Resubmissions
23/07/2026, 13:30
260723-qrybfazdpd623/07/2026, 13:29
260723-qrnr1adm5w123/07/2026, 13:25
260723-qpf95sbb5910Analysis
- user interaction
yes - max time kernel
395s - max time network
397s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 13:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Endermanch/MalwareDatabase
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
General
- Target https://github.com/Endermanch/MalwareDatabase
- Sample260723-qrybfazdpd
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 3 raw.githubusercontent.com 15 raw.githubusercontent.com 16 raw.githubusercontent.com 17 raw.githubusercontent.com 50 raw.githubusercontent.com 51 raw.githubusercontent.com - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2548 ScreenClippingHost.exe - Checks SCSI registry key(s) 3 TTPs 44 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 ShellHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe - Checks processor information in registry 2 TTPs 25 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ firefox.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\MuiCache ScreenClippingHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ firefox.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\NoMoreRansom.zip:Zone.Identifier firefox.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 6688 TextInputHost.exe 6688 TextInputHost.exe - Suspicious behavior: LoadsDriver 10 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 828 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 1268 firefox.exe Token: SeDebugPrivilege 1268 firefox.exe Token: SeDebugPrivilege 1268 firefox.exe Token: SeDebugPrivilege 1268 firefox.exe Token: SeDebugPrivilege 1268 firefox.exe Token: SeDebugPrivilege 1268 firefox.exe Token: SeDebugPrivilege 2548 ScreenClippingHost.exe Token: SeDebugPrivilege 2548 ScreenClippingHost.exe Token: SeShutdownPrivilege 6900 ShellHost.exe Token: SeCreatePagefilePrivilege 6900 ShellHost.exe Token: SeShutdownPrivilege 6900 ShellHost.exe Token: SeCreatePagefilePrivilege 6900 ShellHost.exe Token: SeDebugPrivilege 1268 firefox.exe Token: SeDebugPrivilege 1268 firefox.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 6688 TextInputHost.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe - Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 2548 ScreenClippingHost.exe 6900 ShellHost.exe 1268 firefox.exe 1268 firefox.exe 1268 firefox.exe 6688 TextInputHost.exe 6688 TextInputHost.exe 6688 TextInputHost.exe 6688 TextInputHost.exe 6688 TextInputHost.exe 6688 TextInputHost.exe 6784 ShellHost.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 4136 wrote to memory of 1268 4136 firefox.exe 89 PID 4136 wrote to memory of 1268 4136 firefox.exe 89 PID 1268 wrote to memory of 2700 1268 firefox.exe 90 PID 1268 wrote to memory of 2700 1268 firefox.exe 90 PID 1268 wrote to memory of 2700 1268 firefox.exe 90 PID 1268 wrote to memory of 3916 1268 firefox.exe 91 PID 1268 wrote to memory of 3916 1268 firefox.exe 91 PID 1268 wrote to memory of 3916 1268 firefox.exe 91 PID 1268 wrote to memory of 3916 1268 firefox.exe 91 PID 1268 wrote to memory of 4468 1268 firefox.exe 93 PID 1268 wrote to memory of 4468 1268 firefox.exe 93 PID 1268 wrote to memory of 4468 1268 firefox.exe 93 PID 1268 wrote to memory of 4468 1268 firefox.exe 93 PID 1268 wrote to memory of 4672 1268 firefox.exe 94 PID 1268 wrote to memory of 4672 1268 firefox.exe 94 PID 1268 wrote to memory of 4672 1268 firefox.exe 94 PID 1268 wrote to memory of 2552 1268 firefox.exe 95 PID 1268 wrote to memory of 2552 1268 firefox.exe 95 PID 1268 wrote to memory of 2552 1268 firefox.exe 95 PID 1268 wrote to memory of 2552 1268 firefox.exe 95 PID 1268 wrote to memory of 1476 1268 firefox.exe 96 PID 1268 wrote to memory of 1476 1268 firefox.exe 96 PID 1268 wrote to memory of 1476 1268 firefox.exe 96 PID 1268 wrote to memory of 1476 1268 firefox.exe 96 PID 1268 wrote to memory of 3788 1268 firefox.exe 97 PID 1268 wrote to memory of 3788 1268 firefox.exe 97 PID 1268 wrote to memory of 3788 1268 firefox.exe 97 PID 1268 wrote to memory of 3788 1268 firefox.exe 97 PID 1268 wrote to memory of 4796 1268 firefox.exe 98 PID 1268 wrote to memory of 4796 1268 firefox.exe 98 PID 1268 wrote to memory of 4796 1268 firefox.exe 98 PID 1268 wrote to memory of 4796 1268 firefox.exe 98 PID 1268 wrote to memory of 2488 1268 firefox.exe 99 PID 1268 wrote to memory of 2488 1268 firefox.exe 99 PID 1268 wrote to memory of 2488 1268 firefox.exe 99 PID 1268 wrote to memory of 2488 1268 firefox.exe 99 PID 1268 wrote to memory of 292 1268 firefox.exe 103 PID 1268 wrote to memory of 292 1268 firefox.exe 103 PID 1268 wrote to memory of 292 1268 firefox.exe 103 PID 1268 wrote to memory of 292 1268 firefox.exe 103 PID 1268 wrote to memory of 5256 1268 firefox.exe 104 PID 1268 wrote to memory of 5256 1268 firefox.exe 104 PID 1268 wrote to memory of 5256 1268 firefox.exe 104 PID 1268 wrote to memory of 5256 1268 firefox.exe 104 PID 1268 wrote to memory of 724 1268 firefox.exe 105 PID 1268 wrote to memory of 724 1268 firefox.exe 105 PID 1268 wrote to memory of 724 1268 firefox.exe 105 PID 1268 wrote to memory of 724 1268 firefox.exe 105 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Endermanch/MalwareDatabase"1⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Endermanch/MalwareDatabase2⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {13c7f675-e60a-4474-88bd-f66f4afb5bba} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:2700
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27133 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2464 -initialChannelId {8c2a55aa-2933-4655-a028-1e18d3c762e7} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:3916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3796 -prefsLen 25164 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 3804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {c3c2a261-923e-4453-83f8-db0cbd390c38} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:4468
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27274 -prefMapHandle 3968 -prefMapSize 270279 -ipcHandle 3976 -initialChannelId {e9a7b44d-fa92-4656-ae5b-32d388dc5edd} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:4672
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1720 -prefsLen 34773 -prefMapHandle 4536 -prefMapSize 270279 -jsInitHandle 4540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4548 -initialChannelId {ad60d6e8-2250-44de-9741-742ace3a761b} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:2552
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5192 -prefsLen 34822 -prefMapHandle 5196 -prefMapSize 270279 -ipcHandle 5204 -initialChannelId {afc3fecd-5dfe-4c9c-b17d-286e1dd80775} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:1476
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2644 -prefsLen 32952 -prefMapHandle 1612 -prefMapSize 270279 -jsInitHandle 5096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3088 -initialChannelId {17da4f12-d350-4578-a724-1f613c4a4b22} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:3788
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5876 -prefsLen 32952 -prefMapHandle 5856 -prefMapSize 270279 -jsInitHandle 5864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5656 -initialChannelId {2e9f2f1a-9a14-44d1-a79c-12aa2290201f} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:4796
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5916 -prefsLen 32952 -prefMapHandle 5920 -prefMapSize 270279 -jsInitHandle 5924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {684147e4-62dc-4c40-a8d0-2ed507b0d0af} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:2488
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6312 -prefsLen 39943 -prefMapHandle 6376 -prefMapSize 270279 -jsInitHandle 6392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6592 -initialChannelId {8c540b07-2aa0-41dd-9572-a4c20e101d23} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:292
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7056 -prefsLen 36925 -prefMapHandle 7060 -prefMapSize 270279 -jsInitHandle 7064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7072 -initialChannelId {902d81b3-5dcd-4ae7-8980-51bdefb7e7e0} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
PID:5256
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7308 -prefsLen 36925 -prefMapHandle 7312 -prefMapSize 270279 -jsInitHandle 7316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3176 -initialChannelId {41163595-59d5-45e4-817c-9012c7f182e1} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
PID:724
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5312
-
C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppXvj4keqywbrw1mydqk4hd4832qv899sb2.mca1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2548
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding1⤵PID:3592
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:5828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService1⤵PID:2892
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E41⤵PID:6248
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵PID:6356
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6900
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6688
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:6784
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\activity-stream.contile.json
- Size 5KB
- SHA256 bcefb3292c0b8d4f306f008a5751dc4d2372589d98a2e2cae3d3c8ae0946aa33
- MD5 07d9d5159da3b87768e19cf2243724cb
- SHA1 847f1b6d58edcc934318c907c0fc32189e69ea15
- SHA512 e4a6eefa4e6635602b59439dcd409c4b0a5331c98a9ef3c4a1de9d0ac59cc8e8449c7c7402a239b55137d783eda6e2d199ce2b8a78a6d781122ac125af1ba7bf
- SSDEEP 96:TMag8DDx8AFKYFcanY6D6sIiMupQTNUPSml:jj+ArOw6sI+QTNUKml
- TLSH T12EB13CABDC77D84323B2A7F23C4D374CB161B16BEAC48D41FBD6E80298E011902DA548
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
- Size 15KB
- SHA256 6e758ca6bbe545cf71d7c41b794affd2a2db594463cbaef5c4d8e04cb310a93a
- MD5 4f025f3d191965b11e79e37b095c8710
- SHA1 d1ec2aa0bbcfedddd8c89d11e4477ade9bc99f6f
- SHA512 66c3b1aa8430cb2355d6d83b3ab7b11808af001e7cadd47c85a7249e28404e4b280f9c9a1fb9b4bda3f2001a6219c2ca2c5ca08beea0a6ab637640c46b9a171f
- SSDEEP 384:HwCe7iO024Y+dcs3hk2nhfdDE2Ba/rIVy8ewQ+8Q+Z:QqZY+dv3hk2nhfS2sDIVy8i+b+Z
- TLSH T1CD728DBBCF516C5D1917D985C5AD5369DC05F9ABCBF690A60824344DCB8832AB0FA0CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\A67DF40C9250F8A9155BB3733DFBE68776AB2E1A
- Size 134KB
- SHA256 57e189895e19e14a7cd4b59bd8e9f16deda4a366c9ee72b2d4b875c12d8a405d
- MD5 8e1f15b7b311b8188f8e08fdf46a23a1
- SHA1 1e6533aac30b5202d259bce8178548a32a247204
- SHA512 badda932a8d1aaa7953e18a4a78a7a423149cc8c5609502def96d22148151eb63e9cf91e2f4fd24ce7d96157e84c04ab08af9a76fe09089e4345a10b7fc81c3f
- SSDEEP 3072:EvhPpXW9ZOTbgERzp0Wz8mf34L712Oap9RMWKpooSM:EvppG9AQER10U8mf34f12Tp9+WU
- TLSH T1FDD312352E3924992AD345F0D99F93090DEC44C6F886E0D8B4222B694E74EBD94D62BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\AB740295913D6FEAC15A7060502087FA226E19B5
- Size 70KB
- SHA256 7b62b3958bbb649225f974ea543cbed43d2b81768b7b57b5b8f962f353cccdc4
- MD5 c2de77e986933127b3368eab9793a9bd
- SHA1 f91b2b3ed72dfc2552e61342d5de90d42c649379
- SHA512 070263d5bffff93ca4adcdc04d5fee75176a2d454b9224c116481609b2b3e688cb15d92bdd4e27eb5f728f221d5c128c131abb7e1574e04fbd46925e5e761370
- SSDEEP 1536:83mXA2UiAhXWagJaKX1iE3T6VsAxrTLKJgTcKLG2oPzeMgKhGvH/:OwrPA49JaKltAxrTCgTPLAx5Gvf
- TLSH T12D63D0E4A437196C0B334D90EDBA37C42B34E065E511EDFE843592DEE8A572372863AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\startupCache\webext.sc.lz4
- Size 105KB
- SHA256 86a6b5e32612f0af43ecc8385c9528aaae995407c8b882ebb9c4fc2c4784bbb6
- MD5 6005b36d6298d4f6da6c9bc586d7a089
- SHA1 df79ac5ffde4dc89e91c527d08e4376fd170db30
- SHA512 8717641b0fcc80252c53dbf15556b4a02976ca9db39f88d52065ca74836d2ea7460f502de2711986929e144c9db568482be4770225161a2adca4dde1f0ea47a3
- SSDEEP 3072:j3l/u+dGp14l8l5VZ44bkr+LhqmLqn6R0/HtR:pdS42DVZvkrKTqn6yNR
- TLSH T12BB3A0F6DBB2C93D58FFD42DAAC1883EFD262404B3A73009CD53235466CABB46675648
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 16KB
- SHA256 81d10f8f9730f4bc3575c9cc63e632a2e43ae1337f81228ad6fa2975281b9c7f
- MD5 003111692d0bb6633c5cdac197d3e5fa
- SHA1 6fcb811e1c65937941c1ace6fd5b7aa55d1d5bc9
- SHA512 4fe2ce7ad827c4b643448457ca3dfd4272c44ec4e1ace1d4a67cc66008c01b39ce2a6be252f71b11edee137e191eadacecb210aa5a7719c30619ee85b2a1c06e
- SSDEEP 96:r65dj3/mdFF/2d3h4OO+onaoidmeksO+oMdNakHoAlL5oIdnuoANkOvW855dPlvG:23u/sd63jsZPVlmKQWYitbQe
- TLSH T1247202014FFB0959F2F75A327A3173569B73FE019B17822E818562884D32760896AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 16KB
- SHA256 2bcaca222b7dd5b970b78d10b8d43dcff771ca5a543c3266229f4d54a194e834
- MD5 8a6f1b51cce83ad49ede40f51c7067dc
- SHA1 115420e0264ab19d3c4e06f827e9f6c588a8a83d
- SHA512 8b10c75d2eb8e2ef10f2f715e4f02f0d7319d73f53838d57b4ceb1508ac0c7c52735def6c2de5a5254e86cddbc9bc60104f846ca676059d5b5abbc868a2eb6ce
- SSDEEP 96:r95djw/mdFy/2d3m4OO+onaoidmeDsO+oMdNaDHoAlL5oIdnuoANDOvW855dPlvh:BwZ//d63EsZYVlmxQWYZtbQe
- TLSH T14A7211024FFB0D59F1F75A317A317356AB73FE019B17822E818562884D32760896AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\AlternateServices.bin
- Size 17KB
- SHA256 9f5930c18d984dc8d5aa040902702a62522a394a4649e7d9d24e770ded20c180
- MD5 103bf29b87ea305149b87e5e47910218
- SHA1 b5dd218102c5882e9424ec2892ff01170f5669a5
- SHA512 cd02a457e17efbea134f605b1cf37875acd4da1a6ba6ce7c8354f4f06930b94fd88086ccc08e87f545a42672c496081448c726c58da5472a39bb057cc39902cf
- SSDEEP 96:34mIEBEldvlnpFlUM/pZoKywmQYO7yuZP:VQHZZ
- TLSH T1558214E36FB16862F0A18FF08468B05CDC730729596DD594D644A4F703C6FA9D13EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\AlternateServices.bin
- Size 17KB
- SHA256 c02b7306718395e2bd548039557d286d9719e72f4da61555863a7bf9532b7dad
- MD5 0fc108fa114123d7c4e6f436a6bea6d5
- SHA1 65baa1c8b57c27f7e0a09c8751b8e84a82d3b482
- SHA512 97e0952969e32b8a77cf6a4a41085236bfc4857c377c85c14081ac674f94924ff9a7bde1b91f29edd908796d4ecd073dd10ec963943db422b9aa0a35195c9368
- SSDEEP 96:89+4igZB/tt1B2WUM/pZoKywmQYO7yuZP:9QHZZ
- TLSH T1098223E32FB16862F062CFF08468B45DDD330729596DD594E604A4F703C2FA9913EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\AlternateServices.bin
- Size 17KB
- SHA256 22288d74cd73f78c2a57c1b22a97e507a5c623a2e5e6e284fc7955af374bf266
- MD5 402463368a28894e8bcc9efc144710cc
- SHA1 3671f4baf412573fac405ba7d15068332ffcc8a9
- SHA512 9ab188833837c143b8df2cfb7a381d6cf0703afd5fe4d1a5ca5714ecd1c36e92911a8cd20d844965cbaf45aafaf338e49f4e93ed68efea25e486c54fbfbe72ec
- SSDEEP 48:34igZB/ttXlBwM/pJMy6ouI8e7HSuH5Hv:34igZB/tt1BwM/pJMy6ouI8e7yuZP
- TLSH T13F8223E32FB16862F0628FF08479745DDD330729587DD594E644A4F60382FA9E13EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\AlternateServices.bin
- Size 7KB
- SHA256 34f527873f221fbfdc09113eb1e92015272c297697688efdb5f6b8b2d9a46499
- MD5 cc289c71b6dcb1f4065deec589dba510
- SHA1 103f0fd045e2bbfb97f375bc462e87b3baf2cc49
- SHA512 baabe14f62fa17283ab4d828c58b67537eda497018dceb3c6e1218b90833c0e3b133ecda1a7d94d9fb1fe40ff18df979b59690b8487d24023ef3d1ea42663952
- SSDEEP 12:I0QphMQSQctr4qnc3Xw1b4pG4Xc3Xwxi/oGOpjlzOpKpti9jnc3XwBf6IMc3Xwxi:I0uhMZf91A++lzTw9B6+9VvE/9Fuw
- TLSH T142F13BF36B76A462F0A28FF1D064B54CDD3717294A7DD584A644A0B702C2FD9D02EBE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\AlternateServices.bin
- Size 15KB
- SHA256 bbaf70c5c6789343955a2399d2d0fbddf88e5529d49432c11b9ff65d7e011cb4
- MD5 3ab3a88775b046e2fa7ce11001709dae
- SHA1 05a7d9358df0bfb7d5b6586a42afa8a439ef2a12
- SHA512 f003533a2fd2967f4e0c4425771d9c85f88d159503f602d85c0b40700c2bc59335a9c9237e3e8135ef19f62c376735988219d818ee16291a20eb754731840fc8
- SSDEEP 24:I0uhMZe91T++lzTw9B6+9VvE/9Fuwvl3d9l6wf9BbbUWN9VxWAZK9VuUfw+Z9VOF:cJ+4mIEBEldvlnpF9bUM/pZoKywmQ
- TLSH T1146222E36FB16862F0A2CFF08468B05CDC330725196DD594E604A4F703C6FA9913EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 ed528bf8570783d3bda85f4ba35a5c266c0532767dc37f14051eae732ba0c995
- MD5 34b7c8093f0d117a8864cf638ef6bfc8
- SHA1 75aad24df48dc71f4ecf8bdf44be0a2d7cc053fd
- SHA512 4d19c2b4b5622c1545131237be9f8914b17b8f52507f58680a74a2c40424696469c9e3f030a1ca162d3184e2b9ce23f69e5e8f7eb0ec27b1bc64a60e0aa6cb69
- SSDEEP 192:wOv5zbo7oZAmyjviwi1d66JoztdzgCl6mc0dz:7boMZAmyj0d66Joz/zgC1jd
- TLSH T1A5E10FA4F628867FC408427BDCA61B404F39385A984E7F19759C64082D9B2DE368E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 43678a3670dc83c6fccf4677767de325919f03bf1763e3761fb6f8900d00d1d0
- MD5 a9626bd42e5d8e98f8e8e2d33634f123
- SHA1 5aefe7e15b7def40bf07d498a7a6197d5215c545
- SHA512 0949cbc85068b259b93216ef6cbb33cd44d85ae69baf6af34deef7f479fc1653c480c002bc91a9be3db0cff7c2fa66126881970bbc338f7e9f6725b07f34d445
- SSDEEP 192:jOv5zbo7oZAmyjZyi1d66JoztdzgCl6mc0dz:sboMZAmyjFd66Joz/zgC1jd
- TLSH T1AED1FDA8F629467FC418023BDCA61B500F7A384A988E7F18319C740C2D972DE76CE17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
- Size 82KB
- SHA256 6108368b81ce26ddf64577091312ca6badf46aebf0e9f0654018baff3f2a8d25
- MD5 4d169100b9807912f22efde43fc370b7
- SHA1 fa887f034dec5c50d1ba7e017a842c8912fe1c5c
- SHA512 018f65411242364a3eeb22142d42a6239c44dc19b7d947f07c1b89cd867eb2847b662a60df9af9699ff83f1dc098a6f115e46967b96d57aebcebb41fc9ece309
- SSDEEP 1536:yCPNrz01XkqLbhP0Le18RsGHQ/Qr2JBON6rzXlj+FC/iylHe:yC1rA10q/yyQsE8zOgzZUFsHe
- TLSH T112831144EB1A553FD92802BAACD61B103F78F8894A1A2B57371C64783D873DD3D8E16E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
- Size 82KB
- SHA256 11b4dd5d770d9c7e4627035d3ce411fa2ef362218c79b2b55d2400bfb944a526
- MD5 3bd8e9d8d3ecf97f5930653b845c87e1
- SHA1 ea74060b41e18109f1ec195e2720ec6550a03863
- SHA512 68aa59a300f488c145c376a45df517351a468377e94efd57a119dbc2f7ed23aae09b4e94799658a5086b0d0dab70c5d16a75723b77a717614c71242d6a2d6a3c
- SSDEEP 1536:yCPNrz01XkqLbhP0Le18RsGHQ/Qr2JBON6rzXlj+FC/iylHG:yC1rA10q/yyQsE8zOgzZUFsHG
- TLSH T129831144EB1A553FD92802BAACD61B103F78F8894A1A2B57371C64783D873DD3D8E16E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
- Size 82KB
- SHA256 600a3485941739c20920cf475063cc6cbf15a2446fe907d4674f35f8278cee3d
- MD5 6adb10ce40c8a81d7438bb29b484603e
- SHA1 4633e7d87f7f2884dcef7a4e8334992c6b5b190e
- SHA512 a340e384ce5cd010b296e36e3d7ed683c6a496aa38e02c44eb6e61020416e49c54a430e5503970bc57fe1840267524d23838082495978314d3f9f52157de813f
- SSDEEP 1536:tCPNrz01XkqLbhP0Le18RsGHQ/Qr2JBON6rzXlj+FC/iylHR:tC1rA10q/yyQsE8zOgzZUFsHR
- TLSH T1DD831144EB1A553FD92802BAACD61B103F78F8894A1A2B57371C64783D873DD3D8E16E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 b5cb200182e14cfa0885196ca8993892f2c915a9c09eecc800cb0fe086a9a904
- MD5 d2f7f46d97442d4528886b737e964bd6
- SHA1 33bc18e34957049140c72f8a6b7d026232ca8517
- SHA512 34483d98e90c1c2cbfeb82274f461432c90b95d7cd361b2ac1dcb2dd70a9e8c220a23e52ccb8c409f41426a6c5ca4e787af0c5e19d071192efdcde814fb319f9
- TLSH T1BD21675C3AF89D2AA8C7E2DCB881128E53518F0605971C432D22FF8DCE91ADD326E47D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
- Size 5KB
- SHA256 76b4c0a859d73e4e3d8ef469eb795ec887a826e2f73e09f67e547d598d2dcc59
- MD5 5af23546822f17c68561d3be85acee76
- SHA1 302c89346ec91650a8d4eedb36028a250448fc23
- SHA512 b2c2dc3804ce67302d0c562ee99a8b63575963fbea0e3b72315861dcd7e83a8fd834178566c9251d678ec779a23a55106d790627ad346785e9c56f8638bebb2a
- SSDEEP 48:YUcIbYsMznZFqI1VbG2hzCJVgCJLRYwuZGMwQZbp+C4ZbCW3qFN53MH/XWzmC0oh:uZi2hGDRTspt5WYPUWcoS4ioh
- TLSH T13FB10F1C6ABA5CBE78D7D3D9B841128D43C94B0384871D432CE7FE48CE86A9E321F569
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\205d741b-d640-48d7-9edd-48c929b67449
- Size 883B
- SHA256 5b83af00289cf6792b1d4c36a26552507f857e99bfe3dc65f5811d9c3638193d
- MD5 728856a2896bb0d73b10b767caae7581
- SHA1 5eef5df3c740873f0b9d62273e5c03253bcc542b
- SHA512 91b0e0698ef227004b554eaf9c0af3ea33f24a5fc0fe5c86a82f0ed53fcd193a524ba7f31e6ee67570e9e29928398a73353746031f19071fc565d39b2295df85
- TLSH T15A1100C09625B6F1DC28934FC9693B45C7E8352380C699083DE59E140EAF52B936A30B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\2224b482-48c1-444d-a9dc-79d8f1a4a04b
- Size 16KB
- SHA256 f5b75a7d597c7ab54574f7d0c48e63f99a367b7b1d010b58d2a0a14a64876e16
- MD5 988376ea9389a8878361bffcc518380e
- SHA1 8ec43d122dc8e38b9578e15350322713cb63827e
- SHA512 94ac7e0045791822185bd118ab54c40e8943edb0d33c937e68faf95da61d4041b379d2749e52567db351a67afa8358f327c9d75e865f67ed22abe6626efc81af
- SSDEEP 192:Y94Kl7ddJ5poXBTMT13kisLzISRN5jRTE25Ve0J+wxz4iJUh4Y6+3tTnl4Ov5Bhf:s9l7d9poXvis8SRN5jRY25o0J5+9Trf
- TLSH T1DD72B856286056BA9151E3A894FC7FC3E6F638CF4C019FCA97E4BD085DDE06E112784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\30f1782c-9f42-42ef-9077-946364feac03
- Size 235B
- SHA256 c2a3c316903d249cca54a4888b3e95a9b62a58803d9a7874bbed41b2cb34ad4a
- MD5 bd9c1873dee281fb96bd8d210c54d0bf
- SHA1 1cd365e7e5eccd8cff7704542a9acb5beef38727
- SHA512 de810b8c4ab069452f3335e7b56be8355a5d20ac02f31dfeb64043b0e86ba37fdf30170cfbd497d8d92dfa2a5bef07f25bad0bf501903e43728c5527187323c2
- TLSH T187D097C0688C635C092C1F83F0A029E674C58C33A4646C20C7A140789AFCDC9815582B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\562df06e-7231-4a2a-a5b4-d318decd4539
- Size 2KB
- SHA256 d914df9ab9c046816cae0c8f990419424b25f8e0ec726a792e2981251e143b63
- MD5 f427399d1bc3b81e12a141425d4ca187
- SHA1 e8853761fbe46cad0252c4728ba380477bece2aa
- SHA512 5cce5e607c653871128a1f379c3a48108cbc0e70b15bc9aa58f9b485148ea95767b5a311a85a6a83c4715b2ea85d4afc7064e06d07dbd8ad19867e608f892a11
- TLSH T19641335835785D769CDAE14D945223CED3E1994304C62C473E51EE0C8E962AE33AA52F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\7eb09840-9094-4be4-8eb5-c517d322ea48
- Size 235B
- SHA256 75ec3f56d935e522d648713f9b3e22a2f7433bf9de7a2567f5a1edd78908050e
- MD5 a418163bb384c51a9e5c902f8aac09b9
- SHA1 853068270dfc80c906bfbf94fd2ca83a22afccec
- SHA512 123a7ac0ad94db2d6a51309c3dbb230fea0b80b653f31487f183bbb79b432011bd34d799c298cf6d3a2e43bf1133c4505aa307277312c52cf49f56b43d0035af
- TLSH T1CBD0A7C12898B75D08144F4BB4F0A9D7714D8C3794655810DB6145759AF9EC44169916
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\d80a8bd3-e7c6-4fb0-9909-55d0e42f8a9c
- Size 886B
- SHA256 46f8e3fac7b5572a6fe43e61890b4cc4b774ab1d4ae1851a020d619f258667d3
- MD5 ad2c3e41a23bd8dd30fd9f14e33355ae
- SHA1 a6dd53f46521c7b75121e401f9731f3884459f24
- SHA512 452f7620d49e05a8a13269e144292ffc44ac08160d6a2e4ad705cd8754e5b56b7f343829835e93cf25b1711ff64894664a42f2d3613748f5ee41c24631eae80e
- TLSH T1861144805A7479F19C38834F85957751C7E4712380C69A0C6D959E080EEF02B576630F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\extensions.json
- Size 16KB
- SHA256 096a28c85871c63193c75867f4775d2fa2ccc725ca5663774ee7055a61ebcc3f
- MD5 14f6426a01f76ad23e214669b2db762b
- SHA1 654df81c1ad433b3151fb2eae21c78ef1c4ad84b
- SHA512 fa9836633d84571f9edfee219b14e04ef003d53623d63c41f9a25ed204f2b13cbdc59cf04677966ebf6752855c596cf91db1f833b341dae19b181ad3ae5d0e50
- SSDEEP 384:CkI4vnUmldvO8dhWd94zt96o8L4HTL4PfL4HKL4HZL4HGf4ha:1I4vRfjXM4H6F4/4r4Y4x484U
- TLSH T16572521545049EB8294FA79AAA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
- Size 12KB
- SHA256 09d8493c7c92f48549eac317b693853bbdc66fd76d3a07470487b2cd00bf96e6
- MD5 6c3ff846a36d5cfb921219d53a9dfb95
- SHA1 34ae4f0bc06bc46a6c549294ef4b5358cb8ebdb5
- SHA512 6301b51dc96530b9e530342da8b417244a57caf9bd04501416d7b1e972b7288d99917f363d3338a34ed8d7f124d80abbba33035bddf1745058313f71a83ff562
- SSDEEP 192:cJCR1Df0/W0SSBXLRZjCXEOBw88oy4k1GzU+:xDqROfwJIP
- TLSH T1D142DE3855008F3F30B236BDBC2559705A610337B6BFBCD225F99892445CF2845EAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
- Size 8KB
- SHA256 faa4c406edc2013c9f040f6969f70ef3da796ba468d35fbf221320b8d73ee52a
- MD5 7d2289954610aaea39d9a6c8e8396583
- SHA1 4f34625b3d53d2d5dc3bd493183bca123f4248a9
- SHA512 d96b1c06147c3fe2de760d575116367363b533753428f42f58ad764c1ef52e89cb1cb62af0734a8c5dc82f6d9057cf3d98c90f7a78be697359c06611ae1f3d17
- SSDEEP 96:xHSNTUNqGq1Df0/WObzSKSSlvdv9janNeRWRStEcSqZJgsXdBw88An/c8L4cn1Vj:cBR1Df0/W0SSB8RZjCXdBw888BF
- TLSH T1E9021E785504CF7F74B276ACBC6849306A62023BB7BF68D620B954C5054CF3845FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
- Size 6KB
- SHA256 f77868c87482d52d686a6cba3f09d7bf95287d85f23f85aa5e4d7a8ec58e9c65
- MD5 1bf5cd5c8c66187a0ec0885b656ecbe1
- SHA1 7f421971a4de9b2961511c2b9abc52bdcf351039
- SHA512 daa15af28a1c6b371b3867321b9d0256375e01847852067523b5fa985e5bad7f154dedfdcc5637adead871e96a34ba3ecc64f94f7b1707ee602a3974beeae5d0
- SSDEEP 96:xHSUTUNqGq1DfG/W1zSKSSlvdv9janNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG/WLSSB9IjzBw88jM
- TLSH T18DE1107894088F7F74B6766CAC688C316AB2013BB7BF68D650B554C4054CF3841F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
- Size 6KB
- SHA256 409156fdc9c6e4a8b17d300e34d464ac5a9a368eed831be13e9580d4f322c735
- MD5 1302adbc2a926dc276219f26c1ac1375
- SHA1 549fcb25c4221886e33db0fda4038ebe1118a1ca
- SHA512 4f3b4247c2d2857dbd4abc5ca0d3d61131641da0d374cc1e571f37c3792f324ee711bde4ca5ef88410f780e3c1c4a3fa0b45ca16e6d44ec0544ed546adc8c86b
- SSDEEP 96:xHSUTUNqGq1DfG45G1zSHSSlvdv9jMnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG45G6SS/9IjzBw88jM
- TLSH T1B1E11F789408CF7F74B6776CAC6888316AB2013BBBBF68D650B55484054CF3846F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
- Size 6KB
- SHA256 01ae08d7f4571a340f5aeb7ba6d25ca744f12970e28571d67d0a37af898e9960
- MD5 93810b5129924327821c48b6c16cc7c1
- SHA1 c17e074612305396d4414d594e62ee409c161977
- SHA512 557d0365670e15bc007a4fa2c233259e51a995d33cdb13138635ff6feb54b9dca03e570e8badb3f5f0ad432aea5fc24702748d657d5b9303ed2771f6e0de090f
- SSDEEP 96:xHSUTUNqGq1DfG/WObzSKSSlvdv9janNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG/W0SSB9IjzBw88jM
- TLSH T120E11F7895088FBF74B6766CAC688C316AB2013BBBBF68D650B554C4054CF3841F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
- Size 12KB
- SHA256 d5c9f4e759eaa67ee4efa8d8935c8068df77963c2a65dd0f727a4dd447697069
- MD5 feec01582a28914801b836f2054466c9
- SHA1 f4659e7ad2812ba7a2ea5250cfec5d2c65ffb9a1
- SHA512 a8e89cfc038c6abebfef7f8765679bb0c66f3cee600bf2f4fbb7e73c9008da0ec5388d3ac7979923895e675e3e4a897c6f75b8eed38d340d454aa3e962192a59
- SSDEEP 192:cJCR1Df0/WHSSBXLRZjCXEOBw88oy4k1GzU+:xD3ROfwJIP
- TLSH T1F242DE3855008F3F30B236BDBC2559705A610337B6BFBCD225F99892444CF6845EAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
- Size 3KB
- SHA256 d7f95d0fb4a217d629d4cbc11f0983dc1cda04adec3fc15c4ed3b9426886ff73
- MD5 f3c627eb1e08f5006d2af3b512c94372
- SHA1 51efa68daa69acf492a625064ee6435bf6b2daf4
- SHA512 310377f6057230b0743d15002aafaa8d24c7d5a727138b44076d1a440d2558fb31644792f8d99753b7f11d5b4f35172388df933a4505984e86398c7f83556144
- TLSH T1C3815B5B70E93D679B1AB55DC88D2F5D968A30336DBA2990E58DCEA54003C48248E2AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
- Size 3KB
- SHA256 a9d5ab41b01880025591c5532483ed77e60d734656f0338018526adef1d14005
- MD5 8c1cf9a24e4fda96939cc143ace51b14
- SHA1 b8f05120f111a15cfad42857091fb6136203c758
- SHA512 f639a1fc8bb34112ba40c91551e87d236542b28f9c34d796fb61bd4c96688d1bc2d2661ced2b6c4d34637833923fa0c33ab0a347bf084c572a65827373f9274d
- TLSH T148817D5FF0B13D239F167559C0CD6F1D624F3473AEB618D0D98E8DA61003C443A8A2AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 cce69085381291de1227c587765aed3dc90bf8c50aa0c2e5cc69ef72c8f28c77
- MD5 5477137026a3648e8cf6c742f5e506c7
- SHA1 65d31bf97b4d904201fa6edc6ea2ae067a177e5b
- SHA512 579852697112826cd48b8e32c228a9fbedc381ffdb257cd37061da3ee9cb7c894bb16258df81f28767859c44de749cd12ba220ae8fc5b120c34a2ac49878d31b
- SSDEEP 96:GPfTJ9DT5xKKytz9y3fSx2OiI1PF/q33mi6f:y995EKK83fX61PF/q33m5
- TLSH T172918E5BB0F23C336A1A750BD4DD7F4D534E14736DB62490EA8DCDA05102D80368E39D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
- Size 7KB
- SHA256 56434fafdffb61771ffcbc2402476ab37968bcd7de5e702e9025db2b8d607a83
- MD5 3d5cfce0aafbc7f07a71a5d5e07d6d81
- SHA1 8681ee3c7b9ac60c480382884487ef5252c9b9d7
- SHA512 2ab68216d42938592981e0b2b8c904d04cb97bfadfc7cbc35ff7e34161d37eeab3d78d887ae2abc15a6530af550a0d9d3afcd1886639d4d6ce199067616a072d
- SSDEEP 192:E995EKK83fX63q569m6/dlygwRAi0v/4dh3mxB3:E9lKcN56M8yg5pgdVmL3
- TLSH T1B2F1AF37A426BC53AB6AEA69CCCE0F5D414620B19DF52060EE6EDE36400BD0849497FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
- Size 3KB
- SHA256 b707edd7bd282313571dc1e85033cb4e8dff57674020984527d4cd022d5437e5
- MD5 73ad877b0479c6ffca29caea78f300df
- SHA1 5716375c4d79995f5815c3e8ea640e721756baa7
- SHA512 9d11a47bb72b5a1f3e9e55b0257e7609f5e2db3c2eb42368b749cb30900982e7d3ec59966cde84891ebc4599749b844ece1f2303afc1ad4b2cdd9e7b8f3686b1
- TLSH T1F6614B5B78662D678D15306880CE3F0DB64B3033AE7679D0E9894EF94002888158E3BE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
- Size 3KB
- SHA256 b76b3f11819d9bc03dd88fc6477b7bcf19f584eff33090eeecbab65abb511192
- MD5 9e7e819f73d6a5032320e999f905f697
- SHA1 4ffdad8b7dd6f3fcaa80798e3543795f18cc06e3
- SHA512 505388a99c2a0d1b71ef7f20b57d96b549766c1f85f3d57f5829d47a7b64c3a3b09fd74aeadab9d651617828a07b2c63fbc84397ee3b57c7ad905fce10492ff9
- TLSH T1A2616D5BBC6A3D674D1674A984CE6F0DB74B30735F727D90E9898FB280038442A4E27D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
- Size 3KB
- SHA256 37cc917626c641659051a5a2f6fd37d226c4c31b3dde4ef4d7a1f7bf8d6bda8e
- MD5 7bdacff35e45ad884a1e6cbd6cf0fd35
- SHA1 dcbaf6f2d06ed3caa796f4bf6ff48a3f5c657c8a
- SHA512 86bf5aec0da5b48c3c2abac8a8fedf07b9e7396400018459c4a742ca480973c0c0f5aa355cf6f6e8b0fccb1869b453b04e2f7d545f0dc6ed99e926b515c719c6
- TLSH T104817D5FB0B13D639F1A7559C0CD7F1D664F3473AEB62890D98ECDA51103C443A8A2AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
- Size 7KB
- SHA256 8d195e0ce44bc44d0389656e7cd90f4a3ea525c07a3dfcec49333c08791363c5
- MD5 ce3471b03af1f6ffc89313fe3f1c55cf
- SHA1 8b30ba25ecc30226dfe87f1adee4cae910bd7a2f
- SHA512 a9a81d503a574b4f0b0fa9c2cc7fdab175e5e73b5b11a1adab8ebb09776f112469d97a481ba6a86d82659d265939f523d273f94040b5daff3d2accc9d66472b2
- SSDEEP 192:Y995EKK83fX63q569m6/dlTgwhi0v/4xI3mdiOf:Y9lKcN56M8TgKpgQm7f
- TLSH T115F1AE37F836BC57AA5AFA55DCDF0F1D414620B09CF22170E96ADE36800AD081A497FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.jsonlz4
- Size 7KB
- SHA256 ecd6e90bb4a347207d462179f93981880044c57208ded882a86e559d89b28957
- MD5 d532e45c3125ac44d21cd5c3cd521989
- SHA1 40ec4054f2dce99af16df72cb59202367013587f
- SHA512 5a876de3f4df4c2e30d948d7a15da3190cbe4b73879a0664781686b5ee322a7db3c9f5c0dfd3a0109441916979e2b14046daf29b4436bac224785bab1fd9f5b3
- SSDEEP 192:A995EKK83fX63q569m6/dligwRHi0v/4XO2s3mHD:A9lKcN56M8igypgSmj
- TLSH T1E5F1AE77E827BC539B66EA54CCDE0F2D414210B1DCF12164EE6F9D36810AD045A49BBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.2MB
- SHA256 c3cde8ef48ccf941d7ca752702ee500a2a985b3ae3ac7afdc210d7529e990c50
- MD5 78fab653b4c60cc50cb5ce8d181eb6ad
- SHA1 a68bba3c048e3beb39e477dbca05dca2d96986bb
- SHA512 6a5a3c5c478a164480fb13903929c2ec52c84e27bd93adb7d7aa54fa10727db451efec83f6de0dd8d250fcb26086a6eaeb8d654d69bc3427ebc132c85e327146
- SSDEEP 49152:rLELykaeU06QC5zYYjUZJghDcePVuKRPiS67uF3ZnXBizXtYgJHpxYe1uzonSeY4:wtlIonSeY6FjW2b7B
- TLSH T1CB765CE420E19253F38644B3719993FB20EFC01C6036CE44579496FAA9748EB8E977BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\UQOAV-I8.zip.part
- Size 916KB
- SHA256 5cbb6442c47708558da29588e0d8ef0b34c4716be4a47e7c715ea844fbcf60d7
- MD5 f315e49d46914e3989a160bbcfc5de85
- SHA1 99654bfeaad090d95deef3a2e9d5d021d2dc5f63
- SHA512 224747b15d0713afcb2641f8f3aa1687516d42e045d456b3ed096a42757a6c10c6626672366c9b632349cf6ffe41011724e6f4b684837de9b719d0f351dfd22e
- SSDEEP 24576:+FhIdZxByAl+XiqNk6n3DaeCTLD1yilc7KrBVw1lFVFDqE/zQRsAOfySS:AhAgo2ikhryLD1hcerklFVhqEMiAuySS
- TLSH T10C15339E73C7ADC3783F5A32E1C5B0C502EFA45DB5A812C94D005346922FA787E272A7
- MD5 SHA1 SHA512 SSDEEP TLSH