Overview

overview

8

Static

static

1

Flash-Lite 3.1.txt

windows10-2004-x64

1

Flash-Lite 3.1.txt

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    900s
  • max time network
    622s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 06:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Flash-Lite 3.1.txt
  • Size 8KB
  • Sample260705-g2819aev2l
  • SHA256 fcc1d513b91b9e75df6c5abbeef0cd207cb5269383389b9ae839f50ea6bf56d8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 62 IoCs
  • Suspicious use of SendNotifyMessage 50 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Flash-Lite 3.1.txt"
    1⤵
      PID:1468
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:5776
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4876
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {ca102bf4-b597-4066-b0be-c3f8d49eb024} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          3⤵
            PID:1232
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 27133 -prefMapHandle 2404 -prefMapSize 270279 -ipcHandle 2412 -initialChannelId {385ef1d9-abe2-42b9-b3ee-fc15eebc6bf5} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            3⤵
              PID:5436
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 27323 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {04c2937b-cfc1-436d-8cf0-581f93d2c04e} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
              3⤵
              • Checks processor information in registry
              PID:3908
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3984 -prefsLen 27323 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {2d5e8a84-6268-48bd-97be-d95a5fe4dfec} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
              3⤵
                PID:5916
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3120 -prefsLen 34822 -prefMapHandle 2852 -prefMapSize 270279 -jsInitHandle 4372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3096 -initialChannelId {cda1b889-2a7e-4ee3-a5a9-9e7553394985} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                3⤵
                • Checks processor information in registry
                PID:4940
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5056 -prefsLen 35089 -prefMapHandle 5060 -prefMapSize 270279 -ipcHandle 5080 -initialChannelId {c5c46c79-5672-428a-a058-49b1c9ba89a0} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                3⤵
                • Checks processor information in registry
                PID:4556
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32979 -prefMapHandle 5268 -prefMapSize 270279 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5300 -initialChannelId {0ae445db-67bd-4049-8b91-cf3fdee1f3b7} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                3⤵
                • Checks processor information in registry
                PID:3120
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32979 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5364 -initialChannelId {a714c70e-56dd-4877-955e-d4924a2b6014} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                3⤵
                • Checks processor information in registry
                PID:3828
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5784 -prefsLen 33031 -prefMapHandle 5744 -prefMapSize 270279 -jsInitHandle 5780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {589a3370-2fb3-41b9-870c-652dc4eaa08f} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                3⤵
                • Checks processor information in registry
                PID:5096
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6360 -prefsLen 33031 -prefMapHandle 6364 -prefMapSize 270279 -jsInitHandle 6428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6368 -initialChannelId {31d1fb4c-f60b-41a5-bc5f-8436ba3bba53} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                3⤵
                • Checks processor information in registry
                PID:4780
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6824 -prefsLen 33261 -prefMapHandle 6620 -prefMapSize 270279 -jsInitHandle 6784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6516 -initialChannelId {ef083f22-a8b0-4dbb-a5a5-fde1ac204ebd} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
                3⤵
                • Checks processor information in registry
                PID:5708
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6844 -prefsLen 36885 -prefMapHandle 6572 -prefMapSize 270279 -jsInitHandle 6972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4364 -initialChannelId {d988c5fc-dda0-445e-930b-5d7e77b0cc3b} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
                3⤵
                • Checks processor information in registry
                PID:2652
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5288
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:2568
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:2688
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4812
          • C:\Windows\System32\oobe\UserOOBEBroker.exe
            C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
            1⤵
            • Drops file in Windows directory
            PID:5052
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
            C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
            1⤵
            • System Location Discovery: System Language Discovery
            PID:6396
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            1⤵
              PID:6948
            • C:\Windows\System32\SecurityHealthHost.exe
              \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
              1⤵
                PID:2068

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    activity-stream.contile.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\activity-stream.contile.json
                    • Size 4KB
                    • SHA256 30d9960a8a5a6ccdae74df0ce09f343444089951e8d84bf01c36d35459ef4751
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    activity-stream.discovery_stream.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\activity-stream.discovery_stream.json
                    • Size 75KB
                    • SHA256 f2d105a66a58e4eddf017622128fff82d4cf9251db92aed995fa935c38c8579d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    9512A4488B00CC053350DAC32D417B4A35C11513
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
                    • Size 13KB
                    • SHA256 9b1f711059b5c36ea4d60d078d369d255854efac4d1615fa1f9a44aef791ac9d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_arts_and_entertainment.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                    • Size 67KB
                    • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_autos_and_vehicles.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                    • Size 44KB
                    • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_beauty_and_fitness.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                    • Size 33KB
                    • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_blogging_resources_and_services.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                    • Size 33KB
                    • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_books_and_literature.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                    • Size 67KB
                    • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_business_and_industrial.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                    • Size 45KB
                    • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_computers_and_electronics.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                    • Size 45KB
                    • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_finance.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_finance.json
                    • Size 33KB
                    • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_food_and_drink.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                    • Size 67KB
                    • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_games.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_games.json
                    • Size 44KB
                    • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_health.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_health.json
                    • Size 33KB
                    • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_hobbies_and_leisure.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                    • Size 67KB
                    • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_home_and_garden.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                    • Size 33KB
                    • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_internet_and_telecom.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                    • Size 67KB
                    • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_jobs_and_education.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                    • Size 33KB
                    • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_law_and_government.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                    • Size 68KB
                    • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_online_communities.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                    • Size 67KB
                    • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_people_and_society.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                    • Size 45KB
                    • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_pets_and_animals.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                    • Size 44KB
                    • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_real_estate.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                    • Size 67KB
                    • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_reference.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_reference.json
                    • Size 56KB
                    • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_science.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_science.json
                    • Size 56KB
                    • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_shopping.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_shopping.json
                    • Size 67KB
                    • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_sports.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_sports.json
                    • Size 56KB
                    • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_travel.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\nb_model_build_attachment_travel.json
                    • Size 67KB
                    • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recipe_attachment.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\personality-provider\recipe_attachment.json
                    • Size 1KB
                    • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    webext.sc.lz4
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\startupCache\webext.sc.lz4
                    • Size 104KB
                    • SHA256 2ed1ab005c79c00002bfe6f30a7c4860503264be063c93e7aa98ec680ab31afd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prep_Activatable Class_Hermes_perf.cache
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                    • Size 599B
                    • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    remote-settings-startup-bundle-
                    • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                    • Size 544KB
                    • SHA256 86f95de33a360444653a765dce16a79ef6134aaa04bc7800c804ded0235442ee
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 11KB
                    • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 502KB
                    • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    XT6ISQ86WAANGX9NRP3G.temp
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XT6ISQ86WAANGX9NRP3G.temp
                    • Size 11KB
                    • SHA256 bbcc775d02db2088388c34712b709cd94bcec81e48beafd229d69717a350d516
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AlternateServices.bin
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
                    • Size 20KB
                    • SHA256 fe16a5f0def8562a0a6de77f302268fddc3ebbd8740638e28463edf8860fee3d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AlternateServices.bin
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
                    • Size 21KB
                    • SHA256 03eebdf382fb04f884658085a8919bf0d34fcbfac00a37c275a078cec928275e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AlternateServices.bin
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
                    • Size 7KB
                    • SHA256 d16854afe95039aacf40eb35e53a58c9981d814b66eb04a8720de06d6c3c43f9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AlternateServices.bin
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
                    • Size 12KB
                    • SHA256 25bdcbd4615a320e2b6f85ab399f5ddf0e34962dbbf393f1a301de2e9ebda396
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AlternateServices.bin
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
                    • Size 13KB
                    • SHA256 b8f9026d213e33cedfc9923634528d803c6e8a38c8a1b87d14032bbbd13bd548
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    addonStartup.json.lz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\addonStartup.json.lz4
                    • Size 4KB
                    • SHA256 03073f4575df11ddeaf3842eb8c88e6acccbbcc8607700acee9b069240757c35
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    bookmarks-2026-07-05_10_a465JCWqPbWIHJ3qreHtH4KbjozsYHyflF-bqu_85tc=.jsonlz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\bookmarkbackups\bookmarks-2026-07-05_10_a465JCWqPbWIHJ3qreHtH4KbjozsYHyflF-bqu_85tc=.jsonlz4
                    • Size 865B
                    • SHA256 3a7a49fbfa76babdad19604627059d3ec29b4c39df054e56a16af814aa2a00e2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 74KB
                    • SHA256 ebafb7e9fa17a11e56cc24dce737d896fcc2987c29bccc1f32be44bef07148a6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 74KB
                    • SHA256 233a4792edfb4996eac35d1d6f3384a563b36f2738f05df9ab32ffdbb3a65595
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 74KB
                    • SHA256 911b52bb6ad0836261d162bc58913e63d3c9da65482996bc7744e6d3de171a95
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 74KB
                    • SHA256 7d9382c9c2f584238515e6082e814fce77094d316564d8a97e9c8fc42665ee41
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 6KB
                    • SHA256 32af40bc39cffeb985b79c8bad200cc25cd41ff7115b6aefeea950cb4326cea0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 6KB
                    • SHA256 96313cb74241c7b806bda37fdd26811b22510f1717f39694943811611300b6a6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 7KB
                    • SHA256 1f01c68dfa1283d021b7e5523f3e3d548fb32da840887e6f208c53d6bbb494f5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    events
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\events\events
                    • Size 1KB
                    • SHA256 802a663bc124ddc2e404d1d6eddcc693625ee2eb88f95bc9df6b024255001e4d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    events
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\events\events
                    • Size 5KB
                    • SHA256 fa44b6839bdeedb329055673d4e818bed4945355f1d91f3c43232973de994fd8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    12f51b6f-b257-4e20-a6d3-b5b757d85bee
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\12f51b6f-b257-4e20-a6d3-b5b757d85bee
                    • Size 883B
                    • SHA256 2a7eeecfca38ea8987de9fe48bbe365700630ddac1f1963444c4fad36e79bb89
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    1ca9388d-cd52-49af-9525-5f05eb87fd16
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\1ca9388d-cd52-49af-9525-5f05eb87fd16
                    • Size 886B
                    • SHA256 c5b4f1ab34a1f4d93071657422a482019f4eefb381c369ce1a07ae3958c455e2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    32de5a98-14ee-4389-be11-802c72241ed6
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\32de5a98-14ee-4389-be11-802c72241ed6
                    • Size 2KB
                    • SHA256 50f62ab93882c8c972b44257d076a13925956c2e9197a2a4d54765fd7852f927
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    798249d2-90ca-47bf-9fc1-a1bc8f664a28
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\798249d2-90ca-47bf-9fc1-a1bc8f664a28
                    • Size 235B
                    • SHA256 9b4a4e5f16e9ab31820f4a453cda96e065bc091ff4d4e5fcfaff798211d6c9f4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    a6e9b222-e1e6-41c9-9065-596c03b23c96
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\a6e9b222-e1e6-41c9-9065-596c03b23c96
                    • Size 16KB
                    • SHA256 bb128f085ae665bbebb965af6ef44d63f13f980437eaade35db480edacc8c0ea
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dbae729d-e991-45a5-8eab-cd0839cbf476
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\dbae729d-e991-45a5-8eab-cd0839cbf476
                    • Size 235B
                    • SHA256 0a56dd93eac1fbf64a95aa850fcb04413df0b040ccfe018cec4ecb655ca5835a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    extension-preferences.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\extension-preferences.json
                    • Size 942B
                    • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    extensions.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\extensions.json
                    • Size 16KB
                    • SHA256 fa64ef69e26bd22506d79ad19bdb2fc73a147dc1af16b2c7c4bdd2971a668d68
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                    • Size 1.1MB
                    • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.info
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                    • Size 116B
                    • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    manifest.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                    • Size 1002B
                    • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    widevinecdm.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                    • Size 21.6MB
                    • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\prefs-1.js
                    • Size 12KB
                    • SHA256 7c10576e97b5ec4f729fbd6570ea5d9ebf42e0a33d27ccceb89470869c76b0d6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\prefs-1.js
                    • Size 7KB
                    • SHA256 bcc1aa0eee37311b87991591d8b9a5cb5f1bbdd2e36c8c2157549b06c187300d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\prefs-1.js
                    • Size 6KB
                    • SHA256 cc9c8193402f01507e6103e25bfb5b24fd0150a483c0e848967d551e38021f0c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\prefs.js
                    • Size 6KB
                    • SHA256 e699daddf3dc73db8239fdc255076df780cb5ecf0b48f7d39452f009d3299240
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\prefs.js
                    • Size 7KB
                    • SHA256 66ac7617834bebfcd1875f0b029fddf8bc3deb58aeee5cdcdb1b5c6b25a6ec1d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\prefs.js
                    • Size 6KB
                    • SHA256 3e31a8cd09d79de78199f3dd513a423219723dd769e184eb3cee7e8d8888b921
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\sessionstore-backups\recovery.baklz4
                    • Size 3KB
                    • SHA256 a37fd06eb0311f5843ea4a9b0d4fc1694af6e1318e7b86027aa44add454f5913
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\sessionstore-backups\recovery.baklz4
                    • Size 3KB
                    • SHA256 01900f8b4dbf629d9d55272be4435c81e2eac8924f4fcdf97a4fcdf20556346a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\sessionstore-backups\recovery.baklz4
                    • Size 6KB
                    • SHA256 5e465488410bf23c82a8cf9b5c84dca212417be322dc72b3d44f536291f61bf8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.jsonlz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\sessionstore-backups\recovery.jsonlz4
                    • Size 7KB
                    • SHA256 f26642946afc6cbb4e91ce27557d8ad6710d8dd14bc1053843ae077de0d22102
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    3870112724rsegmnoittet-es.sqlite
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                    • Size 7.1MB
                    • SHA256 71f4ad79d69ee4398fd07b5e0c84e1af912664433730d2080f1b19a140b9f8d1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    3870112724rsegmnoittet-es.sqlite
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                    • Size 5.0MB
                    • SHA256 f5fb4e1c72a1df3dabf6001f8c3e9a5d6d4323edd2b8a2785ca300f9fb4d7614
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/2568-711-0x000000000EA10000-0x000000000F28B000-memory.dmp
                    Download

                    memory/2568-1073-0x000000000EA10000-0x000000000F28B000-memory.dmp
                    Download

                    memory/2568-1706-0x000000000EA10000-0x000000000F28B000-memory.dmp
                    Download

                    memory/4812-859-0x000001D201C50000-0x000001D201C70000-memory.dmp
                    Download

                    memory/4812-893-0x000001D2146A0000-0x000001D2146C0000-memory.dmp
                    Download

                    memory/4812-843-0x000001D2001E0000-0x000001D2002E0000-memory.dmp
                    Download

                    memory/4812-860-0x000001D201EB0000-0x000001D201FB0000-memory.dmp
                    Download

                    memory/4812-868-0x000001D201D90000-0x000001D201DB0000-memory.dmp
                    Download