Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://github.com/G...

windows10-ltsc_2021-x64

8

https://github.com/G...

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    898s
  • max time network
    899s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 01:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://github.com/Galkurta/Account-Manager/releases/tag/v1.4.0
  • Sample260718-cbrl3ags4w
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 19 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Galkurta/Account-Manager/releases/tag/v1.4.0"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Galkurta/Account-Manager/releases/tag/v1.4.0
      2⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4676
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270279 -ipcHandle 1996 -initialChannelId {329471ac-dec7-49f2-acf7-0aa91663c12f} -parentPid 4676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4676" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:2956
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2404 -prefsLen 27133 -prefMapHandle 2408 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {650196fa-de26-4bad-9a7a-6207eb11ec4b} -parentPid 4676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:5936
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3708 -prefsLen 25164 -prefMapHandle 3712 -prefMapSize 270279 -jsInitHandle 3716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3724 -initialChannelId {843d1196-714e-4a82-8740-29548e8cf29a} -parentPid 4676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:2532
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3876 -prefsLen 27274 -prefMapHandle 3880 -prefMapSize 270279 -ipcHandle 3948 -initialChannelId {baba4733-7489-46ce-85b1-28ad3c40b73b} -parentPid 4676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4676" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:3396
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3020 -prefsLen 34773 -prefMapHandle 2636 -prefMapSize 270279 -jsInitHandle 2872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4396 -initialChannelId {0c66cf6a-59e1-4c01-be39-607f78f4b13c} -parentPid 4676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:3768
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5044 -prefsLen 34929 -prefMapHandle 5048 -prefMapSize 270279 -ipcHandle 5028 -initialChannelId {f87be5ac-0812-4fd4-bf6e-837d51f0cd02} -parentPid 4676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:4164
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1080 -prefsLen 32952 -prefMapHandle 3296 -prefMapSize 270279 -jsInitHandle 4600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2712 -initialChannelId {b0a7d36a-c1e9-4093-b67b-e3f75ec45187} -parentPid 4676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:5808
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5948 -prefsLen 32952 -prefMapHandle 5952 -prefMapSize 270279 -jsInitHandle 5956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5716 -initialChannelId {12e9068a-56b1-405f-a26f-be1a2e40b049} -parentPid 4676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:4840
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5912 -prefsLen 32952 -prefMapHandle 5908 -prefMapSize 270279 -jsInitHandle 5904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2548 -initialChannelId {7c2749bc-3924-44f4-a063-f990c52d5943} -parentPid 4676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:2192
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:2252
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3900
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:2692
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4448
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3004
          • C:\Windows\System32\SecurityHealthHost.exe
            \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
            1⤵
              PID:1944

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  activity-stream.contile.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\activity-stream.contile.json
                  • Size 4KB
                  • SHA256 3f015184637cfc7da48bdccfa4bc9a8790121782c1898b8ee80a8792895920a3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  activity-stream.discovery_stream.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\activity-stream.discovery_stream.json
                  • Size 76KB
                  • SHA256 69587275e45fc59607745559d4193e4c028e2b75778f58eff4dfd6867b0833d4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                  • Size 15KB
                  • SHA256 52e17746f32d1621409b0e01a22e2e5dbf11dd1cfe4873dd74240b06837aa36a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  6D89348819C8881868053197CA0754F36784BF5F
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
                  • Size 16KB
                  • SHA256 d0c2901c194d85c2d68874af770ad9f4d8eceb6cba5aa53f58af3bc88a467f67
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  9512A4488B00CC053350DAC32D417B4A35C11513
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
                  • Size 15KB
                  • SHA256 5b2f143fa8e97db16ef1cb6d78a406dab65286631ce003b5b7effef7aeaf8f74
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_arts_and_entertainment.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                  • Size 67KB
                  • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_autos_and_vehicles.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                  • Size 44KB
                  • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_beauty_and_fitness.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                  • Size 33KB
                  • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_blogging_resources_and_services.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                  • Size 33KB
                  • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_books_and_literature.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                  • Size 67KB
                  • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_business_and_industrial.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                  • Size 45KB
                  • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_computers_and_electronics.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                  • Size 45KB
                  • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_finance.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_finance.json
                  • Size 33KB
                  • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_food_and_drink.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                  • Size 67KB
                  • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_games.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_games.json
                  • Size 44KB
                  • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_health.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_health.json
                  • Size 33KB
                  • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_hobbies_and_leisure.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                  • Size 67KB
                  • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_home_and_garden.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                  • Size 33KB
                  • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_internet_and_telecom.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                  • Size 67KB
                  • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_jobs_and_education.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                  • Size 33KB
                  • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_law_and_government.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                  • Size 68KB
                  • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_online_communities.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                  • Size 67KB
                  • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_people_and_society.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                  • Size 45KB
                  • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_pets_and_animals.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                  • Size 44KB
                  • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_real_estate.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                  • Size 67KB
                  • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_reference.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_reference.json
                  • Size 56KB
                  • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_science.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_science.json
                  • Size 56KB
                  • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_shopping.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_shopping.json
                  • Size 67KB
                  • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_sports.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_sports.json
                  • Size 56KB
                  • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_travel.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\nb_model_build_attachment_travel.json
                  • Size 67KB
                  • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recipe_attachment.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\personality-provider\recipe_attachment.json
                  • Size 1KB
                  • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  webext.sc.lz4
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\startupCache\webext.sc.lz4
                  • Size 104KB
                  • SHA256 9a6d39becf500d2c2f005673a5afc2c43196511c15559931438dc408b0825ea4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 595B
                  • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ed446e96-af83-4e8f-b9b6-3a2d36bc09b2.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\ed446e96-af83-4e8f-b9b6-3a2d36bc09b2.zip
                  • Size 3.7MB
                  • SHA256 f4e612c6287621d80102c51dbbdc18ea2e771777ab3f025297ccbf1dec970f35
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  remote-settings-startup-bundle-
                  • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                  • Size 556KB
                  • SHA256 01b0f277627727a06b001226d3cebac4400591662e3b49944a8b370c001536e4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 502KB
                  • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 11KB
                  • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  50U77UE94VFIIBDOKE57.temp
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\50U77UE94VFIIBDOKE57.temp
                  • Size 7KB
                  • SHA256 133e06e28a87b91b2cbc429189b940d505a13970ae0efc66220a05a002da7df5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  addonStartup.json.lz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\addonStartup.json.lz4
                  • Size 4KB
                  • SHA256 1da36e2a3f48d8c072ef55b8b7661882e736827755ebebd79c601c042f03a294
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bookmarks-2026-07-18_10_Vtt1lKVAc4s5j1OCIdlwMJbGo-yf8Y6FD-30ENev-pg=.jsonlz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\bookmarkbackups\bookmarks-2026-07-18_10_Vtt1lKVAc4s5j1OCIdlwMJbGo-yf8Y6FD-30ENev-pg=.jsonlz4
                  • Size 856B
                  • SHA256 e51cf8de830804243fd9342e7b31ca863d2d5ec9cdc8a23639c3ad6c968fc657
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 29KB
                  • SHA256 0bd053cec44724dd0bb4860998a98b696e9f6e5ca9f777987e92a4a2d491fd38
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 29KB
                  • SHA256 dfe566e5547c26c07fce26552d3c832845bfc32d5d03ba71f1e90a1d6ed436f9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 36KB
                  • SHA256 e59fe96cb2170d8546a03400d40abe0b198a24b2b454e5bd4278704ca1687a3d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 28KB
                  • SHA256 3e1857a177fd5cbcbe413c5d9e006490a96267d00f59a0b697328ef8fec23d91
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 36KB
                  • SHA256 35ad7c3c9ea59af4ee129569fd90f7a37b3f3b0569e0b72dca04e028d8285029
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 36KB
                  • SHA256 812c3e9db9fff32f2112b4615a716278808bb57956267ca7233fedc87a22fdec
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  events
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
                  • Size 1KB
                  • SHA256 a200c9a526287f455363c63c29ff2d0bed96e430343a87c3f46c52c728dad4ae
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  03613dc5-a0f0-4a08-9847-79ac0fa3a61a
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\03613dc5-a0f0-4a08-9847-79ac0fa3a61a
                  • Size 886B
                  • SHA256 2967bc3c9c27a5d7c91ec2a349e80e8315e08b7d4a3fc3dac2a354266d98675f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  47516040-07d0-4963-932a-2ca8b928f105
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\47516040-07d0-4963-932a-2ca8b928f105
                  • Size 280B
                  • SHA256 ba11cfe298ceb432642837ccceb554777f4e0c06cff8b057d40b9082d040fb62
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  83ae55db-3855-418e-8ecd-4b003135f41f
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\83ae55db-3855-418e-8ecd-4b003135f41f
                  • Size 235B
                  • SHA256 992428a260071add7c860314fea467d7af9c7d6f99372d1aec1a434424794502
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  8c3a341f-56c9-4485-bd05-a73dca886e14
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\8c3a341f-56c9-4485-bd05-a73dca886e14
                  • Size 4KB
                  • SHA256 5e9fe340fa4b7204b9b7dbd32d07cc207e1d6ce4ec76f6afba7b17c81d6d893d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  90e48ca1-9b03-4c65-9487-73f367b2cad9
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\90e48ca1-9b03-4c65-9487-73f367b2cad9
                  • Size 871B
                  • SHA256 ecb20a26b14fcf8fa04aa0d4b9b3f585f72606362b753a9a98c91369a13773a3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  9c983054-0f47-4cee-91a9-ea40cf0c41f7
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\9c983054-0f47-4cee-91a9-ea40cf0c41f7
                  • Size 2KB
                  • SHA256 c553b0e689b73579a1ac564eb31f409311b62736334b05a9b4a5e61aadd3fb87
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  cee934e9-9fa6-41c9-a6c7-d2f476c69fc2
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\cee934e9-9fa6-41c9-a6c7-d2f476c69fc2
                  • Size 1007B
                  • SHA256 c7306623c3e329277d9620be15e0be5dae55c5a7de2936689ab216195ba9be3c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  f1529339-fa24-459d-80ca-fd21b3f22b42
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\f1529339-fa24-459d-80ca-fd21b3f22b42
                  • Size 235B
                  • SHA256 9211ed299b9cfc4308dd1a8bce2453ed8f8b4cd23e1ec9a36f33d3653012ae31
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extension-preferences.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\extension-preferences.json
                  • Size 942B
                  • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extensions.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\extensions.json
                  • Size 16KB
                  • SHA256 f2a7558aa5de5c9eff9e453e98e416895ae545195f58e5e1e94c67c178ce9b85
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                  • Size 1.1MB
                  • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.info
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                  • Size 116B
                  • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  manifest.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                  • Size 1002B
                  • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  widevinecdm.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                  • Size 21.6MB
                  • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
                  • Size 6KB
                  • SHA256 e0086e422058ab44b4e604ec66ed401f19ad7a6daa63b3336ef5169b13913f17
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
                  • Size 8KB
                  • SHA256 d5eeb2a07457b9b2fca55ddf2c981a21e0b3f03fa2fe142ea6a979eb7336a18b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
                  • Size 6KB
                  • SHA256 0614bd283940f65ad9894d8d819f5ff37e5716a88f05449eeff5da19086ed5e0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
                  • Size 12KB
                  • SHA256 a3227e222f5f76d1905569cc37824d897239ba7a42ede2709a4380d5eecbec35
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
                  • Size 6KB
                  • SHA256 533b01254d2ec95f9fa550b1b96f4211670e579f971594e569daa170c38a0795
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
                  • Size 12KB
                  • SHA256 194a64c99bc0c01769f593fa432431d2bfe47337025eca683b470f80d4e50363
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.baklz4
                  • Size 3KB
                  • SHA256 50db03aff205c8c142937dc19f615fb27caa763ff026f7aa16523cfa48fc7e3e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  recovery.jsonlz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.jsonlz4
                  • Size 3KB
                  • SHA256 a27e1973170c94e0af4f254ae3dd1518b46b7e8890a173aa4f0634afc19cd0a0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 7.2MB
                  • SHA256 5f47d6223f1a5e3a15c77d3ef7a9d9bc604bf5f77797b90938f1a953d38f8c9a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/4448-849-0x0000025604300000-0x0000025604320000-memory.dmp
                  Download

                  memory/4448-803-0x00000256001E0000-0x00000256002E0000-memory.dmp
                  Download

                  memory/4448-819-0x0000025601F00000-0x0000025602000000-memory.dmp
                  Download

                  memory/4448-835-0x0000025601DE0000-0x0000025601E00000-memory.dmp
                  Download

                  memory/4448-817-0x0000025601A90000-0x0000025601AB0000-memory.dmp
                  Download