94ed30455bbe98022cb6c829859923a6cfb39722d3c6ea044b60fc7db65f23f6

Analysis

user interaction
yes
max time kernel
129s
max time network
188s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
jman.png
Size 70KB
Sample260723-ee82maga39
SHA256 94ed30455bbe98022cb6c829859923a6cfb39722d3c6ea044b60fc7db65f23f6
MD5 ed3ea58b03290cfb5e40aa54e7f2f0cc
SHA1 74382e2249dca19beb205ee267d2bfde41f045e9
SHA512 c4a6cb7580fe1be9a036cb9d5cf0d340dfe8ffba0c1d8f7b0d3061f6a95461a39bffcc6b2b95224884a494bd8d2fcff24f2e7ac30a95fe6260b31b7299b5a6ca
SSDEEP 1536:flGl95Qzn7r6Qe0crA3guoLAnWXvCu2B/IdtdhEIrGellh4CyNEPK:dGl/q7r6QeQwuoM+Ku2NgyIyu4EPK
TLSH
T1636312C8A37C616F595AAA35FAB70A76113BEF4BDF0409E5346F30104C7809EBAB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5528-1491-0x0000000001020000-0x0000000001114000-memory.dmp	autoit_exe
behavioral2/memory/2684-1486-0x0000000000540000-0x00000000006DC000-memory.dmp	autoit_exe
behavioral2/memory/2864-1498-0x0000000000810000-0x000000000091C000-memory.dmp	autoit_exe
behavioral2/memory/6684-1502-0x00000000002E0000-0x000000000091D000-memory.dmp	autoit_exe
behavioral2/memory/6684-1503-0x00000000002E0000-0x000000000091D000-memory.dmp	autoit_exe
behavioral2/memory/1484-1506-0x0000000001160000-0x000000000126C000-memory.dmp	autoit_exe
behavioral2/memory/6684-1511-0x00000000002E0000-0x000000000091D000-memory.dmp	autoit_exe
behavioral2/memory/6908-1514-0x0000000001300000-0x000000000140C000-memory.dmp	autoit_exe
behavioral2/memory/6304-1517-0x0000000000820000-0x000000000092C000-memory.dmp	autoit_exe
behavioral2/memory/6684-1519-0x00000000002E0000-0x000000000091D000-memory.dmp	autoit_exe
behavioral2/memory/6684-1524-0x00000000002E0000-0x000000000091D000-memory.dmp	autoit_exe
behavioral2/memory/6684-1528-0x00000000002E0000-0x000000000091D000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6684 set thread context of 2684	6684	VeryFun.exe	127
PID 6684 set thread context of 5528	6684	VeryFun.exe	128

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/6684-1483-0x00000000002E0000-0x000000000091D000-memory.dmp	upx
behavioral2/memory/2684-1485-0x0000000000540000-0x00000000006DC000-memory.dmp	upx
behavioral2/memory/5528-1487-0x0000000001020000-0x0000000001114000-memory.dmp	upx
behavioral2/memory/5528-1491-0x0000000001020000-0x0000000001114000-memory.dmp	upx
behavioral2/memory/5528-1490-0x0000000001020000-0x0000000001114000-memory.dmp	upx
behavioral2/memory/2684-1486-0x0000000000540000-0x00000000006DC000-memory.dmp	upx
behavioral2/memory/2684-1484-0x0000000000540000-0x00000000006DC000-memory.dmp	upx
behavioral2/memory/2864-1496-0x0000000000810000-0x000000000091C000-memory.dmp	upx
behavioral2/memory/2864-1497-0x0000000000810000-0x000000000091C000-memory.dmp	upx
behavioral2/memory/2864-1498-0x0000000000810000-0x000000000091C000-memory.dmp	upx
behavioral2/memory/6684-1502-0x00000000002E0000-0x000000000091D000-memory.dmp	upx
behavioral2/memory/6684-1503-0x00000000002E0000-0x000000000091D000-memory.dmp	upx
behavioral2/memory/1484-1504-0x0000000001160000-0x000000000126C000-memory.dmp	upx
behavioral2/memory/1484-1505-0x0000000001160000-0x000000000126C000-memory.dmp	upx
behavioral2/memory/1484-1506-0x0000000001160000-0x000000000126C000-memory.dmp	upx
behavioral2/memory/6684-1511-0x00000000002E0000-0x000000000091D000-memory.dmp	upx
behavioral2/memory/6908-1512-0x0000000001300000-0x000000000140C000-memory.dmp	upx
behavioral2/memory/6908-1513-0x0000000001300000-0x000000000140C000-memory.dmp	upx
behavioral2/memory/6908-1514-0x0000000001300000-0x000000000140C000-memory.dmp	upx
behavioral2/memory/6304-1515-0x0000000000820000-0x000000000092C000-memory.dmp	upx
behavioral2/memory/6304-1517-0x0000000000820000-0x000000000092C000-memory.dmp	upx
behavioral2/memory/6304-1516-0x0000000000820000-0x000000000092C000-memory.dmp	upx
behavioral2/memory/6684-1519-0x00000000002E0000-0x000000000091D000-memory.dmp	upx
behavioral2/memory/4984-1520-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral2/memory/6684-1524-0x00000000002E0000-0x000000000091D000-memory.dmp	upx
behavioral2/memory/6684-1528-0x00000000002E0000-0x000000000091D000-memory.dmp	upx
behavioral2/memory/4984-1575-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System.ini	VeryFun.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	cmd.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7144	cmd.exe
7108	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VeryFun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe

Checks processor information in registry 2 TTPs 46 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{1D7745D1-9355-471A-B9AA-C659F1E94550}	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4176	mspaint.exe
4176	mspaint.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe
6684	VeryFun.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeDebugPrivilege	4180	firefox.exe
Token: SeDebugPrivilege	4180	firefox.exe
Token: SeDebugPrivilege	6684	VeryFun.exe
Token: 33	6672	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6672	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
5528	cmd.exe
5528	cmd.exe
5528	cmd.exe
5528	cmd.exe
5528	cmd.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
5528	cmd.exe
5528	cmd.exe
5528	cmd.exe
5528	cmd.exe
5528	cmd.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4176	mspaint.exe
4176	mspaint.exe
4176	mspaint.exe
4176	mspaint.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
4180	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1312	3404	firefox.exe	98
PID 3404 wrote to memory of 1312	3404	firefox.exe	98
PID 1312 wrote to memory of 1396	1312	firefox.exe	99
PID 1312 wrote to memory of 1396	1312	firefox.exe	99
PID 1312 wrote to memory of 1396	1312	firefox.exe	99
PID 1312 wrote to memory of 2696	1312	firefox.exe	100
PID 1312 wrote to memory of 2696	1312	firefox.exe	100
PID 1312 wrote to memory of 2696	1312	firefox.exe	100
PID 1312 wrote to memory of 2696	1312	firefox.exe	100
PID 1312 wrote to memory of 3464	1312	firefox.exe	101
PID 1312 wrote to memory of 3464	1312	firefox.exe	101
PID 1312 wrote to memory of 3464	1312	firefox.exe	101
PID 1312 wrote to memory of 3464	1312	firefox.exe	101
PID 1312 wrote to memory of 2992	1312	firefox.exe	102
PID 1312 wrote to memory of 2992	1312	firefox.exe	102
PID 1312 wrote to memory of 2992	1312	firefox.exe	102
PID 1312 wrote to memory of 4104	1312	firefox.exe	103
PID 1312 wrote to memory of 4104	1312	firefox.exe	103
PID 1312 wrote to memory of 4104	1312	firefox.exe	103
PID 1312 wrote to memory of 4104	1312	firefox.exe	103
PID 1312 wrote to memory of 6420	1312	firefox.exe	104
PID 1312 wrote to memory of 6420	1312	firefox.exe	104
PID 1312 wrote to memory of 6420	1312	firefox.exe	104
PID 1312 wrote to memory of 6420	1312	firefox.exe	104
PID 1312 wrote to memory of 6720	1312	firefox.exe	105
PID 1312 wrote to memory of 6720	1312	firefox.exe	105
PID 1312 wrote to memory of 6720	1312	firefox.exe	105
PID 1312 wrote to memory of 6720	1312	firefox.exe	105
PID 1312 wrote to memory of 6728	1312	firefox.exe	106
PID 1312 wrote to memory of 6728	1312	firefox.exe	106
PID 1312 wrote to memory of 6728	1312	firefox.exe	106
PID 1312 wrote to memory of 6728	1312	firefox.exe	106
PID 1312 wrote to memory of 6740	1312	firefox.exe	107
PID 1312 wrote to memory of 6740	1312	firefox.exe	107
PID 1312 wrote to memory of 6740	1312	firefox.exe	107
PID 1312 wrote to memory of 6740	1312	firefox.exe	107
PID 1312 wrote to memory of 1288	1312	firefox.exe	108
PID 1312 wrote to memory of 1288	1312	firefox.exe	108
PID 1312 wrote to memory of 1288	1312	firefox.exe	108
PID 1312 wrote to memory of 1288	1312	firefox.exe	108
PID 1312 wrote to memory of 984	1312	firefox.exe	110
PID 1312 wrote to memory of 984	1312	firefox.exe	110
PID 1312 wrote to memory of 984	1312	firefox.exe	110
PID 1312 wrote to memory of 984	1312	firefox.exe	110
PID 5588 wrote to memory of 4180	5588	firefox.exe	113
PID 5588 wrote to memory of 4180	5588	firefox.exe	113
PID 4180 wrote to memory of 1652	4180	firefox.exe	114
PID 4180 wrote to memory of 1652	4180	firefox.exe	114
PID 4180 wrote to memory of 1652	4180	firefox.exe	114
PID 4180 wrote to memory of 1732	4180	firefox.exe	115
PID 4180 wrote to memory of 1732	4180	firefox.exe	115
PID 4180 wrote to memory of 1732	4180	firefox.exe	115
PID 4180 wrote to memory of 1732	4180	firefox.exe	115
PID 4180 wrote to memory of 3032	4180	firefox.exe	116
PID 4180 wrote to memory of 3032	4180	firefox.exe	116
PID 4180 wrote to memory of 3032	4180	firefox.exe	116
PID 4180 wrote to memory of 3032	4180	firefox.exe	116
PID 4180 wrote to memory of 4572	4180	firefox.exe	117
PID 4180 wrote to memory of 4572	4180	firefox.exe	117
PID 4180 wrote to memory of 4572	4180	firefox.exe	117
PID 4180 wrote to memory of 1716	4180	firefox.exe	118
PID 4180 wrote to memory of 1716	4180	firefox.exe	118
PID 4180 wrote to memory of 1716	4180	firefox.exe	118
PID 4180 wrote to memory of 1716	4180	firefox.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\jman.png"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4164

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {b54bc825-63b4-4784-a79c-bde8f3acbecc} -parentPid 1312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1312" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {16ec9ef1-0b7a-41de-aa45-7a91a80333e4} -parentPid 1312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 27274 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {d2a47291-9ee4-40a6-8d1e-0111222d230d} -parentPid 1312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27274 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {96a2ccfa-acb1-44ad-ac27-5ec8a5572311} -parentPid 1312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1312" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2760 -prefsLen 34773 -prefMapHandle 2984 -prefMapSize 270279 -jsInitHandle 2988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1600 -initialChannelId {be6f0885-7e6f-4c1f-8bda-838e50e1e76c} -parentPid 1312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4660 -prefsLen 35010 -prefMapHandle 3160 -prefMapSize 270279 -ipcHandle 2736 -initialChannelId {235903a5-74f1-46b1-ade3-a05c630cd692} -parentPid 1312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2976 -prefsLen 33031 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5668 -initialChannelId {28a826a9-c708-4a1c-8a54-ae53e99bf693} -parentPid 1312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5740 -prefsLen 33031 -prefMapHandle 5744 -prefMapSize 270279 -jsInitHandle 5748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5752 -initialChannelId {a2fe220e-a313-4bd9-b05b-1753272a413d} -parentPid 1312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6008 -prefsLen 33031 -prefMapHandle 6096 -prefMapSize 270279 -jsInitHandle 6128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6132 -initialChannelId {d1b163ec-25c2-40d4-949d-45c0306eb0f0} -parentPid 1312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6476 -prefsLen 33071 -prefMapHandle 6484 -prefMapSize 270279 -jsInitHandle 6488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6496 -initialChannelId {90cd615a-ff3d-479b-8a0b-74227021385a} -parentPid 1312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2648 -prefsLen 33071 -prefMapHandle 2800 -prefMapSize 270279 -jsInitHandle 7076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2948 -initialChannelId {28c6e813-c768-4cee-b0bf-6ad8c4b08eb2} -parentPid 1312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:984

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 31500 -prefMapHandle 2000 -prefMapSize 271002 -ipcHandle 2088 -initialChannelId {16ae25c0-f476-40e9-84e7-b64d278ad6d4} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 31536 -prefMapHandle 2448 -prefMapSize 271002 -ipcHandle 2456 -initialChannelId {e20ce681-1c08-42d5-8e81-f556349d3b39} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3692 -prefsLen 31677 -prefMapHandle 3696 -prefMapSize 271002 -jsInitHandle 3700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3708 -initialChannelId {e570dd0f-c326-4771-a9bc-55df89179b0f} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3892 -prefsLen 31677 -prefMapHandle 3896 -prefMapSize 271002 -ipcHandle 3948 -initialChannelId {cfc26af5-76aa-4203-9d3b-b13cc54dda44} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4556 -prefsLen 39230 -prefMapHandle 4560 -prefMapSize 271002 -jsInitHandle 4564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3004 -initialChannelId {4cb01fce-a4fb-4ae9-9f27-89ea7d79aecb} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3252 -prefsLen 39279 -prefMapHandle 1572 -prefMapSize 271002 -ipcHandle 2916 -initialChannelId {3abb9393-9c09-4a6a-9ab5-27925ee41239} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:7120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1700 -prefsLen 36076 -prefMapHandle 5152 -prefMapSize 271002 -jsInitHandle 5084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4800 -initialChannelId {9b66c387-1d29-4cbb-9741-39893f50b6d7} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5168 -prefsLen 36076 -prefMapHandle 5172 -prefMapSize 271002 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4968 -initialChannelId {df22f52c-8358-4ef5-90b1-9fe9da3885a3} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5816 -prefsLen 36128 -prefMapHandle 5820 -prefMapSize 271002 -jsInitHandle 5824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5832 -initialChannelId {aebb1bb9-926b-48c9-99b4-d5b6d7e2fff8} -parentPid 4180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6636

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\VeryFun.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\VeryFun.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:2864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:1484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:6732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:6908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:6304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x0000000000000508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6672

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe"
1⤵
PID:4880
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog
  2⤵
  PID:2552
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog
  2⤵
  PID:3452
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog
  2⤵
  PID:1500
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog
  2⤵
  PID:1460
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog
  2⤵
  PID:1188
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /main
  2⤵
  PID:6488
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:4716

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\HMBlocker.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\HMBlocker.exe"
1⤵
PID:4984
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /r /t 6 /f
  2⤵
  PID:6744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:7108
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
    3⤵
    PID:6088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\HMBlocker.exe\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7144
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\HMBlocker.exe\"" /f
    3⤵
    PID:6280

C:\Windows\system32\cmd.exe
"cmd /c del "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\HMBlocker.exe""
1⤵
PID:1688

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3994855 /state1:0x41c64e6d
1⤵
PID:6100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6956

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3999055 /state1:0x41c64e6d
1⤵
PID:3704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5740

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa399d055 /state1:0x41c64e6d
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\activity-stream.contile.json
Size 4KB
SHA256 d290665b749b54212c39879e97aa6c40217821ae5406a522c9b54cba00cdf691
MD5 5beb9ac082fe5ab0790330db042337cf
SHA1 b24064ba28b319a05c1f69c294ce723a1652117c
SHA512 7607c8c15894e698323f731b9f6bd63a216e39893018949d217217c78300b8f792b98fdc67d4a1e28a723ca842d58799d6fe30830dfea31c0c0d926366148917
SSDEEP 48:Yda5g1M5reDX87hqHICL3STBl2ElhKwNbAIImeeVKYmreDXaK7hKch2O9uwn898+:I1MapSTGElIm/KY0ctnx6DeUj6wanWl
TLSH
T139A14BAB88FACCCB1772FBE13D09230CB1427557C5F98840FF8AEC15E495226409EB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\activity-stream.discovery_stream.json.tmp
Size 76KB
SHA256 80023cf901654cd2f5f15575fe75ff8c5de6c89ac30b61cdfce99cc675f76627
MD5 35c9905d6bcf33dcb598a2d940911145
SHA1 14693598baacba96026013667a573882e3bb7cd7
SHA512 17e2e61c61f61397843caa2658767ef26a6e727b7df4bad645886604fba6f9511a21a9323b10f5ba22001fcbfed4de5ff8e33e1fb420ed096d98d8110262bdd9
SSDEEP 768:dyp+ekM6glNNqOW92i7pTwvoMWZv4wWs1rUY44OQ2Lzb9VWbM1+jDBqW/n:MxNNqOW92i9TzZv4wH1MF9VWbMIjDBq0
TLSH
T16C732B6392A871BB2BE13BC72C0FB99B6AE20145F34505C9FCDED61CC18C695123A5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

01682221A33A9938EC20E14A7A7BE6E93093E052

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\01682221A33A9938EC20E14A7A7BE6E93093E052
Size 10KB
SHA256 640c543665b2ccb133d69e8b968d136703595bd217d09ca19ccef39f143365e8
MD5 2931cfa09c1728b6507e10cd233df7e2
SHA1 af0c2c8a809d5b04f561f6368ef215e76a13db2e
SHA512 c0f154eca4569f422db6ec3edb5721705bb9ff36b1669830237cd72634865806b9fb5f80f7dfba2f66f3139746e2ec369bd81c28006a789d587607e934535806
SSDEEP 192:jl5ePIXYhAuxCCx95bWxX+JdfiTkh6ZcfXlHlUpPrk1GZX1MhPXlwaXHbMbx/:uwX0AMCCx9xWxX+JhiTkhfwpPrkJPXls
TLSH
T12A22BF395B21245C2B859EA1CD5A72681F57D683FE39D0ACC09429CAC1C8BDDE8CB1CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01855AC78AC51A7F6D32ADD31A4675E922962845

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\01855AC78AC51A7F6D32ADD31A4675E922962845
Size 15KB
SHA256 c8486e509f9b68a68b511666955ed11a58dc622131b318dd2eaffd7d8beda1b1
MD5 1425487ccce5661b14058a65919f337d
SHA1 1c206ddc883b89dd3a1bb0e3ec043d1911f015e6
SHA512 a5c77bdd98c9d4d9b999f8cbdca34e13d6df417337939b204c3abd4368a8c8f63d114155a0e9ed57e0d6f4d833d352d88dc85158571db0aaad4ae9476091cac4
SSDEEP 384:3yJDV/lZGa7HPF8ts1hfo47J8ts1hfo47J+aE1Clez4NnsKxKisDs:3yJDbAaJ8C1hf77J8C1hf78aE1Cl4CsW
TLSH
T170729F7F073014C32B83C2A597BEF8D91ECAED13E580C2D594553A878EDD7AAB84C219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

020A85DA21FF5FC8037738FBCBF558243E416F56

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\020A85DA21FF5FC8037738FBCBF558243E416F56
Size 11KB
SHA256 3dbcc1f41660821d8431cb4ec93fb8ad24d57b135cb24d186ceb9e36ccfdb3c6
MD5 7bd43f1ea908320dbaf6506ba1d48ced
SHA1 034c2eca658a64c9402ee68dee388b627047eaad
SHA512 a0d100afc9fabc877e6df346ca58dad42ad34b89090bb05911e95ff532cd7c630f58aa802d89c21e8fdb701dd803124a1004a5d67b7e976c6ba5598805d04481
SSDEEP 192:w6cPJJ85mVKps1dffo4dp/J85mVKps1dffo4dp3PJ+PiCB1ClezoDtPjz4ZGs1CX:XcxJ8ts1hfo47J8ts1hfo47J+aE1Clew
TLSH
T1A8426D3F0A1425821B87C3D09ABFB8C81E8BFE53E591C1A5D0153E8B99E9BF5B88C155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0260A1A5A1BF125043D674182DDE87A24B58BE2B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\0260A1A5A1BF125043D674182DDE87A24B58BE2B
Size 35KB
SHA256 9ed97525218b03eaef97330969b6b9fb80a4c03a3072002cd40c41f13b5398a4
MD5 276e5b1562db77f359412e2614f22a7d
SHA1 2babe016fde6482dd60fa06ff75222fece825959
SHA512 cc4882cab1521ca7988f12f1706ae2a486f996c5d95ef11d0c91c10673963f7106e173235be8c4226c4669d3f4a3809e5ae67c75a3dc75d7f0fa967df3123be8
SSDEEP 768:wnlIueQHV03yd4NZCidJctYUEUPXTnQoX9u4K8C1hf77J8C1hf78aE1Cl4CsKxu:wnxsid4NZCw2YhUPTQ2kQ6hXK6h4a6CG
TLSH
T176F2E03F061058D665C383A16DBEB4C63E84EED3FC9583F1C06C2AD558E5BD93A490AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

028F73A688566BCD2FB63A5686B4DB60288175CD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\028F73A688566BCD2FB63A5686B4DB60288175CD
Size 11KB
SHA256 0840f3bc39e3a075cf9a33154964f43672eb0ef90f0d4f70fc40fef81618320e
MD5 60e252c62acc00a99695cdd749271b68
SHA1 cc86ab14c4740a227387d3ca7eb9913bbbb9cdc4
SHA512 0c58d0b96599f388463ab654ccdb0d7f32bfa9b1cf2a621ccb478aabb4b12a361c44f3ff3ec57db6deecceee39fde4ea2a67995fadd59676e9611d75501149f3
SSDEEP 192:a1F85mVKps1dffo4dp/J85mVKps1dffo4dp3PJ+PiCB1ClezoDtPjz4ZGs1CHNc+:aD8ts1hfo47J8ts1hfo47J+aE1Clez4x
TLSH
T186325D3F462014C21B87C3D09ABEB4C52F8EEE53A990C1E6D0583A8B99ED7E5B4CD549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03D74D5ED346B6A425AA45C38A54C3F6BCFF5085

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\03D74D5ED346B6A425AA45C38A54C3F6BCFF5085
Size 47KB
SHA256 e1c7040339d29522e29f95e8f9a1ef5122f9721594553c73194857d3a139b5e0
MD5 4d9835764ada7b83b6428441e7374a2c
SHA1 b63d692cc8893f15f2bbfdf40df4e631075e7f61
SHA512 af70157b8ec40adb5bb4c019cd953d78bd2db374664fb37c1b467feb8353712f1d3ffe23fdaac517e73f53e5e98896f58686690290a25c55ac7e8027afb74e04
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3udc0bc:eUEEoBVQDjeQaLnP2pfZTqgSET1W2w23
TLSH
T10223F1330C4A3B518241F250D4DEB509BC93F623AFE2D9BC90787B8A55093D69BB51EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

075B8FCF1E4761117058C2EFF149858F93A6A354

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\075B8FCF1E4761117058C2EFF149858F93A6A354
Size 9KB
SHA256 aac30b22f69d4d3290d230f87e9ea6d70c7bb59305c3952e9004466015b24368
MD5 bcb7afb036ba022b0e33eb0a321294f6
SHA1 a3594e8f6cd3d4d97d611552886f73c8f2d33676
SHA512 ee64ccfc87bc0323e695bad2547e66b7ae61f08398b2d972dac1971ae1703539ad7667d81062c024096a347b3bbcbab1414753a76efe55db7cf40eacf858af0d
SSDEEP 192:1DK8FcEW6+Kb9ZOBcsJsLabDPwEEB3UKAvIzUIrW29t2BPCEbEv:1D/c0b2WMwEWkKAvKrWCt2BPCiA
TLSH
T183126D3B8F1032054A52A6D2D641BB483E76F713EBE7F4ECB0183B44D9C47A5557A0AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07DC4800717A370AE6C3F59C5897D3E652E71F55

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\07DC4800717A370AE6C3F59C5897D3E652E71F55
Size 13KB
SHA256 025fa38a2dea4c26989b1da52fe1b1c820456e3c4ce3f54bbe892f2db49bfd5d
MD5 7823add89cf0415ca7c79a32f589c28f
SHA1 3ab1c7b7352bb99d19894b7256b8ce411bab63a3
SHA512 f9c2a19966db9dc9d59dc1f2a1f98b11f123b67b36da96d718656c1dc92d8dbbb684145eb64835ea6a4032d0f79dd162042a3ff5feb5832a7a6f9276a50a8f9e
SSDEEP 192:3+I1clKAJdfSKOI/JMhA1N0ZpAjMJfiJzhwUykUKDlVx4hVx4t:QJhSKOGIAn0GMlszPyybxexy
TLSH
T1285231E4A933256C07338D51E92E32D92934A057D485ECFE8835A29DE9A073372C67FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08C61CBE63F90DA32A52689DB898F704E6AA0645

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\08C61CBE63F90DA32A52689DB898F704E6AA0645
Size 16KB
SHA256 133d9300934fab5dcf1e19225545cfebea6d19ed51d623ed2fabea00464ad2a6
MD5 d40b20167bbbb195ca10cbfe0fc9f0a7
SHA1 232320e33f3c3a24233e675c4f3a425fc8a8c93d
SHA512 bae51b3bfe083cae54a7f0113a018873deb51dd61856a88b8f37fb0822e1ba89592a8528075e198e0f656e36e1363568df65cbdb2fe265a6d37ca90a229f8293
SSDEEP 384:rGGUCgh48ts1hfo47J8ts1hfo47J+aE1Clez4NnsKxKi7:i5dC8C1hf77J8C1hf78aE1Cl4CsKx7
TLSH
T1C072AF3F072019C31B83D2C46A7FB5852EC9E913B5C0C1E6942C3F8A59AA7E9B88D15D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

096E3BB54C0C3BFA94157E1D661A6048DA22B300

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\096E3BB54C0C3BFA94157E1D661A6048DA22B300
Size 14KB
SHA256 8f96786636666e8c83aba7fa44baa1cfeeb0aa8980d429b349fe5b83800bf85c
MD5 132fe618d4f938cf230077bdd3514375
SHA1 0cef16be6fcbd7e893534c774b28472f7ff9a231
SHA512 fa236db4272cef2a3f6b2c216a7da9c23724b8fc0389ebb16862794bc2d13a7b96e135ace7e6d0b1f9be375861b74f0cc3473af55eb17325d5f8f918da9e73ff
SSDEEP 384:bnMunxwhB4oWZP8ts1hfo47J8ts1hfo47J+aE1Clez4NnsKxKi9:bnMu8yt8C1hf77J8C1hf78aE1Cl4CsKv
TLSH
T18E627D3F4A3814C21787C29099AEB4C52E8AFF03A591C1F5D0593BCE89DAFE9B58D145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09CF0BB71BF4AC8343AEBA632ACC83395AD3AB2E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\09CF0BB71BF4AC8343AEBA632ACC83395AD3AB2E
Size 17KB
SHA256 d443bb62756da0c7787fe4fce2a51cc37e0ee7056804a6135ed4645fa819a7f7
MD5 806c6363351443ff2ec19d36fc7bd5e4
SHA1 1c4d18da72f502976144fcf90962caa8a3fbc5f1
SHA512 dd156eb07bfd7d6992bcc0b1ed2b4a3ca701ebb3edcb0b1ade6c142ca7ae852ada5fa646acbe3e85c989091100f8a5c6b6e4f6c66ad0619b6739d7049b612fbc
SSDEEP 384:PsoUymY55c4T0FDN4feaLulj8ts1hfo47J8ts1hfo47J+aE1Clez4NnsKxKi3coq:PsHymYbc4T0Fh4GaLulj8C1hf77J8C1e
TLSH
T1EA82AF3A051424821BC3C3984BAEB8D93E96FC53B9C1C1E6D0293A8F99ED7D5BD4D149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0B41BB59277864EB2116E1823E53B495AC95799D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\0B41BB59277864EB2116E1823E53B495AC95799D
Size 8KB
SHA256 cd1432216875f251054a4f1688f197cd6b3bf3fdd1032a68fb7d29b7ac8a801d
MD5 47b5342895b72f1c1edbfc2993dde0a7
SHA1 bab153fce694c42073d1d7266db32c98f377c595
SHA512 26e022068c3ac37ca692145ce8010bad0921255ff3e4ee38ce1098f6afa0eac7e8eaa349485c6cb44311e8ae68edc48a10a10dc7fd6846af9d724d2c5d6140b1
SSDEEP 192:oDYX6q/QDYX6qJA4KKfCPJMGna0AxknKHKl:oDY5QDYHHKKaPOGnAw
TLSH
T17C025B775E0534094F910FD0804BAA9C7CB93593FEEAA1DB79047A02C8A9A712DEE0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0B98AE8F997B6EAE32215010E443C3148BC64764

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\0B98AE8F997B6EAE32215010E443C3148BC64764
Size 86KB
SHA256 d32718f3c00d6c9a0e0d97f4a1f5309e2c21181f0a31f61d1ca669c7fb58946b
MD5 b16735e552de88a19431c8e0b7df9953
SHA1 32aef33c42d44df42c7af1fa8108be185d6b072e
SHA512 804ab160a7fd52ec1d3af5621f9072506668626b7464477bd17589c20cbb62029cc6420234c798d2e3b1c21933d879932195369687b20203d50a9ded45282bea
SSDEEP 1536:NHWHM1rqMRDGCUKdBbXB1ABXfcIsHnP3ZTHeRsuX+yyJfUaUALCs8po3:AHM1rqmmm1ARk9nPQpyvCs8po3
TLSH
T1E883023566833F458CF182F164080FEA9C94F2738AC442EE76558F4AA9E997168FD1CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0BC04A807C48ED4572FC41967C82F0ED4488EC69

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\0BC04A807C48ED4572FC41967C82F0ED4488EC69
Size 11KB
SHA256 b10b9fd391d23b5d92345fe489d48fdd5db98490615fad5f245ab17793061895
MD5 c2a3bf9af5a49c3b16e1fddb4f7181ae
SHA1 9b974a2d5cdfc7b957e8c4c71248e9590af6016e
SHA512 e4357c25297bec5b1a61eeb61bdf8fb08394cd644e3d385eb6853787a85d3b981e2a5c4ce511de37edaed188c1d48bfd4971fcc4fa8a963fb0a6843cdde223ca
SSDEEP 192:V/y8ysK1cURPAew0Bzmoy72e0Bzmoy7oirNfoEHjGPl2BadE4Pro15j75ywpskCB:Vyawty6PtyLhfdDE2Ba/rIVy8eQU
TLSH
T161426C7A4F844C1C5D999803CC9E62509C78F7178F50E6EC6E94361D8ACB2B8A5B42DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 04d92fd07a4b7921f9dd436fcddc98f13d9fe15cac71770760d64b84e0ae77b3
MD5 b69b36747f558b81a5cfe66075457867
SHA1 50fdc075c6fda56985a6dbe7a31ec6ef1d3dd7e6
SHA512 078ad3ad7604701e69f0949f310cde38e2ab2a03f8694cc7c7a8a636a343aa0075af2717d0f02cc4b0ad948226f6031690269a1a4c81928d0ecff23df76f76d9
SSDEEP 384:HwCe7iO024YSdcs3hk2nhfdDE2Ba/rIVy8eru+Pu+x:QqZYSdv3hk2nhfS2sDIVy89+G+x
TLSH
T17A729EBBDF416C5D1917D989C9AE93699C05F9BBCFF690A608203449CB84326B0F609F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 019a641feb17e06bb6cad9a849ae965f27bb2abd742f5de2dbcf6995b36d977e
MD5 52a1fb0f428f313603a74c31bb8ba9ff
SHA1 45a2fd94676f95a1e27fe2d3589415feb5d45833
SHA512 5cf064d7664ba66814b9971db00a3a1490de8eea926d7173fd2dab38978cb16a2952d1102d25e528c889cecaa36aa706fa15d313f17d0fc26a25bd1a3de429e8
SSDEEP 384:HwCe7iO024Yxdcs3hk2nhfdDE2Ba/rIVy8eru+Pu+x:QqZYxdv3hk2nhfS2sDIVy89+G+x
TLSH
T1A8729EBBDF416C5D1917D989C8AE93699C05F9BBCFF680A608203449C784326B0F609F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 16KB
SHA256 c3f085b76a8369fd1909731f76f212ed4f4b07b48dec65c08d01a9ccb5668bb8
MD5 d9a37dda18e8bce1ce972e9d1cd5f5b3
SHA1 48c8b805174ae33a202eec5e2abc24a61acf1a47
SHA512 4c37a6c1cb9497a790cc6a8484a3253d89be23b783a1747a23df905428e68377693d2b15f3a3f80130ea1c439129b14967e15c134c15d6475f0869ab6d2022a6
SSDEEP 192:DqSTGElIme0weUmInWH0Bzmoy72e0Bzmoy7oirNfoEHjGPl2BadE4Pro15j75ywI:DzHAty6PtyLhfdDE2Ba/rIVy8ez
TLSH
T1DA728EBB8FE58C4D1E51D583DC2927546C15B2178BB8E0E97B84B40DD2DE32A84F92CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 8a0381591a0e9ea8942dbc42aee89c822869c4a4af08caba38de2892190665e5
MD5 c982c4d17a05d51487356b5f8203d5a9
SHA1 bf4bd25916eca4735533e95d7e53616cbf89ee8c
SHA512 30ec2b58957d5d72b6e3a72abe3643600ec303b8239bd10482a2dee198b7f1202bba56fda39dd8e62fa543bb82fa5f5bda597b7bd1ce5d244801da77e2076d7e
SSDEEP 384:H9XghOiO024Y9dcs3hk2nhfdDE2Ba/rIVy8e7bIU:dX+ZY9dv3hk2nhfS2sDIVy8I
TLSH
T14F728DBF9F017C591967D546C8AD8369DD05F9ABCFF690A618203549CB8432AB0F60CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BB95D0607349D05725D5FE01D4FB300E319072AD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\BB95D0607349D05725D5FE01D4FB300E319072AD
Size 11KB
SHA256 4e30298e53d9687a1376fab1fa257efff2f1bb20d1b41511b6aabfa10dcc2432
MD5 e195cff3c20c27c27b71fd11f66d05f8
SHA1 5c359ca027e35c26b6b3ff06a0f75b8deda2ee6a
SHA512 3e02104f18db21f46d9e5d04ce8caef1203bc0fb1c31c0c75f733709129b9f95fff74aea453b9fbb8d016bac544807ce41e473446444d15894c8843c7a27f41c
SSDEEP 192:2jpAM1YM6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDA:2FIMvI2Efy0vI2EfnaGUzHODWoh1B9ML
TLSH
T167427F3ADD50586D0AF1D6DBD97C25780C55EB03EDC6E19E2E193104D8C43A9B3B91CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0F48A0632B6C451791F4257697E861961F06A6F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F
Size 258KB
SHA256 ef3885a5ef98b3cb84a424b1acae3f042dc10d9dd9a8fff5721a52590f9ec4bd
MD5 990d57cfdb5a94becce0e05846836fd0
SHA1 fd3e3ae70f3c66e06308c641f89da9881df0a2e3
SHA512 002d6fa0f4df87a1f8419b701b2d89fa4dbc13859572a5d55ceaac4facfc05d3b419ddc600b939b8e53e38c6dfcce165e14a2db915e04fdcadbbd26b1d919a28
SSDEEP 1536:YYCYFsi4SPrRMHMyvkcI5Uo0fzGw0ZocrTzvDKC7bN+jzA98i11/Oc68Ct5X+2MO:QsDcdfzGw0RTzK7i11yuFix
TLSH
T1C244F7F7D69C30FB17528ADC6C1D72CF62AF4239DB5208D6FC688148C3C9AA5107679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E473D920361435DF4BBBF194E406FE372015579A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\E473D920361435DF4BBBF194E406FE372015579A
Size 11KB
SHA256 ec655fd9e7bfcb816da91ff67bd8ebdf9ca1908793c9d86c1f77e5c616019b12
MD5 567e7cc73f98b3e863f54fc87a4b467f
SHA1 844125d85c2c128b337dda066143eb7a71a47ff8
SHA512 22d9a1b06febcf000e576fd571d2d9c8307d7904abb72ce5f846d504bef68763f54274b60f3b8cb2a30eefad290afe5c2751365d4132e1444004c6aec2eb7c15
SSDEEP 192:ttwI6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDU9dIJ:bvvI2Efy0vI2EfnaGUzHODWoh1B9M0lH
TLSH
T1A4428E3ADE5158AE0AB1D59BD67C69681D46EB03EEC2D1DD2E193104C8C03B9B2B91CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache-child.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\startupCache\scriptCache-child.bin
Size 540KB
SHA256 0c6f2e5e71aa1e544e569711c29c14ec142f87799b07f2e40a032e60aa1b52fc
MD5 52a538b2b3543ee573711661aa4f454e
SHA1 e2b988291a77a0c545ca5577a61bf9019d78b87e
SHA512 9f7ad7006a4481cd7b12ce3351d49848c80650ee894cf2a1a18914d1738abd056683135a3663d3ec6ea1f1c26edfcc3502fc1a8df2577f69cd6b8935e5efb5ec
SSDEEP 6144:/FCUbu1hjktpJn2pmYXHqjOcpEIvSW2psd:d7ubotPnpv9h4k
TLSH
T1DAC46111EFA64E23C418037A44F753313A31E1451BEAE3276F8F7629BC673A91D8A95C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\startupCache\scriptCache.bin
Size 9.8MB
SHA256 92c2d27e926e3969f04902f75cf33859351219d624598d03a734584440f85926
MD5 8b2995d5fc15474a01829277ece3bbcf
SHA1 30a8a5a2f4832906720bfb639409d41f6c5318d1
SHA512 5b8e96588e647037a1160cf6f97cef9328d7718f2739f0eb322b5bdf0329dbcaebecc193f240105cd00a37be9f3f7737540cdd9b2ab84679dd6c7a73605e265f
SSDEEP 49152:ZkVvxHNHhFDzwH6f8z5vVby38zYPHpJFVFwjdhCXfJe/BUbSQD:gv1F/waf95PnRmSRt
TLSH
T1C7A69315EF664E23C468027A48FB53313A30E08547EAF3276F8F7129BC6B7691D8995C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startupCache.8.little

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\startupCache\startupCache.8.little
Size 8.6MB
SHA256 b2fb969a8cc6ff2f3bd9c6d08e4f4cf555fdb95388b3570e6bc1212a35a52889
MD5 7510b37b0d9bc5e9bfcd3b209bd563eb
SHA1 09a2109e98ff946d1c75643584dc8da6e1e442e7
SHA512 b212cf90b9152093d4a2a690db3fc715a8b7b487f3831873fadd47c5bf5795ca471a3f565f7555980e974e373a280ddaba9aa4bd3d14d70fbb0954b8f0c3ed19
SSDEEP 98304:xUr3EWRX4TeNrIGqFy4AQoZiYlwE5YTngXVGKwGHAbrR:x8hROkey7LicwiYreAnR
TLSH
T1479602B7B3554697C429181AE87A0A3937A3414203E1669ACF78533FFEC724C1BC6E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urlCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\startupCache\urlCache.bin
Size 3KB
SHA256 74ab1364afa485b9f675a05577bb95f0bb06c560a2979fe5ff511f8411d7cd86
MD5 221eb7f455d6ed63eb0d2361b44cff03
SHA1 a040acbb4b2d98fe65f9d07253233d986c685124
SHA512 10751a66b287156bbff716893c024856052f91abd452157726fcc859eabbb27374622f77417785d07a7a8461faee6d5e286f7c17e99ac76189bfd8b94ca1bb87
TLSH
T1F161B492E43F203B7D62A4FBAD95C171B42149CED1CD20DDBA9663D4209E7DC034EB1A
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 521632dd2bf66cab9e878e3cca750223a199f4555abaaa594a8f5658929d2d6f
MD5 12a8beb2ea87f22500ccfadeecd293aa
SHA1 7a50702f531ef7a6247c83d7ae168d26b7e354bf
SHA512 10677789c6b1b765a5f24aa164089ecd319ea91d20d984dc71efe7a7d3cb882968db92fb3b83f8c9f9531d29373bd63aa44f528784fdcd5eb914dae0ccf01ca2
SSDEEP 3072:X3lH5ieIqZIZB3a0srAvKeyGRo58uB0Tb:FZvZoqZp9Gm5FBq
TLSH
T153B3AEF6DFA2CD6D69FF942DAA82C43EFC262414B3A73009D913271461C7EB87675248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\AlternateServices.bin
Size 15KB
SHA256 26b6ed6ebfbd899231f619e3bf02abb9ff5a5078286c7d617ea2a5e5e4e29b98
MD5 0702df45220b9b63b66f02ceb9cce2c2
SHA1 fc60fb9b8ec6ca96a04c126e8db9178f71c26b2c
SHA512 5eb7f3e55aead4708bee7db8c98a368cb399eff5aa5af626a25d15bc752519fc687692e4555f6da1bb18c55155e69722ec5e15a55549f7998347bced4de4fa50
SSDEEP 96:Gew15O+PGBCG4tI56JasXPTM/pwK4LO0Y4:XuQ
TLSH
T191625EF36B7564A2F0A29FF1C098758C9C331325447CE994CA54A0A706C6FD9903EBEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\AlternateServices.bin
Size 8KB
SHA256 cbc9ebd406fc3726d25d512fcd371523605146cd24b8594b48ce56ae7274ebc6
MD5 4f069b878e17a739e4943a65f8127b6b
SHA1 110de63f9e3c1ceee2d49a6a4cc743a7a5e1a406
SHA512 121dcd72a52abcdaded0f131beccae613e569b50fb0b9356c2b0366a4598b682fe18585d0f7970008ee817cb4af0afad78bd9bd6cd3c86b72b1558af751016c7
SSDEEP 24:KkSRuhMZ/791DP9x3z9BjR9VvRd9F1j5q9F55A5J:/EZ15htjBRXTtI56J
TLSH
T169027FE36B76A462F0A28FF1C059758CCC331725557CD985CA84A0F702D6F9A903EBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\AlternateServices.bin
Size 15KB
SHA256 49f27eae959f11483b491fe6269ecbeffe549765b59e9aa03fbc5c2bccb76beb
MD5 77f0978363e6b6e60db2ba318053abd3
SHA1 bf31f89212abd9a573d569839ad4de8331371b69
SHA512 30afc13fdb569c08a9d63d8eb959d6ce508e6904fa1015efff6d0ab3585245967c884d578fe84fa8437b2cd6913f6fcd5b5eabad8864b45ec8d8ac9ac56badc4
SSDEEP 96:Gew15O+PGBCG4tI56JasXPxM/piS4LOkZ4:XgQ
TLSH
T118625EF36B7164A2F0A29FF1C098758C9C331325447CE984CA54A0E706D6F99903EBEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\SiteSecurityServiceState.bin
Size 3KB
SHA256 87eca1a0ed5fcc7da965b6da8839c72c50858cfe6720930197bd3888a1dce822
MD5 710222b6e0411b104c1cdd19e5517bc9
SHA1 5f290b6dfb87f7364403d1eadb256a89bb05d8e1
SHA512 a00f4f05d3b690693a80a32a7d39d4fb11c0708eb0d44a60e82b4449acd0ff7789d7fccd3b06981800179a19ad3c1a000722ab7253b87f0f6ffd18adc5337004
TLSH
T1778138FB5DA2E293E5D18E3490ED90E44C310355D402E488BC1B06922394FBA61FF3B0
MD5 SHA1 SHA512 TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\addonStartup.json.lz4
Size 4KB
SHA256 0f7942c61a5c905b714f35c238778e17080f2b95dbdd65ad05ec1add8d060ab5
MD5 44fdd5340fb9b0d27a218dbfb466af71
SHA1 094aadd9ba38196c294c0bfc54e71a412729cdbe
SHA512 3687ee78f0d2847eaf8a6bcb53fbb469d297d0be92a27700e6f47bdfc18b7a3661d8e59b98dc837fd040351d155129ee9cddeaac7581dd01c7230ef5cb71d7ea
SSDEEP 96:N9J54sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:N9y52xxhD8rGvm6ApwnHUuhN
TLSH
T141A16CBAD541EFA1FE32C04398D97FB2E6A69B7414B9C4D4F16EB1294D24A735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bounce-tracking-protection.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\bounce-tracking-protection.sqlite
Size 96KB
SHA256 09b3dbf17480279ef86d77409248684f412db4a77df51800e5328c348dafa23a
MD5 8bc7cb52026685fa12743058edacc8ab
SHA1 bb217d7a93f4948dd6a1163dba758e929b522a05
SHA512 ae8f017c4b03a2ae20f40bf6eba9295ffbe060b730c6f33f425e7bfa151052d55956ddc921ce2177b13ee13da54fbdf165e51b2a3e9a93e476495739842b655e
SSDEEP 12:DBl/TWni88/ykS2lcBDMGEJKM+vcBDMvYkMBAl2RDDDRnsrojAuK:DLTWr8akrEDE+vED8YfAl0k
TLSH
T1BFA35C9F1AA42692ED8925B1C38054BA6B7FC32DCB17DA92005490B39A410604A160B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\broadcast-listeners.json
Size 221B
SHA256 5d19a15457c508e53cc73171a3e1055ed7d33814e4f0106570f210d15fdfcf7f
MD5 dcceb1c521ecece6bb407359ca9f54c5
SHA1 105c75bb474f9b608612aaff2706d422d870c018
SHA512 d1fb4bb878c18b14694228918537e2c9053709c37660bf3fc0ece654bb5679637a3f3567220a24b330b15af9aba3a063a51e15d7cb04a9eea9322a8619eede48
TLSH
T110D0220E14137C7F8B4C6329F00427860B9B20093274903DC3AE31580B3AFFC44091D0
MD5 SHA1 SHA512 TLSH

Submit Download

cert9.db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\cert9.db
Size 224KB
SHA256 d214f58d979727c24f19ef8e6fd9480b898200d3edc638021567df71fbb393ad
MD5 a6073e1c940e574e0473ee9fe66343f3
SHA1 4d53e6807670bceff7d4949cdc308828d432838d
SHA512 b54c6da62bb80350d37cc74af7a9576364a6c6a9df0b8b8982a2ccb8343f7663f460a3ea634cbab462d95bd6e9dbe4afa2b13bddc26a7400f12e20a8e16bf421
SSDEEP 192:zOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vgdHaRPNnKoP70w+:K1zkVmvQhyn+Zoz67jcPVPQD
TLSH
T19A242FC2F820745ADF8A6D31B662DCF23D7227410385A422CE28993F1D64A1F67A68DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

content-prefs.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\content-prefs.sqlite
Size 256KB
SHA256 fff6c2239e0d2ccc2dfe16bece3f51fe2831ce8baaa337827bbde444207a727b
MD5 d3941a15a96fb3023cf1587a47b586b2
SHA1 94996d072eea6af88a1d96b8ef900a1fe3ea56ca
SHA512 d627318f49a185b6ad4dbd76c9eb5aef82c360ab76fed195641fbd258e045e1f04c0d6359827a9c31c677414bc656e183770c0d1b829821388db8bfd2608f364
SSDEEP 24:DLCKvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DmWwae+QtMImelekKDa5
TLSH
T1234426174AA17408C0B014B1D4636F22AF3D405B8933E7B23ABC143A4F886AAFC791E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\cookies.sqlite
Size 512KB
SHA256 d19f282be267f6c0a3edca9929330fc6179b893104ad6f959dfb9ecae41eea9a
MD5 23f6aafb298900861fa0d4c52e5e00d2
SHA1 9d1ca82c82b4e0b378adcc6599fc0923f849cbde
SHA512 ae477eefcf3dea53a8f4accb5061fc7de058ac99ea1589748248cd7828352b14e61d64382ce4c8a9a200fca38c27d08235f6adb85c31211d499a738b97db7369
SSDEEP 24:DQnS232mNVpP965RayKN0MG/lFNo4jhiFKk5QQWyoOc/37rmUNm8cqNpbM4Dz1mH:DQnS6rh9WTbNnwrQPOcvHdmipZ184
TLSH
T188B442C77978818ACD864AB2E820254E593DE614D81BD9AE6D14B0B75CC6D038636DF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.bin
Size 95KB
SHA256 ba7342dda3b79eed9bd36518e9cd2d44083ee2f1c66e504519b97025d8ba3205
MD5 73bb62fa7f826e0b3a8be769b77914fb
SHA1 e9515c67a6a13b87d7b981a842da59670388aade
SHA512 32d8df077983667a024279c16e2dbd619ca662f32b644cc75c9e4a21e4bb84abae683de52e91134bd48bcff2058024c01b7860277e4024643e2e505c1c445e04
SSDEEP 1536:SGX510amGIkgjJfd53pAZ0wZAmIuxQ94Yh1EWdRolL6x9UaNsak3:SGX5hdId3NZ/1XNoJ29UaNsak3
TLSH
T1C0A31180EB1A403FEC2442BF689617283B35F4654A596B1B3A6C00751DCB3FF2D5E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 72KB
SHA256 29276af482eeb2298358c7d2a0e9e6a6b8b7fe3b566125615b7fb4e868450dcf
MD5 d61eb6607bb7c3c986f3e63cc77872a4
SHA1 7532d2319da5714aa6a1329cdcef3409ba40ea4e
SHA512 e056f836ac78a6a1ac6a088cb07d86cde4df0d0d0ce37d2487ee6a088211e8f20773b92b45359b3a4ec7e4c50392923c71c4f059605f10cab1dbc31adb60e2d7
SSDEEP 1536:nGjJXYHDNEZ34oWjFD+08ZZJNRs0BXWUfgKJ8t+XvP:nGjJ65mqCnZhz4UtGeH
TLSH
T16273FF44EB1A953FD82802BA9CD21B007F79F8895A1A2B67371C54783D873DC3D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 520ba66b9e266ffb4c0034bc2ba7e312249f12f47a88b067572e3f0913ec7741
MD5 3459ba40d81c06cc61d1f8d69612a913
SHA1 610e2203316e1512edfd06b98be0cfaf6f4bf8e4
SHA512 b28167fc49d6b81f635debc0c4e606ce7fade31a674fb56631dbd1cabec888498a5d702db36a5ab3f6e5a06ec85594637cd4ab6fec2c64e527afd7b5615d80cc
SSDEEP 192:ROv5zbo7tZmAyjXdYoC1/66JoztdzgCl6mBNdz:OboJZmAyj9M/66Joz/zgC1Td
TLSH
T101E1EF64E628863FC404527BDCA21F454F3A384B984E3F1935AD644C2D572DE7B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 95KB
SHA256 f2473027d6a6f2821bd7cb73606d70880594e2e16424688cff611791b0bb4b24
MD5 f2beb38de1d6d5db5a47b450d4f4b310
SHA1 aa85ca635c08ceb594040bc4a6f9783dbead4bd3
SHA512 3976ff8a750179e3d0d1481cdc2185d8a43172a6663feb580cf4eee628a50dcd05ec023abf871f0e076409d1afbf1a97cde06862db6fa232264c95ee8afcb8b1
SSDEEP 1536:wGX510amGIkgjJfd53pAZ0wZAfWdRolL6+9UaNsakG:wGX5hdId3NqoJv9UaNsakG
TLSH
T12F93EF80EB1A403FEC2441BBA89617283B35F46549596B1B3AAC00751DCB3FF2D5E67E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f34e42b4234bcfecbff3f1ce055a9bde96bd5210d4bcbea42b7adb23d5392174
MD5 6ae03cdcc9f79db4dcee22c57886f742
SHA1 c656a9a82a8b9ddbb73045574fa8ec8e1bd1fd4c
SHA512 298748c83a23c099bbf1f1fa39602ffe4d26292e35c3821f36dd809c01e5710c29bebdc153786b771b506a3e121825d422f04116f23647e855f5f7fa1e629ead
SSDEEP 192:KOv5zbooZmAyjBtoC1/66JoztdzgCl6mBNd:pbooZmAyjAM/66Joz/zgC1T
TLSH
T18ED1EC68F629923BC418423BDCB61F400E76384B985E3F2531AD644C2D572CE7B8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3179c2885cc3a8f78598d7126858017d528cd9c6f34075c920407e931c8da18a
MD5 7a29128dc13f75f23d7a45ae30ba1f08
SHA1 5c57748303c5946e4b8f7f07bc9b95d791c1928f
SHA512 0cc61a7692b76d279da336c36264ab139272f778c6735cff6a9b2243e61abfcd3d1a40cac82e4658a0e35c26cf4ce8219e314970bc1ac856db4ae075d7bb59f1
TLSH
T166214C5C3AB84D6A688BF69CF44112CE53924E07449B2C830D63FF8DDD81AD9316A43C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
Size 5KB
SHA256 b8feca3befb565d4d5611dfa541d8942c421248f39e8aa9331b8a6edeffcec39
MD5 0f52eeb4f2aacb75208dcee03f4316e5
SHA1 2842f589e47f987731d4213dcee35bc0e28016a6
SHA512 2be285850c092207c3c69e2316f199f669ab6fa3545acaff8d20585e1a3a7afc5142cf55f6b029429ebbc9c4b0884709a0d006b908fad32ea310e4f33215a439
SSDEEP 48:YXcrcYAB539Zw5KpsNHKFi/hGOOm6JBB1f4HZLcLmOqdTg12YGm13dox/04J0vEv:C9wK6jg4HZ6qdVAdW1WMli5liXwYiz10
TLSH
T1BCC1FE1C66790CBE38C7E39DF841028D46CA4702C4DB2C874CABFE4D8D56E99315F469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e648e65b7ef6693b3386e681890b7d62e82df3177eb4b3d8d203939553aa6968
MD5 96cbfdf56082c434fe5b0d51ebaa3bf9
SHA1 fa2dc9ecaa9e0e500245115e0de02aa075f58e0e
SHA512 4d080f0dea3425bb0fbd133225685a80f7279c987be859cb208bb88d9006119037f9ef87e450fac134fa87e552b604a310b3dfab3bcf1004f1f24b52bd39f16b
TLSH
T17D214B5C39B94D2A68C6F3DDB440218E57568A06449B2C430D23FF8DCED1AD9326E4A9
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
Size 4KB
SHA256 f60fb70b4cdfc2216f69fa302d828c1217fcbbc3ae5539b6a5b944709f145608
MD5 da946edd44b8f5deed416921cddec4b9
SHA1 86dc793538f85232cb4bf10473846d2c44dd60e3
SHA512 4ef3ed89066b41de0fc1fc8f11ec6550b0953083fd6a2ba20048fbffd88430a45b3eb20c4128cf3e2a11088d87a3868c37365cbcb107e7e27884913878abcc7a
SSDEEP 48:YXcrcYAB539Zw5KpsNHKFi/hGOOm6JBB1f4HZLcLmOqdTg12YGm13dox/04J0vE8:C9wK6jg4HZ6qdVAdW1WMli5ll
TLSH
T133A1EF1D66B90C7E3987E39DF841028D46DE4B02C4CB2C874CA7FE49CD95E99325F4A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pageload

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\pageload
Size 845B
SHA256 5bcc55827049b23eace595e44f7554fedabf3c9db112b7291027cf75f1cb996a
MD5 27cd8f8a90cc770860d8745382e8b025
SHA1 7165d0a409a86e575f9fcf234b4552396b8af489
SHA512 ab5406c324487c6fd8e73bc7cd6b6d90a509918f910ad0591b2dc6e8c92677b66d01d672fa1bc8db1f0de699aceacaa3a2bcd3aefa314bab97f9841990265bc7
TLSH
T16201F11D6E24DC6CABCF603C7281C3EF6BC9A24311D67A131DB1DE2CC5C0A0920073A5
MD5 SHA1 SHA512 TLSH

Submit Download

2c43f092-1263-47b7-b663-07b7f0f9afd0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\2c43f092-1263-47b7-b663-07b7f0f9afd0
Size 235B
SHA256 3af427168ff617f0c463e3bdb3489954fe0ff20e737f9f9074eff1c55a515781
MD5 7c83fec09fb1b35d5a01499102e3faf9
SHA1 0e04e001a06754f2af9c52595976ada4528d67dd
SHA512 38592a66f1612c30130c52cf8e2446602c18b3170eed22579980fd0c63b81df68742a3ed7198982dcb953e135b33be4cf2c931d6db083cf3cbd52021b4bde89b
TLSH
T17AD0978434A8636C08120F07F0B12EC232884C3328659C20C6B29578FBBA9C64362C46
MD5 SHA1 SHA512 TLSH

Submit Download

56cb6fa8-e6a6-4135-a9e7-a55dcb6eb4c2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\56cb6fa8-e6a6-4135-a9e7-a55dcb6eb4c2
Size 16KB
SHA256 d1c6065b96ffc358f8bbe872adb800889815f84be9fbcd2451599897130eabaf
MD5 f3e79dcb8e87902d3c0a4b03334c3130
SHA1 2483289f09a7afbce2ec359c459030a9811f05a6
SHA512 9e1a716f07fe52517fb224855234be4821bf768939f83816018ef6d311fa9fd4382ca89c0e735d770c75630590276ee9efc1c7a4ed3cb44fb6940f93091354ec
SSDEEP 192:AqtZW8jEHip/QeUUl5j7ZheSs47Wsej82WWIhJmKSU7RijJizAu1pxWJvBgIlX+b:9tZW8NF3VyIbSU7RijMMA2y++b
TLSH
T1BD72EA56686055BA8551E368D4F87FC3E2F538CF4C019FCA8BE0BD0869DE0AE112788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85d33688-ea4f-45ca-b505-f2c88bcaa6bc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\85d33688-ea4f-45ca-b505-f2c88bcaa6bc
Size 883B
SHA256 19940161c579ebdb731e4f28963ac37ac811cafc2f8d102114352c29c5aeaddd
MD5 e1f217a637eca3b090c6dd63b5fd0c45
SHA1 d4e4c2f3c0f204de686dd9098a81ef2082d30901
SHA512 91cb96615ce59da6f04e4d4df179738372a0c8e0c1bba97935825da7796c25a58d518b0f7fa7c3afc2146ee98a2fa16a4205b53a4ae2712521dd7583d90b5400
TLSH
T1E211DC84D635B572CC28D24A8961BB028AE9781380C644143DA14E140EBA51E9B5B60B
MD5 SHA1 SHA512 TLSH

Submit Download

890a36e0-220e-4b00-b6ba-130fbf9644b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\890a36e0-220e-4b00-b6ba-130fbf9644b8
Size 280B
SHA256 8552c17a5108c1f57775dac098ee4bd5d8a2bad9266984795f377d8e37acd7cf
MD5 ee4ee582240c2a62f75fc9a02f20fa76
SHA1 82e61e2ceca4c5d36fda54e5a31d4e152730cb80
SHA512 27902e3d1cecaeff1a2dcfc61f5278d8e0f02cbdf88af695e65107dab4e8248ed414709bfc1b2c7959f7937313d40b84e7dd0d4f86dda7ae0a58eab67c16de59
TLSH
T125D02B906C89277D0C7C0F07B1B028E77AA58C3611F55D5496D10578D6FEDD9412194A
MD5 SHA1 SHA512 TLSH

Submit Download

a03e2ea7-d2fe-456e-9475-bcde9a9c363d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\a03e2ea7-d2fe-456e-9475-bcde9a9c363d
Size 235B
SHA256 c7ac28a85cc12a96699fd12223e0e1f1db02343d8f314120765ae824d429cee9
MD5 e3a78f4f29e8d676575985b28cba47d9
SHA1 d783ed26147bcc1090f2851effbcc6ceed89a590
SHA512 04c338b1a27006ccf9962ec6d632956988ba42548f97e23ae03139c0775d242016679bdade477e9831d5ff56d3bf2d2d1ee0546c70490df0af9ea89580f0139c
TLSH
T1C7D097D154887F3C48004F03F0E168D730488C3328B4B8609E910878AAF8DC45191806
MD5 SHA1 SHA512 TLSH

Submit Download

b9e2d2f8-bde7-4b81-94bb-1e261945f4ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\b9e2d2f8-bde7-4b81-94bb-1e261945f4ec
Size 2KB
SHA256 b0c6868550a4d18f599a8e10e9e8bdd1d5c2ae21c46a2a2ca2d1e0f390461bc8
MD5 a40f939a9011c3f7be60d71ef1646044
SHA1 0d457df51683b45bde7e658a03f8c3d2c53a0203
SHA512 95b80b8416280de2420482b0e0c6851b42dffc9d43ea02d6cfabf731648aae558d87c70db3b50af3753d6310b6e8806cdbb7affd63a87cc5c586c27210b52603
TLSH
T1DD41739C35785D778CCAF58CD492338ED3A1990310C618572DA2DF0CCE866DE33AA62B
MD5 SHA1 SHA512 TLSH

Submit Download

be0b72df-434a-4e82-a8b3-c1eb080e325e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\be0b72df-434a-4e82-a8b3-c1eb080e325e
Size 972B
SHA256 9959b392863ff8666d4fc4899d655081812bdf52888fa708cf4f9926d53f295b
MD5 8e548c88e02340b6dbf73ff12e4245ec
SHA1 d5bfd8d80565a211a33396cbf2cf87022dfa5305
SHA512 f5937cd883405b3cae9cfd89ba6798392addaa9a66d5977c01e5f4bcfbb71c81e5bf1adcf8ab200fa6db6f9408ec97e7c918c081f17c241d42b2fe8b1eed35b0
TLSH
T1671121509528B572CC7CD28BA4A17B83DAF5742380C60A243EE15E080AEE91FE75770B
MD5 SHA1 SHA512 TLSH

Submit Download

be238b12-f7b8-4d09-94bb-2696fddc7e10

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\be238b12-f7b8-4d09-94bb-2696fddc7e10
Size 886B
SHA256 2ade6d835970d94d0bf1261843999ee1d35cd0a28de53a824f7db8ffa8fcc9ce
MD5 1ec3aa948b7d9958402b5db4e2e56fee
SHA1 1cf6f2d2c1de7cf5e2ba918da77f5d76a41a463c
SHA512 0ed807463a8d8edfe524b60d52472c1eaa1d10805bf3d6e27552006990065a8c49c09d07dd3fa4201f1a63f0852b8143f6a89e1641ab7b5b8902448d4e21a5c1
TLSH
T1141104409575B572CC3CC24B94E57B42C6E5742380C609143D915B180EAF65F9BA6707
MD5 SHA1 SHA512 TLSH

Submit Download

c5f1258d-0d81-4294-bee5-e36ab7f0e578

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\c5f1258d-0d81-4294-bee5-e36ab7f0e578
Size 6KB
SHA256 535b0ff2fe9c2924967e66b55df9d4d9e329a756ff382470821923886f33bad6
MD5 a879bee89e2175b7ba65fea3e5854534
SHA1 c9a5cf0f52aa3ec9678da383387ded67fad33b5b
SHA512 7c3bb0d960d1cc30ac05a14659ee54d3afe9d035dbecfa1e84a2d9b7a4d0a76f368d8bc79f25c610b729369352e1af21f5e65c63fb4d817f3bf2c4ad4dccfd59
SSDEEP 96:vONsSKEoVGepkJC4UocqdT+dUrKwHIDvYsOhA/lS:p0OdaT4UnHIUXA/lS
TLSH
T149E1211C66790CBE68CBE29DE443128D87DA4743C0CA2C874CA7FE484D96E99325F566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dda3a908-6649-4a04-baca-adac9958cd49

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\dda3a908-6649-4a04-baca-adac9958cd49
Size 17KB
SHA256 8cebca05ff3bb562b53d5f082b48566aadb618ac1eb72ec82c55a013f12cfcf1
MD5 7054304b0e973ebcd0772e835710b18a
SHA1 9b734fc91e05742ece9bcd58d5b83d0341ea18f6
SHA512 5fbd03d31b609fd9b7a488053c81a371f9463bbb10a2b1eb912b23527de637bdec04aa0ce6a1c07d2b5726eedaa05b9be9eb4d8de6a32e173dbcfd5f6fcc1239
SSDEEP 384:Oh6gDj3SQS5pv+jJiYxevhXJyqaFugBooTpk0jTfmzdf51E6:Oh6gDj3SQS5pv+jJiYxevhXJyqaFugBe
TLSH
T1FF82C5FDCE1240473E65E52EF2A5EDAB2057293109CCC79D6AFC483A36D69BB1127318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed23d01f-a16b-4d2c-98ae-3a10285df012

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\ed23d01f-a16b-4d2c-98ae-3a10285df012
Size 10KB
SHA256 791fe48ee3573d26a45efeae66614eb6e7d0921f735b4a2782f2b5107e0f9a09
MD5 8e59add7e053674d855e947250dd7b68
SHA1 cb225939912a6cbf01d752878fcc6a9c2696d5bb
SHA512 782b8b87fa3f070fe7111114b792f9436adea0fbc61ceeea95e44826caac23addf995f0b5f1494f3de0e01e71a17327b7e24daf0f95d38fe29567b9aca54cd1b
SSDEEP 96:sDRvYJNAUhv/NZcZpEdyUgbYCzleByCOBurixb0WgI6vurO2J5QJDsQ/5w8/TDba:s1vvr0wnMocSKUpuh5zcN
TLSH
T1E122CBFDCE12404A3D65D61F76AAD52B305B293249CC869E7FEC443A0ADA83F112762D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f576302d-3690-4f2b-8e2a-c8fe23259d3f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\f576302d-3690-4f2b-8e2a-c8fe23259d3f
Size 1KB
SHA256 ba78351221c04ecdc9eecd8eaa4fa58f99c48bdec9770ef65772499b77ce98f3
MD5 8801fdaaf82e773b8601738632fa0d08
SHA1 d0629f2f9b9f78ab513470e1436bfa670ba0c351
SHA512 c6e5e5335999f66a0fcf4340b54783b7be8513685bae6d9e61ad267c281dc6c2ca790ba2b20e0055efce93420847ea2732d7e0c9859b411644d3b9a7cb3a4ee3
TLSH
T1AE21621D4904FC799FADA21C91C7B3EFD7E4A15300C6A5222CB0DE2CC9D160B0113746
MD5 SHA1 SHA512 TLSH

Submit Download

domain_to_categories.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\domain_to_categories.sqlite
Size 96KB
SHA256 c7baab1cd8662625bc822a3c3c7b57973b927cd5c26192d6cda60ed9ecc0ed07
MD5 7231237395096e88196ba0ffd7ac0ac6
SHA1 d303ddfed1d4341f30ed79abbc23ce51f651bd35
SHA512 6220c9908bfa889f1db84625dc214127ee76c40c97a0d2b81df251253d4a8cc7ba6387d94f751a8f092850ce8a86d5c7e0d7938b85ef763813c4ab4a0834055c
SSDEEP 12:DBl/ATMbUSoQym5H9L9ftirhP81MONd4/F0LA6Gr:DLbbv5XvtQhP8W5/b
TLSH
T1A6A32B1F1B1CB840D4C356F26D8329067634D50B8913BEF03B9D84004F066481C35AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\extensions.json
Size 16KB
SHA256 7ab47ff676753e810df775aff247d35da1bc7151cea9e931090a3bf359d66067
MD5 c6b9073e340896e6384554de1f781a4f
SHA1 c4b0dee48f2d54fe44f7afbf41ac0bae37f0dab7
SHA512 e38dd2593a0cbb7ac3628d5f0f935e727f22dfe505c2b42e7fc992aa408bd1c48eaf8c390037a852f3442039b374fe67af0139004b8e098cd3777fc0b4ff0a66
SSDEEP 384:ckI4v0jUmldvX8dhWS94zk96oDeL4HSDL4PupNL4HpL4HHL4HH44h3:zI4gRf0Xz4c6Wk464WN4h4L444d
TLSH
T1CC72421545008EB8294FA78AAA36BE01C37D473B60855C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicons.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\favicons.sqlite
Size 5.0MB
SHA256 c9641ec3a75809c1322a9698bdf8f0dc1cfa4e25c1d05b8bbc72b04699ae074b
MD5 9cde908a0efe68ab33c101f50631a738
SHA1 77baab62e28d3f02cd984f3fbaf5618f701e5766
SHA512 59bc4a3b9b16f4ec948370d991937caeef8349f3472ce18ff0d8e1ffee13f43656820b49c330b0e6d3e67d68399c3070ec9f208c5cafa4b1f497e8b4e5739318
SSDEEP 768:IIZ6ZzBZzQiB7EjEJrdpKrBpvQWhIzQ1+ogYYO2x5qTPlS:h6HlB7PrjKjvThoQIYYOTP8
TLSH
T15D36E0966204209DD709DB33FC8356023A2FB25CDEF79B9B30589270DD3B96CEA41497
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

permissions.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\permissions.sqlite
Size 96KB
SHA256 a048f9434da1c467fe71303e34f8c7c1c57ba2e0b54de14944df22bf07b477e2
MD5 b3c3ab1c82a2ad3fa5db54b94748637c
SHA1 3df2c562fe1104434b2c331ee404d453d1fe63c1
SHA512 b9f6eadc252e2846135592d374f84d564ea79cca39390b47f092896f3ea351375b36ff1c10d77aeccc6d9fa03d837e4ea43a020ac48d6445d9add0effb355211
SSDEEP 12:DBl/T0ygbWla0mwPxRymgObsCVR45wcYR4fmnsCVR4HltX0BAZHElX8:DLT0jb5sh7Owd4+gtIA
TLSH
T1E6A376A75C3869E2DA8186737D826298603F48098C5FFAD80DC2403B8D438D6DA05AFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\places.sqlite
Size 5.0MB
SHA256 c287c34698e02ebdc22347b0ee00946e09a0649d7cc92d2282d02f4e380fd544
MD5 62d71d4d136efe4004aa694077028574
SHA1 6dcaa51bf4d8d15f0af4ec55e7d9976f02aa2e49
SHA512 a749b1f612c35379a46afc4ac926ba4c76cdcbe072c451f20f9558cb87ed73e91df7f8708c40b9f8eaad800719c1d079af7a57e671d603c22e83dfc83ba21130
SSDEEP 192:M8rJQaXoMXp0VW9FxWnhEIeg0pA7FETlFyAOcTm:M8r54w0VW3xWnhEIexpA7F
TLSH
T1D136645F7A605051C4DA9532ECE26F19183FB21BC63676833D94256E4DE0B23B92CCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 12KB
SHA256 20ec4ce6b59abb902c9bdbd2c5ec0971e76276a50998e7230883abb0a2b40528
MD5 24f422a1e65d2a3dcf49ffec3052c306
SHA1 b6e4e2e10fb2fea05989caa7bddbe2195a7012e3
SHA512 50312032773bc2081263d29f9a6948e05b333ca8bc96fb6cf9f241ca36bbe14a37e98c580d1216f2ae846b1270f2a4f838a6fb9c998e5682a2798b8cffaaa60c
SSDEEP 96:xHpNTUEPqGqofwUpNbzSWSSlcdv9junUpwoDRN0YElbkOBw88Eyokz3iTr2B8L4U:npCRofwUpTSSqLR2Y1OBw88Ekz3iTr5
TLSH
T10C42CF3C91088F3F34B2327DAC255AB019A24237B6BFBCD745F9A492054CF6441E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 7KB
SHA256 b73201bd760e590243af4f3294e1fbf6004d909940be7fe835a9899440346d47
MD5 c6d4880d40f7205f6db8d37ae1d8c953
SHA1 04a3f4a0ae24bc2a77c35f32c60c6454f15f311f
SHA512 2ff65d018ec896237bff5f54f6917a6ab1fb1141bb0838b5bbc21a58cf26bed76be765c40b48fd8836814fe58823f99158e27aa5d1307b9a6ade144032bc1fe2
SSDEEP 96:xHdNTUEPqGqofwUpNbzSmSSlcdv9junUHgYE+Bw88wSY8L4cn7/T5GS:PpCRofwUp7SSSgY/Bw88J
TLSH
T1BFF10D7C91088F7F78B276BCAC64493159B2023BB7BF68D610B95485054CF3842EA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 6KB
SHA256 c49027e09698ed64313ed7683c90a61af1ce442d5fd350dc0bebd02e5615932d
MD5 eacb9f9401cf255487ce1ea27a92c408
SHA1 bb0f0aa2609bac0a4a520fe0af44a7a0c961d497
SHA512 c6ad196cb0731be70ae79b1ed607beb77f2f205a84ec08039e15b262b8ecd231abd3c338a0873675d0803f775ddb5ec2825a1e906390995e39c2870fea039be2
SSDEEP 96:xHdUTUZqGqofyUpkzSmSSlcdv9junUHgYETBw88u8L4cn7yT5GS:P0RofyUpMSSSgYeBw888
TLSH
T195E11F7850088B7F74B677ACAC688C315AB2013BBBBF68D710B55485054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 11KB
SHA256 da8cb45b0f7e0ad33ba14d393effc714d6a49f96ec610f09703379d8b4d996bc
MD5 0f001ac5225d2555833c7e170da919a0
SHA1 7201935e3d245678f1ee24e92f6c836f32a66911
SHA512 ca7e135dbbb8b7706d29eaa21e4aaffb7e46d23fe7d49e32ae8ef702da194897c44f808701b9322fa7aa474d2613c47a99145a01472265328d9dcaa9b0dbaaff
SSDEEP 96:xHpNTUEPqGqofwUpNbzSmSSlcdv9junUpwoDRN0YElkBw88Eyokz3iTr2B8L4cnr:npCRofwUp7SS+LR2Y9Bw88Ekz3iTr5
TLSH
T15442DE3C91088F3F34B2327DAC215AB11DA64237B6BFBCD245F99492045DF6441E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 7KB
SHA256 49af97fcdea8411996fbe96a1adf355fb21cd8c073dde7bfc42124dd75225a38
MD5 070c6788730192a3ef7eae38bce21049
SHA1 a9cec4b14cf8dcb3270c156d21be9575d4c0c21b
SHA512 cc9b92870995dd935fad79fb9b8f98815533618c842b8874f10a27dea018677bca9c654e16c421c42056061a917335c6a1604f618081de2540b615b8d624c749
SSDEEP 96:xHdNTUEPqGqofyUpNbzSmSSlcdv9junUHgYETBw88EY8L4cn7/T5GS:PpCRofyUp7SSSgYeBw88k
TLSH
T10CF10D7C51088F7F78B276ACAC2449315AB2013BB7BF68D610B95485054CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 6KB
SHA256 75ca66674e6e8652ebaff4edefd29bbaf884fc3068269997fb3f53f3d317364c
MD5 1ca45466210e04ab2c2450a0df97a847
SHA1 5bf2e5ef919f2508d02e3265ca2617164e6957bb
SHA512 0f20f48042e6aa4ffd3675f6d229835c946c4189f5b145c0e2e7d35b7f874361713256e17f04fc08717fdb23100d36e7179d64d1a032686656c05b2a0b603081
SSDEEP 96:xHdUTUZqGqofyUp1zSmSSlcdv9junUHgYETBw88u8L4cn7yT5GS:P0RofyUpvSSSgYeBw888
TLSH
T1E5E11E7850088B7F74B677ACAC688C315AB2013BBBBF68D710B55485054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 7KB
SHA256 3f451ceed1a676ce67d3ffb846840d749f630b45771d4d85b6c91d06f7baf183
MD5 a4cc8ecaa747fe75cb9718834a12f0c6
SHA1 0fcadcb21bccdd3af497ac30a51bb4c17f14377c
SHA512 17d56e05dcf9647e791de45afb0b1f00d9b5e1a72154e3e2bad68dec8e7083de4484e5a62b7fde1c24911ff18e6286b392b79029195f91cd7cbea366b42faa45
SSDEEP 96:xHdUTUEPqGqofyUpNbzSmSSlcdv9junUHgYETBw88u8L4cn7yT5GS:PUCRofyUp7SSSgYeBw888
TLSH
T1E9E10F7851088B7F74B676ACAC688C315AB2013B7BBF68D750B55484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 6KB
SHA256 8ecb2467177ebddc4cb064b5dc9c030dd0610e54e084304a697da0cd6cb97e5d
MD5 919bfa7d336e12b18367a627f5a64cfb
SHA1 932db1182ee8ed2dd894514da158155161aac37c
SHA512 d97e1ebef0acebcfa3b7f049320b6e34c883419b59d86e433dea5aff6f89b27ed85c675bb39ed7c6c1f414f9d23b96af8ce8e2cf299291cabe6e6842e3147107
SSDEEP 96:xHdUTUZqGqofyP21zSvSSlcdv9jznUHgYETBw88u8L4cn7yTM:P0RofyP2WSSrgYeBw887
TLSH
T133E1207850088B7F74B677ACAC648C316AB2417BBBBF68C710B55484054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 12KB
SHA256 eaf02bfedf7c6b812463c90b0d61759cd70c918860ffd8b5e2d0c9de9717a9db
MD5 c4fead730d028b7bcd8e3bcbeb7eb976
SHA1 c018260acac08de6458fe19e299310cc067c11c5
SHA512 8cfc01a49e6fc80ef9bbd0e0916860841dcecb98739b02e216bc45c04fd633605b6aa8a35ff4abac924b18133bff9d65fce466c25685531f4dc41becd8becbc7
SSDEEP 96:xHpNTUEPqGqofwUpNbzSmSSlcdv9junUpwoDRN0YElbkOBw88Eyokz3iTr2B8L4U:npCRofwUp7SS+LR2Y1OBw88Ekz3iTr5
TLSH
T18F42CE3C91088F3F34B2327DAC215AB119A64227B6BFBCD745F9A492044CF6441E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 7KB
SHA256 e42eccebf01739dc73a4b05bfe812e680825a6edaefe40d7643bb3c4dd61500d
MD5 153ac65b505e35ea0712c71751916a96
SHA1 d20670a6443e5bbe76728377fb021cb414e4a01c
SHA512 153bfebd4718772a831a937c4dceaffc6a62e2932458552309f4f8b18c603e8bacedd09853f87d2e5ecf226434becd4bb61e92c742bd53ce3825fe9cc0ec1511
SSDEEP 96:xHdUTUZqGqofyUpNbzSmSSlcdv9junUHgYETBw88u8L4cn7yT5GS:P0RofyUp7SSSgYeBw888
TLSH
T126E11F7850088B7F74B677ACAC648C315AB2013BBBBF68D710B55484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protections.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\protections.sqlite
Size 64KB
SHA256 f47973dd13805200a469d534a0ec50e224f0c12ae77d93a0e5bcc267af19c145
MD5 63b6f9d979a2cd96d93c105805cafcfc
SHA1 5fc70ce8799617202d1b2a350f6d596b65d48e54
SHA512 ca475720928bd40abab686efb8b890fdccef59c292b26263d41bfd9dfe8f35d21405820e10505fa7cff49eea5ae57ffdbd6ca73d5cf6e1cfe67f5994d2823b90
SSDEEP 6:ltBl/l4/WN1dR4BEJYqWvLue3FMOrMZ0l:DBl/WunddfJiFxMZO
TLSH
T1BF53225E47387021C0891372ABD323923F3CD2FA93232E836A100C358C0A023B822AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionCheckpoints.json
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 4744cb5dd4358ffaea6e59e2f64542a93f42fcb5f2289b9e0e1f57a3a22462d6
MD5 1bf3de610603a5360372444a2313df27
SHA1 8095d188b8c1a428b7318f64f26e7173f60ca649
SHA512 dda7a59d641fcba0cd32fa760d97cfdd20e906695c5851035ba7d7015d745c99ba1c4de2834c81106aeec06dc0d91af96e9dba8340e9673507ae9b265ffce6e7
TLSH
T17451290BFE7E6CBA0906B4BBD0CDBF0D7246043B492149B0CA6C6B608445648365F3AD
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 3e70877ac4bdbdd90aca5c79d12bbf9145ea60f13f1714dca7b7d757b7448db1
MD5 191ed1930250bf8c3be2d1dc26af24bc
SHA1 02ab85dbd40c86d967071018bc1b166e116caed9
SHA512 f0ecad282da30c1636274386965ebc3e227d7308f8f385ad49e1940d4f254de9ac9104282bdf7596dbf1cfdca3c73af7e55163e10cc112bcc23536e63293818c
SSDEEP 96:I2h2O8jACh15E9UyAhlny16FO1M9cUJOI8nSx2OiIeIFxrYfpTXY:IfEChc9xK6JM9RCX6eIDrYu
TLSH
T1D9B16D7FF9285CE20530F1D488D87F2C23CA6056DBB61D908F2C57A188491C5276C2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore.jsonlz4
Size 5KB
SHA256 64dff32c4d8607999ca3046b37203cc9765d38da3dbe5d6fd36a2f163e140474
MD5 72fb2d2972288501f55391ab99c68f54
SHA1 d679b7a1643f24bcaa9788491d82fd453db770e1
SHA512 09ab16f8a92da60311185f1b15bd426638655657b162dcb898169a7db6ae07d7864f420b984579d97bae4d38338d7d35c977f41ba0a45cac8a9256ff666dd955
SSDEEP 96:g2h2O8jACh15E9UyAhlny16FO1M9cUJOILnSx2OiIeYhmfT9ihz:gfEChc9xK6JM9RDX6eYsM
TLSH
T1C2B15B3BFE696DE20534F0D548D86F2C33C5615ADBB61E50CA3867A1888A0C5272C2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage.sqlite
Size 4KB
SHA256 2fdea303fc84fb460daa8df14939edeb6719e3632272fd3febbe095eb79829f7
MD5 7afa0793f70ec62c2bdc05ca136d91a4
SHA1 ceb38c6f15bacb81f35bc5c4cf4bbe515dbfd204
SHA512 8c3be15d1d015712f52a7cc869099ed7500f9ca39c9b33a5c0eaf4d7e72fc276c859636596f6e00139565beb6ec18fd14f071431b1519bcc6a6b6f779e061449
TLSH
T16181888F0F107500C1B0A7F1E5E01E929E2B210E8B5785C72EA151FACAE34925A1A4B9
MD5 SHA1 SHA512 TLSH

Submit Download

1657114595AmcateirvtiSty.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Size 48KB
SHA256 644438ffbcb9cf485f2cb1c007034eee39a7d287c60df1695fdbd5398e0249e2
MD5 9dede61469ccc167de5188ae9924fa9b
SHA1 3b39945580fd67a7c4cbae2a6a3c3f57ab653703
SHA512 3591a2be534d8930227594c63c34f30daa7c1360354523f4826263a3522a6c0e1032ff3e8a455970e707d92b68ac240ab89d8a4fb10ea19bf6bac475e75a6ea4
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEmkBV:Oa16S6CKnqlizbxV+2xVeU7X2B0mKV
TLSH
T17D237F8E3F07A511C57AF0B178A08D51BC5E321D07222AD669D0DAE4C8F215AEA1F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.3MB
SHA256 93fa8c6ab36830b48e00d8adcd6ced8026eb046edb338db1af5007fc6ce06ed4
MD5 ae3455b8d0c4df1ca971d889ff8bd4a9
SHA1 f5580bbc690c512bba8d5faa85d8b810dd8b889e
SHA512 8bd4a54eeceb7fc87b8627e3c9fa3a3fc295d40c6fc0217bdab14eb1b979766b4a6e7ccb9c94f0caedcaaf99d34a2dd4a3a1d5449f83a29b300035ceb4e58579
SSDEEP 49152:3LkLy3aeUa6QC5zYY2XyAJgkFZIYPZJsYiLsDN+Pa4VjIwi8UXEX9rYY5EqMPxKW:T92z5EHZKyX9LGHPw/
TLSH
T18F765CE420E19253F38644B3719993FB20EFC01C6036CE44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 efe316484d7783d8a40362b9df18aeaa44b3972d6952ba9780a2f0d86e3a3de3
MD5 54761a53e63b17da4c436643df38636a
SHA1 4a41bc024b291ffd8256474b358eb7bff74cbaf6
SHA512 1f67b713d8e6b983c8f90ebccc01917ac7befa3339b92a8224f1b1caa180b3d93950e91af5d24664a1bb850cad0b3b2957355b2f2366506e4b4dfad62dba9de3
SSDEEP 49152:yMcETBx27MCaUYV/isqMkxK+C/1GC1o8p0:vceNisHMKt/1GC1o8K
TLSH
T1A84629F820D1A257F3814033764993EB21EFD00D5037DA085BA95AE9A574CEF8E17B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

memory/1484-1504-0x0000000001160000-0x000000000126C000-memory.dmp

Download

memory/1484-1505-0x0000000001160000-0x000000000126C000-memory.dmp

Download

memory/1484-1506-0x0000000001160000-0x000000000126C000-memory.dmp

Download

memory/2684-1486-0x0000000000540000-0x00000000006DC000-memory.dmp

Download

memory/2684-1494-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2684-1495-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2684-1484-0x0000000000540000-0x00000000006DC000-memory.dmp

Download

memory/2684-1492-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2684-1485-0x0000000000540000-0x00000000006DC000-memory.dmp

Download

memory/2864-1498-0x0000000000810000-0x000000000091C000-memory.dmp

Download

memory/2864-1497-0x0000000000810000-0x000000000091C000-memory.dmp

Download

memory/2864-1496-0x0000000000810000-0x000000000091C000-memory.dmp

Download

memory/4984-1521-0x0000000002190000-0x0000000002191000-memory.dmp

Download

memory/4984-1575-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4984-1520-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4984-1522-0x0000000002190000-0x0000000002191000-memory.dmp

Download

memory/4984-1523-0x0000000002190000-0x0000000002191000-memory.dmp

Download

memory/5528-1491-0x0000000001020000-0x0000000001114000-memory.dmp

Download

memory/5528-1490-0x0000000001020000-0x0000000001114000-memory.dmp

Download

memory/5528-1487-0x0000000001020000-0x0000000001114000-memory.dmp

Download

memory/6304-1515-0x0000000000820000-0x000000000092C000-memory.dmp

Download

memory/6304-1517-0x0000000000820000-0x000000000092C000-memory.dmp

Download

memory/6304-1516-0x0000000000820000-0x000000000092C000-memory.dmp

Download

memory/6684-1524-0x00000000002E0000-0x000000000091D000-memory.dmp

Download

memory/6684-1511-0x00000000002E0000-0x000000000091D000-memory.dmp

Download

memory/6684-1503-0x00000000002E0000-0x000000000091D000-memory.dmp

Download

memory/6684-1528-0x00000000002E0000-0x000000000091D000-memory.dmp

Download

memory/6684-1502-0x00000000002E0000-0x000000000091D000-memory.dmp

Download

memory/6684-1519-0x00000000002E0000-0x000000000091D000-memory.dmp

Download

memory/6684-1483-0x00000000002E0000-0x000000000091D000-memory.dmp

Download

memory/6908-1512-0x0000000001300000-0x000000000140C000-memory.dmp

Download

memory/6908-1514-0x0000000001300000-0x000000000140C000-memory.dmp

Download

memory/6908-1513-0x0000000001300000-0x000000000140C000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads