Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://ww1.goojara....

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    303s
  • max time network
    305s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/06/2026, 00:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://ww1.goojara.to/watch-trends-genre
  • Sample260627-aba8zaft91
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 39 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 58 IoCs
  • Suspicious use of SetWindowsHookEx 52 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://ww1.goojara.to/watch-trends-genre"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://ww1.goojara.to/watch-trends-genre
      2⤵
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2140
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27097 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {793841ce-64cf-4b03-ba97-755c5a137ee8} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:5852
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {2b0ef852-f3fe-4311-8f7c-95ae0a135b6d} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:5536
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 25164 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3868 -initialChannelId {4125bbd5-4107-4aa6-939c-08f3f791aef4} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:5752
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27274 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {eca2a941-9989-4f3c-90f0-084622849294} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:3452
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4460 -prefsLen 34773 -prefMapHandle 4464 -prefMapSize 270279 -jsInitHandle 4468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1240 -initialChannelId {d8bfda29-0b4b-4385-8c98-c64de7b4842b} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:5932
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5100 -prefsLen 35010 -prefMapHandle 5124 -prefMapSize 270279 -ipcHandle 5132 -initialChannelId {13e4df76-3fa0-4165-bb0a-72007ca31bed} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:2572
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596 -prefsLen 32952 -prefMapHandle 5600 -prefMapSize 270279 -jsInitHandle 5604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1180 -initialChannelId {62d78d82-de0b-429f-a826-c4f9a2d88bd4} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:5540
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 32952 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 5628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5636 -initialChannelId {9750a856-4b86-4e85-852c-b6a1f4b4b217} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:2512
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5820 -prefsLen 32952 -prefMapHandle 5824 -prefMapSize 270279 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5836 -initialChannelId {2126cb30-b247-447a-b645-cdea41b85989} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:2984
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6148 -prefsLen 33031 -prefMapHandle 4484 -prefMapSize 270279 -jsInitHandle 4720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4952 -initialChannelId {d9a8f88f-5c89-46ca-917f-932e1b6c36c9} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
              3⤵
              • Checks processor information in registry
              PID:2200
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6388 -prefsLen 33031 -prefMapHandle 6392 -prefMapSize 270279 -jsInitHandle 6396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6404 -initialChannelId {57bb8b59-e0f2-4eeb-842a-a5154884cdbd} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
              3⤵
              • Checks processor information in registry
              PID:564
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5692 -prefsLen 34863 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6192 -initialChannelId {9bb94661-5895-4528-b619-398d35def699} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
              3⤵
              • Checks processor information in registry
              PID:4508
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6084 -prefsLen 36845 -prefMapHandle 6188 -prefMapSize 270279 -jsInitHandle 6664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6656 -initialChannelId {78473242-de30-4174-bdd5-e26c88f232a1} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
              3⤵
              • Checks processor information in registry
              PID:3784
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6356 -prefsLen 40474 -prefMapHandle 6164 -prefMapSize 270279 -jsInitHandle 4696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5900 -initialChannelId {d369da29-814c-44de-a620-4df0701675d9} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
              3⤵
              • Checks processor information in registry
              PID:3712
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596 -prefsLen 37377 -prefMapHandle 2792 -prefMapSize 270279 -jsInitHandle 4644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6848 -initialChannelId {5e36b4b2-a403-4163-b564-7d4c2f76c1bf} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
              3⤵
              • Checks processor information in registry
              PID:6376
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 37377 -prefMapHandle 5696 -prefMapSize 270279 -jsInitHandle 6884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6836 -initialChannelId {bd133090-8fd7-4257-857b-5660eb3e34c8} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
              3⤵
              • Checks processor information in registry
              PID:4216
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7348 -prefsLen 37377 -prefMapHandle 7352 -prefMapSize 270279 -jsInitHandle 7356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7364 -initialChannelId {9097bc2d-fa0e-4259-80db-42ae4461758e} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
              3⤵
              • Checks processor information in registry
              PID:3160
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7028 -prefsLen 38420 -prefMapHandle 5900 -prefMapSize 270279 -jsInitHandle 3020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4696 -initialChannelId {85d9a334-64c8-4741-94c4-1c1714952a20} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
              3⤵
              • Checks processor information in registry
              PID:4736
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7096 -prefsLen 38420 -prefMapHandle 7092 -prefMapSize 270279 -jsInitHandle 7088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6984 -initialChannelId {ef4c9e55-a3af-426a-aae0-418cd6e92b7c} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
              3⤵
              • Checks processor information in registry
              PID:6616
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7244 -prefsLen 38480 -prefMapHandle 7388 -prefMapSize 270279 -jsInitHandle 7464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7504 -initialChannelId {dd87f113-6556-4b6d-9d42-9eea8e35b7e5} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
              3⤵
                PID:6992
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3076 -prefsLen 38480 -prefMapHandle 7028 -prefMapSize 270279 -jsInitHandle 5900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7020 -initialChannelId {9ccdf6f7-2c54-4672-b731-23c83b63cd83} -parentPid 2140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
                3⤵
                  PID:236
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2876
              • C:\Windows\explorer.exe
                explorer.exe /LOADSAVEDWINDOWS
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:2432
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:3424
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:2736

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  activity-stream.contile.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\activity-stream.contile.json
                  • Size 4KB
                  • SHA256 856f58a03b9b4af5bcc2c1d8c5ec9e3519f1b31a3e75ad1cbeed8db932b1c3de
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  03100235E7AEBB25C597DD91664A8F544DDFC529
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
                  • Size 13KB
                  • SHA256 2f89d58b7beabaca50439e7f52e17aab0dc41c29cd31d21b822cea05ce441cc0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  YN4APbzJCmHWSB9ncXfK7dr+MPeWMdAqD3ygo4WaFu0=.ico
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\jumpListCache\YN4APbzJCmHWSB9ncXfK7dr+MPeWMdAqD3ygo4WaFu0=.ico
                  • Size 646B
                  • SHA256 381fb3a86f3e9e8a020ba42a5200572bf283459f3ac07f4bdd5b83d257d3278d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 599B
                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 11KB
                  • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 502KB
                  • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CWT6SW4FQXD368HSTITZ.temp
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CWT6SW4FQXD368HSTITZ.temp
                  • Size 19KB
                  • SHA256 d38a22706d6a881c272f2940b5f3dfd7682e2cb6ed133a451fe3e78e2e3965a9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AlternateServices.bin
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\AlternateServices.bin
                  • Size 8KB
                  • SHA256 4afa4b5f286917c8b6a8b8095441534a4d81a148c2c5dfbda752649f6bf601b0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AlternateServices.bin
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\AlternateServices.bin
                  • Size 12KB
                  • SHA256 199b68f709233f38ce12ebd3b30980d9c26d0b76cd0c32e5f22847188d82ec1d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AlternateServices.bin
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\AlternateServices.bin
                  • Size 17KB
                  • SHA256 5c4702d7475656f58ee105d5f6c8abc49c6d7f28c2a52ebfaca9e7467423a76e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 108KB
                  • SHA256 bb3837457d30d19977c22d5ca3f77c304fea79cbfb27597914fb90e55e658967
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 29KB
                  • SHA256 5f943f4ac3755a39e695827efb4105a3533ef0997b246be14038dca39a31a4ab
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 108KB
                  • SHA256 4160a61df989cf4e0a5d1730f9b576055f8100f11eb19dcec1fe16e5c89f91b1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 29KB
                  • SHA256 141477c74587b66bf6b2c96da08f079d782ed0acd1d43385fae293dc2efd9971
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  events
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\datareporting\glean\events\events
                  • Size 5KB
                  • SHA256 c57dc5b04dd526e388ec7c839e1a0796e0838f27dd62cb07140795a4189a361d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  events
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\datareporting\glean\events\events
                  • Size 1KB
                  • SHA256 c045f048e65c685547c0c4b03bce5a8bde08efec45cfca83a6328f8274e0228a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  15a66e87-ffc8-4c02-a512-f793edd3af7e
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\datareporting\glean\pending_pings\15a66e87-ffc8-4c02-a512-f793edd3af7e
                  • Size 235B
                  • SHA256 38086fb153df151a2b4bd2a1622055ef66a83d6c7b0f3d5889d9661e631cf572
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  2fcac1ae-6e9c-4489-ab01-0e76437cafc7
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\datareporting\glean\pending_pings\2fcac1ae-6e9c-4489-ab01-0e76437cafc7
                  • Size 235B
                  • SHA256 52253e9d0832de4c655fb3aa91aa882ead68f39ab4213b7dede75231f5c3747f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ad9764e9-0b66-4780-80fb-41607df2ccdb
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\datareporting\glean\pending_pings\ad9764e9-0b66-4780-80fb-41607df2ccdb
                  • Size 886B
                  • SHA256 e6ea7d8753b8173a656767183093a231ed5bfb386553b6020d8dc454b6953bd8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  b3929a27-f142-4458-bd3f-80420833af2a
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\datareporting\glean\pending_pings\b3929a27-f142-4458-bd3f-80420833af2a
                  • Size 2KB
                  • SHA256 bb7f413bf303c4469e27fb157025c1f9e5a0ed156d2a1b162f23491f48a3fba9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ddd04cfc-6fae-441c-927b-55ae40248868
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\datareporting\glean\pending_pings\ddd04cfc-6fae-441c-927b-55ae40248868
                  • Size 871B
                  • SHA256 c1c9f5feb92dce3612830864ab0d0a88e041817ff8444e6230d28d54405e100d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extensions.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\extensions.json
                  • Size 16KB
                  • SHA256 e1672bddbc320d857720549b165c6f8265447abf9b1caa0f28426dca5cb8f5ce
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                  • Size 1.1MB
                  • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.info
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                  • Size 116B
                  • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  manifest.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                  • Size 1002B
                  • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  widevinecdm.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                  • Size 21.6MB
                  • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\prefs-1.js
                  • Size 6KB
                  • SHA256 2d14d2851b303227fdce8ff1f5781182ebb73325176817ab9bbf3043ee4d45ab
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\prefs-1.js
                  • Size 8KB
                  • SHA256 faa8b982daac6b1febda1430bfbbae5cd3e20cd287faf66132f445dd69a69e1e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\prefs.js
                  • Size 6KB
                  • SHA256 6c2b634a570700d05f3dcfc01ee8326e3c2dcc9a840e13e3a1db24d132228423
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\prefs.js
                  • Size 7KB
                  • SHA256 b787dae970f5fbdbcb52c59dc47f9c783a43573ea2740e3fa7d6a93d917bf6df
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\prefs.js
                  • Size 12KB
                  • SHA256 92315562eaf9970637919c7021a95096522748cc4ad8b53633734821f762372f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\sessionstore-backups\recovery.baklz4
                  • Size 2KB
                  • SHA256 c670f28a42b9da71ff02b1eaf1b24f9cc45c6f7a908e4c3dc233ec6ecf32faa2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\sessionstore-backups\recovery.baklz4
                  • Size 3KB
                  • SHA256 d807aea6dc869130f52dbd4cc82225c5d54062b86f2205ca44040006e2dba5ef
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\sessionstore-backups\recovery.baklz4
                  • Size 3KB
                  • SHA256 4db5168f312da693d2307fdb9b9b343e3496f95ff7db52753d8cee6b9fba54c9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\sessionstore-backups\recovery.baklz4
                  • Size 3KB
                  • SHA256 73750465ea1327deb5a48c23cde164be916517a87d91ff2b3d626407ecd48ee1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\sessionstore-backups\recovery.baklz4
                  • Size 6KB
                  • SHA256 f51123436baec792a4254b56ff4a255aa08d21e28599b36323d1c7c7c7854426
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\sessionstore-backups\recovery.baklz4
                  • Size 6KB
                  • SHA256 c429e99074d2aff7f0c86914726363e2382a640cba38dd2bd2fb055832616549
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\sessionstore-backups\recovery.baklz4
                  • Size 2KB
                  • SHA256 18599c9b86dd532c58227dcf058827fb489454a1f432b0802616be44339f2694
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\sessionstore-backups\recovery.baklz4
                  • Size 3KB
                  • SHA256 423477d4da7e96cd6b1927d6bdae9b0fc24313601f798bba9b9b69ffc24f0c68
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\sessionstore-backups\recovery.baklz4
                  • Size 3KB
                  • SHA256 ed843dee276bb24d5aedd3afba505c2b4c1d1f3343141f4d6b129486011493ed
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\sessionstore-backups\recovery.baklz4
                  • Size 6KB
                  • SHA256 15c7b5610263cfdb83d96b263a08e2619aa11803340e0034f861db787e6c6c21
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\sessionstore-backups\recovery.baklz4
                  • Size 6KB
                  • SHA256 9c4d14fb7f9f87c40c94901f0342cc28f527600aefa879ebd0bf2abc749f61fc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\sessionstore-backups\recovery.baklz4
                  • Size 6KB
                  • SHA256 560f193be124298c4676097769b0c93a3dd399ddc8b9bb2761c444782a8c4925
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 7.1MB
                  • SHA256 49174b20dc89305dd500a6660aa2c3d4b0b4897af68f5a6277f9a65aa652a353
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0f6nwvf7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 7.1MB
                  • SHA256 dd6a2b7b0f31479354709ada59873709b2174fcc17d57b5e09a30b9773efb34f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/2432-1020-0x00000000062E0000-0x000000000653F000-memory.dmp
                  Download

                  memory/3424-831-0x00000235801E0000-0x00000235802E0000-memory.dmp
                  Download

                  memory/3424-838-0x0000023581AC0000-0x0000023581AE0000-memory.dmp
                  Download

                  memory/3424-862-0x0000023581E00000-0x0000023581E20000-memory.dmp
                  Download

                  memory/3424-878-0x00000235942E0000-0x0000023594300000-memory.dmp
                  Download

                  memory/3424-839-0x0000023594000000-0x0000023594100000-memory.dmp
                  Download