hxxps://github[.]com/TrinityEmulator/TrinityEmulator/releases/download/Trinity-Release/Trinity[.]zip

Analysis

user interaction
yes
max time kernel
284s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/TrinityEmulator/TrinityEmulator/releases/download/Trinity-Release/Trinity.zip
Sample260721-tspbpscc76

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Trinity.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	firefox.exe
Token: SeDebugPrivilege	4184	firefox.exe
Token: SeDebugPrivilege	4184	firefox.exe
Token: SeDebugPrivilege	4184	firefox.exe
Token: SeDebugPrivilege	4184	firefox.exe
Token: SeDebugPrivilege	4184	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 4184	3628	firefox.exe	85
PID 3628 wrote to memory of 4184	3628	firefox.exe	85
PID 4184 wrote to memory of 2124	4184	firefox.exe	86
PID 4184 wrote to memory of 2124	4184	firefox.exe	86
PID 4184 wrote to memory of 2124	4184	firefox.exe	86
PID 4184 wrote to memory of 4972	4184	firefox.exe	87
PID 4184 wrote to memory of 4972	4184	firefox.exe	87
PID 4184 wrote to memory of 4972	4184	firefox.exe	87
PID 4184 wrote to memory of 4972	4184	firefox.exe	87
PID 4184 wrote to memory of 4364	4184	firefox.exe	88
PID 4184 wrote to memory of 4364	4184	firefox.exe	88
PID 4184 wrote to memory of 4364	4184	firefox.exe	88
PID 4184 wrote to memory of 4364	4184	firefox.exe	88
PID 4184 wrote to memory of 3828	4184	firefox.exe	89
PID 4184 wrote to memory of 3828	4184	firefox.exe	89
PID 4184 wrote to memory of 3828	4184	firefox.exe	89
PID 4184 wrote to memory of 3776	4184	firefox.exe	90
PID 4184 wrote to memory of 3776	4184	firefox.exe	90
PID 4184 wrote to memory of 3776	4184	firefox.exe	90
PID 4184 wrote to memory of 3776	4184	firefox.exe	90
PID 4184 wrote to memory of 1052	4184	firefox.exe	91
PID 4184 wrote to memory of 1052	4184	firefox.exe	91
PID 4184 wrote to memory of 1052	4184	firefox.exe	91
PID 4184 wrote to memory of 1052	4184	firefox.exe	91
PID 4184 wrote to memory of 4792	4184	firefox.exe	92
PID 4184 wrote to memory of 4792	4184	firefox.exe	92
PID 4184 wrote to memory of 4792	4184	firefox.exe	92
PID 4184 wrote to memory of 4792	4184	firefox.exe	92
PID 4184 wrote to memory of 3648	4184	firefox.exe	93
PID 4184 wrote to memory of 3648	4184	firefox.exe	93
PID 4184 wrote to memory of 3648	4184	firefox.exe	93
PID 4184 wrote to memory of 3648	4184	firefox.exe	93
PID 4184 wrote to memory of 1312	4184	firefox.exe	94
PID 4184 wrote to memory of 1312	4184	firefox.exe	94
PID 4184 wrote to memory of 1312	4184	firefox.exe	94
PID 4184 wrote to memory of 1312	4184	firefox.exe	94
PID 5616 wrote to memory of 2648	5616	Trinity.exe	109
PID 6116 wrote to memory of 1672	6116	Trinity.exe	113
PID 4348 wrote to memory of 112	4348	Trinity.exe	116
PID 5080 wrote to memory of 5128	5080	Trinity.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/TrinityEmulator/TrinityEmulator/releases/download/Trinity-Release/Trinity.zip"
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/TrinityEmulator/TrinityEmulator/releases/download/Trinity-Release/Trinity.zip
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {76888dcf-28c2-4022-bdbb-fc51c78ae86d} -parentPid 4184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4184" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {251ea5f8-e379-444e-90e0-d7c886c8ae60} -parentPid 4184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4184" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 25164 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {132830a6-321a-4c8a-99b4-a58875c7e133} -parentPid 4184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4184" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27276 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {39ad3dc2-3ed2-432f-a0e4-4fae5317235b} -parentPid 4184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4184" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2968 -prefsLen 34775 -prefMapHandle 2692 -prefMapSize 270279 -jsInitHandle 2824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2780 -initialChannelId {48088af7-24bd-423b-b59e-2ddc960eeb3a} -parentPid 4184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4184" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2800 -prefsLen 35012 -prefMapHandle 4884 -prefMapSize 270279 -ipcHandle 4912 -initialChannelId {909df3a1-bcd0-424f-b23e-372335f5677a} -parentPid 4184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4184" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5036 -prefsLen 32900 -prefMapHandle 5028 -prefMapSize 270279 -jsInitHandle 4928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5084 -initialChannelId {78318d38-e363-414d-8ad8-9c581daa2a0c} -parentPid 4184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4184" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5064 -prefsLen 32900 -prefMapHandle 5068 -prefMapSize 270279 -jsInitHandle 5072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5092 -initialChannelId {c3c17de8-84dc-47e1-9878-5c7a28603094} -parentPid 4184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4184" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32900 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {6b2270eb-b5a3-44ee-a84e-1cd301616bb4} -parentPid 4184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4184" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3712

C:\Users\Admin\Downloads\Trinity\Trinity.exe
"C:\Users\Admin\Downloads\Trinity\Trinity.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Users\Admin\Downloads\Trinity\x86_64-softmmu\qemu-system-x86_64.exe
  .\x86_64-softmmu\qemu-system-x86_64.exe -accel hax -cpu android64 -m 4096 -smp 4 -machine usb=on -device usb-kbd -device usb-tablet -boot menu=on -soundhw hda -net nic -net user,hostfwd=tcp::5555-:5555 -device direct-express-pci -display sdl -hda hda.img -cdrom android_x86_64.iso
  2⤵
  PID:2648

C:\Users\Admin\Downloads\Trinity\Trinity.exe
"C:\Users\Admin\Downloads\Trinity\Trinity.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Users\Admin\Downloads\Trinity\x86_64-softmmu\qemu-system-x86_64.exe
  .\x86_64-softmmu\qemu-system-x86_64.exe -accel hax -cpu android64 -m 4096 -smp 4 -machine usb=on -device usb-kbd -device usb-tablet -boot menu=on -soundhw hda -net nic -net user,hostfwd=tcp::5555-:5555 -device direct-express-pci -display sdl -hda hda.img -cdrom android_x86_64.iso
  2⤵
  PID:1672

C:\Users\Admin\Downloads\Trinity\Trinity.exe
"C:\Users\Admin\Downloads\Trinity\Trinity.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\Downloads\Trinity\x86_64-softmmu\qemu-system-x86_64.exe
  .\x86_64-softmmu\qemu-system-x86_64.exe -accel hax -cpu android64 -m 4096 -smp 4 -machine usb=on -device usb-kbd -device usb-tablet -boot menu=on -soundhw hda -net nic -net user,hostfwd=tcp::5555-:5555 -device direct-express-pci -display sdl -hda hda.img -cdrom android_x86_64.iso
  2⤵
  PID:112

C:\Users\Admin\Downloads\Trinity\Trinity.exe
"C:\Users\Admin\Downloads\Trinity\Trinity.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\Downloads\Trinity\x86_64-softmmu\qemu-system-x86_64.exe
  .\x86_64-softmmu\qemu-system-x86_64.exe -accel hax -cpu android64 -m 4096 -smp 4 -machine usb=on -device usb-kbd -device usb-tablet -boot menu=on -soundhw hda -net nic -net user,hostfwd=tcp::5555-:5555 -device direct-express-pci -display sdl -hda hda.img -cdrom android_x86_64.iso
  2⤵
  PID:5128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 51f48e60b13dd5a322d621f0739387484a85953d2278b7f7eb1599e41aecf605
MD5 5beca2976d4a7baf9a501740b15136ac
SHA1 dbaad4f009747edbd44a5964ed8aac103802f125
SHA512 ebebbdb19477d545b32c8b87000c8c601be3baafb6ac93b4166d16c99f0452b2afea9688f7b95248cd45a0b6af12ca9d058479acef4e937745a0b413bac40a15
SSDEEP 384:HwCe7iO024Yidcs3hk2nhfdDE2Ba/rIVy8ev5EU+75EU+F:QqZYidv3hk2nhfS2sDIVy8OB+7B+F
TLSH
T1E1728DBBCF506C5D1957E986C8A95369DD05FDBBCBF690B608243449CB84326B0FA0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 962ec2722c4070ad7d413d05e2fa070d4f25f1a29b033cdce392ef4b17f8ac58
MD5 534dd9d0e6e85ea3c34b4ef9d14cbb7d
SHA1 b31a59ed0e3f48690f49af218e96be8ff2f429c2
SHA512 aad88784f4401d3039aa1ae2e0749a4ff518a78cbfdcb7e7860c402adcdaccf5a8b497b9e6dc15a7ff03a10bad4640bffc95ae3baac241ff8879047aec16345c
SSDEEP 384:H9XghOiO024YIdcs3hk2nhfdDE2Ba/rIVy8ety90y9m:dX+ZYIdv3hk2nhfS2sDIVy8WvB
TLSH
T1AA729D7BDF116C1D1957D986C8AD8369DD05FDABCFF690A609203449CB8432AB0F60CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

691b5b9f-0e30-44a4-aca2-6d2b40c7c118.zip

Path C:\Users\Admin\AppData\Local\Temp\691b5b9f-0e30-44a4-aca2-6d2b40c7c118.zip
Size 3.7MB
SHA256 bc95998470d618938a0fe50570dbed499e4e6215b1edca8a6693192fe6632a81
MD5 522ec10a425d48b166d10444a5f97035
SHA1 65faa22b1cf5781051be57453db6de36407601d1
SHA512 58d22c8dac7f7163bcadbfb5cba368f912b1a9e076fca9192369e116846e7c59b5846044f867e7451895a4ce65ee30f90710791c9a4b721e1116846c70abdd4f
SSDEEP 49152:fwoQyV1AXPC/Tn2HVqo0Ssh3F2Z95OOlo36EiyHK1CgaESlsi/tpcuQtZcOCgLM8:IoQUUHz+f2ZnBQHK1VaEM/rK/LM45YU
TLSH
T13B06F135D25CD60ACDCF83BA810C2FC2C87C6F66A054A55BFEEA9571DCA32D21F54A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 8c4f764c1663483e6ba2a4c8d4d51c89f46ca44df3c5817ec7ca92d7090ba1c0
MD5 f8528e56c633a031a3abbbe831d4f1e3
SHA1 8e54af1f96a9ee255bc2fe2410600dd16ebc7125
SHA512 caa9d49e386d909f68dbf6eacce085dd6c32b8ff462f036f3afe0b6e7d562517fa2a4951427fd779f40d4884a922c14d64f62c957cf3e2f035adc218339e7e2a
TLSH
T110619658F2288A3EE044413ACC861F415F347456A8AF3F2A39ACA08D1E5B2CE77CD53D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 44fa558a9e19f4d9f0697167c66580a8be040a9b7d05f605286ae0eda113d9bf
MD5 9140a61d40b397ce182659adabe8fec4
SHA1 c1cd0918d729a7c18e4bcaf296e70185c98870f3
SHA512 7aba1ff05f2face8fbd729f29e02b50482651913f70c90c1b2c6416730eb95f2838d18557655847cc43fbfa6cb6ebf1232b9b711a337dd3005b8c684bc7cb3d4
SSDEEP 192:hOv5zboPtZVtyjiws1d66JozGzgCl6mc0d:+boFZVtyjCd66JozGzgC1j
TLSH
T1B7E1FB68E7288A3BC404037BCCA21F404F39399A984E3F29369D64182D576DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 730f94955bba5aa6322c48c60d0018b4c6a847d79cad0a8d49a73c9789bc1cf9
MD5 312b0427e03394e58dfa2c63412aaee6
SHA1 d6629d9a7f0fccf6814cb313bb48f9e299cb7bf0
SHA512 f4011cc05f1e7fa34a8dd6b21ea60cef5268a99c7c83320b2794bae1f9cd510c5c8d09c4f0eb40914b104e10e257219c64ace3c637a8b1a16457612b627d6d52
SSDEEP 384:pbogVtyjCd66JozGzgC1jGeq6CaETjZA8BiKGcmhucmfGsyq/K+svDSbtbj7:p9uEMeq6mBtGcmhucqHK+svDSbtbf
TLSH
T182D2E044FB6A953FD41412BBDCA50B002F79B88959192FA73A4C646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 e5f409f8aa3f493aa23aa6b40eb74887cc035183611f0ec2ac60f472da9a2c1e
MD5 6f2ded1374eaf8cb0cc719cc46a73abe
SHA1 17d7c53aa953212aec1993a61d6177b1dec2b03f
SHA512 4954f35ea9b93278e59df2fdd9e1c147edad9c8fa3e2cced89a9db276ff37e93d48d06a047e83fa79d2b6d3327ee658ac0ba2ed784d4707b45f411d97f7705a0
SSDEEP 384:Req6CaETjZA8BiKGcmhucmfGsyq/K+svDSbtbj7XbogVtyjCd66JozGzgC1jd:Req6mBtGcmhucqHK+svDSbtbfr9uE/
TLSH
T1FCD2E044FB6A953FD41412BBDCA50B002F79B88959192FA73A4C646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 6d95542401deca898750c6a6191a2d0a8bce1811acbf3128ea00109c18604c03
MD5 9a1e8ed0f95a33b1b0fb9e20a7cc4e87
SHA1 6dadbdaa9ac4937ee1f90c4c9aaf5b042a853b14
SHA512 97506896df2967fe1291eadfebdd937970919be6857be3f6e84d1d4650a17e41a87717a35fc47179a03f104d6c6cab53557a924e4b4dd11c0909065538c2b4e0
SSDEEP 768:cwnpCcplmQm6GcmhuchNFSMKshXtInZ3f0ynbYbsbubpbgblbubmbOAiQeBhRzkh:cwnpCcplmLNFSMTAiQeBhRzkAHPKcY
TLSH
T14123E044EB1A953FD86812BBDCA617003F38F8895A1A2F57375C64782C872DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c48b934850a844bea7cfa2de2282b0003d294ab3aa7e1d3eb4942a11fb11888f
MD5 50ef1dfc2912ea4091d38dabf112a91d
SHA1 1164b98139a85b37da0d94c0bfa3ea8d13e26563
SHA512 225a70b721a06094edf9235ad76773de32e495915809af3371ad75b7eed0c6cc66814ebf331cc0d634d4c228eed23a3c95053657cc8bdaa099cc279116c43b17
SSDEEP 192:h1d66JozGzgCl6mc0dVOv5zboPtbVtyjiwr:fd66JozGzgC1j8boFbVtyjv
TLSH
T17AE1FC68E7288A3BC404037BCCA21F410F39799A9C4E7F29369D64082D5B6DE76CE17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 56d2726df8e53e646da503d3d09ec0adbf9cf891cc9aa64af9d0d2437d39eabd
MD5 7b1c1920555e2d7be7969bc4072fb801
SHA1 3d170360f94fe15fcd1887fedf2998ef4a51f6b3
SHA512 71924409f7aad61482f1dc8b04c4671ed9c1655ee1f02b39d9a47439216d781e2ef9fa2899c725572aec2f0fd2752d5efb831ffeb91b70fc73b8a7bfb3f21362
SSDEEP 192:8Ov5zboPtMVtyjiws1d66JozGzgCl6mc0dz:/boFMVtyjCd66JozGzgC1jd
TLSH
T1C6E10C68E7288A3BC404437BCCA21F404F39399AD84E3F29369D64182D576DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 bc1f43bd94eda63c3dd0fdc490a080084de390c9fa5da04a3dd4462359a2a1fb
MD5 6ce9649eaafc8df196e33a1081d95569
SHA1 677548cbda29c6247cfb11c3de68ae825e21e085
SHA512 e12e4d065b1132e65d756dd5de1bdff6ff5475c0175d85c6bed974245ba808c01f890c3b1b81e2833eec371f1c6a8f4bfefba7aca3e9622753c44d76b94d7513
SSDEEP 192:YOv5zboFbVtyjiws1d66JozGzgCl6mc0d:jboFbVtyjCd66JozGzgC1j
TLSH
T1E9E1FD68E7288A3BC404437BCCA21F404F39799AD84E3F29369D64082D576DE76CE17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d8c4daa327b917f9b990bddc3ca4eb784e6f4793f435d3281b5a621c10c4bfd9
MD5 9f0efbe31f8b254132bf900961231dfa
SHA1 282e591d9ef8aea2958afeeef7edd6bb53554bd1
SHA512 cbfdcaadb5583c9edf1a582e3f8a025f0db6655aa6ae529ef832b5d6b02363ef9f301a87dec1e4651a9e5cdb0a0a8c2b3a66db00da42411e1ee0699fc534f303
TLSH
T133213D5C39B84DEA58C7E29CB441128E97558E0749472C434D12FE8DCEA1EDD326E479
MD5 SHA1 SHA512 TLSH

Submit Download

2280853b-2384-428f-8123-d9090bfc5ac6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\2280853b-2384-428f-8123-d9090bfc5ac6
Size 2KB
SHA256 62c966a58ed48c325825fdf7082eebdcd2a70e5f160ca851d62960edeadab2cc
MD5 99293c94fc62349644a7b4c8bb115d91
SHA1 4ad8d5b0ef245dd22aace07babe752846a39e671
SHA512 ed4663c65432d58cc6653459268f4b4f3ae7445361d0dba7149876b4c32e82dd3bc9f9953752d9397ac5a321b9d4134c540fd47221831ed93183466271b2b17d
TLSH
T15141156C35785D765DAAF59DD8C1334D57A0CA0300C51C837E52EE0DCC96A9D236B52A
MD5 SHA1 SHA512 TLSH

Submit Download

53e6a04c-ef61-49c9-b3a4-05eb8cb99e23

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\53e6a04c-ef61-49c9-b3a4-05eb8cb99e23
Size 235B
SHA256 93cf9de15d649e44e498a47fda9cd4f962c82b55e7891785c57af93e1191c4d3
MD5 f24f98ddd5f43361e27585b04ac39097
SHA1 cfb64881af366e7a70935d98d21a007ef1664456
SHA512 0f537d3cccaf6e0d1553887b66caddb2e6c904daa436f92a25aa66835bf125d2e3611de42c0ed8e0c41ca95b1297d3cf4fde053048bffa82343c59678abff6be
TLSH
T18CD0979414AC27DD49100F16B0B16AC6304B8C3720605810AA6104349ABD9D453B2836
MD5 SHA1 SHA512 TLSH

Submit Download

5847ec49-8afa-4c2c-b87b-4558915e580b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\5847ec49-8afa-4c2c-b87b-4558915e580b
Size 15KB
SHA256 10c79e78774213cd6bdbf355c186f120dfab7bcf7a501fc4e31c353c4d4b0d40
MD5 6a9821325a2f8656d9e60066bae645d7
SHA1 84d8971bcc16e0d6449ce94feed63d978f41dbb5
SHA512 2e98311ff18b97e1a0f3588c7ec7e5daf34b0a4c8c82b566bb62df6f48aeebd92fc0041688f5ecac88997fe38d68582b589e66dbc147fb0f73ad4eb221af9a51
SSDEEP 192:Igf61gXbNh64uNVe70cbts2wNZqXB/5zZc5UXLWzTMBlCnMzbRR7Mb6aEcd2gog/:U1gLNhtuN7jO6MBBPRR7Mb6md2go85q2
TLSH
T1AD72C8166860457A8251E369D8F8BFC3E6F628CB4C019FCA9BE4BD085DDB06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66387fc6-f96e-4e09-a7dc-9d5deb47d7ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\66387fc6-f96e-4e09-a7dc-9d5deb47d7ae
Size 883B
SHA256 e96d7bfa36af0e6f03b54b83f80a2c41cf5092786e99ec5bef1ff3243658e300
MD5 b0aebf3be3fb5243e88c3e3c1919b823
SHA1 f5acbd7f4691eaeb629d4e43e8c499be144c29ca
SHA512 5512fb94e886c4e5d224cb2e490ad3863961e5d92e774c59854e60b0769b4571c33da30b1760d600943f1f02a91cee1b03cfcab64b29a9ade4cd483f68e04aab
TLSH
T1B21127515774BD72CC78D21BC9513B415FE4BA7380C594147FA14E140D7A91B93DB20B
MD5 SHA1 SHA512 TLSH

Submit Download

b23207c4-3b9f-4824-99fe-cdc516359492

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\b23207c4-3b9f-4824-99fe-cdc516359492
Size 886B
SHA256 b880c6138dc35ce890eabc584907e8fb2d9c50dc40eedc7ae07d306a641e15ac
MD5 2280c059c74aa8257e9a52be14f0d3c0
SHA1 306c69dfc5feb986e91fd5d24e27ccc2a71a1493
SHA512 bff1b0b8a81ea273faaa31583e6bf3e6db1a2addf37a40d531fd6d2130e48d3248414880d9f3f75bd24ed7b909fd532c86f442a540e34b628b0d6e78bc074480
TLSH
T1DD11005047B8FDB28868D24BC9A177028FE8B623C0C558143EA51B280DBB51F93ABB07
MD5 SHA1 SHA512 TLSH

Submit Download

cb25a2f0-4142-48a3-8ecc-6ea5d6d8766a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\cb25a2f0-4142-48a3-8ecc-6ea5d6d8766a
Size 235B
SHA256 b982b809f483c56f9ebb8cf4a49379465fe441130c255c854aa2da939e3ad6a5
MD5 9183a4a2e7328584fb7acf0bd73d323b
SHA1 0e16eaff4e3f1b2341432f2e30785aad873374a1
SHA512 575db93dafff32073557fbd14ad356247cb744a50cabfa8e043b0404075c8156585ef7abd6f7b2b445e23f8d98948fa693928a089f4b26ce9ea0abbc3d06c61f
TLSH
T142D0238128C86B7C48180F07F0F02CC330484C3BA878D810DA710838CAFDFC44112A27
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json.tmp
Size 16KB
SHA256 2521acb812dd822239ace13857c9bd5644113fb862821d707f47d7d12435739a
MD5 57ff1a1daf52ea1740e8d5858f24d05a
SHA1 edf9ba874877787b19c1e89bad177ac9683977b7
SHA512 eb04a4d9dd86d478610eaa44a4e7f1257412a69680a9e71659ac167467a0aee4cbed2189501237fb64005a45c4f327660e3ed1491b2965202fbf70f1d2526187
SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4HzJ4hI:mI4dRfFXQ4d614d4D4J4+4V4+
TLSH
T1F672521545049EB8298E979AAA367E02C37D473B70845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 12KB
SHA256 be98055a8a46e4dcc010ba8ce8d2e30994c61615fdf1e4656c21249438aa2f85
MD5 18ee8ff1e41f1539c92e41b313534af3
SHA1 db6db371b920f44764ba189e6f4aac159416faec
SHA512 72152d5548646f64aec93c9b807ca873905430981f7725780ae67af2e106cee29548eb1596f512d3e48620d076071fcd69f38d027e0dc45747b8729efae8a4ae
SSDEEP 192:VfACRZWfp1k6KSS2WLREfOmOBw8OC7aH5Lca:mQR4O5wyWwa
TLSH
T1C942D03C61448FBF24B232BD6C255970196142377ABFBCD705FD9882085CF2941E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 7KB
SHA256 34a3421e37a4ba498e364f29e12e835e1bbe8588cb2f36c2eb927be71b9b2e62
MD5 6d43d5e7dfb59d3b706873397127f509
SHA1 fc268cfe103f8bf539e48db590b4f19b012a0d36
SHA512 f0cdee58e105ef5b3e38a296079d3479b565c4b5c7f6080fabc76e40096b3da3047de0f6d9b10205ca5456832f5023966e6e0e04dc79c1e6f5b2ef31388b308e
SSDEEP 96:xH4fZTUOCPqGqsWfpeSbIObzS4KSSladv9j3rnIHehBw88Swq8L4cnTDSx:mfACRsWfp1k6KSS2qehBw88va
TLSH
T1FCF1107CA154CFBF75B6376CAC2489315AB2023B7ABF68D610B95484051CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 9KB
SHA256 e75c0a47ec54a5907cb92f49d25cd8921185a8dfb1b99a2d609f04b0bccd4513
MD5 cd9f514d436a47885d26549a4d2dfc33
SHA1 cfade61d7b06367e96b43e4f97305a2d465abe3c
SHA512 dd2864b4017d69b7f060e9b0008de7f22b2a646d5d7b5c47a0cc3390bd8597028352dc00ee7d2a25f9a8e4692e8543eb8e4b94a45f7f336ebf6588790601ea1d
SSDEEP 96:xHTfZTUOCPqGqsWfpeSbIObzS4KSSladv9j3rnIWRtKP3OvKjBw88L66hvw8L4c+:VfACRsWfp1k6KSS2/REfOqBw883hvba
TLSH
T10312F03C6144CFBF65B6367CAC2489715AA202377ABF78D310B95885055CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 b9bc841da367aaf62562f2831d38a4815fd6f3da405919dc468a792ff3dc9190
MD5 56392fdcf9050013fd0436792132307b
SHA1 5f5fb0a0a24cab337109e9f33deaa9213a0c2930
SHA512 28c5fe72e90b0f6341449cb4e11fa3c5851e9932ea936fb813195430cb740481dfa91f61a96a3156417d86d3259b65165f119e778f76279411d2961ab6404e5c
SSDEEP 96:xH4fUTUOPqGqsWf24P1zSiSSladv9jInIHeABw88n8L4cnTDEx:mf5RsWf24PXSSGeABw88qY
TLSH
T123E12F7895188F6F74B677ACAC6888316AB2413B7BBF68D710B954C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 7KB
SHA256 338577943292b45ad0f20017c2e1a58eab95b4480c0af7e6c482dce833aea4ff
MD5 01e8e70feada583c9a4109a421043267
SHA1 794053fb62c63644ec16d9e88a79c52110b64564
SHA512 ab008e6bbd481841ff2a03fcc6ea0c057ad8044155cfe806d14d7c8cfd2abf8f835bf70327eb1ba0ab23dd2a631693b85b036bd8ff3fe53c58d3daec72c4dbb2
SSDEEP 96:xH4fZTUOCPqGqsWf2eSbIObzS4KSSladv9j3rnIHeABw88E8L4cnTDEx:mfACRsWf21k6KSS2qeABw883Y
TLSH
T1F9F10E7CA154CF6F74B6776CAC2488316AB2413B7ABF68D610B95484011CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 620f00a257416e96445eee5104453dee9fff2f24dd81a85393c10c077d046e78
MD5 57d8fc1cbb9d3d7e0daf075bad744357
SHA1 55e48a372e92c5ecb1f35846dc8751ed0682320b
SHA512 77d7ace638a78d99fc0e7a305dd5d9d483dcb06dcca53466d5e84df5a1427c1b02f22ef09e5a30c45671ad7b430f60f1e01c70c4de56bbbf60788a4bd6981fca
SSDEEP 96:xH4fUTUOCPqGqsWf2eSbI1zS4KSSladv9jInIHeABw88n8L4cnTDEx:mfhCRsWf21kVKSSGeABw88qY
TLSH
T1D5E130789518CF6F74B677ACAC6888316AB2413B7BBF68D710B95484011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 74958bbf15f0ce4136854714607af89513e0c1afb438b82dc5b97c9cb64016a4
MD5 d0c15db90bf6f34714f3246965123140
SHA1 a8fd78008eae2ad6df8e0ad1fe293ef134fbfed8
SHA512 0fb6bb1e08902ba4aef199e33ca8e32916388fa99d0b2688e0b78632f8110213d1656999fba0024888ab7e48a24b499b3aa66a8278a9bed70934d59d2f193af9
TLSH
T19B21FB839BA31DF8BD33916ADCC887F5C55A31254871BCB091999C15627990A7F8B109
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 15.3MB
SHA256 4dd6b108b931a76880b950d37f5d7a4158d67375724d19277c623ee68faa50c6
MD5 40c87eb793b4d5af65b10d517abe0e38
SHA1 ccd1d9c6e935a079d7bec6190fa2558d9e58c9bb
SHA512 94792f42bec55a953c3f59ae97fdb7ef9e65759d54956a274e6841089b6acae2e69b168c602a2bf4f2cbd07b80169447b6f3755036e11cb56d4bf23f10a2be09
SSDEEP 49152:BYYgsuE15lUb2bNpnO/Qw0/3+UYYjgI62yIgcQbDP4KbtUIY3/K8VUH57I21rIa4:6Y9uE156b2znO/rI6WgcQRUPV
TLSH
T175F66C9271E0DA92EE0146B6F31F43DB313FC1CC24E689941A78BA5C585329BEE6F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 15.3MB
SHA256 234c0f3b4d187a75613fe109d0dcfafeb4348063a4a15e33ebbd34c74f86dce9
MD5 1d7f7c9d4dccad0e1969867780df5313
SHA1 5791c80f1b794fe2680ea431a10593e3c9b531d1
SHA512 b522646d8c648d1d72b35ac8c5291de8be2fd66ffe2c67537ec1eda157acfb9ff127af0e4b2b5088b9b0d20d4979ef420ba14114ac1cc049f89fbb5233ebf319
SSDEEP 49152:hBEyx/Y1qkORsPbSSw0/3+JjYjgn62yIgcQbDF4KbtUIY3/K8VUH57I21rIa9mtv:7EyK1qkORsPbet6WgcQLUPV
TLSH
T1E7F65C9270E0DB92EE0146B6B31F43DB313FC1DC24E689941A78BA5C585329BEE6F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 15.3MB
SHA256 1f06bd4f9dc40b2089cdf6de88122941fc47970d1e27131d8643ddd488126724
MD5 674dc506c52076b749dc665e444e7002
SHA1 3852c4e7a3020c028a55cf4a01a9dd6882842c77
SHA512 a96b1ce0e1310ed0443bbf1be6341e3e3145bba2c7a892cd252e51310b2522a57e0db7b4727756e90a2da11f4fe1be38f4cbf36d3cbebffe59d108da3bcee79d
SSDEEP 49152:HBVfx/Y1CkjRsPbSqw0/3+JjYjgn62yIgcQbDF4KbtUIY3/K8VUH57I21rIa9mtv:hVfK1CkjRsPb+t6WgcQLUPV
TLSH
T1A5F66C9271E0DA92EE0146B6F31F43DB313FC1CC24E689941A78BA5C585329BEE6F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/112-8520-0x000000006CB80000-0x000000006CBAA000-memory.dmp

Download

memory/112-8523-0x000000006C740000-0x000000006C82C000-memory.dmp

Download

memory/112-8515-0x0000000064940000-0x0000000064956000-memory.dmp

Download

memory/112-8516-0x00007FF8DC8C0000-0x00007FF8DC912000-memory.dmp

Download

memory/112-8517-0x00000000649C0000-0x0000000064AFA000-memory.dmp

Download

memory/112-8519-0x0000000065580000-0x0000000065631000-memory.dmp

Download

memory/112-8512-0x00000000626C0000-0x00000000626DA000-memory.dmp

Download

memory/112-8521-0x0000000063500000-0x00000000635AF000-memory.dmp

Download

memory/112-8522-0x0000000068B40000-0x0000000068B80000-memory.dmp

Download

memory/112-8514-0x0000000061440000-0x000000006145C000-memory.dmp

Download

memory/112-8524-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Download

memory/112-8525-0x0000000064D80000-0x0000000064E3B000-memory.dmp

Download

memory/112-8526-0x0000000069140000-0x000000006918D000-memory.dmp

Download

memory/112-8527-0x0000000071040000-0x0000000071051000-memory.dmp

Download

memory/112-8528-0x0000000063940000-0x0000000063951000-memory.dmp

Download

memory/112-8529-0x0000000000DD0000-0x0000000000F5A000-memory.dmp

Download

memory/112-8518-0x0000000067F00000-0x0000000067F52000-memory.dmp

Download

memory/112-8507-0x0000000000DD0000-0x0000000000F5A000-memory.dmp

Download

memory/1672-8494-0x0000000068B40000-0x0000000068B80000-memory.dmp

Download

memory/1672-8492-0x000000006CB80000-0x000000006CBAA000-memory.dmp

Download

memory/1672-8482-0x00000000001D0000-0x00000000001F8000-memory.dmp

Download

memory/1672-8503-0x00000000001D0000-0x00000000001F8000-memory.dmp

Download

memory/1672-8505-0x0000000066000000-0x000000006610C000-memory.dmp

Download

memory/1672-8484-0x0000000140000000-0x00000001430EC000-memory.dmp

Download

memory/1672-8485-0x00000000626C0000-0x00000000626DA000-memory.dmp

Download

memory/1672-8486-0x0000000061A00000-0x0000000061ED3000-memory.dmp

Download

memory/1672-8487-0x0000000061440000-0x000000006145C000-memory.dmp

Download

memory/1672-8488-0x00000000649C0000-0x0000000064AFA000-memory.dmp

Download

memory/1672-8502-0x0000000000AD0000-0x0000000000C5A000-memory.dmp

Download

memory/1672-8489-0x00007FF8DC8C0000-0x00007FF8DC912000-memory.dmp

Download

memory/1672-8490-0x0000000067F00000-0x0000000067F52000-memory.dmp

Download

memory/1672-8480-0x0000000000AD0000-0x0000000000C5A000-memory.dmp

Download

memory/1672-8493-0x0000000063500000-0x00000000635AF000-memory.dmp

Download

memory/1672-8495-0x0000000064940000-0x0000000064956000-memory.dmp

Download

memory/1672-8496-0x000000006C740000-0x000000006C82C000-memory.dmp

Download

memory/1672-8501-0x0000000063940000-0x0000000063951000-memory.dmp

Download

memory/1672-8500-0x0000000071040000-0x0000000071051000-memory.dmp

Download

memory/1672-8499-0x0000000069140000-0x000000006918D000-memory.dmp

Download

memory/1672-8497-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Download

memory/2648-8470-0x0000000064D80000-0x0000000064E3B000-memory.dmp

Download

memory/2648-8476-0x0000000066C40000-0x0000000066C4F000-memory.dmp

Download

memory/2648-8467-0x0000000068B40000-0x0000000068B80000-memory.dmp

Download

memory/2648-8456-0x0000000140000000-0x00000001430EC000-memory.dmp

Download

memory/2648-8457-0x00000000626C0000-0x00000000626DA000-memory.dmp

Download

memory/2648-8459-0x0000000061440000-0x000000006145C000-memory.dmp

Download

memory/2648-8460-0x00007FF8CFF60000-0x00007FF8CFFB2000-memory.dmp

Download

memory/2648-8462-0x0000000067F00000-0x0000000067F52000-memory.dmp

Download

memory/2648-8463-0x0000000065580000-0x0000000065631000-memory.dmp

Download

memory/2648-8464-0x000000006CB80000-0x000000006CBAA000-memory.dmp

Download

memory/2648-8465-0x0000000064940000-0x0000000064956000-memory.dmp

Download

memory/2648-8466-0x0000000063500000-0x00000000635AF000-memory.dmp

Download

memory/2648-8468-0x000000006C740000-0x000000006C82C000-memory.dmp

Download

memory/2648-8469-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Download

memory/2648-8449-0x0000000000BB0000-0x0000000000D3A000-memory.dmp

Download

memory/2648-8452-0x00000000001A0000-0x00000000001C8000-memory.dmp

Download

memory/2648-8478-0x00000000649C0000-0x0000000064AFA000-memory.dmp

Download

memory/2648-8473-0x0000000063940000-0x0000000063951000-memory.dmp

Download

memory/2648-8474-0x0000000000BB0000-0x0000000000D3A000-memory.dmp

Download

memory/2648-8475-0x00000000001A0000-0x00000000001C8000-memory.dmp

Download

memory/2648-8471-0x0000000069140000-0x000000006918D000-memory.dmp

Download

memory/2648-8477-0x0000000066000000-0x000000006610C000-memory.dmp

Download

memory/2648-8472-0x0000000071040000-0x0000000071051000-memory.dmp

Download

memory/2648-8458-0x0000000061A00000-0x0000000061ED3000-memory.dmp

Download

memory/2648-8455-0x00000000649C0000-0x0000000064AFA000-memory.dmp

Download

memory/2648-8453-0x0000000064AF3000-0x0000000064AF5000-memory.dmp

Download

memory/2648-8454-0x00000000649C0000-0x0000000064AFA000-memory.dmp

Download

memory/5616-8479-0x00007FF6DF360000-0x00007FF6DF3B6000-memory.dmp

Download

memory/5616-8448-0x00007FF6DF372000-0x00007FF6DF373000-memory.dmp

Download

memory/6116-8506-0x00007FF6DF360000-0x00007FF6DF3B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads