7950ee0ddb2505fb2b842ed9b94ac3f6962e26346340b56b0165bedb790fd49f

Analysis

user interaction
yes
max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TH Project.exe
Size 740KB
Sample260702-tekrcses9p
SHA256 7950ee0ddb2505fb2b842ed9b94ac3f6962e26346340b56b0165bedb790fd49f
MD5 af385f9b78070ce15f2d6a44f2ee49d1
SHA1 3bc13383e9afd7ea722388a6c2cb0fb8a79e31f7
SHA512 1e6cb21aa592abd2fbb297c3b61bbd12260ae846182c881fe6e32a87ac8eddd9904c38a7c7fc8258b04d4b6c663f906ed1c459468716eda5cae4cbeac8fabe94
SSDEEP 12288:lgztBs/YnnTI5WHToTZvQxvuu2XyGOJucTI8woiVSG6Xw+kRQ6a86dKLFiU33Wt7:lgBBs/YnnTI5WHToTZDXHOJuck85ikX2
TLSH
T166F49E0BB2E902FDD06BE138A686A50BF6753408032499DF53E445652FE77F09BFA712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe
5156	TH Project.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	firefox.exe
Token: SeDebugPrivilege	1288	firefox.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe
1288	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1288	firefox.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 248	5156	TH Project.exe	89
PID 4192 wrote to memory of 1136	4192	private_browsing.exe	94
PID 1136 wrote to memory of 1288	1136	firefox.exe	95
PID 1136 wrote to memory of 1288	1136	firefox.exe	95
PID 1288 wrote to memory of 4516	1288	firefox.exe	96
PID 1288 wrote to memory of 4516	1288	firefox.exe	96
PID 1288 wrote to memory of 4516	1288	firefox.exe	96
PID 1288 wrote to memory of 5556	1288	firefox.exe	97
PID 1288 wrote to memory of 5556	1288	firefox.exe	97
PID 1288 wrote to memory of 5556	1288	firefox.exe	97
PID 1288 wrote to memory of 5556	1288	firefox.exe	97
PID 1288 wrote to memory of 3364	1288	firefox.exe	99
PID 1288 wrote to memory of 3364	1288	firefox.exe	99
PID 1288 wrote to memory of 3364	1288	firefox.exe	99
PID 1288 wrote to memory of 3364	1288	firefox.exe	99
PID 1288 wrote to memory of 3756	1288	firefox.exe	100
PID 1288 wrote to memory of 3756	1288	firefox.exe	100
PID 1288 wrote to memory of 3756	1288	firefox.exe	100
PID 1288 wrote to memory of 2104	1288	firefox.exe	101
PID 1288 wrote to memory of 2104	1288	firefox.exe	101
PID 1288 wrote to memory of 2104	1288	firefox.exe	101
PID 1288 wrote to memory of 2104	1288	firefox.exe	101
PID 1288 wrote to memory of 5240	1288	firefox.exe	102
PID 1288 wrote to memory of 5240	1288	firefox.exe	102
PID 1288 wrote to memory of 5240	1288	firefox.exe	102
PID 1288 wrote to memory of 5240	1288	firefox.exe	102
PID 1288 wrote to memory of 3944	1288	firefox.exe	103
PID 1288 wrote to memory of 3944	1288	firefox.exe	103
PID 1288 wrote to memory of 3944	1288	firefox.exe	103
PID 1288 wrote to memory of 3944	1288	firefox.exe	103
PID 1288 wrote to memory of 5080	1288	firefox.exe	104
PID 1288 wrote to memory of 5080	1288	firefox.exe	104
PID 1288 wrote to memory of 5080	1288	firefox.exe	104
PID 1288 wrote to memory of 5080	1288	firefox.exe	104
PID 1288 wrote to memory of 1220	1288	firefox.exe	105
PID 1288 wrote to memory of 1220	1288	firefox.exe	105
PID 1288 wrote to memory of 1220	1288	firefox.exe	105
PID 1288 wrote to memory of 1220	1288	firefox.exe	105
PID 1288 wrote to memory of 3052	1288	firefox.exe	106
PID 1288 wrote to memory of 3052	1288	firefox.exe	106
PID 1288 wrote to memory of 3052	1288	firefox.exe	106
PID 1288 wrote to memory of 3052	1288	firefox.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TH Project.exe
"C:\Users\Admin\AppData\Local\Temp\TH Project.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5388

C:\Program Files\Mozilla Firefox\private_browsing.exe
"C:\Program Files\Mozilla Firefox\private_browsing.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1924 -prefsLen 27097 -prefMapHandle 1928 -prefMapSize 270279 -ipcHandle 2012 -initialChannelId {016ed210-cac8-444b-8af6-43a0651109bd} -parentPid 1288 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1288" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2404 -prefsLen 27133 -prefMapHandle 2408 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {d748e0c4-1def-4706-bb9f-a18635fc766d} -parentPid 1288 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1288" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:5556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 27198 -prefMapHandle 3868 -prefMapSize 270279 -jsInitHandle 3872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {1e58831e-8c77-4433-aca2-094e18afb688} -parentPid 1288 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1288" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3364
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27198 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {b63d8bb0-a4cc-426e-a9f8-18ea0936902b} -parentPid 1288 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1288" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3032 -prefsLen 34753 -prefMapHandle 4560 -prefMapSize 270279 -jsInitHandle 4512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2996 -initialChannelId {59d73007-3ccd-436f-9729-8faab65e8212} -parentPid 1288 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1288" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:2104
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5224 -prefsLen 35069 -prefMapHandle 4032 -prefMapSize 270279 -ipcHandle 1284 -initialChannelId {e2123775-10dd-49e1-92bb-e44b41c99da7} -parentPid 1288 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1288" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 33003 -prefMapHandle 5444 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {b03675bd-102e-411a-863d-def712bed76e} -parentPid 1288 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1288" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 33003 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {60357b43-7829-4acf-b8b3-1d580a980cb7} -parentPid 1288 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1288" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5860 -prefsLen 33003 -prefMapHandle 5608 -prefMapSize 270279 -jsInitHandle 5788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5064 -initialChannelId {6f38ad85-4b73-4945-89dd-dfde5d5d08e6} -parentPid 1288 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1288" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4900 -prefsLen 33043 -prefMapHandle 5504 -prefMapSize 270279 -jsInitHandle 6012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3284 -initialChannelId {3a0b9d71-e25b-43e7-9787-6a94edef1582} -parentPid 1288 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1288" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:3052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s9p00y6l.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 13KB
SHA256 d1603169864b1b3ae8fad0f2ecb279df14e58cb59038933395d0dfa8d3489493
MD5 52488b5c4f911527b6e9fdcf1d194371
SHA1 10656f308629c38897f967c2ed08feebe304bd83
SHA512 74acf6242f8a40d23b4dd556778490dc0c2260108b2816c6535114c0d30b9c63b18d680fd00018e0596ed5a74702c7f1cd06bb2fd2ddf004bc70fdc4c2ddb28e
SSDEEP 384:H9XghOiO024YXo6J+Sl1xDnZBPsac4j0lpDII+Hr5:dX+ZYXo0+Sl7zZlsac4ID8LF
TLSH
T138528D7E9F0138A91E67D194D4BD9244CD44A7BBEEE2D0651A143C14CA84BF8F4E64CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 e066f3eaf2caa2d179f086de199eb01fea937b951b8af528f8932e719d20cc10
MD5 e7fd834f1f8862d939db6462e83b0323
SHA1 8705edc6882415d2d12058871ae779f58195d7b2
SHA512 5e35f751d11629056e3d0320ad8cdcd61d603e8aad2c314b2ccd0d1c3edb81af8300a445830091434656f0312234860dd015f4ecfe9207a5a01b5ce9990f0169
TLSH
T1AC61BB59F229863FE4098139CC861B415F747456A8AF3F2A359CA04D1E5B3CE768D07D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 7a8ef53fb9de6354422a8fbfee00b2ed41481cdc7ca2a3aca1179b7f3579afb4
MD5 cc5d84d1dbad8aadd1a271c5036835da
SHA1 90835166c0b74d4008309205ae5f55f799fcd477
SHA512 3faab258364ea60d8a4d0f18641594ede96c83f8d4c9d23dc9400e9c8b9434a1cc46c5537c04cd0274834aa0d3c1c1f12908b525e75316c7a7df26c50b5c235f
SSDEEP 96:1F/2FR9aFRXFRqFRP/dd66JoztdzgClKtmc0d/UU6OhSdF95/7bkW6ArcEzZ9yUa:u9qPaP1d66JoztdzgCl6mc0d1Ov5zbo9
TLSH
T103C1EF28E629463FC448423BCCA60B500E76795BA85F3F1931EC744D2D5B2DE7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5fe176abc1f4696caf976a0120e02f61be098f3ff64cc71411620e96e0da7843
MD5 a9143be26a7ce8a753e6cda7c7bb9711
SHA1 bcf1b8672f2ac9c7d90a2abe05526807685d1153
SHA512 b27320394b652f7c407818b8dc3e4b091ce9b8f0938a85940e4ea1cc471f3f5115a60ea31b237f4443d3775cf6c97d047ce9d2fcc1e98e6f6f395d9a39ac745d
SSDEEP 192:dOv5zbo7zJZzfyjdFAH9qPaP1d66JoztdzgCl6mc0dz:Sbo5ZzfyjXSJd66Joz/zgC1jd
TLSH
T120E12168E628863FC404127BCCA60F400F39395AD84E3F1935AD744C2D5B2DD7A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c63537ee89adf9575310ac7ff87c12086c5e5ce2dc3607305764686c960c6887
MD5 a65877f3343488661d0f9a97c2510ab7
SHA1 bcfa779c1ad904a764e1fa0e9b602c07cbc0b46e
SHA512 8c0a422d6e707a2aa21dad15716782aa076b53754aaeb6a78615986f85a25742259d3da2be003b4dd2da4074a6eeeaa78feaa756ffec34f9a7ac3196bd9b0dbe
TLSH
T167112B6C39F98D6AA88BF39C74A0128E93254F4A448718534D56EFCDDF81ADD327A42C
MD5 SHA1 SHA512 TLSH

Submit Download

217c5a3f-f42b-4844-bb61-4d1fc57b93be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\pending_pings\217c5a3f-f42b-4844-bb61-4d1fc57b93be
Size 883B
SHA256 53aa9f5a563d9b618df03a553f550153b1e03719c1ab371e7f8abbf3cc0e96c4
MD5 a180c6b61fd71a5a050019901fae9edf
SHA1 e9840ee45ac5535caeb46c92b0967a94039d91d9
SHA512 29af91879a3ba5503f5700240076fe018a4341de91a3e8e3c05914534a4ce3b7b286480cf61395b317271a590df213fe812f58c20bcbc7848ef90610fe9bd653
TLSH
T169110C418634BAA2CD28A25B85A237429BE8B92380CB55143DB1AA0C0E7E65DE396307
MD5 SHA1 SHA512 TLSH

Submit Download

21bd4536-7932-4a30-9db1-b1513d5fefb5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\pending_pings\21bd4536-7932-4a30-9db1-b1513d5fefb5
Size 5KB
SHA256 6361259c8a49627140caaea7ca202fa8f7ad7ddc840371f38defd44009c9e51d
MD5 283b5e8a956caa7bbad1d10835cfe284
SHA1 2f8b03c6e34a49b6d4dd5e9ba5667cd25cb2ec4f
SHA512 38d9ee38b1a709a41a2f3fb32534aecdde47ba519c7de7bf891774cb106f62f47eb23db12206b5b0973828bb13dd98645318b9fbbe15032ed08d7dc8ee15065a
SSDEEP 96:8u4ovrNVFUEU4DzYe6EL2YhxDdYiM32OvYyEf5YuM7xdmlfso2JqKy3YI43ikkE3:8u4ovbiFZ8jMJ9f9aLSSlfb9OmKH
TLSH
T18CB1EEFEDD2201677A25E62DF1E8BEEA009A493049CCC79D59FC0C2A37D2AB71653315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

456b45be-2a8d-4059-bfe7-f35e5be6101a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\pending_pings\456b45be-2a8d-4059-bfe7-f35e5be6101a
Size 235B
SHA256 45339e44683c70d04eba4a85ff1e226847ad51ddf119fb953213a273f2a243c4
MD5 a527d6861f48367123548bba9d7e4e5f
SHA1 d7103773238bfbfc9ef5cd1ddfd8a0aa2dc04773
SHA512 f00d78074cae336bdf5d7857df26d9612a35ea60060157b525d2c9941e4d091e797d95ea17f11e9830f05847a52e764767dce1b88aa8de6f4067603e4dfa9b57
TLSH
T142D097842498276E4C004F87F0A038C730494C3314A0A8209AA10474DFFCEC80221847
MD5 SHA1 SHA512 TLSH

Submit Download

afa55294-e4b2-4eed-af09-626a2e56b620

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\pending_pings\afa55294-e4b2-4eed-af09-626a2e56b620
Size 2KB
SHA256 ac71b6dfe64ed256ffbab467eb34305e3c80173edb8841315799d23963ad373a
MD5 21dc355628e868f8c684981ea5edbe19
SHA1 4b54b9b9001d4059cd77f6d132d80407d763bfcc
SHA512 8ba3da8e5d05a55918420b09ede3d21871ac76b99ac1c40bf5dc8fccff798f7d85a58fa5472aae1f3b38d6494ac6e7333de623f812cb537abe76c31438ff98b1
TLSH
T16341215C3EB85C368DCAF19D9092234E97248A2340C62D432E51FF0CCED6699636E52A
MD5 SHA1 SHA512 TLSH

Submit Download

c445df54-6ae7-4dc2-a5bb-67e14ad42f22

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\pending_pings\c445df54-6ae7-4dc2-a5bb-67e14ad42f22
Size 16KB
SHA256 0f8a663a549f205be71f21d82982361648747815c63ad83fa989ace67a2ce916
MD5 3dd4ff2205946ac2d8e0a2e50fd50c5f
SHA1 f7594bd73f2f41166cdf207d0a30ba02e7825857
SHA512 08d22369d1a1071d3ebc7a223df869a0728d0faa03e0ad12dfa2ebfb417a125a3f3f0174745a14f222a3c4ebaf64c5e76f71041a7a8e6cd5c0333a56590ca23b
SSDEEP 192:Yu4DsKWtzxReSYK+jW114T0BGBXJvvn2JOJevWuNLIzDBzw4HO7rPRMl+9h0JXPS:bGsKWtlRLYK++4QEnFJmWuNLwy6a
TLSH
T17072EB56582055BA8251E3A894FC7FC3E5F628CF4C019FCE9BE4BD086DDE0AE512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c71b386a-e29d-43a5-b346-c2bbcb659945

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\pending_pings\c71b386a-e29d-43a5-b346-c2bbcb659945
Size 235B
SHA256 dae7b0a3b88a87ae46d3c8c839d439e325002f988435031d246ca64083b65108
MD5 75e6a55bbf9645bb34de2c4ad5dfa87d
SHA1 272ea691a429bbc96eb90b79c5bb4871c5fd8348
SHA512 358b17c8b2353a8a3104d69abec8604c91a61e3fc7191a90819fa62cd234dc6d3846f3eb815e02d978ba0887a328bc8261869e37a9fe347b509b75beb45742b4
TLSH
T1DBD09790548C739E08140F06F0E16ADA70894C3320A4A820D7528038DAFCEC882A2817
MD5 SHA1 SHA512 TLSH

Submit Download

ce98b3df-8762-4bc5-9225-aaf92fc25a61

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\pending_pings\ce98b3df-8762-4bc5-9225-aaf92fc25a61
Size 886B
SHA256 6e83d5f1b7af1ba0e85debf5b4fa358f4c77c9701c1a44961547ee0c7d429ead
MD5 9134a8db99670d93aa89f0be62f7186a
SHA1 0dc28815b3b0b4fc10cf7ba67000f5495aa5299c
SHA512 e903545ef580c993da163f38296a818be46b74baee9bd72f379aa1f1282bb70f04b8a6155a09aa1bfa7561e8e43bb2ce035faf0c1b8c13a7e5f8a052e26f511e
TLSH
T134110494C624B572CD68D14791E277414AE5B52390C70D047D645E0C0EFA559D797347
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\extensions.json
Size 16KB
SHA256 ba7e38a73cd7d1a8df3d1c6176939d1b2c7a5ff58275c7ccef456a05d02d331d
MD5 a6072770a7670c01183150d6242206d9
SHA1 1c485b44cd1d096aacc00bc09b74c6b31bc681ed
SHA512 83692db992948785830c5c04b187156576dad7472e6f680d4ca6b7ecf82b59baa5e1198a95d35ef3519cff13f767a7919f08527b5b961dafa29d0ed25bd698e5
SSDEEP 384:5kI4veUmldvc8dhWH94zc96oTL4H5yL4PFL4HLL4H5L4HFy4hl:aI4GRfFXW486o424d434R4o4H
TLSH
T1FC72431545049EB8298FA78BAA367D02C37D473B60845C78F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\prefs-1.js
Size 6KB
SHA256 6cf73c9bac6be63e214b7538a81e76dc29617c3d60a5390333e7645f239ae11b
MD5 68787029166d91079646ec8cce4e52fa
SHA1 02c084dca37b52c0384ad54fda880f7e20fa7045
SHA512 79e8ae9c0a008b8d84b6f61f5f1bf56e654082669e48c7faf88b2000d747feaf79a7012e97b0e7fd8afe4d9a86a80927103f781b45e1d01d9b4912f0de8e7d45
SSDEEP 96:xHV1UTUDqGqOTfkE31zSrzSSlAdv9j++n6HHPtBw88u8L4cnbI92PGS:71eRCfkE3mSS9HPtBw88Gy
TLSH
T104E13F7891088B7F64B677ACAC6488716A72023BB7BF68D350B554C4014CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\prefs-1.js
Size 7KB
SHA256 5cdb4e4b5a282323639e65ed90c02f4eb2f82a8dc8fc5c8bd8e8b5f50bd16be5
MD5 5059495534e9c7849ac987708b750999
SHA1 89f61efed66cdae6f81a09b8646612de86b4fb2a
SHA512 77d5e13b5be9319017001c5c833bdecd567cac3a30a368d2a275ca70cbed345eb7381e94f443cd79486fe83d0651756a712562a7235d92a580d8e1edb5236238
SSDEEP 96:xHV1UTUDqGqOTfkE3NbzSrzSSlAdv9jtn6HHPtBw88u8L4cnbI92PGS:71eRCfkE3KSSTHPtBw88Gy
TLSH
T163E1307891088F7F64B6776CAC6488716A72023BB7BF68D350B554C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\prefs-1.js
Size 7KB
SHA256 6d7ec1bd3db2e561a2cc93bf2fe4e87ca4834139a23865f3b9f34cf37d3b9663
MD5 02d16bc48d51d4a372fd05333430e296
SHA1 e69221fe9dfc267fb5571edc9bd667e7168acb35
SHA512 1f8a01e6c5856e04da842e79a25776c344b52dca7568bab8af1b95ae797efa2dc3dca306dc8a4ffee9ed400ce46a8eb03581a96c079724cc78435a11ec8aa0f5
SSDEEP 96:xHV1tTUDqGqOTfWljE3NbzSrzSSlAdv9jtn6HHPtBw88Nv8L4cnb82PGS:71jRCfWljE3KSSTHPtBw88NO
TLSH
T18DF11E789144CF7F74B6766CAC2488716A72023BB7BF68D610B944C5060CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\prefs-1.js
Size 7KB
SHA256 8b3c0440cf8bb66afeeaa49e28523e9c8740dac76259434fb92aa417932b05a1
MD5 bab25e69ad5013ec20d151a94f42fd86
SHA1 f893cc9f12051936955d09f936f932c0b78fc0f2
SHA512 e03b50a506a7007a146f2894460349337c4a0c718ff36b2bb565edbdb23ce6f4291cda33a724285de92682a1527ab60681e2127779225765b1b81c4f10bab556
SSDEEP 96:xHV1UTUDqGqOTfkE3kzSrzSSlAdv9jtn6HHPtBw88u8L4cnbI92PGS:71eRCfkE3FSSTHPtBw88Gy
TLSH
T194E13F7891088F6F74B677AC6C6888716A72023BB7BF68D750B654C4010CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\prefs.js
Size 6KB
SHA256 973a6f0235058fc2bc358d9df0b743a395774c02b1a46dc34ee9a5f63e7ee682
MD5 a10e9d4352e21467dc98982141a9d5e8
SHA1 692cfe9838435bbe7f8df90f5e2d2926fcc48f7e
SHA512 c5b8bc46ef3dfe516d50f4ca5f65660e2606abccd664ad3a268882cc0f9648859599aa561f2ad4c8c9cc8e543f17d08bf7c629ad1d5f133ac3b0b909f08810cd
SSDEEP 96:xHV1UTUDqGqOTfkyA1zSBSSl+dv9j++n6HHPtBw88u8L4cnbI92W:71eRCfkyAUSSvHPtBw88G5
TLSH
T134E1407895088B7F74B6776CAC6488716A72023BB7BF68D350B65484050CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download