090f2f668799ba806d6e5ec31bf7ff1fd39b7260f129f4d6a944decae0f04df9

user interaction
yes
max time kernel
38s
max time network
46s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/06/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Exitlag Cracked 16.1v.rar
Size 4.2MB
Sample260628-vb2fdaaw2l
SHA256 090f2f668799ba806d6e5ec31bf7ff1fd39b7260f129f4d6a944decae0f04df9
MD5 451806c60f6f0c52cbb49026d4e14d89
SHA1 8463cb0297d3e3b9bd28713d1ed75ef4d78b887a
SHA512 e59a94c974f32d2e275d97add0a1eac8fdf794db008f0ecd69835ff120afd93e446852849e30f1bf598c57305891cf7d536b645e91dccd01c07dfe2679465cff
SSDEEP 49152:uMKPSGs1uhQvK+8UU2JyWIpeHWf/j6fVThnaYvWG/W7FWmOEa4u2Q/L16JyFH7QE:JAsli2UpcWf/jcs3FVQh603pUrAeA
TLSH
T1C71633E64F8E3581CC71DCFBBF3B19AF5758D3E0B1192F2F93760021952165A808AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2668	chrome.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1668	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	1668	7zFM.exe
Token: 35	1668	7zFM.exe
Token: SeSecurityPrivilege	1668	7zFM.exe
Token: SeSecurityPrivilege	1668	7zFM.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeDebugPrivilege	1964	firefox.exe
Token: SeDebugPrivilege	1964	firefox.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1668	7zFM.exe
1668	7zFM.exe
1668	7zFM.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
4104	chrome.exe
1964	firefox.exe
964	firefox.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1964	firefox.exe
964	firefox.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 2548	4104	chrome.exe	82
PID 4104 wrote to memory of 4316	4104	chrome.exe	83
PID 4104 wrote to memory of 4316	4104	chrome.exe	83
PID 4104 wrote to memory of 2668	4104	chrome.exe	84
PID 4104 wrote to memory of 3484	4104	chrome.exe	85
PID 4104 wrote to memory of 3484	4104	chrome.exe	85
PID 4104 wrote to memory of 4036	4104	chrome.exe	86
PID 4104 wrote to memory of 4036	4104	chrome.exe	86
PID 4104 wrote to memory of 4152	4104	chrome.exe	87
PID 4104 wrote to memory of 4152	4104	chrome.exe	87
PID 4104 wrote to memory of 3452	4104	chrome.exe	88
PID 4104 wrote to memory of 3452	4104	chrome.exe	88
PID 4104 wrote to memory of 4728	4104	chrome.exe	91
PID 4104 wrote to memory of 4728	4104	chrome.exe	91
PID 4104 wrote to memory of 1444	4104	chrome.exe	92
PID 4104 wrote to memory of 1444	4104	chrome.exe	92
PID 4104 wrote to memory of 2896	4104	chrome.exe	93
PID 4104 wrote to memory of 2896	4104	chrome.exe	93
PID 2404 wrote to memory of 1964	2404	firefox.exe	95
PID 2404 wrote to memory of 1964	2404	firefox.exe	95
PID 1964 wrote to memory of 1568	1964	firefox.exe	96
PID 1964 wrote to memory of 1568	1964	firefox.exe	96
PID 1964 wrote to memory of 1568	1964	firefox.exe	96
PID 1964 wrote to memory of 3620	1964	firefox.exe	97
PID 1964 wrote to memory of 3620	1964	firefox.exe	97
PID 1964 wrote to memory of 3620	1964	firefox.exe	97
PID 1964 wrote to memory of 3620	1964	firefox.exe	97
PID 1964 wrote to memory of 4576	1964	firefox.exe	98
PID 1964 wrote to memory of 4576	1964	firefox.exe	98
PID 1964 wrote to memory of 4576	1964	firefox.exe	98
PID 1964 wrote to memory of 4576	1964	firefox.exe	98
PID 1964 wrote to memory of 1676	1964	firefox.exe	99
PID 1964 wrote to memory of 1676	1964	firefox.exe	99
PID 1964 wrote to memory of 1676	1964	firefox.exe	99
PID 1964 wrote to memory of 2096	1964	firefox.exe	100
PID 1964 wrote to memory of 2096	1964	firefox.exe	100
PID 1964 wrote to memory of 2096	1964	firefox.exe	100
PID 1964 wrote to memory of 2096	1964	firefox.exe	100
PID 1964 wrote to memory of 4960	1964	firefox.exe	101
PID 1964 wrote to memory of 4960	1964	firefox.exe	101
PID 1964 wrote to memory of 4960	1964	firefox.exe	101
PID 1964 wrote to memory of 4960	1964	firefox.exe	101
PID 1964 wrote to memory of 5704	1964	firefox.exe	102
PID 1964 wrote to memory of 5704	1964	firefox.exe	102
PID 1964 wrote to memory of 5704	1964	firefox.exe	102
PID 1964 wrote to memory of 5704	1964	firefox.exe	102
PID 1964 wrote to memory of 5848	1964	firefox.exe	103
PID 1964 wrote to memory of 5848	1964	firefox.exe	103
PID 1964 wrote to memory of 5848	1964	firefox.exe	103
PID 1964 wrote to memory of 5848	1964	firefox.exe	103
PID 1964 wrote to memory of 5960	1964	firefox.exe	104
PID 1964 wrote to memory of 5960	1964	firefox.exe	104
PID 1964 wrote to memory of 5960	1964	firefox.exe	104
PID 1964 wrote to memory of 5960	1964	firefox.exe	104
PID 2104 wrote to memory of 964	2104	firefox.exe	106
PID 2104 wrote to memory of 964	2104	firefox.exe	106
PID 964 wrote to memory of 5308	964	firefox.exe	107
PID 964 wrote to memory of 5308	964	firefox.exe	107
PID 964 wrote to memory of 5308	964	firefox.exe	107
PID 964 wrote to memory of 5376	964	firefox.exe	108
PID 964 wrote to memory of 5376	964	firefox.exe	108
PID 964 wrote to memory of 5376	964	firefox.exe	108
PID 964 wrote to memory of 5376	964	firefox.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Exitlag Cracked 16.1v.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b502c728,0x7ff9b502c734,0x7ff9b502c740
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,14312238822169787411,2446099886606800278,262144 --field-trial-handle=1968,i,1997733824259942089,13217083770340097176,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,8988653170759336363,1226322862943213383,524288 --field-trial-handle=1968,i,1997733824259942089,13217083770340097176,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1840 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,7895064132315204411,7619915751440184486,524288 --field-trial-handle=1968,i,1997733824259942089,13217083770340097176,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,9693172588571753810,3956343943580679808,2097152 --field-trial-handle=1968,i,1997733824259942089,13217083770340097176,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3388,i,570495004907379582,7491909525524947013,2097152 --field-trial-handle=1968,i,1997733824259942089,13217083770340097176,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,6868736399591175199,16288922266545538570,2097152 --field-trial-handle=1968,i,1997733824259942089,13217083770340097176,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:9
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,5806733543519437691,1333038218772100450,2097152 --field-trial-handle=1968,i,1997733824259942089,13217083770340097176,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4928,i,330928591824417972,8319483691208625800,524288 --field-trial-handle=1968,i,1997733824259942089,13217083770340097176,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:14
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,10587797622171819330,4578113041140892646,524288 --field-trial-handle=1968,i,1997733824259942089,13217083770340097176,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:2896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2620

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {e6f75f59-55ae-4a02-aa6c-8a8156816d55} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {9b3c4635-216e-4c0b-8071-a91b6688b6a1} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3744 -prefsLen 27323 -prefMapHandle 3748 -prefMapSize 270279 -jsInitHandle 3752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3756 -initialChannelId {08fd57e0-fdb3-41a3-aa1f-4e024caf5b50} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27323 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4032 -initialChannelId {cd884427-a507-465a-9db3-17a17d1c541c} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2844 -prefsLen 34822 -prefMapHandle 2848 -prefMapSize 270279 -jsInitHandle 1584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3156 -initialChannelId {bd4913fb-2e7f-426f-a890-c7ba08359305} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4920 -prefsLen 34929 -prefMapHandle 4924 -prefMapSize 270279 -ipcHandle 4936 -initialChannelId {58f4595d-8946-408d-8ea8-10c4ade1139f} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3096 -prefsLen 32900 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 2916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2944 -initialChannelId {48a164a4-fa67-4910-96b8-7cfe9e702d10} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5332 -prefsLen 32900 -prefMapHandle 5328 -prefMapSize 270279 -jsInitHandle 5324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5316 -initialChannelId {58bbc816-2394-47c2-b589-ac2d1536dace} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4704 -prefsLen 32952 -prefMapHandle 4800 -prefMapSize 270279 -jsInitHandle 4804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {c59467f4-bea2-4257-b1b5-b3ea9456291b} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5960

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27057 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2104 -initialChannelId {af9b5436-9ba9-46ba-90b5-97b8609bdb1a} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27093 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {8eb4f5a7-eb90-40bc-8c51-371f72004511} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3752 -prefsLen 27234 -prefMapHandle 3756 -prefMapSize 270279 -jsInitHandle 3760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3768 -initialChannelId {07757a2c-c323-43cc-b58f-090edceccaff} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    PID:2868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27234 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {6342dc14-231c-4739-b326-9dc57eadfc63} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4712 -prefsLen 34844 -prefMapHandle 4716 -prefMapSize 270279 -jsInitHandle 4720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4728 -initialChannelId {492a21f4-cc19-40fc-aece-c01800b310cf} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    PID:5804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5116 -prefsLen 34893 -prefMapHandle 5124 -prefMapSize 270279 -ipcHandle 5132 -initialChannelId {f7dd18f8-65e2-4548-ae95-94cf5e124099} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    PID:2020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3128 -prefsLen 32818 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 3364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5020 -initialChannelId {76c2bfe1-5bf9-4e7d-8dac-205a30ac0ae2} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    PID:4532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5276 -prefsLen 32818 -prefMapHandle 5264 -prefMapSize 270279 -jsInitHandle 5248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4488 -initialChannelId {f7a09190-a101-4d66-aead-239c892b860b} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5836 -prefsLen 32818 -prefMapHandle 5840 -prefMapSize 270279 -jsInitHandle 5844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5852 -initialChannelId {51a32919-48b8-40e5-b55c-c07091e3cde0} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 af670bbff1c3d7b510582632d57e4608097f38fb151a506f74480e5cd2ae1fac
MD5 50c6302792ee65cbcce0285615b4bc49
SHA1 985f467df501a754a68729b9c19202307ffa64df
SHA512 4ec26a908316ea2620f6bf332b5c178622c980fa9c3a6e0ff5a61d951e0828f7b8e0e20df49e3bf013e3fb5d443b2caf2ad2b99925cfd6295ed712bf4ad298d9
TLSH
T129317CF793F4997D861096F4AB156F2FDE690924531C3CA788E46E1B43F2872D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 3be80206383ef6770cb72f55299430c357f7621a4fe905383e1a44dbc6f73e7c
MD5 9be667694388607f092cf37d56d3eb83
SHA1 7eb85740dc6cb86bb858ee9cadb4c89df67ae970
SHA512 36bd81b6279876eac7001cc3322b91e36e4e8b86224542c40e1111c8261b0949082a226658eab8c10004dd0d8be9d922e0ba7ec5c18968e1e2ab661a07068770
TLSH
T116F0C0DB9AB83813007E4CF70E007C09647564B9179069F8CE6B426CE1914E31F0143B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e7d910a41d8ee723f8b50c37ef8782a4d1c13d7298f3d7da883f4b17c17ed12d
MD5 967db98385a1a15032b59214c6fb2e7b
SHA1 a9b0f17fb42d404acd5126b58d13b21f20aa64b6
SHA512 62d3fa1fbf780af44037f88a5be4100da66faa3cacfcca6ab0424e15fdcb4c90d466051dd74b7cea50d8b2160db0d79d7b75134efd53bf26b613674cd44be6e6
SSDEEP 192:sR2R3J+OKv75pAPRp2A98Hsb+WNnt2dxqPyIsnAUge:sR2RjGVUXLuwYdme
TLSH
T13532951EBD14697B9CCAD22EF9267767D3F6102125D02E84E6FCCA2C19E79CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
MD5 64d379491386bdf9d2b82bfed49740e5
SHA1 522dcfd2f4d188bbcad58538c6461f8bbd43b2e9
SHA512 5d58b317ff66bb8f8373e7f5972247e20a553af50c4ad2756a022edf34ee0bb5688a058056e953d457420c82cddb02044d6062aa1788af614d0c7bcf05ddc3bf
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcSjwxXODuh+ErU37PHG7iK:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pV
TLSH
T10B72FA67BC4C9E370F94CA8CD9167F4FADF5024A65E9886482FA9C2503D5BCA11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cdb4c9a05d89c40b822ac6b56b270245fb062cae7dbe7d18f121462aaa07879a
MD5 4988c532f32186528b95120bdeeb5341
SHA1 5816c9eca48ff83f55b49543e3834f70b337a145
SHA512 51741c1587e423d26578f3806ea16d9fac323c408936fdb1ec2bb18e3ea5c3859c2b092d0d9894b5646561a4a279d3f0da732f219ed8ba4cf39b766dabf92bc4
TLSH
T1F9B0124080015101C0C202B4110218C87304DF10960A270143E87D27C8352618328152
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cc73.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cc73.TMP
Size 96B
SHA256 63b018166e090e5035bcf505c61e8a19b597e263b80e5823239fb77f560b65e1
MD5 eba4a6f4aee4f03f403d5cc79e2fa828
SHA1 5351e920e938ea8b2cfb2661aad3f59903362b35
SHA512 88aa71f0d66860c3c2ce84c373b8cda5f99bfd7392e81e3c28d1d372e7680107142b5a9c474356bfe702fe201ee8e4aa4020a7513cc24a4dab4ad3fb54e7703a
TLSH
T1E3B00259C102B217C05207F425ADDDD871F1EF25E653331296E21ABBDC25671453A170
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6db52e2ec170f8d405d01eb12306cfe005731a98010dfab675531443fd08ea17
MD5 2298e96de0b1f397b1dd1492892e777c
SHA1 bb409096a49115828b2e01e22c38c128361d64c0
SHA512 d9071b8d5c932b86d2480af892c7f8d3fd6fd9947db0357b9b8e9c656ab1c11c2d5372c049e65e39e133c7d42f18afdf7446929944498135ae403fad3da995d4
SSDEEP 3072:OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:Jm7Rkm1tYpBeh2BAoF
TLSH
T16BC3122B5D70A97659B9AB4EB08E0B1E1EF149A6C930DE92C8D85B0477FA7CC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

b582ccdc-c186-40f8-9b39-97896b2ee7bd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b582ccdc-c186-40f8-9b39-97896b2ee7bd.tmp
Size 116KB
SHA256 d75462d762be5ab96358170d608c3985cafa3e52cd1fccb2ede6a7cac9ff5dbd
MD5 b286ff0a54d7d907c8419f9bb12d086b
SHA1 26caa50afd66ea040887b417719609425771c573
SHA512 1669afb0503e6ca6ad284548823c00756f618738c353005494941c11643912c1048c35d7b87ff28aed460bff162f83f108fdc4d15d0826fb4b14fc4477371acd
SSDEEP 3072:+0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM8:+3m7Rkm1tYpBeh2BAo8
TLSH
T1ADC312275D74A87759B9BB1EB04E1B1F1EF149A3CD20DE91C8D85B0837EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\activity-stream.contile.json.tmp
Size 4KB
SHA256 8a82bcee1f472948ba939753ca9277161180ba4b901263d0706ebbb43c4ccd39
MD5 42248edab9f621839737d75d3d2475cf
SHA1 73390d7ddd04b000dcae6658b279d4ad49cfdc15
SHA512 30eb077c5191440d9b6e95ff68685d18f0f795fbb2dc36718cd116dcf53c3d9bfb92be007b14151a40e341918e55d1fe43a552e5eca3c92c5ad29c43a24117ee
SSDEEP 96:TprD8DS+qovVIzlYDjKT+mRoAHKYhcVny6DWzl:Bw7NvVIzlEmRoAx/wWzl
TLSH
T1AEA1F7D7ED2A9C830362F7E17C1937A9F047B14BEAE94E48A7518C0094E416B81FD684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\activity-stream.discovery_stream.json.tmp
Size 74KB
SHA256 4188c0354232660e83856490568dd98a80f8dd1ab8c0502a6f2a7afebbeb8f96
MD5 ffe0688f057fc14f8a8d00d27aa30710
SHA1 8e16f696ec8a51026632be57f6d4abe8cc7ebff6
SHA512 1bfb361052c9f8789d49703b90b3c04d6df24e9bd0313328d5cc227a4ff18003b3edbcd9e02b698ba25664c2ae2c5129af1293ef8b5904b8d89fc4d50eaf7503
SSDEEP 768:/yxytAHlnJp1uBTKdHCyWT7IRyuzgGWUTi3k71+p+rVIep:axlnJp1GUiWyYgGWUTCkxl
TLSH
T1207309A3A6A9B2BB1FA13BC71C0B798753E5014AF78105CDECEDCA1C819C651123F5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 a4a8482672d92bc292a5003e8116426cb4020ca53e0f5ed867a78e1ea918be52
MD5 a3644dfd0cc36755209420d9eb312a33
SHA1 918f8a8c33efc61061e3217470590d3a69e1f1ca
SHA512 24adffdf09548577cec561717fedfa2dc8df50604f1b7e846dd3adcdc17602266dd546a8f8b060e29d5ee50941138119f8418c6bd4940298469f677925f6f023
SSDEEP 384:HPC9iO024Ylo6J+Sl1xDnZBPsac4j0lpDII+KsfwsfK:v9ZYlo0+Sl7zZlsac4ID8LXlK
TLSH
T168529DBE9F0238BA1927D5A4D5BE9344CD04A6BFEEE2D05615143C04CA847B9F4E68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 15KB
SHA256 592f5752a97e2ddba0e7606cf64986056d0d8d330d679ea95e92c45602591824
MD5 345461d47e8f2ba3975cab888dc7816a
SHA1 6d39640b435a11538b06ec3954a831b5e74953fa
SHA512 e24e8bb9037a5d99d30f83e3e577d436c922b06c192250ae97423ca9eb897354cf7757de0e6f72eb1f534dc9c8cf31720a6616db7386a15bf8501dec40fda8d0
SSDEEP 192:Jw7N+VIzlEmRoAb/wWzq0Bzmoy72e0Bzmoy7oirNfoEHjGPl2BadE4Pro15j75yo:qz2S7ty6PtyLhfdDE2Ba/rIVy8eCL
TLSH
T10672AEBBCF854C4A0B52E583DC6D27A5BC19F21B8FE5D5DC6A40340981DA36AD0FD2C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BB95D0607349D05725D5FE01D4FB300E319072AD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\BB95D0607349D05725D5FE01D4FB300E319072AD
Size 11KB
SHA256 a02ff5cc8144d9e6e9a3817d975a73e348cd0d453e250a5afd3667a2f9df4b59
MD5 775cc86917d57c2e723bcf922d5a19bf
SHA1 56acba753fd3c1e1d3ab0e352564db3b48682be3
SHA512 9ff2ea96649d24675f02af70aa667a2fbe0ecf123be6db0da4b8c440246f211ff2a70d7fe1e75cd194cc1bcb70508ea69e770e14d4f35d7c85506ec1df1c25cd
SSDEEP 192:2ljU/O6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDNmK:2ljU/OvI2Efy0vI2EfnaGUzHODWoh1Bx
TLSH
T108428F3ADD52546E0AF0D587EABC65690C45EA03EEC7E1DD2F193104DCC02A9B2F92CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0F48A0632B6C451791F4257697E861961F06A6F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F
Size 242KB
SHA256 47e6e366dacc791f7b6494171ce5009899871e44d2168bd280038ae43d045ed5
MD5 0647c2fb5b6b90fded2a4098b2c3cf9d
SHA1 215aaa252956a33e93c682d172eb6ceeb78940ea
SHA512 6fe44ce55363e97ff883323a873e1260438bb48f19b9c1ab07bb4acb41e5f0ff693a95b06aa9bc5be131ac17eec6a34aba1bc6d1e5fa1b8a251129d4591c9b00
SSDEEP 1536:SbYCYPslYchR1eDx3SPrPZFZMvkcI2HrLPTYwea+i881n/bjLV81t0SkM1SCumR4:N4/JcBXBdCRg
TLSH
T1D834F8F3D6AC71FB17524ADC6C0D72CB72AF427ADB5208DAFC688148C3C9A651076789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DE5F6CB1BD71958EB146CDD974763A3115937269

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\DE5F6CB1BD71958EB146CDD974763A3115937269
Size 12KB
SHA256 db756b08364a266a880d1aa963baf5bab8653f1fa2de66922c596c8761df25ea
MD5 406cf973d64fb1977200235985e98682
SHA1 91df1c0feba3745cd509498673aaaf3193431e0b
SHA512 75cbea882785e28d74ed62bc03e0dade92824896d3d818f095f1b106018afad6efacef4c23af62e38581d361a5ce6d6386ebd8b0de8574528209a33388d56771
SSDEEP 384:w4lvI2Efy0vI2EfnaGUzHODWoh1B9M0lpDIIDNYHY2:w4lw2ey0w2enaGUzHODxh1B9pD8KM
TLSH
T14D426D36DD61586E0BB0D687E5BC696A0C46AB03EEC3D1DD3E193504D8C43A9B7B82CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E473D920361435DF4BBBF194E406FE372015579A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\E473D920361435DF4BBBF194E406FE372015579A
Size 11KB
SHA256 aa7951dd0d0eb690a9639df600581d21c29449e7facc01fc3a687ad98b1c83ac
MD5 3d840d0f84f9a8feb959fcaea773f970
SHA1 8acd1e8c498c21112500a9220e41491d711d6b39
SHA512 d97cfbd52fab88649e00bebbbc321d21344c9a75e5b650dd734690fd4e3784bc2f7a3155a609b16f56d81ca3025ea4f880c320cd65364499e151302d1775f1f2
SSDEEP 192:ttwQ6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDlHdKD:bTvI2Efy0vI2EfnaGUzHODWoh1B9M0lo
TLSH
T1A6428E3AED5158AE1EF1D58BD67C59681D46EB03EDC2D1ED3E193104C8C03A9B2B91CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6DB2CC802065A948266A380F89F5EB80BB1A349

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\F6DB2CC802065A948266A380F89F5EB80BB1A349
Size 11KB
SHA256 a41a7dac06e6c302d3ae02daebd9351f1b3289b896c6298345b2aef361834898
MD5 6122649759fb0b2877dca0f7270e26aa
SHA1 74cd763e6ea2f9856e0cbdc096ec18f406924b44
SHA512 4fcf5abdbdff4cb5abe2f070c0414926977d1b2e7b9b31e68027f7d0bab99934ed30676f1c6d6ce9ff3fbe82432d91229f778d6a932bf7566403900f750ebb10
SSDEEP 192:kfy6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDNmdybR:k6vI2Efy0vI2EfnaGUzHODWoh1B9M0lV
TLSH
T1C7427D7AEE5254AE0AE1D597E5BC25A91C49EB03EDC2D0DD3F193104D9C03A8B2BD2CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache-child.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\startupCache\scriptCache-child.bin
Size 471KB
SHA256 067c497c7ca834470e8ad826a0bfb7a786697d6eafc1141167e441b74a0e9009
MD5 9d9af615d1064548fd54820894429dbd
SHA1 6c297e3ba9c82e20979acb2375198e6457e262fa
SHA512 ec08f7760f920697eea95e2abd71d3ac634983b3f59fffcda08b35cb720e55c581c34410a0f68150d4c5db93c95165b3bde0a6de9803c830c5a13a49149b0235
SSDEEP 3072:DiO5Ho9UbaekRHeUwCbZ7jktcvFiTTBdtTapBCACi0uvjmHSTXHqZoNV4QWSW2SE:DFCUbu1hjktpJn2pmYXHqm4vSW2psu
TLSH
T1A4A47111EFA64E23C418037A44FB53313A31E14517EAE3276F8F7629BC673A91D8A95C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\startupCache\scriptCache.bin
Size 9.9MB
SHA256 b99297570aaed01dc7eed21402560919b354e7f70c5c4ca81c1481d87c887558
MD5 b0eddc19a7ae30b459a704dc8c88ed5c
SHA1 df417773b9b24ccda3117376132e7d936fa3fc57
SHA512 0478850e40f028b95040d40fe4f3716d5801d66cf7df924ecce537ee0434d1439bc088973f034bf0829833c3076b3c4fabdbf62313a75d3cacfc5daadc3a0962
SSDEEP 49152:FwkVvxWNHhFDzwH6f8+5v8bX38zYPHpJFVFwjdhCXfJe/3UbSQD:FVvIF/wafM5PnRmSR7
TLSH
T118A69315EF664E23C468027A48FB53313A30E08547EAF3276F8F7129BC6B7691D8995C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startupCache.8.little

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\startupCache\startupCache.8.little
Size 8.1MB
SHA256 7462b98b42e7be7dc81c5b25bbbe57cee29d36faf12b1ca38712e9e3d8371001
MD5 d45d4994d62844f2c6f3afbeb7b4706c
SHA1 5755b338ef2ac272cee836f82bd078ed7a1ceb08
SHA512 96876b0e25cb565d5820840e9d3f5b93b5b4d2c4dd0a8fa6b058a5bf7d3247fc98af3a8aac34ea4c9911bb14d5953908626de7aff11eb800e25bbaea280ad7bb
SSDEEP 98304:Lr3oLbJPeeNr7rqd8fVHoYi6lwvhNTng8VXKFGHYOR:Xib8k+89biuwpN717R
TLSH
T1558602B6B3590697C425191AE87A0A393763414203E166AACF78533FFFC724C1BC6E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urlCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\startupCache\urlCache.bin
Size 3KB
SHA256 9f848803cdf539f83ec25ce30290ac2b8ef012fd57c4498c33cbcc48ff0dd3d9
MD5 8353933292c7445f2860783ad85e8511
SHA1 f43cf711fcdc78da792e9382987aabc9ee24cb8b
SHA512 b16def65490aa4404e0e3745145db81c6f0b4a9ca1b3a9bf9d8251b7abd4fe5926e58c95191ed93c711674cbdde71253597ec56d4ccab47bea548a4ac7da36bb
TLSH
T1D561B492E43F203B7C62A4FBAD95C171B42149CED1CD21DDBA9663D4209E7DC034EB1A
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 77fc8d72dee40dae92667605ac397d3ff3f2215dee6419d71cca189547a46754
MD5 72afccd52abdbc5afcd1a5ccf90b1fdc
SHA1 11bddaebe93c1a81b4f298fb3223a915e211fc1b
SHA512 7c2f6e6cdb7e4234708928679598eb2a14a7f7ea48d243dd0f0e6b54af90cfa9bc53844accfa77205afa80ab00fd94f909e50f79099234b674cb82bfef622e0d
SSDEEP 1536:jTrliaXGZCou5vSsj0FbYacbcDxDp/1XNZn7nc3f+8JIlMwGblbalrzDVrhm7Mhh:j3lAASsj0/Dhp9T++Tuw7fVAP2xDX
TLSH
T180A3A0F6EBA2893C55FFD429AAC2C83DFD222814B3973009C863675066C6F746779648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\AlternateServices.bin
Size 1KB
SHA256 19c19b1129c33f84a5e0d4278210abb4c2ad259e307a11130cf13aab64485b63
MD5 3de4e65e6af286acfbc1daf47bce0f65
SHA1 036ecf425b9a0ef83c57ca064cc19d3d1c9244b8
SHA512 1a5325cf5e5fbf57d68977e6f078d84f63e464083d59d404901f1cc1e7059989cebb88b1e14ad7c032d72f571340be315f9471ec466851fee68e4d4b042d8c1b
TLSH
T1C4214CBB51730031E4144AB8B8276004CE2B63C79BF5548D1B60F16A3682D9EA0EC094
MD5 SHA1 SHA512 TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\SiteSecurityServiceState.bin
Size 1KB
SHA256 7a80e6b91d88876dec0eb7c135959b926605376d8d1f61e301090cec1c765da2
MD5 82690185eab1bec8884b33d2cdb68b1e
SHA1 4cc73eecabe86eeee54c1274486d50207c697149
SHA512 353f7dc26a64c14a383d7b93bbcaa9a7c284a6eb5673fdf302aa22379bf43ab07c80bdd0ab4081b3b6b33cee3cfade3d053f7758ef09ffcf60776f560cc97645
TLSH
T19E211277489AC137E2D5CE34385F8E502C29679742A7F0AC3D6596F03287EB624AC3A5
MD5 SHA1 SHA512 TLSH

Submit Download

bounce-tracking-protection.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\bounce-tracking-protection.sqlite
Size 96KB
SHA256 83e2a5c9d65ed4f819fd9bd6a52715e7d92eb7665d12e9f6dc431496c2b758f6
MD5 87b094ee8bf6b3236413e045af531f39
SHA1 35b84680882ae729f75eaaaf14047adaf5f6746f
SHA512 0c47f8a39b1342ee8be869ae5e146cf2693fc118f9ae9588a03f08a26a756e2c1453c860d42060f505fc19bd47512d7becf73bf2680e233f1e7c3c10f6d88a4b
SSDEEP 12:DBl/WhnB8/ykS2lcBDMGEJKM+vcBDMvYkMBAlO:DLsB8akrEDE+vED8YfAlO
TLSH
T18CA3C68F0E702680EDC420B0D7828EEEAA1EC32DCB13279202A000B29D0206019220B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

content-prefs.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\content-prefs.sqlite
Size 256KB
SHA256 fff6c2239e0d2ccc2dfe16bece3f51fe2831ce8baaa337827bbde444207a727b
MD5 d3941a15a96fb3023cf1587a47b586b2
SHA1 94996d072eea6af88a1d96b8ef900a1fe3ea56ca
SHA512 d627318f49a185b6ad4dbd76c9eb5aef82c360ab76fed195641fbd258e045e1f04c0d6359827a9c31c677414bc656e183770c0d1b829821388db8bfd2608f364
SSDEEP 24:DLCKvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DmWwae+QtMImelekKDa5
TLSH
T1234426174AA17408C0B014B1D4636F22AF3D405B8933E7B23ABC143A4F886AAFC791E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.bin
Size 28KB
SHA256 8ea7f48cca01a01d549f02a5ec8610c47d7166e63c560edf03fd497c80f66f7a
MD5 eff729b2781577db4f738fdba8ad36e6
SHA1 835b846f943eae00bb672216d3d3705177d30e5d
SHA512 43c428cc4d2580aa59656fe1f8282609dacfc935235a701c46c94bf28aed655e7aef896f80f97f7fdd6517d55af3f322748c2234aba8bd0ea54b060c3398b522
SSDEEP 384:jd66JozQzgC1jCboKY4yjsECucWEtOOZfSGcmhum7vwRKKUG4ebibnb1bB3:Mmw15Ekh6GcmhuOwRKKUG4ebibnb1bt
TLSH
T144D20F44FB2A913FD42412BBDCA50B041F79B88A985D2F573A5C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 01cb1f5c6e249ac56d23b54eae42f54f997707dffc7f6f6eec2fe382c5ce11d2
MD5 8be2f0ee1ef55aa61c73a80204e6d850
SHA1 180e355db6701bfa3419687bdc8e8e59e790d340
SHA512 a34294eb3b7336b9e44a5fd7d371c6015a5873342d80e4bb063498ad6e05528eee7cb0f12001b82e12ec02d16ca47b1764a0cf3ab8361eaa9625ad7f9f109408
SSDEEP 384:7boSY4yjVd66JozQzgC1jrECucWEtOOZfSGcmhum7vwRKKUG4ebibnb1bB3A:fdzmpEkh6GcmhuOwRKKUG4ebibnb1btA
TLSH
T157D2F044FB2A913FD42412BBDCA50B041F79B88A581D2F973A5C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 99646048bf4a50b28e361445ab94e8c8baefdd9baca2670f8264351cb62dbf72
MD5 5c7686693be9bce5c6adc898469010a4
SHA1 24bbf2b1cd91cfb206e081ad9e2665840d799c99
SHA512 f8accec8e8132818b91ff3408b5891c8fcd1d90f3b88272b0d08bd8666bd3f1deeb1e4fc82d0a9371c2608713e6527c5bb8734e2feb9847a344a38218f397d93
SSDEEP 384:MECucWEtOOZfSGcmhum7vwRKKUG4ebibnb1bB3lboHY4yjVd66JozQzgC1jd:MEkh6GcmhuOwRKKUG4ebibnb1btVszm/
TLSH
T1A7D2F044FB2A953FD42412BBDCA50B041F79B88A981D2F573A5C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9a753535c44bdbf615eb7e2f6e2b39328ce021ba0cb8ff1d23344b3e1501fa1b
MD5 193259e18fdb6cca7a100f020b656854
SHA1 d15f8ac7a6cbf7046d98f153bc7889c4b9576acd
SHA512 1170fabeb855c2e68b95987ae22088cec7601af2c0f51a6e82512bc506692515f3378dc8b21c1fe1cf5d3943724b5b17e9c326580b6e8d6a735c3a2366143e8a
SSDEEP 192:COv5zbooZY4yj1Ml1d66Joz0dzgCl6mc0d:hbooZY4yjud66JozQzgC1j
TLSH
T1ACD1ED68EA28563FC448123BCCA61F400F35398B985E3F2935AC644D2C5B7DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2e3c875d65660e6b0ed1e4f0add140ddd4916510d3c15f50dc0d940cf07eae25
MD5 2ed3bb750041f2e833cb518c6ab9f06b
SHA1 7e124f06ec0ec8beb26d097ab59fe0bad5c667a1
SHA512 7f434eabfab3e54951441cb7b83cc83594bf9faa12ec51f36a19d3b23831427d40ccbd84334692d2dd444843fa09ff42b3a0ee375aafe652598f32421899b731
TLSH
T10121296C3DF84D2BA887E69C7841118E53558E070A871D471D46EF8DCE85AD9326E83C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3ce2ebe9aa41cd62bbb27b67704c55b3117a648edd302a12cf50f2c1c0919f3c
MD5 045aba537ad27db0411b2994a86c4111
SHA1 be1e42dd80cd237b1c0299bec88c4caa69eebb64
SHA512 7d8f3cd4ebf77f16fb2fdb98524905e027eea4eccc9606692e18d365c58002ce687d406888efc03a8e390de6e621214ff67ef59d772de3ba0ea5dda6736e8c52
TLSH
T19C21675C3DB84D2B5CC7EA9C7442028E53984A0709871C4B4D12EF8DCE85AD932AE83D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b9f68389f1ebf7acd6883ebe3ab02d6f7358d3e9bc70f6378bc50d27a1f864ed
MD5 d9511d35d33ffc2b4ebf0d0af66a976e
SHA1 6d7ed7a2e1fb1c5215d51799325c3493ff766efa
SHA512 6042d8a750c0933b4b298d5d7f7b992121078eeaca5e6310e72c402f90c1d1e7963a92565b5f761cfd41727e6884c331e9fb7768934cfb56bb3eed5fd1f0218e
TLSH
T13221475C3DB84D2B9CC7EA9C7442028E67494A0709C71C4B4D12EF8DCE95AD932AE83D
MD5 SHA1 SHA512 TLSH

Submit Download

0905e88c-f4f0-4683-83c5-5e878ae60109

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\0905e88c-f4f0-4683-83c5-5e878ae60109
Size 235B
SHA256 b8440105f49474db45c45d09d82089573e252280ba19c2ca02d7817f63ebb4b7
MD5 4caa3e3253df986a76ffe5c909d32165
SHA1 673fe92113892ecd397630a4d5047ac1380978a3
SHA512 01bb54c3c2429f4b044a27aecb994bbfd7bfe60d7fc1c6f3a711ea5e96747064b1813e38f4aba16dd4325927db22e6f27a089866412a4ff6cb4abfa18f4bc06e
TLSH
T185D097892898271D09114F0FB0B06DD272888C3324A85820C55042B4DABDDC4812282B
MD5 SHA1 SHA512 TLSH

Submit Download

10d9a7e6-84b0-49ee-9af2-f88150cd8899

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\10d9a7e6-84b0-49ee-9af2-f88150cd8899
Size 886B
SHA256 8da4eeedd6f0b475b92f2e8e7cc550db106b6c15e273a163e25bfec10f7e78b9
MD5 b4c147b1ea90a9f4d4d76e546d12b539
SHA1 ef9a8cdc36eebe1902f969e0cac770268413029b
SHA512 287397aa666718c92c83be12882fe9401b70d43cb91234a6a3569de3d43d0a290762cc50f4ef2e4f3e39451eb9dfe6d7389c4b222cb95e1b7ffdf843df799cdf
TLSH
T1D711C0519A757AB2CC6CD24B89D17B424AE07123C0CB4D987D985E080CAF91EA3A670B
MD5 SHA1 SHA512 TLSH

Submit Download

456d1dad-262f-44da-b14d-7229d044b018

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\456d1dad-262f-44da-b14d-7229d044b018
Size 235B
SHA256 0f92dc391dfda2a784d71185068f5804b7e3b8cb186b05ef8c071bbe6d052c12
MD5 83b6bff237f2d834506bffb0f3b2eee2
SHA1 ebab011f6f1f3ee1956cd8ad573cac8de21ef706
SHA512 c1ba3cdbd847b974c45d77ac4e7f18184e9ac1b2823c03fd17dca45cd5b9ee44308854898a3b810dd2d1a99a3f5f9a360242d6326d2cf291dde4ec84fcf0ce08
TLSH
T1ABD0A789649867AD58345F0BB0E0AAD671544C3324B45810D66186749AFDEC99361857
MD5 SHA1 SHA512 TLSH

Submit Download

68d96fc5-112e-4e01-8a47-abfec1da5399

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\68d96fc5-112e-4e01-8a47-abfec1da5399
Size 2KB
SHA256 052cfbaf898da7f6a376e8a6abeec13c96a9acac97c28dd2ac3ff7ce3f1083fc
MD5 5dd73f3372a1148f88282ddcbeb49985
SHA1 b2d160707e8e3e06364ad6ad34cd441ea90ef440
SHA512 e6b596a7b7d2c3361ebdd98c2de9a9d3fc54b213a3a857c17f787dfc5bca22130cdc9dc2814ec22f1876ee272a9e8514dcef8739a68b1e06341fbeda00830dc4
TLSH
T1C741F15C75745DB78CEAE14DD082378E57708A1340CA2CC36D90DE4D8C9AA5E277B52B
MD5 SHA1 SHA512 TLSH

Submit Download

74990ffe-4757-47f5-9f82-899738bcef52

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\74990ffe-4757-47f5-9f82-899738bcef52
Size 2KB
SHA256 ed4478da93d906370760129f3a278348fd5b5f801b101ac2d38f9ac878d6a735
MD5 0646a1f34e3ef1319b333b060cf095de
SHA1 1c3eb61164a0d729d7a9eccb9862e03fea2f0a71
SHA512 7c2f0502b820027e51db2869e54786597ac3b106d8f6e8b0d4a70b623c389c5c416cbdeff36bd71060d02584818559bc04659000c287af0dd415e3933e81f508
TLSH
T18F41426C3C785D778CCBF95D9483268E53288A4344C21C872D45EF4C8D9A79D33AE92B
MD5 SHA1 SHA512 TLSH

Submit Download

819e268d-3391-4c8b-9227-20d1773effd5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\819e268d-3391-4c8b-9227-20d1773effd5
Size 235B
SHA256 b7f794bb29d552effbd1cf25dba66567d817b9b500aca3ecbabdfbcf675f1203
MD5 9b6f91088deda6a823a54bbe62617f05
SHA1 ba7ae24c473a2d2d911f12f91bc6a50bbc502f39
SHA512 bd82503efd90138c4f9f850283473dd55f5c2746f13e1d9810b073f1527bd70853e996fbb1d4410d47aa3c0ba02e63a25d7a637634fa31a4ddc131f1cc1fbad3
TLSH
T19CD0A788A89867AD08149F1BF0A069DA35D44C3714F4A870D5914678DEBADC95262827
MD5 SHA1 SHA512 TLSH

Submit Download

8a643368-a23f-4b87-bb99-c2cd52f0000f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\8a643368-a23f-4b87-bb99-c2cd52f0000f
Size 897B
SHA256 9ed03495ec5b7300dd2e5d96c60ef116a87298587af758aba9a62e19d57d0376
MD5 8275d0010330cecbbe8bf2fc3165f10a
SHA1 2b825f9988bd54943246f354e6579c7a7c74586f
SHA512 291abc4d104193d35f666a996661f2314b1349eb32d832eef60fc43c9f0e51b5722a85bbfd6f879bb52ef33fcc628146b72444186f254dc6c020e5ddf6b0f0ba
TLSH
T15E11DC418975BA72CC79D24F85D177464AB0B43380CA0D587EE81E080CAA91E67A630B
MD5 SHA1 SHA512 TLSH

Submit Download

91c818ef-2085-4d86-be28-5f61871c7ab4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\91c818ef-2085-4d86-be28-5f61871c7ab4
Size 883B
SHA256 7a124d454cc3dfd7bae6bd4204dc994bd54d83a21f4a277b4b1051540c1e4bbb
MD5 3942a034d5a66eec6ffd0ce11bee8158
SHA1 4a5cebb9bff40bfd77353c89f166fea4fed890bf
SHA512 3913b6e7d397cee6ca23d8f922193bd9d00e8bcc3bb76140fa40605f665465fddb9459595975b6a38c6a0144a781d8a5bde2dc56126a68d3eafc16b310a6a671
TLSH
T1F011E341993576B3CCB8D14F869137425BF47523C0C688687DF85E190C7EA2D93AA70B
MD5 SHA1 SHA512 TLSH

Submit Download

dd758d24-f0bb-483e-8481-35fecaa92376

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\dd758d24-f0bb-483e-8481-35fecaa92376
Size 16KB
SHA256 493d14e609c8170438d659b5e118b35d971f0ef02b70e9c6a1d570d37b336b13
MD5 1cb399c86179836fb8fb3c5c7cce9a2c
SHA1 24754c8929fa1ac9c0446bc870ef16693d5927fe
SHA512 63fb23b29a1735ecd7b66453f6baf39d62e78486092ffbbdae7ed08cdf2bbca5b4ede80201febefac1c0c1bbb39841c84f0c858d15db5c93225eb23ef774a331
SSDEEP 192:DP6BnLqTq1aBSjpcPlM8caR7gDk+iMdzXIs7yW3XkY8ruEjtLkXv/PlV8Ojw4y6J:uBnLyAjQK8caR7wk+iMdR7R3XktZk
TLSH
T1DA72CA56682055BA8251D36C94FCBFC3E6F538CF4C019FCADBE4BD0869DA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_to_categories.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\domain_to_categories.sqlite
Size 96KB
SHA256 c7baab1cd8662625bc822a3c3c7b57973b927cd5c26192d6cda60ed9ecc0ed07
MD5 7231237395096e88196ba0ffd7ac0ac6
SHA1 d303ddfed1d4341f30ed79abbc23ce51f651bd35
SHA512 6220c9908bfa889f1db84625dc214127ee76c40c97a0d2b81df251253d4a8cc7ba6387d94f751a8f092850ce8a86d5c7e0d7938b85ef763813c4ab4a0834055c
SSDEEP 12:DBl/ATMbUSoQym5H9L9ftirhP81MONd4/F0LA6Gr:DLbbv5XvtQhP8W5/b
TLSH
T1A6A32B1F1B1CB840D4C356F26D8329067634D50B8913BEF03B9D84004F066481C35AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 6KB
SHA256 46a60f647ebe832f8861126e49048285983e6f09ef0f91996e659e04afb5d44d
MD5 06d98c16dcb5eb486e328e0a9433fa37
SHA1 cb99bbe5776d501035f49815e35822bb807f1e26
SHA512 39d622138d83de4ab6cbc0becde1789d1532f61dbead154a561e45105ada0d36846b489e8c122d1529fe44d46b4196e86328fdd0d0cbd7156c525f27471eee89
SSDEEP 96:xHPUTUkqGqDf2GVObzSISSl5dv9jYn+H+StBw8OH8L4cndwWc:FHRDf2GVmSSb+StBw8Oh
TLSH
T17AE1227894188F7F64B6776CAC6488716AB2013B7BBF68C710B954C9050CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 6KB
SHA256 3d21cca82393765205518576e7f3d06fb3b70b3128dd1f6f4cdbc39fd99cc8f5
MD5 693b703c36c3629ff90158d5b151e068
SHA1 fedd57f954075b41214aac80918564024408514b
SHA512 ec7bb3123365fe1a511391e5168ddd6885067b5c277c99991a0d69be347fa7504ffb58665f14505b24a84967aacfadadf64fdba2f44a587d1392d0a85bd3b1fa
SSDEEP 96:xHPUTUkqGqDf2h81zS0SSl5dv9jyyn+H+StBw88H8L4cndyc:FHRDf2h8VSSe+StBw88O
TLSH
T188E1207890188F7F74B677ACAC6888716AB2013B77BF68C750B95489050CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 6KB
SHA256 2307f3c914edec8292e02f7abb1cea31fb5ae39e79fe982bfd1252f5823d33bf
MD5 bcaaa4f768bf149d3bd6fc8aeb75c026
SHA1 a562ff3b0f8654ed2f45900f093a899a35b83861
SHA512 5dfc1079b87a369cae8341571490eb69c1cc96f50247a8f1474b35297b9300041a9674186258194300b9774141bb45f31532706b15e4cdaf1048014f6f4fb2e3
SSDEEP 96:xHPUTUkqGqDf2GV1zSISSl5dv9jYn+H+StBw88H8L4cndyc:FHRDf2GVFSSb+StBw88O
TLSH
T1D9E1117894188F7F64B6776CAC6888716AB2013B7BBF68D710B95489050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protections.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\protections.sqlite
Size 64KB
SHA256 f47973dd13805200a469d534a0ec50e224f0c12ae77d93a0e5bcc267af19c145
MD5 63b6f9d979a2cd96d93c105805cafcfc
SHA1 5fc70ce8799617202d1b2a350f6d596b65d48e54
SHA512 ca475720928bd40abab686efb8b890fdccef59c292b26263d41bfd9dfe8f35d21405820e10505fa7cff49eea5ae57ffdbd6ca73d5cf6e1cfe67f5994d2823b90
SSDEEP 6:ltBl/l4/WN1dR4BEJYqWvLue3FMOrMZ0l:DBl/WunddfJiFxMZO
TLSH
T1BF53225E47387021C0891372ABD323923F3CD2FA93232E836A100C358C0A023B822AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\sessionCheckpoints.json
Size 259B
SHA256 4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea
MD5 700fe59d2eb10b8cd28525fcc46bc0cc
SHA1 339badf0e1eba5332bff317d7cf8a41d5860390d
SHA512 3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4
TLSH
T15DD02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 f7ea0f99cde00b66c98ef7f162a33a7a8a78051230c318a344cf4406ee7f4057
MD5 0018fb4291590ae2ccc9d792b2f4aa09
SHA1 dd962eaa4c13ef66e30c9c3cab7ee6d73c40c237
SHA512 9b02ecf6ba0a00af7840dccb5db02b0d09102c30d154de900dc2f06b4124df34a936f44c07d60a80ccd9ee7644b56e0ff375792bab2e3d78bea4b063ea03dd8f
TLSH
T11421F997D8670EF67E649269D08D8FF3CB45303280B15CA0845D475B22ED44D738522C
MD5 SHA1 SHA512 TLSH

Submit Download

storage.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\storage.sqlite
Size 4KB
SHA256 1db39598ae2ee67e7a598723a6ec07a3b74ab17ef166a2614785c74c43d1c5c3
MD5 701bd81ab9bb9fb95ec393a557d20be7
SHA1 7f6d6f5a146ac2e0c5f5424da7d7199ca8b6662d
SHA512 4f6b7a82f3361c2f452f0093fb0286acfa898528a2933f501bfe627993899cc77e136c435a0cebd95457c72c604b030b46dc07fb7b2b937d67ce3dd46179fc5d
TLSH
T1CF815C8D1F247A00C0B057B1E5E00EE35E3E111E4B5B95C72EA011FACAF35966B164BD
MD5 SHA1 SHA512 TLSH

Submit Download

1657114595AmcateirvtiSty.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Size 48KB
SHA256 f812a2078d2aaffd37864acd6ef140973ca0c5fe57ff255ae4e3e7fe3aebb4c9
MD5 de0d813be2e94052f89049febd4b77d5
SHA1 56528d07416251ec57399a637ce962d854e2e7ea
SHA512 b94bfe44006c24cf4cb37fadf72f9f10bbd7520f201515db48cd3062529f067e774ec769a6d06afd6eceebc99e8a88ea01d1903cdf29db6d85754edb3e0cf894
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEmkB6v:Oa16S6CKnqlizbxV+2xVeU7X2B0mK6v
TLSH
T1DD237F8E3F07F511C57AF0B178A08D51BC5E321D07222AD669D0DAE4C8F215AEE1F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 91515106140f558599eeb6d85f83b9f6480052f2bd3578435a331a175be4a6eb
MD5 93792f64d97c761dade5e9f5aa3b0d3b
SHA1 82f571d634b89c6c2df9667c36a01cedd4c91b63
SHA512 3b3b8cd78e02600a73c72e56f4f530e9d50486eee35191d22f09f6de20f363ffb061428ac50eae3f64f737dabbfef7577bd9d24c4b455956e0e93d1034b99194
SSDEEP 49152:3lPbkMngvZR+Uh3YdAF5eQ9hJTHkda1NPUTD:VPbkMngRL5eQ9h1HkdQ4
TLSH
T17A1639F824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download