Analysis

  • user interaction
    yes
  • max time kernel
    914s
  • max time network
    917s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 00:59

General

  • Target
    Soundpad.exe
  • Size 10.9MB
  • Sample260722-bcferabq8y
  • SHA256 ed3371229647ef876b45cb5940e48b461df58d4e68ad4932f5877eba90c8d379
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 3 IoCs
  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 3 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:612
    • C:\Users\Admin\AppData\Local\Temp\Soundpad.exe
      "C:\Users\Admin\AppData\Local\Temp\Soundpad.exe"
      1⤵
        PID:5584
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:5684
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe"
          2⤵
          • Drops desktop.ini file(s)
          • Checks processor information in registry
          • Modifies registry class
          • NTFS ADS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1192
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27098 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {1e4cf266-c00b-4079-ab70-84606351bb84} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            3⤵
              PID:3156
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27134 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {bafb3584-d76b-4cca-9d8f-7d580079b329} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
              3⤵
                PID:3400
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27274 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {1b78d8b6-8d42-4ad8-8d21-c555141e747b} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                3⤵
                • Checks processor information in registry
                PID:932
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27274 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4040 -initialChannelId {b3ba3f1a-cf55-483b-9cfc-c25ec8aa985d} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                3⤵
                  PID:4620
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4444 -prefsLen 34773 -prefMapHandle 4448 -prefMapSize 270279 -jsInitHandle 4452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4460 -initialChannelId {717b2d37-86f1-4ac2-ac63-5c3e004398bc} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  3⤵
                  • Checks processor information in registry
                  PID:5428
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4920 -prefsLen 35010 -prefMapHandle 4936 -prefMapSize 270279 -ipcHandle 4988 -initialChannelId {e54eb353-6db9-4f7f-9bdf-6077e5dac5e3} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                  3⤵
                  • Checks processor information in registry
                  PID:240
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5452 -prefsLen 32952 -prefMapHandle 5456 -prefMapSize 270279 -jsInitHandle 5460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5412 -initialChannelId {5fbdbb36-750d-44a2-b8b1-36933f8fa30a} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                  3⤵
                  • Checks processor information in registry
                  PID:3128
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32952 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {9c5f2967-ad38-4dd3-9e2d-98110eca2720} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                  3⤵
                  • Checks processor information in registry
                  PID:3324
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3348 -prefsLen 32952 -prefMapHandle 5768 -prefMapSize 270279 -jsInitHandle 5772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5780 -initialChannelId {4fd22367-f9c0-45f5-8149-8a64891e15ca} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                  3⤵
                  • Checks processor information in registry
                  PID:1104
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6628 -prefsLen 33071 -prefMapHandle 6632 -prefMapSize 270279 -jsInitHandle 6636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6640 -initialChannelId {4a27186c-daa1-435a-be2c-bf382289d43d} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                  3⤵
                  • Checks processor information in registry
                  PID:5768
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5984 -prefsLen 33071 -prefMapHandle 6356 -prefMapSize 270279 -jsInitHandle 6484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4724 -initialChannelId {003251cd-4721-4669-96e2-d4a8eb08d50d} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
                  3⤵
                  • Checks processor information in registry
                  PID:5136
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5688 -prefsLen 33071 -prefMapHandle 5704 -prefMapSize 270279 -jsInitHandle 5700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {75df829e-cad7-47ef-a258-48eeb9facffe} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
                  3⤵
                  • Checks processor information in registry
                  PID:2764
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:2996
              • C:\Windows\System32\SecurityHealthHost.exe
                \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                1⤵
                  PID:4104
                • C:\Windows\System32\rundll32.exe
                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                  1⤵
                    PID:2384
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                    1⤵
                      PID:5388

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          activity-stream.contile.json

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\activity-stream.contile.json
                          • Size 5KB
                          • SHA256 3fb80e446dcd1784a29e6e81ce41a8521d8c7f8f08ff02e77a1b688f4440b4ac
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          08C61CBE63F90DA32A52689DB898F704E6AA0645

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\08C61CBE63F90DA32A52689DB898F704E6AA0645
                          • Size 131KB
                          • SHA256 09d243dec5440eb578ec88f2701503bf50ad9bdf54449121780007db44b268c3
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          09CF0BB71BF4AC8343AEBA632ACC83395AD3AB2E

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\09CF0BB71BF4AC8343AEBA632ACC83395AD3AB2E
                          • Size 95KB
                          • SHA256 257170c91a729c3014bc6e2162f63ef576ff8096b14682654e6a04d7e710143d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          0BC0A9EFBA39EA25D0E6D6BFF2FE613A1D7B4B55

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\0BC0A9EFBA39EA25D0E6D6BFF2FE613A1D7B4B55
                          • Size 131KB
                          • SHA256 51f2276f7706afb6ca540d9957e05819fdeec0fa8ce6303c1280a38ac9668268
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          116F7BB9EC0299CF47A2E033A295DE26BEE683BE

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\116F7BB9EC0299CF47A2E033A295DE26BEE683BE
                          • Size 77KB
                          • SHA256 578843a527d296efe3ae0a642d4494d37aa3bcaf7974096a2aae897570f3c90d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          1D054B5C163DB29F232E67B87856D9202A904BEB

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\1D054B5C163DB29F232E67B87856D9202A904BEB
                          • Size 28KB
                          • SHA256 ec5fe152ad843c88e4bfc0e1a27205307a684b1ec1d8e493109e10a8495ff9c0
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          21C56CD6878278EB71D205753DA4D36054824CCC

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\21C56CD6878278EB71D205753DA4D36054824CCC
                          • Size 17KB
                          • SHA256 a41f63a20e92a49ca703e4e5609e4354bbc2f2a04e1af3e7f63663738416baf3
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          28B8EECE82D538A0828A37925F806DF0772FFF4A

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\28B8EECE82D538A0828A37925F806DF0772FFF4A
                          • Size 98KB
                          • SHA256 e22589eea8299b7d32a16f4b6591bda9809627aecc3ce4ffc928fcc5a567fb2a
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          3044D4ED18E412C7839C15CE4381787456A36774

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\3044D4ED18E412C7839C15CE4381787456A36774
                          • Size 356KB
                          • SHA256 ee8d1a1ac82dd6f6d6b074339540d5fb6d6e7bb5e7ecb5a871477c3099d56ba6
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          30629C8B739FD37D9EC2C384EB33250CB2D319B7

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\30629C8B739FD37D9EC2C384EB33250CB2D319B7
                          • Size 35KB
                          • SHA256 e01bff3fedf474d5a8135c18e462105c387857870186307461f469a3b504fe3d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          3C4005C00D89BDE4D43BEBA1EBD02F66AE4D7DF5

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\3C4005C00D89BDE4D43BEBA1EBD02F66AE4D7DF5
                          • Size 229KB
                          • SHA256 5b4139af6d4fdc76e5d23143885d1881db66280379bd101663c7511a1ad45a9e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          45991DBEED3F80D011EC3D451135E4DD070A199F

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\45991DBEED3F80D011EC3D451135E4DD070A199F
                          • Size 17KB
                          • SHA256 408dda0a4e291b200da9ed229ff2b3e8cd87add503e671c94b67e1e50c195188
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          4A704E72D44E1FF4625F6E47B1421CD7696EE817

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\4A704E72D44E1FF4625F6E47B1421CD7696EE817
                          • Size 14KB
                          • SHA256 9f26d0480548bf22affcae9cfe3fd69ba84c8f76743a09a2d3a1a606a1477762
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          4C7CEC42EA4639B6274B36118897DB2653FEDDF2

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\4C7CEC42EA4639B6274B36118897DB2653FEDDF2
                          • Size 215KB
                          • SHA256 cc20cb177477ee59f328ddbc79cbb51468050f829860c633b364cc0ee4d6a4c4
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                          • Size 15KB
                          • SHA256 236758884cf4787a6e911a78bec6b570c5d8a6c171f680655c241eb794b19ff6
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          4F53BBBBF538AA37B7A620C43EAFDBD7F8BE7EE0

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\4F53BBBBF538AA37B7A620C43EAFDBD7F8BE7EE0
                          • Size 962KB
                          • SHA256 54f6df24704c73bf52e696ae104c2e66e50d986aa500c251e15e383d4c0b1523
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          54734A0BB1899E02EDFA3436455D4F33D678D8A1

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\54734A0BB1899E02EDFA3436455D4F33D678D8A1
                          • Size 167KB
                          • SHA256 0dde8f18445eec340ac929625f3c0b890d035f8c134d014b89cf4f547b43abf5
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          570A16D3C1F3D9659599D906FB19F0DFA407AF39

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\570A16D3C1F3D9659599D906FB19F0DFA407AF39
                          • Size 36KB
                          • SHA256 4927b10c99e034fd5603fdf25172245d341b5bda0c14d31f59e7c5e29ab149e4
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          58A1FC62BACC03F5856928FED9A5A904D8E01B58

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\58A1FC62BACC03F5856928FED9A5A904D8E01B58
                          • Size 92KB
                          • SHA256 0eac67dd695ad384e940a24ab9a9cb0f013b11965a939af2a446379c8b64959d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          5B520C28FDD78FD7104C73FFAE787ACEA26C09EE

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\5B520C28FDD78FD7104C73FFAE787ACEA26C09EE
                          • Size 15KB
                          • SHA256 a2094434e72d2edb61f7b8e403bf58cc0b8189142641e1ebc58ecf25ea1c5fe1
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          6089EBF8EADB4769E10DF565AB73C665F0615A6C

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\6089EBF8EADB4769E10DF565AB73C665F0615A6C
                          • Size 41KB
                          • SHA256 f47938c5094e8347f81fc8a72794feb964ae1227bf12454b75ba9328bda791b1
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          65AA3E9C9AFB7EEA66D0AFB970CE52658F9BB801

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\65AA3E9C9AFB7EEA66D0AFB970CE52658F9BB801
                          • Size 2.3MB
                          • SHA256 613c5fff7744a81de449db29d424f6bf9bd56565141ec7d1ab9cd7380f3e82ca
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          76387B22E72A7B09AFE2B6F75FAA5E92A32F33F4

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\76387B22E72A7B09AFE2B6F75FAA5E92A32F33F4
                          • Size 63KB
                          • SHA256 4714127a25f16841e55f1f8668d8b2b44d1b87f1e7d22b76309d62c6b0a3c72b
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          7BCE86457993E6E91BC5835759FA354CE7F56840

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\7BCE86457993E6E91BC5835759FA354CE7F56840
                          • Size 87KB
                          • SHA256 7e1b9ae8b44bd7327ea219776985808e5f69e4f77401f2707522f70236f870a1
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          7C394EF86DA02802B62BBDE584B08CC966ED4818

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\7C394EF86DA02802B62BBDE584B08CC966ED4818
                          • Size 16KB
                          • SHA256 02e99c5a26c488af09afd346216ed1f48519ebb079c01d949ed1a69a6f8e8062
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          7C6BC379887F3D6F48646FED66483DF8530E27A1

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\7C6BC379887F3D6F48646FED66483DF8530E27A1
                          • Size 15KB
                          • SHA256 78ceffcdf138bab5aac1c541466914402e9eeb124e6fed1fdb6386bc2e64c687
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          9512A4488B00CC053350DAC32D417B4A35C11513

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
                          • Size 15KB
                          • SHA256 273c6802ee15ad013ee0bafe5088a389a026daee86ad5cea653edbc045525b0e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          9AC3C952C628E60854887024F5676D96DF26D5B4

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\9AC3C952C628E60854887024F5676D96DF26D5B4
                          • Size 88KB
                          • SHA256 746e92934e6ea1e9947173531d20440d93dd2cc914475e20e1b55a511bb2db71
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          9C526699EE73F4C3FCFBCD35D4E4AE160E049FEA

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\9C526699EE73F4C3FCFBCD35D4E4AE160E049FEA
                          • Size 16KB
                          • SHA256 bc88149ddff7f08fd7eca71f20de9e49c5871c6c459673c9d71d40f5c4087d5e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          9D82FAD92F808D05606EF29331063114B08C6B96

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\9D82FAD92F808D05606EF29331063114B08C6B96
                          • Size 24KB
                          • SHA256 9df8c90325a374468c6ae756fee82a730143de0aedb35adf07c5248302f5111f
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          9FE6D5B36A200326497477DAE4123AC9AFCEE31B

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\9FE6D5B36A200326497477DAE4123AC9AFCEE31B
                          • Size 1.2MB
                          • SHA256 861673c3c4b4c9851c57130ec1263d7accd1c8af72a9c5abcf1b0fb53fe4e9c3
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          A6C74BC2260EAFF823C7AED38BBA607C962CCB55

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\A6C74BC2260EAFF823C7AED38BBA607C962CCB55
                          • Size 38KB
                          • SHA256 3416f66f4473e393cc659e469cd1d85b7156389e19f9ccdd199022de34533dad
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          A8269637CAB8EAD4040FE3A178ABA7C5BB7A9E3A

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\A8269637CAB8EAD4040FE3A178ABA7C5BB7A9E3A
                          • Size 306KB
                          • SHA256 6cee10246fecb3ecf6302cacaecc5b3577515a36c0a34a74af626c9118ccd23e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          B6B4DAE3940D32F843237BF177F4D8424A59F3B2

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\B6B4DAE3940D32F843237BF177F4D8424A59F3B2
                          • Size 18KB
                          • SHA256 8029baa5353c84ddc946200b1f53af6896ff1682e62c268116115dfbc52fc8e8
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          B832A4F71ABB6A674E4E949D149A35A218996D11

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\B832A4F71ABB6A674E4E949D149A35A218996D11
                          • Size 15KB
                          • SHA256 99dc9479637f019d468ded070c7bedce3472fa8d947474375b979cac72c563f0
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          C5F9E61B68369C07B406C662AF6B84EF202132EF

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\C5F9E61B68369C07B406C662AF6B84EF202132EF
                          • Size 98KB
                          • SHA256 dca2b38c3a6b4b386be0b4c0633d1c64e2fd2e694799b2a709bb687e034a206e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          CA7DBD1087C86DD5E5D14B96907A8F5820711C0F

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\CA7DBD1087C86DD5E5D14B96907A8F5820711C0F
                          • Size 61KB
                          • SHA256 83753758cf2e5298baa6b9c27fc80390e199e6cfec5959e1a17985b2912e5602
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          CDECCA5729E5911D983487B9F6495BE646BADD79

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\CDECCA5729E5911D983487B9F6495BE646BADD79
                          • Size 36KB
                          • SHA256 f99249bd0e8cf8e3c611bee101ad945483eac94bba49a382e92931e2985a4d2c
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          E2ECA89E3AC59FEDA845EA719B552B174B3E31B7

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\E2ECA89E3AC59FEDA845EA719B552B174B3E31B7
                          • Size 18KB
                          • SHA256 7c7ff58b8ba37ffa41bab6b9a336d7ab6ee444d03c2ad0c24bd06e4eeb4c6b06
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          E61D3E7B5DDB9FD9C03DEA07F0D72574444E8ABA

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\E61D3E7B5DDB9FD9C03DEA07F0D72574444E8ABA
                          • Size 15KB
                          • SHA256 ed50c60516c32488bf0cdd972d5dfee5ada3b9c29d35311d334cbd314b1dadf6
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          ECAD90F90B9065B3EB82BBDF95ECB2E9769DF9A9

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\ECAD90F90B9065B3EB82BBDF95ECB2E9769DF9A9
                          • Size 20KB
                          • SHA256 65bdfaef085a846b94c61b6e68f20c535e00f6ecc07038664a3d18b89689960d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          F8934A2D82039012787F3491BAFFBD3BB0C2BE1D

                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\F8934A2D82039012787F3491BAFFBD3BB0C2BE1D
                          • Size 353KB
                          • SHA256 ae3fc73e00bfd82287f0ca3e67734a57a3834fab7d3728118ec2eee25e819873
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          tmpaddon

                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          • Size 502KB
                          • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          tmpaddon

                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          • Size 11KB
                          • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          6824f4a902c78fbd.customDestinations-ms

                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                          • Size 19KB
                          • SHA256 4ffe7697f4550fa32870da9de9fb488ff8e8604bcae6a3cedc5c2beda8a6acc8
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          6824f4a902c78fbd.customDestinations-ms

                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                          • Size 15KB
                          • SHA256 4f58090c722ae553790c30dd052f4bf003b5ce5cf0f9d5e0d42bbdcfeac1e43e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          AlternateServices.bin

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\AlternateServices.bin
                          • Size 8KB
                          • SHA256 c378a94f8fba6667a361bb86d554ed40b95712109bb8724557f33db44f98c4b7
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          AlternateServices.bin

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\AlternateServices.bin
                          • Size 13KB
                          • SHA256 1bf2a90454a3bf9c5b110077bf90bf001c1b3be9f1ddbf0b8d29a6477dcb8325
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          AlternateServices.bin

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\AlternateServices.bin
                          • Size 15KB
                          • SHA256 2a50ea7ee6fcba65a3027f2a0e70de0dd7f52dfe453a0b96942550335a3cc6e2
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          AlternateServices.bin

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\AlternateServices.bin
                          • Size 17KB
                          • SHA256 886ac45dd0bf2f01a9217ab3e2fb1c9911603ec06fca4be3e3895adac486f47a
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          AlternateServices.bin

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\AlternateServices.bin
                          • Size 17KB
                          • SHA256 33237a6d9a3aabfc1260cb3e2391f1cde649a74ae5ef1826b24c513e52d082f3
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          data.safe.bin

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.bin
                          • Size 112KB
                          • SHA256 888c46b042cbb550ef08d3fe4bdf9ce888a24e31595ca94ffdc15dc6b0457a7c
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          data.safe.bin

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.bin
                          • Size 101KB
                          • SHA256 70285633792abd484f0a1091877a481c2b52f9aaed53b5d361ef7604da64c49c
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          data.safe.tmp

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
                          • Size 101KB
                          • SHA256 5002fdeac3d6be46c441e36c60c5c13161180537e00fb22ad8a4f5a855770a42
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          data.safe.tmp

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
                          • Size 112KB
                          • SHA256 d4a31618ef426df96026f455be4b02a68e2544547880d0b6c79b6b072fecb8c2
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          data.safe.tmp

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
                          • Size 27KB
                          • SHA256 12a77225e741b2093b8e200f29edd16eddf6d27badb203a50c6be150a6612997
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          events

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\events\events
                          • Size 1KB
                          • SHA256 f1e98a2403ddd1ce42f0fe2c953ce2b2232a14afed0c3a27062ce25eb35258ef
                          • MD5 SHA1 SHA512 TLSH

                          events

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\events\events
                          • Size 4KB
                          • SHA256 07a826c33bbe0c368be7822180095d36149363ce15227b5a9b50f2c85a589930
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          3f5ad469-640f-48d4-aa60-4183783fde3d

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\3f5ad469-640f-48d4-aa60-4183783fde3d
                          • Size 886B
                          • SHA256 58967f40ebf5303cfc237876f0b87f1e0f2d14ed820cab50cc5882955a831c81
                          • MD5 SHA1 SHA512 TLSH

                          5fa27175-b422-4f69-8d6d-d2e8c170062f

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\5fa27175-b422-4f69-8d6d-d2e8c170062f
                          • Size 2KB
                          • SHA256 5bdbd14ecc868402436a0a7c5f5107f58da14741571829af48a718cf517e264e
                          • MD5 SHA1 SHA512 TLSH

                          d1e53ff6-bc81-48c4-97ff-b87d64b363b6

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\d1e53ff6-bc81-48c4-97ff-b87d64b363b6
                          • Size 871B
                          • SHA256 e78f77532402136dd4fb8572ad208cea38b32ed7db250745a29d4440cf2ed721
                          • MD5 SHA1 SHA512 TLSH

                          d3862cce-c19f-4c17-8c23-be513c16f9b2

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\d3862cce-c19f-4c17-8c23-be513c16f9b2
                          • Size 235B
                          • SHA256 7d9c392641172b1981c18f77e22b17910f760ab44b6012b681750e5f08430d43
                          • MD5 SHA1 SHA512 TLSH

                          f763453e-c630-4493-a74b-f99b93ff6574

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\f763453e-c630-4493-a74b-f99b93ff6574
                          • Size 235B
                          • SHA256 e1c51b2bd0013feab074efd0a5ad6a157bc18ad38349ecc559a26cbc82f8b1f2
                          • MD5 SHA1 SHA512 TLSH

                          extensions.json

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\extensions.json
                          • Size 16KB
                          • SHA256 89dc8e9e875835a0264d3d64dd92d115b7b39fedd63547712257684dc3375e14
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          gmpopenh264.dll

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                          • Size 1.1MB
                          • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          gmpopenh264.info

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                          • Size 116B
                          • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                          • MD5 SHA1 SHA512 TLSH

                          manifest.json

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                          • Size 1002B
                          • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                          • MD5 SHA1 SHA512 TLSH

                          widevinecdm.dll

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                          • Size 21.6MB
                          • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          prefs-1.js

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
                          • Size 7KB
                          • SHA256 c9090e158ac92be4a6a095c39601d54521844cfd5106598c013b446760b7d3a2
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          prefs-1.js

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
                          • Size 12KB
                          • SHA256 81d151f1c5e8cc472ad65a2d9b7e9f5c168d0b326cac4ba27533e74a1f0f0e13
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          prefs-1.js

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
                          • Size 8KB
                          • SHA256 95f4ff09d65afe0949ca18b5408720523a3a859caec1a7de9bcf5b8ca6c7f246
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          prefs-1.js

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
                          • Size 6KB
                          • SHA256 11e0f1f3c44b95a7158d553492fcdfc02a9e437a37a30ae39ba2da561936f3b1
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          prefs.js

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
                          • Size 12KB
                          • SHA256 71aaee4bc80212dadc130baed67beb11dcbb7cd4f6e7f3a15973cb9f9f89f634
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          prefs.js

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
                          • Size 6KB
                          • SHA256 73a798de3f46ec297274234fe3d8270e7fbbe03eb8dea3c9753db1b64b304079
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          recovery.baklz4

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.baklz4
                          • Size 8KB
                          • SHA256 68ae27c03b3a732a1abe94ca0a8be951c7823172152c19dfd6b8f251cd5c942b
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          recovery.baklz4

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.baklz4
                          • Size 5KB
                          • SHA256 31e0a96f7754bd2a2320f93bef6d40683bf08918323ed1341ad9d1a6bb9034ba
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          recovery.baklz4

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.baklz4
                          • Size 8KB
                          • SHA256 ecea007c331effd0667e39754078ba9882b7e11f99f024057ea8ecea7da223c6
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          recovery.baklz4

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.baklz4
                          • Size 5KB
                          • SHA256 baed659c82eb102f2aff31696f8591a38dd00f248e81fcfd302b5668b0141f29
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          recovery.baklz4

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.baklz4
                          • Size 8KB
                          • SHA256 806c8589e482b45a9c75861c7d0ef13e84487099302389ad9d13b5e93795c857
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          recovery.baklz4

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.baklz4
                          • Size 2KB
                          • SHA256 881816207f749fe3c54a96238e45cd9e007f66ebc6057258e4a63d47901cec37
                          • MD5 SHA1 SHA512 TLSH

                          recovery.jsonlz4

                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.jsonlz4
                          • Size 5KB
                          • SHA256 be13bf1d64b72267beb1f67c52ad8ad85711ca1929128d68fd8c2d4bb0323316
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          awesome-malware-analysis-main.I5yP-6Yw.zip.part

                          • Path C:\Users\Admin\Downloads\awesome-malware-analysis-main.I5yP-6Yw.zip.part
                          • Size 102KB
                          • SHA256 050ff2e4ca85f4fa857b3b4834421388135bb1be39fa77e444fe736d27bd6ac2
                          • MD5 SHA1 SHA512 SSDEEP TLSH