD0978024E8675C88040F0AF0B069D230888C332075E910D9604274DABD9C84512827
MD5 SHA1 SHA512 TLSH

Submit Download

6ca0eb41-5890-47ea-bb8a-0c41fe75e69f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\pending_pings\6ca0eb41-5890-47ea-bb8a-0c41fe75e69f
Size 235B
SHA256 4f7cd78d7e2e2a105157410db86c2839e93430f766d2aa82bc14e179bbc9b6b5
MD5 0d3da4f478f7fa34c78576a75b5fd13c
SHA1 1cc395a3275bb0c24ec4814b1a44d22755bcc492
SHA512 9a436e7a33cdad8d32cd664f0bfc28bbc2d95de26c132905ef20ecfd0db82ad96fe89666760211bcfb3bfdb21a3ceb2f0290cdb402dac25e0dd6e955e5f77dfa
TLSH
T15ED097802C8C676E0C000F0BF0E078CB31888C331164D890C9A1427499BAAC942A1806
MD5 SHA1 SHA512 TLSH

Submit Download

cffce15a-4b9a-45eb-b56c-ff33eea98701

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\pending_pings\cffce15a-4b9a-45eb-b56c-ff33eea98701
Size 2KB
SHA256 f10606068ff04df5229245f72070c1c7d2bffb5344acb6dfc7a34663b3db5d9d
MD5 93bcfca1c08f2a70552e4e5efe22ae94
SHA1 f8587836cb766c9794eb788eaa38b173be6ef0c0
SHA512 d463e82b2809101df7d1aa4c149c7c0bc2451320e6d7f62690f2fd25ae518092bd1a5464bad984312623539a37e3934253a0a4a3d9fdb7927eb1fa6078b1c759
TLSH
T18F41135C357C5C37689FE54CA192235DE3A08A0380C62C83AE51DE0D9DA279A736B51B
MD5 SHA1 SHA512 TLSH

Submit Download

f4efb04e-2db3-42f2-b227-f914512e4a35

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\datareporting\glean\pending_pings\f4efb04e-2db3-42f2-b227-f914512e4a35
Size 883B
SHA256 bc67bfc2ea898ce8447747dd4736b411d9ad0c62513c48335744932674e60270
MD5 c95085454f790c640b21e59661b43b0e
SHA1 302c8e2945f8e6964be5243fe9424487539f67c0
SHA512 85e475a8cf8ed3077e1cb515f35a5d0b3bddd82142778109a71e96ab9f828b90bc333689ad01586f4b1e48e2848c7e365ca6a26abef501029bb7fc0a599c7b13
TLSH
T19C114080E634B477CCBC828F8571330286E85523C0C948187DA259184CBF92F936A38B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\extensions.json
Size 16KB
SHA256 5130d7a4a65142227a3d1e73de94be3a13687db602799764f68e5e9cc13222ac
MD5 1a52ca79ee2857878a101d19823a7346
SHA1 9f9596dfa8810a2d7e189e49f8bb6ec45972ad1f
SHA512 d6a951d1d878f5d0ab2ad29d9f6eda8cc8e4f939bd477c48a6f2625b105c762b368ddfe11cbdc0f6c27fcbec97b83b63497632bff2aa89ea7ae55e7820e391c0
SSDEEP 384:KkI4vXtUmldvi8dhWh94zI96o1L4HlL4P+L4HmL4HjL4HMk4h/:tI41Rf3Xw4Q6e4l4c4s4v4d4t
TLSH
T11572521545048EB8294EA79AAA367D02C37D473B60845C78F4DD8FC802FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\prefs-1.js
Size 7KB
SHA256 003ea5f902af3aff0c76a2e398ea42eaa327a07faa3903911c2a791bf09557be
MD5 2d30135e27d02d9cf04cc3f7cdc132ea
SHA1 e509b8d2b3fbcee7483c0de211515561af12d826
SHA512 6690c7d37c2411cd65846d3e0368a2f38774d4864fdb6adfab8cb2430f5337c4ea5da4b4eee72fc2e120b426d554b0364c923d31657de290ff02cab0e7d4508d
SSDEEP 96:xHdUTUiHqGqnf10LmNbzSrSSlVdv9jTnxRHvaNBw88n8L4cn3r3vGS:PSKRnf10LmSSSZ9vYBw88i
TLSH
T10DE1107895088F7F69B676ACAC688C316AB2013B7BBF68C750B544C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\prefs-1.js
Size 7KB
SHA256 250e8373b531c756505546ca1afd1d973d18d3356f258766582d6e75aa67268a
MD5 9947de1da764f576982ae992371061ca
SHA1 c58f39803146a1adaf25717b565098024ee9dbe0
SHA512 1e06d1bb765aeedbc4d7d4f8648c0df863249cc2d1c5561d3f8bb6d7f2f93e5a4231f3a468578ab62faf9f5862cb7d0a83d7013d851acf41196594143384c00a
SSDEEP 96:xHdNTUiHqGqnf10LmNbzSrSSlVdv9jTnxRHvagBw88mg8L4cn3r3vGS:PLKRnf10LmSSSZ9vJBw88m5
TLSH
T193F1FC789404CF7F65B636BCAC6849716AB2013BBBBF68C610BA44C4155CF3442E96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\prefs-1.js
Size 6KB
SHA256 92b024d362714ae8c0081b1932fa9854c7cd57a717a591d7d9bddf43c3854e14
MD5 9221a66018e55351b148783eab153b4e
SHA1 db8e6559fdafdf2c192ab883093039647a0c56ed
SHA512 066767647fb7355134c1630e817e11dfc24132a1461ed96b02f1d09a06a8e6930479b98ef8f8babb8d2e3b61393135f44913cdb6c20c9a15774874064bdc1d5f
SSDEEP 96:xHdUTUiHqGqnf10Lm1zSrSSlVdv9jypnxRHvaNBw88n8L4cn3r3vGS:PSKRnf10LmWSSM9vYBw88i
TLSH
T1BBE11F789108CF7F64B676ACAC688D31AAB2013B7BBF68D750A644C4055CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\prefs.js
Size 6KB
SHA256 e9eae7a58f953b6cb4d624993120ac79ae56367cf1e598d6a658d0b23ac1611f
MD5 48c2c8ea4d787b49986f9548c0269286
SHA1 ff9f4a80c73dc795e499899516d4265bc1d574f9
SHA512 05d2caa8d5ecec49d2cd4b0806ede380d2ea027e4d3392d691ff534773519cd45fa4f047e5aaf23777797db20e1162d0ae8aa9d9d6ff48ea93f5ef3aa5e2c8eb
SSDEEP 96:xHdUTUiHqGqnf108L1zSN4SSlVdv9jypnxRHvaNBw88n8L4cn3r32:PSKRnf108Ls4SSM9vYBw88p
TLSH
T132E120789108CF7F64B676ACAC6889316AB2013BBBBF68D750A544C4055CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 c63c495461b83888bfaf460007ad2318bb2ce47210450cbde5ae0f0a55b37ccb
MD5 e7fe17b372e15392c83407741ae2d4fb
SHA1 c1c780555af643cb32129b521c4ae2135a819c55
SHA512 a405815db7505ac03a1c76f3854ae0b6a2a31e10b4b880e4da6678b41b08222d4fbf2d464ddb616bd06794abf6f39043d1c45f44f17a29cf1c4677a04a7b8b96
TLSH
T119516EB72C2B2CF73430CAA19CCB0FD04EB2103049F6806576A8D97105EC50A59B5E4F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 abff1dbb038e30bd9966930dc18519269b9fb549e72b78f2b2aa99bc574704e0
MD5 fc59f951c054e2823a8df96e8a1c7e5a
SHA1 94c1c20975dd21abd32eee091d9f8d1f4fc94d6d
SHA512 f8ab19f66372b45234e8746cead748344598a4d13d44efa8aa01e92696cf298825d12b733e38071ac3aedf4a94e05d9f4c42102925aebcfce2421f6277fa379a
SSDEEP 96:wH2sij2jq4R92AiU3atxROW7SwljCd01VrqM4EcZZi6rLKJLqg:o42+4R92AihuCi0v/4aqg
TLSH
T14C915C7F6C14B8FBB7A8E0916CEE4F8943E1109188FA4857AB344FF201E8B59651075E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 f8a77daca98f5e21705102a44a87195c3210f8ffb4c518276765f5c7ee9bd42b
MD5 e0815a6f6b875ffd6703a6487f3d1f6a
SHA1 d64672bcc53fbebad378cc007c9d360168aaaae8
SHA512 58fe696c36018b8f171c618dcee9954cda6f7c1bac050bea9cde447f5aa703d1edd9fb9da4f75c167fe31583e6858fd7ed4e34115d3d3d3895aabbfb1313956a
SSDEEP 192:X42Rlw94UXuYFo7T+1cvuwoNLqJFDpipqtTmOV4xd9X67yjwvu:I2Rlw6tYW3+1Uu/YZBTmOVyT2Ru
TLSH
T1F6029EABF5B82CF60EAD6DD2009C3E1C47C859A3CEB20450DE5C9A6D50A591C6B2029D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 afb54699d354b1cccf58d8e81cf547622e58d1b831c17162bce88b31f5635313
MD5 4663065f8a7f75d149ce693d933d140e
SHA1 089c3e5b407b0034f892fa28d5b0104748e06714
SHA512 172e290cafe23d192d52a981d1fb02ae2787a9b467527320dd16ac2f47245fc096a7b7bd9d779341303a990aa946120c36cf15889a91ff22e55348e5878cbf50
SSDEEP 192:S42Rlw94UXuYFo7T+1cvuwoNLqJFDpipqtTmOVFiLj0X6zDJB:J2Rlw6tYW3+1Uu/YZBTmOVFicaf
TLSH
T12E029EBBF4782CF64FA96DD200EC3E0C57D856A3CAB20441DF5C86BD50A991C6B6129D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 5e14b6354d272120add4ae97de198c89b1fe40bf1924d7a12961d4c3be177b52
MD5 1f2dd0bf379297ee9db63df11af46051
SHA1 0447d12d895c2965cc7bbac39432c6132be9c7ac
SHA512 1b04d1ebaea2ddeeeb6d053101f001f4c647c080eb6dafc9e6d6ee0e1837bb508a59ff03493a28c9dd3974ed29e3d10bc2564362778286e80d6f0355dd400849
SSDEEP 192:e42Rlw94UXuYFo7T+1cvuwoNLqJFDpipqtTmOVNX6zAx4g:F2Rlw6tYW3+1Uu/YZBTmOVN4e
TLSH
T139029FBBF6683DF64AAD6DD3009C3E1C47885D63CFB34490DE18A7BC14B891C261428D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\sessionstore-backups\recovery.baklz4
Size 13KB
SHA256 a1cbb1c43c534d984262093c1c1cc5d6b449e14caa2d4d745e6c55629c169674
MD5 db018a68b33496348f86b02889d1daaf
SHA1 20f6f2321210e465896fa7d647085b35a5ac5533
SHA512 eae7de37e56f86adeb28e5ba696dffeb93a4f0cbe29c9299ea492aec9a7958a082554b900f35de2d3f122f2be1feffa3dc5eb26cd1a9a2a4a26598abb0d6c0fe
SSDEEP 384:I2Rlw6tYW3+1Uu/YZBTmOVNxOEbf/ZW2DY:IiCW3+1jYv1VNxNf/ZWx
TLSH
T10652BF5BE13C2CE70691B6D300AC2F1CA79B9D639BF249509544D7AC31B4E5C3B781AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 80d167295a4c0eae345eba7104fe2257e7bd66a863f6968728d836e1c96b78eb
MD5 e0b00fa9c6a1d207da1ba8610009906a
SHA1 709f2809a03668776ae3011d4ffbf82cdf516450
SHA512 d9af1900eea6c9d07bce4983c4aaaa189173504c0e49c42c37f7567aef2e9bb3c09ed49798050b560a3379c527ecf0ca0601426b94ebac98efa7d09241efa8a4
SSDEEP 192:k42Rlw94UXuYFo7T+1cvuwoNLqJFDpipqtTmOVNX68PtTVkIK:H2Rlw6tYW3+1Uu/YZBTmOVNdPtZdK
TLSH
T1C9127DAAF6687DF50AA97D9300AC2E0C87C49D73CEB30540DF58A7A910B991C5B1529D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\sessionstore-backups\recovery.baklz4
Size 13KB
SHA256 de7f06d719ecb479e87df0ca2567da8ed45a9eababc7db7f2838cc2e2a4bf6cb
MD5 21b4380e93e66e989969f0621b08bf34
SHA1 e22e4f9d4ffe919c9d33e70b35026a3bf67b2a7b
SHA512 54a18ed0aad826d1a43a333e0087f9b0ffad8f804d3aa6c9929cbb52103498ec04ff3531da7e6bb6ceb67a9e97e5e7c68abbd6a69d77e29b5e82eb464a5c50f8
SSDEEP 384:L2Rlw6tYW3+1Uu/YZBTmOVNxOEjRdiRvvFZWIDL:LiCW3+1jYv1VNxXd0vvFZW6L
TLSH
T1D452BF6FE57C3CE20F50769300AC6F1C979B9C52CBF249009644E76871B4D6C6B781AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 2c143dce10fc5eb117f2ca1c3f152ac6bca0cbe8ecfd0c97915d0afb9bfd383b
MD5 c2d8840f6488687343f68b872cc18239
SHA1 d154769b9d5f9863d7bff5419222a6306b5ca9f6
SHA512 1d04f8ec2e20c9f396b4106d186ec0afa3898cef5fbf42099958533cc148ccf2f2d6a78eef779c521b437d5c5f64b6453422d350506e737ffd47b1014bea6cea
SSDEEP 96:K2sij2jq4R92AiU3atxROW7OJCd01VrqM4EcZZi6rLKJ30Z:K42+4R92AihuXJi0v/4Q0Z
TLSH
T181917FBF6C00B8F773A8E1A06CEE0F8407D42091CDF6496367248FF201B8A551524B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\sessionstore-backups\recovery.jsonlz4
Size 8KB
SHA256 377a9f377aa572beaa77e901c6f286f7cd36d9e60c8c68de05d63c5c0bf4d71e
MD5 e9d6fcf7b1e98c151817bed46dd8c909
SHA1 7d7fc920016ae1e67d5024aee873cfba0efe9ad1
SHA512 0d4c418588b54a730c47c002a981bc3892dfc10b0053fa1db8739df7b5a3561f1ab3af8ab52d83417fc7942bd286fb498a40387524b8ec7aa3089d84ca085d96
SSDEEP 192:R42Rlw94UXuYFo7T+1cvuwoNLqJFDJypqtClIszhvBX6ksBLF:W2Rlw6tYW3+1Uu/YZJHClIsVBB4F
TLSH
T1CC027EB7F8785CF50AAC7DD200E82E5D97C85263DEF20551CA288B794095E1D2B253AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.0MB
SHA256 84810c206114e3dd4bb570baa74b40366c00a08f3d64e2b6ac0a5cde82504a92
MD5 97266c131a86cc45b1ba34e66adf580a
SHA1 5fe13587cfb0f713dbe4cdba6fd213d64834faa1
SHA512 5fb63c71fe497327b6455613b7457efea2612fb22e6903782ec6c7c8d727fb8fef3f0187f353a916d6dd7aead644825a546051174cb1bed64c010768d940f979
SSDEEP 49152:QXkiRVaA+oW8zN6wlF6tckx+zuewS8qLC47C5wPIaDsPdQiSOeEQVW6j4c+xXAQC:JKVW6joAzeBGNzp/Omoh
TLSH
T1EE565DE420E2D252F38544B3719A53FB10EFC01C60768E445B9896FAA5B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.2MB
SHA256 16b834b36bd639898371800392611938590e508cbf734a9a1269729938f6bc2c
MD5 88fa83fb3390fdf74750f61ecd318d3f
SHA1 ce7e6bfb3d24ed174d25d2a9d1584a17ca23f0a4
SHA512 737817ef6211e3ff648e335d70448e42df98a18726b380190f2113015892bf9f145a4e516d045e4f4d8664bc3847dd444acc5c43f695d648b9c6b8d87fab6308
SSDEEP 12288:qihaJeT1LiX/6EyFtnHY0ITC0IhtUUszLXru:qEak1LSqvYC0IhtfSr
TLSH
T180B54AD474A3F35AE3968073E649A3E7503EC00C50678E404BDF6294A57DC8FADC5BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2j5er2dg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.7MB
SHA256 ba1f12a8e56c37148289af91c56d4a1f69a085563ae01f0fc1b17fb4145f1b2d
MD5 44e02ed9cea9d06761fc155d6f2edbfb
SHA1 a3cb87d114126e73656ba5f63ae023b51b93eb0e
SHA512 d70080af96a667869fcc9cff1053ca6efc3595a758e687f487e6f2b96d8013b29de4e8e33055fd525dc980aa22ca313f1650fb7dcc936694e43a0bea5cc45567
SSDEEP 12288:HihvJeT1LiX/6EZNtnH3hCTU0IhtUUuzLizC8t8X+/u:HEvk1LSBnuU0IhtfLC8GX
TLSH
T1D4D54AD474E2F346E39680B3F649A3E310BFC00C50369E0447AA5695B47DC9F9D93BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3508-1-0x000001F50EDE0000-0x000001F50EE4B000-memory.dmp

Download