1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1

Analysis

user interaction
yes
max time kernel
94s
max time network
92s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoClicker.exe
Size 1.1MB
Sample260628-2y2g8agy3p
SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
MD5 913a423f66aa1c41e374e21a911a3c20
SHA1 449df612d0f02e868992faabfbf4d5d37c727936
SHA512 ee01f1a322e982bfd6618920e4ec9decf23317628f39dc9b771ff4f758fef3c9266cebbeaeb8ba1e4bbb1f0b683cba1aa3a533bce62a706e7dfd2a7d3bdd1f73
SSDEEP 24576:pRaZROMOm8FN7TjsPnzt2heeRhQbJpOQam1Mfu37d:zkxOm+7TjsPnztyDMBayMc
TLSH
T169455B5523A44199FE6AF0F68A52C106D6B17C4A12B6CB1F01B039B52F736B3DE1E31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe

Checks processor information in registry 2 TTPs 52 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
784	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4796	mspaint.exe
4796	mspaint.exe
6832	mspaint.exe
6832	mspaint.exe
6748	mspaint.exe
6748	mspaint.exe
812	EXCEL.EXE
812	EXCEL.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6320	AutoClicker.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	6196	firefox.exe
Token: SeDebugPrivilege	6196	firefox.exe
Token: SeDebugPrivilege	5740	firefox.exe
Token: SeDebugPrivilege	5740	firefox.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
6196	firefox.exe
6196	firefox.exe
6196	firefox.exe
6196	firefox.exe
6196	firefox.exe
6196	firefox.exe
6196	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe
5740	firefox.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
6196	firefox.exe
6196	firefox.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
4796	mspaint.exe
4796	mspaint.exe
4796	mspaint.exe
4796	mspaint.exe
6832	mspaint.exe
6832	mspaint.exe
6832	mspaint.exe
6832	mspaint.exe
6748	mspaint.exe
6748	mspaint.exe
6748	mspaint.exe
6748	mspaint.exe
6196	firefox.exe
784	EXCEL.EXE
784	EXCEL.EXE
812	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
5740	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 6196	3916	firefox.exe	103
PID 3916 wrote to memory of 6196	3916	firefox.exe	103
PID 6196 wrote to memory of 1512	6196	firefox.exe	104
PID 6196 wrote to memory of 1512	6196	firefox.exe	104
PID 6196 wrote to memory of 1512	6196	firefox.exe	104
PID 6196 wrote to memory of 1288	6196	firefox.exe	105
PID 6196 wrote to memory of 1288	6196	firefox.exe	105
PID 6196 wrote to memory of 1288	6196	firefox.exe	105
PID 6196 wrote to memory of 1288	6196	firefox.exe	105
PID 6196 wrote to memory of 3412	6196	firefox.exe	106
PID 6196 wrote to memory of 3412	6196	firefox.exe	106
PID 6196 wrote to memory of 3412	6196	firefox.exe	106
PID 6196 wrote to memory of 3412	6196	firefox.exe	106
PID 6196 wrote to memory of 3328	6196	firefox.exe	107
PID 6196 wrote to memory of 3328	6196	firefox.exe	107
PID 6196 wrote to memory of 3328	6196	firefox.exe	107
PID 6196 wrote to memory of 368	6196	firefox.exe	108
PID 6196 wrote to memory of 368	6196	firefox.exe	108
PID 6196 wrote to memory of 368	6196	firefox.exe	108
PID 6196 wrote to memory of 368	6196	firefox.exe	108
PID 6196 wrote to memory of 1948	6196	firefox.exe	109
PID 6196 wrote to memory of 1948	6196	firefox.exe	109
PID 6196 wrote to memory of 1948	6196	firefox.exe	109
PID 6196 wrote to memory of 1948	6196	firefox.exe	109
PID 6196 wrote to memory of 3608	6196	firefox.exe	110
PID 6196 wrote to memory of 3608	6196	firefox.exe	110
PID 6196 wrote to memory of 3608	6196	firefox.exe	110
PID 6196 wrote to memory of 3608	6196	firefox.exe	110
PID 6196 wrote to memory of 6400	6196	firefox.exe	111
PID 6196 wrote to memory of 6400	6196	firefox.exe	111
PID 6196 wrote to memory of 6400	6196	firefox.exe	111
PID 6196 wrote to memory of 6400	6196	firefox.exe	111
PID 6196 wrote to memory of 1852	6196	firefox.exe	112
PID 6196 wrote to memory of 1852	6196	firefox.exe	112
PID 6196 wrote to memory of 1852	6196	firefox.exe	112
PID 6196 wrote to memory of 1852	6196	firefox.exe	112
PID 1312 wrote to memory of 5740	1312	firefox.exe	118
PID 1312 wrote to memory of 5740	1312	firefox.exe	118
PID 5740 wrote to memory of 1424	5740	firefox.exe	119
PID 5740 wrote to memory of 1424	5740	firefox.exe	119
PID 5740 wrote to memory of 1424	5740	firefox.exe	119
PID 5740 wrote to memory of 1276	5740	firefox.exe	120
PID 5740 wrote to memory of 1276	5740	firefox.exe	120
PID 5740 wrote to memory of 1276	5740	firefox.exe	120
PID 5740 wrote to memory of 1276	5740	firefox.exe	120
PID 5740 wrote to memory of 3972	5740	firefox.exe	121
PID 5740 wrote to memory of 3972	5740	firefox.exe	121
PID 5740 wrote to memory of 3972	5740	firefox.exe	121
PID 5740 wrote to memory of 3972	5740	firefox.exe	121
PID 5740 wrote to memory of 3240	5740	firefox.exe	122
PID 5740 wrote to memory of 3240	5740	firefox.exe	122
PID 5740 wrote to memory of 3240	5740	firefox.exe	122
PID 5740 wrote to memory of 4276	5740	firefox.exe	123
PID 5740 wrote to memory of 4276	5740	firefox.exe	123
PID 5740 wrote to memory of 4276	5740	firefox.exe	123
PID 5740 wrote to memory of 4276	5740	firefox.exe	123
PID 5740 wrote to memory of 4432	5740	firefox.exe	124
PID 5740 wrote to memory of 4432	5740	firefox.exe	124
PID 5740 wrote to memory of 4432	5740	firefox.exe	124
PID 5740 wrote to memory of 4432	5740	firefox.exe	124
PID 5740 wrote to memory of 5508	5740	firefox.exe	125
PID 5740 wrote to memory of 5508	5740	firefox.exe	125
PID 5740 wrote to memory of 5508	5740	firefox.exe	125
PID 5740 wrote to memory of 5508	5740	firefox.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:6320

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SuspendWatch.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2108

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SuspendWatch.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6832

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SuspendWatch.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6748

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {81c50dc0-be77-4f52-9890-1d33ce3743a5} -parentPid 6196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6196" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {008da89d-d8f0-44af-a5e4-80b5e2a36045} -parentPid 6196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27274 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {325611d5-1429-434b-bd35-20e4bbf4eba6} -parentPid 6196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27274 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4104 -initialChannelId {a48a12ac-4ca9-43a9-b290-965425e6ccba} -parentPid 6196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6196" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3236 -prefsLen 34773 -prefMapHandle 3176 -prefMapSize 270279 -jsInitHandle 3180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4712 -initialChannelId {6d6b87a8-7f68-42ba-94b8-05303a4efe7a} -parentPid 6196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5072 -prefsLen 35010 -prefMapHandle 5076 -prefMapSize 270279 -ipcHandle 5088 -initialChannelId {537c8e21-6d5d-4a55-94d0-6fddd18b4355} -parentPid 6196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4992 -prefsLen 32952 -prefMapHandle 3012 -prefMapSize 270279 -jsInitHandle 2728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3008 -initialChannelId {4cc00fde-203e-4002-a4f0-05ff03518da4} -parentPid 6196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5704 -prefsLen 32952 -prefMapHandle 5708 -prefMapSize 270279 -jsInitHandle 5712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {d3b4f2f3-e714-4b5a-b2c4-cc717c317834} -parentPid 6196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5876 -prefsLen 32952 -prefMapHandle 5880 -prefMapSize 270279 -jsInitHandle 5884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3016 -initialChannelId {8b47e769-b680-42a1-b1d6-097922d8c271} -parentPid 6196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1852

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\UseCheckpoint.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:784

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\UseCheckpoint.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:812

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2032 -prefsLen 27097 -prefMapHandle 2036 -prefMapSize 270315 -ipcHandle 2108 -initialChannelId {78e842aa-c2ac-46b3-8ab0-6c8cc2f82cbd} -parentPid 5740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5740" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2364 -prefsLen 27097 -prefMapHandle 2368 -prefMapSize 270315 -ipcHandle 2376 -initialChannelId {1f9553c7-e37b-4da8-b20d-c05f8dc5448f} -parentPid 5740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4028 -prefsLen 27746 -prefMapHandle 4032 -prefMapSize 270315 -jsInitHandle 4036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4044 -initialChannelId {e972e49b-82c7-4619-9154-6494032de6c8} -parentPid 5740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4288 -prefsLen 27746 -prefMapHandle 4292 -prefMapSize 270315 -ipcHandle 4080 -initialChannelId {0f65c39f-2b6b-46b8-9253-873272bb2305} -parentPid 5740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5740" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4836 -prefsLen 35299 -prefMapHandle 4840 -prefMapSize 270315 -jsInitHandle 4844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4852 -initialChannelId {3eb5d800-46e0-47f2-9fe7-6052db2ffd5a} -parentPid 5740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3056 -prefsLen 35299 -prefMapHandle 2600 -prefMapSize 270315 -ipcHandle 3004 -initialChannelId {6db1954e-2db9-46d1-804f-a5dd40ff778d} -parentPid 5740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3472 -prefsLen 33241 -prefMapHandle 3296 -prefMapSize 270315 -jsInitHandle 4772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4780 -initialChannelId {8afec3bb-4a97-4a22-8036-177d603e828b} -parentPid 5740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5696 -prefsLen 33241 -prefMapHandle 5700 -prefMapSize 270315 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4772 -initialChannelId {9b1d7f00-7f29-47d3-8bbb-8fec4ffa6107} -parentPid 5740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5868 -prefsLen 33241 -prefMapHandle 5872 -prefMapSize 270315 -jsInitHandle 5876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {7bbabf4d-b59e-4810-851c-51961bdaccc7} -parentPid 5740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db
Size 152KB
SHA256 61c8d2fc779afeb26b74231b02e1077920144331a213321b447e51dee238e757
MD5 361c5015d66fa4dc52e5ffe2dc133d4a
SHA1 3f88cddf406c6f923d43bdd8f3b58e89cd4e1893
SHA512 cde666e62939efc1ffededbd436c58fd2b806cd0fa3f6d3e26ccea6a23a0f7b8dcaf185a0f9ad9737d9435412a71a9703db0f4c48d4231938dbcd9a59880fb18
SSDEEP 3072:iDB1v2bjGn002Dph2bze/4IZvYyjog73ljtbIiffybBD:iDB1v2bjGn002Dph2bze/4IZvYyjog7i
TLSH
T19AE3423BDE323467F54EE2B896160F8B37775FD64D51828490441EBCAC1F632AAB2076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\activity-stream.contile.json.tmp
Size 4KB
SHA256 587f032b920a1ae417e28ff4296ed7a2c03cfc74138e8c428931c12b58cb5753
MD5 97975ad0b5acbd77895bd94296bcc05e
SHA1 480789e18cf909aeac8373213f9ce358bff53a49
SHA512 800e6ca5dcb374a5a8cd62548cb603120bb129d9c0649da83dc7fef0ed471d09494e9fb28e36750604d1cb64dc148073e94073cae7f652c4bbe722f7593590fd
SSDEEP 96:TXXJ/8DR9DFKYZdcBnB6DwfdPM0V+tlY0F8KT+mRqtl:z58bD/dUww1PM0V+tltFAmRqtl
TLSH
T160A1E88FFD6598930321EBF37C8D37997206B146EAE98E06BA949801D9DC15F41CE284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\activity-stream.discovery_stream.json.tmp
Size 74KB
SHA256 684ae4bc2b8865f739bc9a5f71d26e31ccf9bf63ac160d716f5fcc22ce032bbf
MD5 42a0dc535335e31238cff03371c45958
SHA1 6e1527dea7bc19840ebd5528b443d5ecee01aec6
SHA512 46c4329edfcc6d2d66a376405b6741fce88a8ce17c85d069462493ef28f7217b0ed2ceb04a456aabb1bbcae9b01948db52b98009cea17ecf16ddd9361d02802f
SSDEEP 768:eyE1MttnCKCvtp1CpT70ynAoXHH/5AmjNZ+PiFS:FIlHp1LEAoXh5NZ+PD
TLSH
T17C730AA3A3B971FB1B9137CB2C0F798B52E1014AF74605C9ECEDCA1C819D695123E5AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 8e00c07ada18a9a3fcd47c9ba3f5f1f40094daddaaa4d2444ab16aacce500300
MD5 7d4cc1b905bfb7969ac36bbb95f6f133
SHA1 c2a513d2ff573f73f75eb48fcb748533185a1598
SHA512 027c207e811cca4116739108d65c652760edd24fc3bddebb0ac2d06faa5819b22802fd057049fca4c42f81be77a8ebce1a9140341eb4133f40a06211718b0aba
SSDEEP 384:HPC9iO024YNo6J+Sl1xDnZBPsac4j0lpDII+a/yvE/yvQ+:v9ZYNo0+Sl7zZlsac4ID8Loyeyh
TLSH
T1A8529EBE9F0238AE1927D0A5D5FD9244CD04E6BFDEE2905619143C04CA447B9F4E68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 15KB
SHA256 85db34d2d0a30fe8bd8f13cb9cc29dbc42bff3807150c3cd73fc4f80c7364a08
MD5 babf4f7f25347cd1a1ed7833abf40cb4
SHA1 d1b8480d110413aa8e263ce339760627b7d93695
SHA512 5c3aee3ad173b2e9ba6d2a8b945deecf5012ae045456d60e2c14a44476240f8c692f1fcc7276a98a3858e5ebcf577a58efc0011d3544774dcb91dd102c483e0f
SSDEEP 384:/ym17tRASLty6PtyLhfdDE2Ba/rIVy8e+:HRzLt7PtShfS2sDIVy8z
TLSH
T16E729DBF9FA44C8A0B52D983DCAD37A46C18B2178FE8D5893A847505C6DD36A90FD1C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BB95D0607349D05725D5FE01D4FB300E319072AD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\cache2\entries\BB95D0607349D05725D5FE01D4FB300E319072AD
Size 11KB
SHA256 875ff7caf72a11aae8f7e63fcd6b026a75164e0ff518134876b35af2d086b2c6
MD5 50370ddac2fa8da1743650d271f9dd5a
SHA1 c44a63fc9dfc6b59e191494c79f1fc51f00934be
SHA512 a002b649cb26a8582d8c8e2b9c00be355239cce3566cbffd66d84998f14d03df0f2436ab685afa14234f63c8c1195c86f3747e83322d102eed832e1c848d4568
SSDEEP 192:2ljU/g6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDNmo:2ljU/gvI2Efy0vI2EfnaGUzHODWoh1Bn
TLSH
T150428E3ADE51546E0AF1D597E9BC35690C45EA03EEC3D09D3F593104D8C42A5B2B82CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0F48A0632B6C451791F4257697E861961F06A6F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F
Size 252KB
SHA256 1b9fb204df62da06572618a8a42508a30bec31d1e9ed59f89f2c73af998a03bd
MD5 74b53a91d82f45ec41574d370bb7121a
SHA1 a9632696a5bbbe971ff4a4c871bafb244bcb4ff4
SHA512 92242d359647ec21ea2ed12e4afbb579babded6190ff6020d22c5ddadc8c862bb39232a9cde8176513979f6ff79de5ef66a42b80bce9c5a144e331d512c98834
SSDEEP 1536:ZYCYPs5YchR1eWhlOSPrcRdNRdyvkcIxrRPT9ARxtLLdG7E68Ct5D+IM1SCumRXD:ZcBDcTBIvKLXZ
TLSH
T17344E8F7E6AC30FB175286DC6C0D72CF62AF4239DB5208D6FC688148D3C9A65107A799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DE5F6CB1BD71958EB146CDD974763A3115937269

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\cache2\entries\DE5F6CB1BD71958EB146CDD974763A3115937269
Size 12KB
SHA256 d12de2a0bf6b67231fe0dd24fd088ead40189144411b2e4aa425f46537ca4c5b
MD5 5b1c9ce1150e67de741c1b7bc9bf9480
SHA1 a950dd1051e21172c779d1f733cbf4da68176ee7
SHA512 6e17b8630a2d7c6bdd32dbe30cb6b36ea6be8debc3cd06140d0805b8b9c753f812d395eece6f61d0559382733e7a86240b93e9ced786dc8681eb0f18f2964d90
SSDEEP 384:w4lvI2Efy0vI2EfnaGUzHODWoh1B9M0lpDIIDNYEY1:w4lw2ey0w2enaGUzHODxh1B9pD8KM
TLSH
T1E3426D3ADD2158AE0BA0D687E57C59691C46AB03EDC3D19D3E5D3504D8C43A9B3B82CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E473D920361435DF4BBBF194E406FE372015579A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\cache2\entries\E473D920361435DF4BBBF194E406FE372015579A
Size 11KB
SHA256 e7cd970769f0408c8d5441f533b9a9ee1c7370c7cb8f8c4089faae3425c6fa8d
MD5 7da40ecc02484f73b93d3de509ba06fd
SHA1 0e8b24596aafb068dd7f40a7b98f53350715bd76
SHA512 c175f7837a2baddfcaf582c82315bca81b0f38e1a632005a735abe06fc2789ced9c4e1d77212dd42bffd47446cd5e7d7764d73d67f81d295fa5949dbf06945ee
SSDEEP 192:ttwO6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIID5Hd+H:bdvI2Efy0vI2EfnaGUzHODWoh1B9M0lY
TLSH
T10F427E3AED5158AE0EF0D59BE5BC69691D46EF03EDC2D1DD2E593104C8C03A9B2BA1CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6DB2CC802065A948266A380F89F5EB80BB1A349

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\cache2\entries\F6DB2CC802065A948266A380F89F5EB80BB1A349
Size 11KB
SHA256 7adbe585a137d633fb7998e0145c536c9f9d705722d87a71c0901f2a2a939fb4
MD5 17f4f036eda991a343366a34fa97b1c3
SHA1 dd525ace9d18c9262e955a80f16837afc4ac4540
SHA512 cfb37ea7f885e2cc9384dd9acf05f7cd421521f7bceb234f01ec2d2af299b038ab72fb73ac1362bdbf2a68b5848a17d3af9739578e73f5a453ffcf2529cc16a0
SSDEEP 192:KCy6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDNmdYk8:KFvI2Efy0vI2EfnaGUzHODWoh1B9M0ld
TLSH
T118428D3AED6164AE0AE0D597D5BC25691C49EB03EEC2D0ED3E593004D9C03A9B2BD2CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache-child.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\startupCache\scriptCache-child.bin
Size 534KB
SHA256 33916a32b07f9ce0ccee5359ca8d7b11b963c54eb9121ed11702f42edecf92f5
MD5 bf89fda946c219da9144c7d55d43fe5e
SHA1 69738e55da77a25279de17f9317e2389570cb19f
SHA512 495e9a1af1b383ba07f4106e2d9499f6c96a3839520968243b6238b283b0b703008539964719445970ba8dfbeb3deee78ff479c4eb1ea0692ca3f2ab206f85e0
SSDEEP 6144:rFCUbu1hjktpJn2pmYXHqjOcfEavSW2psu:p7ubotPnpvRh4b
TLSH
T14AC46111EFA64E23C418037A44F753313A31E1451BEAE3276F8F7629BC673A91D8A95C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\startupCache\scriptCache.bin
Size 9.8MB
SHA256 95ef75a8dfc331d9e289258a531c2166847a030081cdc43f11c3bca4ee44610a
MD5 0c6270abcd3a8c058a58f64e6aedc92d
SHA1 578706bba03890f3bbfe52be26f6f73855dd33cf
SHA512 fcf0e4b95d24997845cd2ed30f1fd32dd4a75ad3849cbbba82e297132d919b65ec5722a1d6833f528d3a27ece0048e0043346fcf118037e119edc8223f423e7f
SSDEEP 49152:3kVvxHNHhFDzwH6f8W5vIb238zYPHpJFVFwjdhCXfJe/BUbSQD:Kv1F/wafl5PnRmSRt
TLSH
T1A9A69315EF664E23C468027A48FB53313A30E08547EAF3276F8F7129BC6B7691D8995C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startupCache.8.little

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\startupCache\startupCache.8.little
Size 8.1MB
SHA256 dbe101e1b777a26ed2c971e82229ce3a948f52a0d9c1790fb7e9dafb9835839d
MD5 8580b06964ae7de48f6588cf4679fab1
SHA1 c902e27122a0335042ba2a8c0b9508fda522cd7e
SHA512 3970bd7f6d8c135cc9e1d63dc2bd8cb38972acdde80d6f48f7f2a6ba578d92e0b3af3664325f7daa459054d3e69adb11642f3e444379f09cd2e063904f3c5164
SSDEEP 98304:Mr3oLbJheeNr7Gqd8MV9o3i6lwvhNTn1jsVIKFGHOOR:0ibmkB8K0iuwpNxt1hR
TLSH
T1E98602B6B3590697C425191AE87A0A393763414203E166AACF78533FFFC724C1BC6E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urlCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\startupCache\urlCache.bin
Size 3KB
SHA256 d751bfcffdd65c49a8681a107441212843caf45085a42a6c806d3561e7d007c0
MD5 b8fb4287c85130624ee3f2008d61e052
SHA1 bab85778fa19ee374f6eb000bbccd4ff5486fd2c
SHA512 2f821a2af959e683c249de2fefedf9a620e5806224db79ae4547f7246763a770275d0dad777773550ade558753b019580f4c78d1955dad73e2cc723bb91a825b
TLSH
T1A361B492E47F203B7C62A8FB6D95C171B42149CED1CD20DDBA9663D4209E7DC034EB1A
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 efecd4c9707f3965c29aab4bbb3c2a039a47496982c35602b45ef8194793d710
MD5 69441eee0630c5066d06bf1a1a1add25
SHA1 5d9e28cb6c6d03998fa04dd55207d0e98066930e
SHA512 bc4a20a0f15183b74c66667fc2c1f14ab0ceaee3a6ce90867af35d7d70e1121dea922117dd4b3640b83047a25b4e1e6296149819d8f1d375ee61e277eca52855
SSDEEP 3072:j3l1tfLr1aZ/NJQ5ZS7ZV7/m/cTnOa0/WEY:p1BgZVK5Zk/m/cLOz/y
TLSH
T1FDA39EFADB92C93D64FFD42DA682843EFD262404B3A33019C853325566C6FB46779648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 362B
SHA256 d003ed95a1becdc5996dd74840564fba82fd69ea7c14dacec73e62b6a8736d2e
MD5 dbb59527a42e683c8fd6e71d8167def5
SHA1 76a3dddf485cdcd35e6d46a61d9042e2dd08ab98
SHA512 f118e8f7226583229bbf0ba365563914c9f8f0249562e221eb0b33ac4dd30f10960d6b6b7c04d23bb4ab3ad4ba00a685e5e63bce5edce068d9632b6d81053a98
TLSH
T14BE01A1B6335C3E1A37D81B87537DCF046F2956CC1AA523519C90CC51E3051395D708D
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 3KB
SHA256 9db604441d79a10f273aac7adac4a71a86c8207d0dcece0ca0ba67504ce26734
MD5 55d2443d831fe9171c9a7301be8cd3b6
SHA1 d7af43e59ea41994b901e35459b147ccbf147b16
SHA512 851debdffd569fed951470d57bc491c0b48427b8c4afeda4d56352d712354215b3c689c7a8892aee1b056f929c2bc79c4205fb7cfab8f10928e371f0f6d86313
TLSH
T1DF7126131A4B4B0BD5D74B31273F975BE620FC539710930DAB88612A2E35840EADE6BB
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 3KB
SHA256 489c39a86e8ee1a891a4231ae9d65ae88565af4c83f2bf6570f9c8ce8b4e7902
MD5 6d98197a892b9612fdead7c6541d2559
SHA1 6c8bdb93991a75bb8c8c73e5438f0e57074fa705
SHA512 141d0d89aed005062ad48b806d7180a2b1f496b3b1386f5d300ef0ee4fbb5f1ca87dbe2b176edf03a87e765685b0b0f4fab57c6d374a4b43ab1def942f0682d6
TLSH
T1335104121E4B4B5BD5D35B31273F979BD220FC539710530DAB88601A2E35800EADEAFB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\SiteSecurityServiceState.bin
Size 1KB
SHA256 973a8ed85fa2c5b742f6796ac11ec626f010b28fc781f57fbd888365907584bd
MD5 6ba995c98a01c5105407278848d406e8
SHA1 50f764bcbd78c110109af1dd79b48aa7d7cd500e
SHA512 b6cf90a5295d3a4729161c0182f7aa73f0b69a55c65fb6e68a7345c9e29934be3e3157aabb01e82cb3260b0eb3b045c0ee3cb89a08efe56a5d482d8bed3884de
TLSH
T1D121C233889AC035E4C2453438ADC5502DE633868273F0687DE2CAD13047FDA39AD7D9
MD5 SHA1 SHA512 TLSH

Submit Download

bounce-tracking-protection.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\bounce-tracking-protection.sqlite
Size 96KB
SHA256 83e2a5c9d65ed4f819fd9bd6a52715e7d92eb7665d12e9f6dc431496c2b758f6
MD5 87b094ee8bf6b3236413e045af531f39
SHA1 35b84680882ae729f75eaaaf14047adaf5f6746f
SHA512 0c47f8a39b1342ee8be869ae5e146cf2693fc118f9ae9588a03f08a26a756e2c1453c860d42060f505fc19bd47512d7becf73bf2680e233f1e7c3c10f6d88a4b
SSDEEP 12:DBl/WhnB8/ykS2lcBDMGEJKM+vcBDMvYkMBAlO:DLsB8akrEDE+vED8YfAlO
TLSH
T18CA3C68F0E702680EDC420B0D7828EEEAA1EC32DCB13279202A000B29D0206019220B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

content-prefs.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\content-prefs.sqlite
Size 256KB
SHA256 fff6c2239e0d2ccc2dfe16bece3f51fe2831ce8baaa337827bbde444207a727b
MD5 d3941a15a96fb3023cf1587a47b586b2
SHA1 94996d072eea6af88a1d96b8ef900a1fe3ea56ca
SHA512 d627318f49a185b6ad4dbd76c9eb5aef82c360ab76fed195641fbd258e045e1f04c0d6359827a9c31c677414bc656e183770c0d1b829821388db8bfd2608f364
SSDEEP 24:DLCKvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DmWwae+QtMImelekKDa5
TLSH
T1234426174AA17408C0B014B1D4636F22AF3D405B8933E7B23ABC143A4F886AAFC791E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\db\data.safe.bin
Size 33KB
SHA256 3799ed4a5810883007ca06dd98d39ffb09e17ddef29269dfb8a5cb995c7fcee0
MD5 6c0ab58d58bce58dbb2acab4409c9244
SHA1 6b3e8a4dbe8d59b3589e23d5d2d553f17af9bbf5
SHA512 7fa0a2fab08fd40caa4f5ca1c7ef26a3a06aaa1d778f6ca552d488adab99a2d2d21cf8279628a4a5290ff0270f86e0bf8703f9b71597edf87d46b2d9ed8bbc4a
SSDEEP 768:L1g9KKCy2sbwGcm+uEjaaKPCvTP1KIbVbhblbhbVSXj:u9KKCy2iCOaVu
TLSH
T124F21444EB2E953FD46812BBDCA107002F78F88A59592F673A4C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 273c3fee6b226faee20ae643dc97105284f2b93578a5ef5672ecbde66c736de9
MD5 8c90bd99ce5604ecd9071ba4d9003f27
SHA1 cb46b46ef8241cdf8b4dddbc2e7f9982eae7c702
SHA512 8b7ae11e72c7d6f861cf4cb9ea709b57a5cfbcc905eab710d45c213256638b00d0b1a8c3f4ab04afad9b639814227eed74d32f8353e2b70db4b3865e587e3dcd
SSDEEP 768:e1Y9KKCy2sbwGcm+uEjaaKPCvTP1KIbVbhblbhbVKbqj:P9KKCy2iCOaVU+
TLSH
T1BEE21244EB2E953FD46812BBDCA107002F78F88A59592F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\db\data.safe.tmp
Size 33KB
SHA256 45190e2795a4c79f329f73f2415394b7d7ca137605f770692096e3316414b2dc
MD5 7952641e16b684a40d33ac2574821694
SHA1 e7b1639340b606fd321f66442c01e767162f3c78
SHA512 eb44e859407598d3ba69c1cb3ff66f83b01b2b5e2bb5f7d9ad315a4920ca2b2dd07b68ccb42e63f652345f01a9d5ee20c75bba6fa25d7e6288939b2ac9970145
SSDEEP 768:p9KKCy2sbwGcm+uEjaaKPCvTP1KIbVbhblbhbVlkAV1/:p9KKCy2iCOaVKS
TLSH
T1F8E21344EB2E953FD46812BBDCA107002F78F88A59592F673A4C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 06331fa7a0131f68f1f8c8fff703b595b76f277633836671746a54f89928b89a
MD5 4671494df19d7608a92c3f1da9acd3ea
SHA1 b7beafd8d35e7a797efb3d67e600ab07970aa803
SHA512 a2e080a721e481ab615c203375259a03660bf0f16f8447257b0fa2ceacad0117c11decf15db9f276c9e9866a304bc2b4949935322217326b7dcddab0c973012c
SSDEEP 768:u1taOCZOUT6ZGcm+unh7RiR8H511AbJbRb/bj:CCZOUeehdiP
TLSH
T18ED2F144EB2E513FD46912BBDCA50B002F79BC8A59192F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 c8de50220bbd9ca856cf0e21bec89114bef30e513de9f892f9d3552d9568ce54
MD5 25a9efe8f50152839924173df15bb7d0
SHA1 61e0fbb798d6c6c0ebe3799b544872d17a319c15
SHA512 fe895f45d9356b1a1686c4a47900d6f5deda8401e97279c305ae89f82f3d3d4340d26c735223b7ac341caa0ebb6bfdcd1cfa39a79fd1bf4af7773162bca816a4
SSDEEP 768:UkBCZOUT6ZGcm+unh7RiR8H511AbJbRb/bj+1/:JCZOUeehdiPg
TLSH
T197D2F144EB2E513FD46812BBDCA507042F79BC8A590A2F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1412a03c259313941db7ce5267a3c67d5c2b6dbb5f0696b728a0fd6cf5eff8cc
MD5 7a1156afadd8433d878c2b79a595024f
SHA1 a7a3371190f4198fef40f9aaeb1eb1c1677714c9
SHA512 6b094b79dd5a6514dcea56b6d66b99f9abdb204cb11b779330ce6a7c30e0b8376ece740f06773a2f46f8c27a1e41ddca7edd7b61ace61e5e071bda1ff1e56d85
TLSH
T1B3216A5C39F84D7B59C7F29C7441018E97948E071A4B1D434D22EF8CCE95AD9326E43C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\events\events
Size 1KB
SHA256 73ec3d0b09bc9e5989c6a27f90e822c6cde3514ac109c86ada8b7a124380ec85
MD5 f66519506fb097ac254d7ca950b41bb3
SHA1 858293d18276243a587dafc1b6244124807b4e0c
SHA512 538036e9ed9a2eaf16a3f9ad3ebe5e298f31ece026268e3a0e4000887e1cc33c5b99283781f3005257ab9ade25c4842e7843de2b6a41a4569443492d5770814a
TLSH
T14721575C39F84D7B58C7F29C7441018E97948E071A8B1C434D22EF8DCE95AD9326E438
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3f416b16746078b6f637777f3b61498aa76ff514e534e6bb5980ab86e25e6eb5
MD5 f6da9d3cf4f5fee746f1c77958c9030d
SHA1 eca16e3ab50b79cf62fe71afbf953a44e83f8351
SHA512 c7d2e53853b27953663350f992ebf1ba1848f65aefa8878964807fa76bd6d697cda383c48896ef96af6e896e9118662b7324645a11f8858d132865bf5cf196f9
TLSH
T1E121295C3AB94EBBA88BE39C7490128E57914F0719871C430D52EF8DCE85AD9326E43C
MD5 SHA1 SHA512 TLSH

Submit Download

26e3b1f2-864d-4924-8cdd-2549ff307839

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\26e3b1f2-864d-4924-8cdd-2549ff307839
Size 235B
SHA256 3d1bfa1362200897e99706e9e2262a6ba978236a8a6d9676226bb50f3c3cbf7e
MD5 2229626bf788e176e159624d96b74309
SHA1 e00543d2a94707bd6571da0b40877e81cc077a9a
SHA512 f981c2e913207c28b6a009f700881a85187092487385051fa7bf5e0b19d9aba252ec8795c0b010ffa303f61b7f6ef9c4aa2b071da156a728645dbc3e2cccef58
TLSH
T1F6D0978024C8235D48140F0AF0B1BDCA30445C3714F05810C9914B758EB9DC442A284B
MD5 SHA1 SHA512 TLSH

Submit Download

2cfb1b83-ee4b-474f-b9dc-dde87fff8f5d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\2cfb1b83-ee4b-474f-b9dc-dde87fff8f5d
Size 897B
SHA256 515d3f1f3f5acbecb7c8f00b0a2aaccb7e9a09971d81c093da69f61968668a19
MD5 c08fbb5c4eaa47cdf59eb99044e743ed
SHA1 edbf9958fef8d3e8bf90c618ce231fa67e9f05be
SHA512 031b48620feabf5e7ec45071a408d765e58eccafcf012d80d7dc4a7d1d8fdd0477812ff28a4f3dbd39920fe0cf7d8b4203d505c173e858db6e6172680d299896
TLSH
T16F1100808774B572CC7CD34B989277878BE0742390C618247EA4AF184DFA62EA76B307
MD5 SHA1 SHA512 TLSH

Submit Download

74bb3187-0836-4f21-b823-2ed68d533651

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\74bb3187-0836-4f21-b823-2ed68d533651
Size 871B
SHA256 6c96c2774e22296d367816331982b173953febd69eb24ac1759a834b3bcc20a5
MD5 888b11726a13d66d7f1d8b18668faead
SHA1 a33c231ac604dfe0c8873b0921e9c8923a3a4eef
SHA512 6087127d2f0e8d347fe348b890d389f9bb3ec51a8749b559bbe0dfec88e3f2149cb42c92db0365459ea164e0384412602a5b5a79564e1091dcf188c049394ef7
TLSH
T1DB112F818B38B5B2CC7CD20B85A13B8A8BF47913C0CB58147DB52F184EBD61E936A347
MD5 SHA1 SHA512 TLSH

Submit Download

828d7329-1e26-4f80-9970-20716407f975

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\828d7329-1e26-4f80-9970-20716407f975
Size 886B
SHA256 1df83343e5afe2d38df079ab0d2d2ee5105d12fc78c7267a245ca8fe53ed6b36
MD5 085ccf048b761742912d39c3b5304db9
SHA1 e31d4f789d81474aad0fec132d01b540f8eb9db9
SHA512 ab353f9e2a18c7e8a3f49689932eb0ffcb99581df0908c6bf3f651eae1df961dd1d638657f58c89f2abe259565a303bc8532fb0803e094088d976c6f825dfb0a
TLSH
T1B51100408B75B972CC7CE24B84E1778A8BA0741380CB1D147DA46B184EFE51EA76B307
MD5 SHA1 SHA512 TLSH

Submit Download

9d61b968-85e3-4484-8553-740a9c7a86ac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\9d61b968-85e3-4484-8553-740a9c7a86ac
Size 2KB
SHA256 c8473346802f9489339a2510d6fc59472edbbaa4a1da95dc9f1c109b5d795e17
MD5 0bb853c24dacd416469246f18c0ab87d
SHA1 e4bd6aecc9c31f0928c42680870ca7d7e0822133
SHA512 86c17fa99843e8e0ddfe2226876041c4625714054c196de7440f1e31035fb33d481335b637f88b9b1b72d54b356768d6e10255933648c3a18326dec6829b4d48
TLSH
T1CE41235C35B85D3A8CDBF65D9092338E93A05A5300C31C476D51EF4CCED169E376A52E
MD5 SHA1 SHA512 TLSH

Submit Download

c7aa158f-4768-4e47-baf3-83db83ef5f7f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\c7aa158f-4768-4e47-baf3-83db83ef5f7f
Size 235B
SHA256 6594dc28fc2df5c08cc45cf7a2413fec6be4567381a18f02c2f0f48b65becd27
MD5 2bd507ed752965f7549e635a2f3173b6
SHA1 232b06f0e7347672c861fcc88fc225d094246c4b
SHA512 5a7ded3bb86d5af30c29c8fae22b82a56b9bf89fcf44abdb28c197ee97b7d6b0dcffb86a1f685768909a352b61e400f265657774bd5ed053d8ad5596fc4eae08
TLSH
T120D097D514A8271C08000F0BF0B06CC230988C3320B4B8209AA94238C9FCAC902A1906
MD5 SHA1 SHA512 TLSH

Submit Download

cc502825-46dd-4b13-bf93-6adf26d219c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\cc502825-46dd-4b13-bf93-6adf26d219c5
Size 2KB
SHA256 bea904a1c34a8a75d4c2b78e316241a2a6aba9792fe385c6bf00a2ca401c7be6
MD5 e5b0cce4e1a7180c4a535ebea9cff432
SHA1 aec6d759245778b37d3fe98864d066be07dadffd
SHA512 23b2f8dc433ebcbcef3d5aa240c68a726c761464df2e5ec2c5e8e5ad1700f639e7b93c7c05091e3ab8839bd6b95dcb1d16bf6430f715314020477d12dbc0035b
TLSH
T16941535C3AB84D7B8CCBF15D9482228E97608E03148B28536D51EF4CCE997AE776E41B
MD5 SHA1 SHA512 TLSH

Submit Download

f892dbb5-842a-49fc-a0cb-a004241bab38

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\f892dbb5-842a-49fc-a0cb-a004241bab38
Size 235B
SHA256 2e4d6735413868df87443492b4c527a77f1698581adf69bc537a22a334cce5c3
MD5 e0b88eefe6812a69d3f06e9c40c4432c
SHA1 752bf1c67ee150e3263cf0591e7d6417c4f5e6cc
SHA512 c35d706a070f6bb3cdda65eea99434c9f7dc67e1304502653bf9e20f35cc5a99b793ab6ca3aea7ec10780fd6361963b4ef5a5e1f478e801271c867d6c23c1315
TLSH
T1B6D097C0648C735D49050F07B0A06ACF304A4C331C6458108AA241349ABAAC4429280A
MD5 SHA1 SHA512 TLSH

Submit Download

domain_to_categories.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\domain_to_categories.sqlite
Size 96KB
SHA256 c7baab1cd8662625bc822a3c3c7b57973b927cd5c26192d6cda60ed9ecc0ed07
MD5 7231237395096e88196ba0ffd7ac0ac6
SHA1 d303ddfed1d4341f30ed79abbc23ce51f651bd35
SHA512 6220c9908bfa889f1db84625dc214127ee76c40c97a0d2b81df251253d4a8cc7ba6387d94f751a8f092850ce8a86d5c7e0d7938b85ef763813c4ab4a0834055c
SSDEEP 12:DBl/ATMbUSoQym5H9L9ftirhP81MONd4/F0LA6Gr:DLbbv5XvtQhP8W5/b
TLSH
T1A6A32B1F1B1CB840D4C356F26D8329067634D50B8913BEF03B9D84004F066481C35AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\prefs-1.js
Size 6KB
SHA256 09cea66448e8ae6b948634fd38275f7f513ad2143f5ba1239bb9a4376e6acbfa
MD5 bcbb73bc0a554cf59e76366c2d82631a
SHA1 e53626245d6653ed69e41c2d31661a7d17f92755
SHA512 49d1ffd04e84fbf19e7ed8699fbd128c85e6bda923321a81f4b0a5b8607a06711ec86dc44c7a79897f43568ce995b21567e3c9aaf8a9e017de9207bf5715cfed
SSDEEP 96:xHchUTUXqGqufrvgQ1zS9SSlAdv9jEnwH0JcatBw88u8L4cnHdom:yhKRufrvgQYSSc0JcKBw88nP
TLSH
T102E11F789018CB7F64B6776CAC6888315AB2013BB7BF68C650B554C8055CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\prefs.js
Size 6KB
SHA256 cf02e1aaed06ccef3f1dc37a0343d0f9b1f0fb0ddd6eddf97b4227a23662820a
MD5 c6146911b7bb3a8752d6dcc61873e82e
SHA1 8608ae194591a7cc39b5742d3e372bf4c26c752a
SHA512 008bcd035b27e119e0319073624e0e474a968fcdbd759925cda479f3ffed319d7e95f4b0a4a3345b0869e84264a87364a59b7b8797310f2f5398a5cb60dffa46
SSDEEP 96:xHchUTUXqGqufrJ01zSkSSlAdv9jEnwH0JcatBw88u8L4cnH9om:yhKRufrJ0ZSSc0JcKBw88LP
TLSH
T181E120789008CF7F68B6776CAC6888316AB2013BB7BF68C650B554C8055CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\prefs.js
Size 6KB
SHA256 4ee760be0d10bb9bf23fb9049ced02cf38124f0c327e600a5f6ca55313dabca3
MD5 1eb7be61ea18a34db223e9b3d3ff3404
SHA1 2a4bd86af00be1211553b7542a221e5bf6902e76
SHA512 3177e67669051031b6e173a00274e0e1d9243a4e2705eb421278f4f6eb0ab81e0d074616bcb20be2ea1838df888ac3081ac941a495a3407e60a6cf25980c543b
SSDEEP 96:xHchUTUXqGqufrvgQ1zS9SSlAdv9jEnwH0JcatBw88u8L4cnH9om:yhKRufrvgQYSSc0JcKBw88LP
TLSH
T16DE11F789018CF7F64B6776CAC6888315AB2013BB7BF68C650B554C8055CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\prefs.js
Size 6KB
SHA256 1c580a679a01ee87b18d27a223fc6b08caad451435ba8f609449286e10a397d6
MD5 025d896e6b08482f8467ae62812a3845
SHA1 1e3d541f5ce170be721bf2ceb4fb73f54d49187c
SHA512 69702a909554adc592a1f670128cee643a1fe3819ba0b17dea6371299bf98f4b545a44e438eff5ee527b2d57f04b916f287aaab6ccea5fee76567cdbee8e88ef
SSDEEP 96:xHchUTUXqGqufrvgQ1zSASSlAdv9jZnwH0JcatBw88u8L4cnHRmom:yhKRufrvgQZSSp0JcKBw88OP
TLSH
T108E11F789018CB7F64B6776CAC6888319AB2013BB7BF68C650B554C8055CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protections.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\protections.sqlite
Size 64KB
SHA256 f47973dd13805200a469d534a0ec50e224f0c12ae77d93a0e5bcc267af19c145
MD5 63b6f9d979a2cd96d93c105805cafcfc
SHA1 5fc70ce8799617202d1b2a350f6d596b65d48e54
SHA512 ca475720928bd40abab686efb8b890fdccef59c292b26263d41bfd9dfe8f35d21405820e10505fa7cff49eea5ae57ffdbd6ca73d5cf6e1cfe67f5994d2823b90
SSDEEP 6:ltBl/l4/WN1dR4BEJYqWvLue3FMOrMZ0l:DBl/WunddfJiFxMZO
TLSH
T1BF53225E47387021C0891372ABD323923F3CD2FA93232E836A100C358C0A023B822AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\sessionCheckpoints.json
Size 288B
SHA256 d1a98a30522d1bf882574df5ed2793bba5c4fdf0381788babea0846f6946745c
MD5 e08ef355498ae2c73e75f5a7e60eada5
SHA1 c98b5ab80782513f6e72d95ab070e1ed7626c576
SHA512 a0550e83ecd1cf632b4e54bf43744ee9f7c0a8dfcf9a043e018c00d4ca0bba606cfcaaa469b204e7c9dffec1f79b91e16cd4f1c94ff512c45d3dd25b7174e859
TLSH
T162D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\sessionCheckpoints.json.tmp
Size 241B
SHA256 dd8349e2789db1125b477971c5d445b6afb2f6ea3b57de65080631040900fe8c
MD5 48fcad918c62db97e9af1dba1d131473
SHA1 d89381594d3241b0e645033f67572a5d8c166764
SHA512 2278d074aab519859188b047c77fe7b4db718e0af237b63e06a1b095d7a1eb4e07d6ea59cab5d7b1325aae0047fadea36eae12a80bfefe112aab85fc18aa1ca3
TLSH
T19AD05287C00D10BADE832E4873D4BB81EE3F00F7B2640542BAAC988C283B023858B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 3a0285c8233ef0324b269f7291094e19fd9b77259f9419861ad796f7e9c979f3
MD5 6b77a9f779399e95d1cee931a2c8f8ff
SHA1 826efd4feb0d50fcce5696111af7c811b81adcd9
SHA512 ef537c75fab8e86483ac03cc0d2feaf41575e35f54b95669a26bf6dfbf58021dc9a5bbe54d9537b55da3fbb0e0262adf6c5efd4394faaec81a31604533afec4f
TLSH
T120D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 774ce7baad79503573979917f32925fd7ae14aefd442932bc089896d6883e03e
MD5 ab2eaa0a436e12ec5306286d5e7fa22c
SHA1 11bca627f3851e526b748087f66de2847f0c90bf
SHA512 84c169282511ff4c1cb9a7661e4e14e6326888cadf58ae27cd389178317cebf122ff8cd8b91364681213ea4a6d12f02e5b367dfc636cc6c1bac2997f119680e2
TLSH
T12721A757882B1AF97A555109D4484F61CA693032847528E0818A9F5611DF64EB6C5216
MD5 SHA1 SHA512 TLSH

Submit Download

storage.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\storage.sqlite
Size 4KB
SHA256 1db39598ae2ee67e7a598723a6ec07a3b74ab17ef166a2614785c74c43d1c5c3
MD5 701bd81ab9bb9fb95ec393a557d20be7
SHA1 7f6d6f5a146ac2e0c5f5424da7d7199ca8b6662d
SHA512 4f6b7a82f3361c2f452f0093fb0286acfa898528a2933f501bfe627993899cc77e136c435a0cebd95457c72c604b030b46dc07fb7b2b937d67ce3dd46179fc5d
TLSH
T1CF815C8D1F247A00C0B057B1E5E00EE35E3E111E4B5B95C72EA011FACAF35966B164BD
MD5 SHA1 SHA512 TLSH

Submit Download

1657114595AmcateirvtiSty.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Size 48KB
SHA256 aaaa4019cfcb4c7a15cd28a851e9f735d7931e17b8099dc4d66eba37b3fc4461
MD5 93bb063bce6872b52145757b496167f9
SHA1 8d214c8e82d13eb7aff15a97d29934b996629bcd
SHA512 86fd660d93b66765ba24bca8caf2d4d4e8fad8869640fd92ecaa6f35209573c8a34962c6c53b7546cd50415cf48b94ef843ba0d9f12f21d0e344ac20fca9d5a4
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEmkB8u:Oa16S6CKnqlizbxV+2xVeU7X2B0mKz
TLSH
T10D23708E3F07A511C53AF0B178A08D51BC5E321E072226D669D0DAE4C8F215AEA5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.9MB
SHA256 64eb0ca9d04dbd5d22dd2f5ae3218730b3f29cd94734c0179f3dd38f487d876a
MD5 cad1338df85d05f7fc38da232c18f003
SHA1 c5de3f1ce5f230f7e1cb4cd0afd1edc7525020f0
SHA512 2143cd7667ea16620b45ba15f1b4492a7f89af939f263530d9a96dfcbef902e0ae6691b8773a0ee0430187fcccd55ca5bd4511237e0923d4b8db56d54454216f
SSDEEP 24576:xRzGYp/6Zpr9oRtYlnXYffi56UD9etSyBC7i+ZDuOEDitwNjJYe8mH/tN:xRzGYp/6jpWY1YO6UReBBC7iQKrWCht
TLSH
T147362AF820D1A257F3814033664593EB21EFD00C6027DE085BE956E9A578CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\xulstore.json
Size 139B
SHA256 80d6e3502e6f8c6518de39e6f52be679903f1add00b126522648aa888f679e11
MD5 64107b8807329700f54c5053c222797e
SHA1 56770d259f6831d78765479cf96198266f225570
SHA512 f48f015a308498844172fcbcd1e36373e6ef3e37b2e35328219185a6a547af63480bf9f1208361b47d0a373a8d3b68ce6bc01bc7cd5f28cea756caa5d2f9bc6b
TLSH
T183C02BB0519FE808BF15CFCB024E27943D2A800091C41126BBD31860008830F4C1C30C
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 f69f8d14eb9acb39bf2ae9e86cada6aff9a16a3c0b9efcec6157d01c64f0c6e8
MD5 ca417a532e5c5f8faaf29158d0a5cfa8
SHA1 3ebc87eaffb5a5dc05edb15cf94ae7aa7e892ec9
SHA512 ec144fed091d4d24fc8ea51a090c806c82bdf80bb73d5908cd0dd27b99b75d1eb69cd1b1286692a894ffc81c2bb35b892702691b102a937c8722a4b2a5742124
TLSH
T1385191D5C4813D9BD78B310ECB9821E41B9FB9CB59E120360E3F7AA590AF189C7E7446
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 4KB
SHA256 d2e0b4eebd2988b0e0e6b4fbbe1ad62e5b08c9109820a9e47e95a593fb2d4dff
MD5 2e13a15beff10515be3f56c225f0484b
SHA1 db3a9bef26b666b14ceae28237c0c7fb879d88be
SHA512 61fb44367cc61cdc6053742fd0e576ea246173c6206e0601ab3f747efd84ce87a3771e6bf4d585c0429dcaed8a21cd00123bd98b6b6b797f61139c450d9ccf78
SSDEEP 96:0E6SmoS0SdWSwWWS3RzolfRHshWS3RzolfRHsS6VBSmfBSMMJ7SdyJ7SwxBS3RzJ:03SmoS0SQSwtS3RzotRdS3RzotR6VBSu
TLSH
T1BDA1D2D5C4413C9BE78B310BCB5811E41BAFADCA99E220660E3F7EA5906F18DC7E7446
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/784-362-0x00007FFD44FC0000-0x00007FFD44FD0000-memory.dmp

Download

memory/784-364-0x00007FFD42A40000-0x00007FFD42A50000-memory.dmp

Download

memory/784-363-0x00007FFD42A40000-0x00007FFD42A50000-memory.dmp

Download

memory/784-361-0x00007FFD44FC0000-0x00007FFD44FD0000-memory.dmp

Download

memory/784-360-0x00007FFD44FC0000-0x00007FFD44FD0000-memory.dmp

Download

memory/784-359-0x00007FFD44FC0000-0x00007FFD44FD0000-memory.dmp

Download

memory/784-358-0x00007FFD44FC0000-0x00007FFD44FD0000-memory.dmp

Download

memory/812-387-0x00007FFD44FC0000-0x00007FFD44FD0000-memory.dmp

Download

memory/812-385-0x00007FFD44FC0000-0x00007FFD44FD0000-memory.dmp

Download

memory/812-386-0x00007FFD44FC0000-0x00007FFD44FD0000-memory.dmp

Download

memory/812-384-0x00007FFD44FC0000-0x00007FFD44FD0000-memory.dmp

Download