5b8ee2df17e7ecd3717ee1dc74f7ceb7dfc40c19cac82d71ac6ebe95bba39b6d

Analysis

user interaction
yes
max time kernel
42s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 20:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
caca.png
Size 59KB
Sample260723-zddvbabj21
SHA256 5b8ee2df17e7ecd3717ee1dc74f7ceb7dfc40c19cac82d71ac6ebe95bba39b6d
MD5 9a92443ac2643fc277d4912fe4d55974
SHA1 0a8baf0e3f302403c235a5b0d686b7cd9520c173
SHA512 69f85531b1012a186040e7863817730876ca8bed87782a4d6a37d6f48529e52c0dbc371dbb2bcdc0b6334d375e7097ba35066e0e07a7468905cb635474c46e1c
SSDEEP 1536:ejtoDb6R2grChi8TOoji6FqBO8GvzV6MxG:OoH6RFCTOSi6P8Ggv
TLSH
T14B53E03F688D8D3EE1EAB8B5A5747C1F61AD90F297F74909956CFAF2AF4F5900201110
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
124	whatismyipaddress.com
125	whatismyipaddress.com
126	whatismyipaddress.com
122	whatismyipaddress.com
123	whatismyipaddress.com

Checks processor information in registry 2 TTPs 52 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
892	mspaint.exe
892	mspaint.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3780	firefox.exe
Token: SeDebugPrivilege	3780	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
892	mspaint.exe
892	mspaint.exe
892	mspaint.exe
892	mspaint.exe
3780	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3780	2916	firefox.exe	96
PID 2916 wrote to memory of 3780	2916	firefox.exe	96
PID 3780 wrote to memory of 2632	3780	firefox.exe	97
PID 3780 wrote to memory of 2632	3780	firefox.exe	97
PID 3780 wrote to memory of 2632	3780	firefox.exe	97
PID 3780 wrote to memory of 4852	3780	firefox.exe	98
PID 3780 wrote to memory of 4852	3780	firefox.exe	98
PID 3780 wrote to memory of 4852	3780	firefox.exe	98
PID 3780 wrote to memory of 4852	3780	firefox.exe	98
PID 3780 wrote to memory of 2172	3780	firefox.exe	99
PID 3780 wrote to memory of 2172	3780	firefox.exe	99
PID 3780 wrote to memory of 2172	3780	firefox.exe	99
PID 3780 wrote to memory of 2172	3780	firefox.exe	99
PID 3780 wrote to memory of 2236	3780	firefox.exe	100
PID 3780 wrote to memory of 2236	3780	firefox.exe	100
PID 3780 wrote to memory of 2236	3780	firefox.exe	100
PID 3780 wrote to memory of 4228	3780	firefox.exe	101
PID 3780 wrote to memory of 4228	3780	firefox.exe	101
PID 3780 wrote to memory of 4228	3780	firefox.exe	101
PID 3780 wrote to memory of 4228	3780	firefox.exe	101
PID 3780 wrote to memory of 5928	3780	firefox.exe	102
PID 3780 wrote to memory of 5928	3780	firefox.exe	102
PID 3780 wrote to memory of 5928	3780	firefox.exe	102
PID 3780 wrote to memory of 5928	3780	firefox.exe	102
PID 3780 wrote to memory of 5944	3780	firefox.exe	103
PID 3780 wrote to memory of 5944	3780	firefox.exe	103
PID 3780 wrote to memory of 5944	3780	firefox.exe	103
PID 3780 wrote to memory of 5944	3780	firefox.exe	103
PID 3780 wrote to memory of 5952	3780	firefox.exe	104
PID 3780 wrote to memory of 5952	3780	firefox.exe	104
PID 3780 wrote to memory of 5952	3780	firefox.exe	104
PID 3780 wrote to memory of 5952	3780	firefox.exe	104
PID 3780 wrote to memory of 5964	3780	firefox.exe	105
PID 3780 wrote to memory of 5964	3780	firefox.exe	105
PID 3780 wrote to memory of 5964	3780	firefox.exe	105
PID 3780 wrote to memory of 5964	3780	firefox.exe	105
PID 3780 wrote to memory of 3892	3780	firefox.exe	106
PID 3780 wrote to memory of 3892	3780	firefox.exe	106
PID 3780 wrote to memory of 3892	3780	firefox.exe	106
PID 3780 wrote to memory of 3892	3780	firefox.exe	106
PID 3780 wrote to memory of 3764	3780	firefox.exe	107
PID 3780 wrote to memory of 3764	3780	firefox.exe	107
PID 3780 wrote to memory of 3764	3780	firefox.exe	107
PID 3780 wrote to memory of 3764	3780	firefox.exe	107
PID 3780 wrote to memory of 5240	3780	firefox.exe	110
PID 3780 wrote to memory of 5240	3780	firefox.exe	110
PID 3780 wrote to memory of 5240	3780	firefox.exe	110
PID 3780 wrote to memory of 5240	3780	firefox.exe	110
PID 3780 wrote to memory of 4800	3780	firefox.exe	111
PID 3780 wrote to memory of 4800	3780	firefox.exe	111
PID 3780 wrote to memory of 4800	3780	firefox.exe	111
PID 3780 wrote to memory of 4800	3780	firefox.exe	111
PID 3780 wrote to memory of 5480	3780	firefox.exe	112
PID 3780 wrote to memory of 5480	3780	firefox.exe	112
PID 3780 wrote to memory of 5480	3780	firefox.exe	112
PID 3780 wrote to memory of 5480	3780	firefox.exe	112
PID 3780 wrote to memory of 5500	3780	firefox.exe	113
PID 3780 wrote to memory of 5500	3780	firefox.exe	113
PID 3780 wrote to memory of 5500	3780	firefox.exe	113
PID 3780 wrote to memory of 5500	3780	firefox.exe	113
PID 3780 wrote to memory of 4712	3780	firefox.exe	114
PID 3780 wrote to memory of 4712	3780	firefox.exe	114
PID 3780 wrote to memory of 4712	3780	firefox.exe	114
PID 3780 wrote to memory of 4712	3780	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\caca.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {70010275-03bf-4535-8d7e-6660b54125ae} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {c0d39e8d-4165-4cc0-ae88-7992cc2b96ed} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3496 -prefsLen 27276 -prefMapHandle 3500 -prefMapSize 270279 -jsInitHandle 3504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3512 -initialChannelId {9956d682-20db-4c98-b7d0-5d699fa91e0d} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3660 -prefsLen 27276 -prefMapHandle 3664 -prefMapSize 270279 -ipcHandle 3680 -initialChannelId {bfcdd5bd-d2ea-4a74-9f52-bfd67fb64872} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4392 -prefsLen 34775 -prefMapHandle 4396 -prefMapSize 270279 -jsInitHandle 4400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2960 -initialChannelId {24fc757f-f3f7-4b9a-9d98-6b854acd8d5b} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5180 -prefsLen 35091 -prefMapHandle 5176 -prefMapSize 270279 -ipcHandle 5188 -initialChannelId {304e5876-ac89-4082-a1af-5a3af8109d78} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32979 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5364 -initialChannelId {07de4da5-8431-4524-a973-b93d2e0e63c4} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5400 -prefsLen 32979 -prefMapHandle 5404 -prefMapSize 270279 -jsInitHandle 5408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5416 -initialChannelId {747328d6-78d9-46c7-9163-ffaeb26b10b7} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 33031 -prefMapHandle 5804 -prefMapSize 270279 -jsInitHandle 5808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {43f20df3-b7b5-47fa-85a9-911501c1f5a9} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6192 -prefsLen 33071 -prefMapHandle 6196 -prefMapSize 270279 -jsInitHandle 6200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6208 -initialChannelId {7a132a89-5556-4bc2-93fe-735637b6bb77} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5056 -prefsLen 33071 -prefMapHandle 3476 -prefMapSize 270279 -jsInitHandle 6816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5360 -initialChannelId {e951db03-295a-445c-b24b-808ef05b49d6} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7096 -prefsLen 33071 -prefMapHandle 7104 -prefMapSize 270279 -jsInitHandle 7108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7184 -initialChannelId {fac7ece0-09d5-4d67-ba3d-c342f2e543f7} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7976 -prefsLen 33071 -prefMapHandle 7980 -prefMapSize 270279 -jsInitHandle 7984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7884 -initialChannelId {ea605255-29e2-428d-baf3-7750653cac07} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8376 -prefsLen 33071 -prefMapHandle 8372 -prefMapSize 270279 -jsInitHandle 8368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8364 -initialChannelId {bbd36d7c-4fa1-4ae3-83e0-9b4e1b5c8d06} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8428 -prefsLen 33071 -prefMapHandle 8424 -prefMapSize 270279 -jsInitHandle 8416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4176 -initialChannelId {d1295a1a-47bf-4b61-af14-168444b1d380} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7064 -prefsLen 33071 -prefMapHandle 8676 -prefMapSize 270279 -jsInitHandle 8652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8648 -initialChannelId {1cb01c1f-8d47-4b9c-85a7-b97051cc1f5e} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:4712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9444 -prefsLen 33071 -prefMapHandle 9448 -prefMapSize 270279 -jsInitHandle 9452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8792 -initialChannelId {c300f9b9-fdc9-4474-bbc6-d394693e324f} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:3996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9468 -prefsLen 33071 -prefMapHandle 9472 -prefMapSize 270279 -jsInitHandle 9476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9324 -initialChannelId {54574cf9-219d-4f2b-afc0-1d1de047bab5} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:1888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8384 -prefsLen 33071 -prefMapHandle 9324 -prefMapSize 270279 -jsInitHandle 9440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9192 -initialChannelId {323aead8-7b70-4020-9f79-b54bb254acac} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:3308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9972 -prefsLen 33071 -prefMapHandle 9180 -prefMapSize 270279 -jsInitHandle 9968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9476 -initialChannelId {9fee4386-e40d-4531-8320-0e7559ef44c7} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10264 -prefsLen 33071 -prefMapHandle 10268 -prefMapSize 270279 -jsInitHandle 10272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10220 -initialChannelId {163dfe74-17a0-41e3-bbcb-2cd2c3c03d4b} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:5176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8652 -prefsLen 33071 -prefMapHandle 8360 -prefMapSize 270279 -jsInitHandle 8388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10272 -initialChannelId {6a6ac28a-e091-4713-86b8-b8220434bef9} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:6348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10664 -prefsLen 33071 -prefMapHandle 10312 -prefMapSize 270279 -jsInitHandle 10680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10648 -initialChannelId {8600a677-b0d3-4da4-8e89-6355934acc92} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:6724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10732 -prefsLen 33071 -prefMapHandle 10728 -prefMapSize 270279 -jsInitHandle 10724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10764 -initialChannelId {7912d11f-e151-492d-a7cd-c6975733d1fc} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:6732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10988 -prefsLen 33071 -prefMapHandle 10992 -prefMapSize 270279 -jsInitHandle 10996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11004 -initialChannelId {56508599-1429-4a34-a10f-cce2d735cc32} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:6740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10808 -prefsLen 33071 -prefMapHandle 10732 -prefMapSize 270279 -jsInitHandle 10776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11016 -initialChannelId {51cfaabd-2828-4502-8ab9-f77b7646e9c6} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    - Checks processor information in registry
    PID:6940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5860 -prefsLen 33678 -prefMapHandle 11340 -prefMapSize 270279 -jsInitHandle 5872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5916 -initialChannelId {1964b322-c14d-42a6-92a5-a92411e07f8c} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    PID:6660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6872 -prefsLen 36235 -prefMapHandle 8276 -prefMapSize 270279 -ipcHandle 10724 -initialChannelId {3b167c24-84a2-44a0-9955-885621995d18} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 utility
    3⤵
    PID:6596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 72bf284d3cd3f3712895a20b19a4430c5246682071badd7f3c038beb4014545f
MD5 53d96a14b7aa6accb340455b61741cc0
SHA1 3876ac8e51916ccbd8714a88054144779bd83913
SHA512 fec4a5f01c4ce4bd7ba45a08ce87d729fdab5cc83d48f03f4a0aa06bb57bdddf99f45959481ec444298302ac53ffd4b2ea1e65340979b01e91fd079052c6a017
SSDEEP 384:HwCe7iO024Yrdcs3hk2nhfdDE2Ba/rIVy8efL+LL+U:QqZYrdv3hk2nhfS2sDIVy8G+n+U
TLSH
T187728DBB8F516C5D2917D985C8AD5769DC05F9ABCFF6C0BA08243449C784326B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5617C2BB77122AC13DC0FB65336A8386EC872F9E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\5617C2BB77122AC13DC0FB65336A8386EC872F9E
Size 22KB
SHA256 57e6309c9f1154661cf3db294fdd64d2a5454b1a78c614ef0f5515f5baffc25b
MD5 e4bc399d15adc5df1f4ad18f1ced4dd6
SHA1 6a24a7f4e039ccbe9b4dbe1616cd51d547579433
SHA512 a990f69e6652ddad4be6ff5c054c61b95aadb2f8b889c79ae779ec92120722a9c8eaaa595995f9ca0950a277647c88954891d03501b4d5feb9760a61977dc4c2
SSDEEP 384:QK+BPGZADC3U+qR951uqFQsbyshqYuZvdvhpK4Mn04IbP/0vuUms9:LoCk+6/bAsolLK4MxIT/0vuLs9
TLSH
T155A2C03F9D0A4A3D1F420106C06F6D959F68B9ABD6CE549E384C344539DCFB2EAA270C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 85KB
SHA256 593cad1e1a63b93f53a16245d8ce2528b169ca6adc71339cb1062f5f46444404
MD5 7457d3e3e448ffbb44ede9b012743e5a
SHA1 574f0e5f453662aa51df5bb1a4e8fdd8382db4e7
SHA512 2413a650ea59bc4e9fd0b89bab2d24fff060333c43e912cdc477c00a69c002aab142047c785dfaed98562e20f2c3b756ed8ae9a19e659eda74bbd0b7f033ea70
SSDEEP 384:MQv22z+YhXZyc2pTZqvV3BrB5Br6gZmg:n22sc2pTZmB7
TLSH
T13F8399F71F79B512E4A26FB080E87488DC33415688588A948A5DD0AF1B917B0F73EF9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 87KB
SHA256 3ce151cc27136a8806671fee6e567e1ad57d2744195a3b7bd6826e7b035cc077
MD5 3a1f6193fe071991f754a0185c11f0e9
SHA1 84c09405a32d6a53ef55ce712d7e290af1aeb409
SHA512 c4cc4a8fa218a3529ee198f707d965bc03c08768c1347a9859b594aeeaaa27a99809a51ae2051a49c6aab9a37a029eb8237c3b6cde7904e9c5fec9b2d19e6bec
SSDEEP 384:UQv22z+YhXZyc2pTZqvV3BrB5Br6gZmg:f22sc2pTZmB7
TLSH
T10493A8F71F79B552E4A26FB080E87488DC33415688588A948A5DD0AF1B917B0F73EF9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 10KB
SHA256 5d1160ae504b2a176bc6db5bf1e381e2af90033fa8cb1755c78166657a826f25
MD5 410f17ec9e3ec1a0563716feafb303ce
SHA1 e58f8861f95bfeca2b499932eb037b70c09ca842
SHA512 b247c675b62175a790c1d81731bbac0423cfe61616c1d9831a0bb1fc5e3ac5a84fbfc5f09829c875ab64c1634ce38cf93a014296adac4207d7cc9c5f9027000f
SSDEEP 24:PuhMZqA91c9C9xI9O9BU9f9VvJ9k69Ft9O5q9F55A5m9j9lx9:jwwQUsFBrZBkI56cRN
TLSH
T1F62260F36B71A462F4A28FF4C058B18CDC334325597C9584C654E0F757C2A99A13EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4ed352d6cd75f6f2a5201bc0c6a1a2e5e0f4f7542aa18dd30c76c79c7c4d7e3a
MD5 2b17f9a9dfb23c0faf7f6a1537fe04e0
SHA1 03864c5876bc49d64798c39b01dca47c0d419008
SHA512 8607875bc8aff6ab5616798a9aabb82eb07d72a1549db9f0512216e42ee8c9ec125f55a7530e3fecd83411ec6e206eaa2b34acc628a507815d232e69e4135d96
SSDEEP 192:Y1d66JozGzgCl6mc0dbOv5zbowbVtyji2L:yd66JozGzgC1jCbowbVtyjJ
TLSH
T12AD10E68E728863BC044437BCCA20F404F36789A9C4E7F29369D640C2D576DE769E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8ffcfa0e00ebe3e01298b4cfa41780730f962f64fe892fe5a14fed6ff3b263cd
MD5 e3681865a140d504e52fe15103260c3b
SHA1 7a7ab042267b5bd1e7f990dd3baa0cdc2db88bb9
SHA512 fde830902daa6f8577c24a62423327871161fa59da75d500d9ac2ed01187cf00016d99d8efff6e4691396d9c67f15731f716cb69c1a842fd493d540efac1e9b5
SSDEEP 192:t1d66JozGzgCl6mc0dEOv5zboPEZVtyji2:Ld66JozGzgC1jVbocZVtyj
TLSH
T1EDE1FE68E728863BC014027BCCA21F404F35789A9C4E7F29369D640C2D576DE76DE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 4KB
SHA256 dc63a96707f6661fd46395a9f8258a99dff2715190a6a24b6e893fdf42ca7ca6
MD5 3164d95eb3d187de1cb306e0d7adb2c1
SHA1 38557c03c0f0a7cd7285204b9b0c69a13feaa53c
SHA512 356a4ef0266c98c556b14182e2d7d50a9b583b5ab4c9e2eb212be1d1fdc2d2edba5e3160f7a69ad1ff4eec27dd9f9feb77102dc32b2dbf9a284cadeb656cfda9
SSDEEP 48:YpIFb3srO4bEVRKfrxi/XcOChQ+P7gBGny7UqaW+4XZpb5Ypdul2lH3dI1Zn5Z2L:ebK/f+Dma/4plQdFldw5Q6RcOSAK
TLSH
T1DCA1352C6AA90C7F69CBE39DB441028E47DD4B0289DB1C834CE7FE58CD45E9A321E52D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b00a1a8869164dc43d513a90c59a770efcb0ab137fc1d3cdaad68faddf716723
MD5 d357201b2966c06fb1beeeef1f0cfcd1
SHA1 a570c5a73f0890d3326155b42dfc3982c2a6d1ae
SHA512 d6fb9020ae96c584fb4e618b0d1cd62163d8f22a45eb6ba03a08d1b635ff31eaddbf0f3861371113dc2cd5ae88442e4dea299d17d446e04ac15158f5ed1c1c49
TLSH
T127216A6C3EB94E2B9887E29CB441128E57554E4708971D430E92FF8DCE81AD9316E43C
MD5 SHA1 SHA512 TLSH

Submit Download

050d5283-6380-4e38-8d29-c57441e3db2e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\050d5283-6380-4e38-8d29-c57441e3db2e
Size 883B
SHA256 404513a861700eda9fddd05460bbe081c337d7dd30455f255ef3f6648571578d
MD5 f7e5353c86e5cc7e50cdf7cb78d04c44
SHA1 4ffdab67401a991d00b68da184d95ef6d582ea9c
SHA512 903cc68ad9e3848871941f36c7832729efdfbdd1ca4eef19940c3f3baeafda127b72ede989ebb5f5459c0871334b208ac07c183948b4e3b3bd919b8147c5110f
TLSH
T1B61123919734B9B3CD68C34FCE557B02AFF4B52380CA94143EA159180D7A91EA37B20B
MD5 SHA1 SHA512 TLSH

Submit Download

08642f76-0b3f-44f2-9f0f-29a05928e0f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\08642f76-0b3f-44f2-9f0f-29a05928e0f7
Size 15KB
SHA256 c6e7d1ab0ce29efd621894997bf260570b78571abd2acb1331fe9cf0897fab45
MD5 69b44aa9e722335c3af3e4a31e0b5f2b
SHA1 a5c1317d375dd7254dbdd83451515780230fc644
SHA512 6d90d91bce76f5c58b6fd33219b2a7f3b52b8033c9e0e59841d6cc0392e429e9d10f20221fe2e5e2f732476c10b5317fc5c077893b35ddf6dda0d24ab28f9b02
SSDEEP 192:82OKB1ZBAUF9y3ortjpt66gdRCd8c9q8YEoEPFJjWa8QSfOKNKz+R8lVbRQi+C0+:YKOUbLJFJya8QeOKNKyRoVbRQ7C24
TLSH
T1B972B8166860557A8251E3ACD4F8BFC3E5F628CB4C019FCADBE4BE0859DA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fd18d25-b532-4c9a-bf1f-6bc502147652

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\5fd18d25-b532-4c9a-bf1f-6bc502147652
Size 886B
SHA256 5ff3bc551f5b6d030f3f311ef7bc7d41bb325fdcd6e7a7dedc6c3db68983a8dd
MD5 6b912384a84367675e7dfca19d46283a
SHA1 3fb72ecbdd7946175e51142a6f2896146e1aea59
SHA512 10f816ba580c0471abc9d34ecc2e5f17f861e489c8082a0b1b9c9c70f7414d1359953a5a42ea144d75963af2e1ee034939298f7c92cb5a2067110501c6b31dc8
TLSH
T1FB11674147787973C874C34BD99177025FE4F01380C948043F949A080D7A41FA3B7207
MD5 SHA1 SHA512 TLSH

Submit Download

62435d60-705c-4f50-8e19-6ef6a4630a87

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\62435d60-705c-4f50-8e19-6ef6a4630a87
Size 235B
SHA256 38c43cf84f38121fb2ddbb74f2d4d4e0df05e7f252520700c744e0b397517ab4
MD5 8242915a571e0a8e7996157e13dd8815
SHA1 67be401426facc2e6b3a52d4f07983ad281114df
SHA512 a508de6ee453058857de4e3803b8021610e827933a7ca42f12b49191f3e137799d9b16bd5549863fc63e31c092c839c354ea50437397f746989e948e06dcaf35
TLSH
T1F3D097806498B75E0C084F43B0A038D230988C3324B6581085A00638DEBA9D90191817
MD5 SHA1 SHA512 TLSH

Submit Download

f7007f55-b165-4a02-8c7a-7f71810e4038

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\f7007f55-b165-4a02-8c7a-7f71810e4038
Size 2KB
SHA256 7d3c730e28a559bfece68bfece85a269cefdd568ca40c1daf848a2ad1368594a
MD5 4077742a0010645873ade083bcd16788
SHA1 50bfe1fa0eba8d616d008b82b073ed3d36612755
SHA512 2b8e690eadd87dc498631dbde479700b7f306aa9f8932adaceafa68530117e509599dc64f65b0e08d930788e8e648f97542fe136c74dbd7441cab6f03f83cfff
TLSH
T13241115C76B85DB689DAF19DD581234E6FA08E1300C62C832E62DE0C8CD665A336E53B
MD5 SHA1 SHA512 TLSH

Submit Download

fd1c3fdc-c6c7-49e3-ab66-0d573d7ab173

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\fd1c3fdc-c6c7-49e3-ab66-0d573d7ab173
Size 235B
SHA256 91d4cb0cb56eec088dfd2af2b9d2b08e55e45a259b0c18ad97ed56bdbc3ec326
MD5 e5c5cfd30d8f8c08f6b2cfbadd9ea47a
SHA1 ae80cf3307914c6e92e88327acf398fcdc97296b
SHA512 06d4bbc5de0c164846fd945e535c9845796948b81caf508a2fb357575f9766a9cc3ad622e19d09f724081fa3d1262bdff8cb2593bd533f4f29fce965c8c5c251
TLSH
T16ED0978474A86B2E08180F07F0F27EC23088CC332070AC209A60057889B8EC882A382B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json
Size 16KB
SHA256 d06e8d26025c822ceb58b4b180b7b1b7fefe223f878c9c2aff8dc209fa3336ac
MD5 cd2a5c074076797849ffbd51867f4d9d
SHA1 dbbe044e42bf9f88cc97d104d7b92fee9b1963d9
SHA512 76c3e24a0686d13aba3d27e4a04388ba0a96061476b606c91560b0172392d205b4267109b047fe83ebbdbd58897ebb7aa578a91411db30a5713ffe2aeec30a34
SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4Hv04hD:mI4dRfFXQ4d614d4D4J4+4s4R
TLSH
T10F72521545049EB8294EA79AAA367E02C37D473B70845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 7KB
SHA256 04bc2bf151fc4aa7e664802d941d0f8dc3745a901b3431a3557730249ff5c792
MD5 49c7c8bb9f97d0456088157411e030e2
SHA1 b968034b62c6f84fc5ac0b45a088a148977840ee
SHA512 fd8632366e34bf7021db3a209b33fa9951679eeafb6ac54513da3249484c39f9271f5500969dbeafeac7dcbcfa78d3bf54eb2a8502e486ef1c3bd3ae09b012ee
SSDEEP 96:xH4fUTUOPqGqsWf271NbzSQxSSladv9jhnIHeABw88n8L4cnTDEMGS:mf5RsWf2719xSSveABw88qv
TLSH
T1FEE1317895188F6F74B677ACAC6888316AB2413B7BBF68D310B954C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 7KB
SHA256 16df4fde138fd2156e5dd45af2a61af71cd0a039ac3ec211431474c6dae91598
MD5 2a1626a395c43f9f2624e04420033281
SHA1 cedc393dcf37805fe759e43ec4566edc7b2f6be2
SHA512 988fc364973f71c33dfd74fc0b7c7bfe9b5f30d8a198ae1ba9d633452eb56d4f2fabe66253c66c65b8a8d4f369117ee5f64e14e9810a7cb4863a6e8dbdc954ff
SSDEEP 96:xH4flTUOPqGqsWf271NbzSQxSSladv9jhnIWROKJBw88n8L4cnTDEMGS:mfURsWf2719xSSOR5JBw88qv
TLSH
T1BBF1EE789514CF7FB4B677ACAC6888315AB2023B7ABF68D710B95484011CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 6KB
SHA256 bb016629106ae0a9c9ea2f3738746f0d115344c7915294025f027ab6b76211df
MD5 5fee9b02c8743ed0f5edbf9a7837639c
SHA1 fd42d12514bfd00850af52d7b099741a651ff5a3
SHA512 4bce17b1524115d3133271e3972fed3459b75fdcd685916db8ac8a0408ac3a1d8a8d23b9d03b316e9ab9ad7c694750e2ab6e71fa267eda6df0351791b4762682
SSDEEP 96:xH4fUTUOPqGqsWf2711zSQxSSladv9jhnIHeABw88n8L4cnTDEMGS:mf5RsWf271RxSSveABw88qv
TLSH
T18AE1207895188F6F74B677ACAC6888316AB2413B7BBF68D710B954C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 7021473f0924596c996f022c02af7a091dd38df9a20b0ca8862ec3ce826d4ab7
MD5 02a73aee436ab53e4fb185dfea141a82
SHA1 ee34a772a49b0ccfcf520f0972eb56b1f9916c76
SHA512 08c5882931eaefbc764d7fe04b61bf2114b5b16f44c014a06606e05427c281f8a646c2905a42f9b7e3d66d44c6f5b3709f6c0b2b9557cbdb4014c8facdb492ef
SSDEEP 96:xH4fUTUOPqGqsWf24P1zSuSSladv9jwnIHeABw88n8L4cnTDEx:mf5RsWf24P3SSieABw88qY
TLSH
T117E1407895588F6F74B677ACAC6888316AB2413B7BBF68D710B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 29adb3c7c8164df02dea8d5842a77596bd4145004a8d88cb2c2fdc9b3773fc4f
MD5 6ff7f71fb689b3ded313768950556879
SHA1 481beaa4bfd615b8ba320f71da8fdb9bfd5d43da
SHA512 39b7c63728353421d7f059bf975afba541cb2c0c0f9c4a9edfca2a30b583dff82cfcb8586758ba24cc0c94bc5130693ef0e0377903c19abd97e5165a52359223
SSDEEP 96:xH4fUTUOPqGqsWf24P1zSQxSSladv9jwnIHeABw88n8L4cnTDEx:mf5RsWf24PRxSSieABw88qY
TLSH
T159E12F7895588F6F74B677ACAC6888316AB2413B7BBF68D710B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 04350d496a759f9d85c167da438ab9a5d551f0603d2d27bf75bc850884b3e1d9
MD5 2d9737dd7c9f3855cdfaa4676e296bc2
SHA1 88a8c0b512e05a456e781e5b4d822a2eaffa4c36
SHA512 d68ef5f95be9c57463ad42d349954afeeda8d6f6c3dd6689289a6c926bf8a8c64393ff3c44523fc4434020081079f342c3dc1ccee292033caf107ef68d30248c
SSDEEP 96:xH4fUTUOPqGqsWf271kzSQxSSladv9jhnIHeABw88n8L4cnTDEMGS:mf5RsWf271axSSveABw88qv
TLSH
T1DDE1307895188F6F74B677ACAC6888316AB2413B7BBF68D710B954C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 7ceecd6b6dc9547c5922383c889dba6d30f649e190bab34f0483e3e56aa09cf5
MD5 a1161837868f25149de6e8bfc5ae87db
SHA1 bb86a48e5326ed2667e13b6c4728714b948a38f4
SHA512 de93b02c09173acec2995585524682083204597df7ba9efbd6bfab5a66e1201e582df4dbceb223fcd17874a3e464310feea463b2ab34621e84c085f9a33c2e59
TLSH
T133410AD69E5F5F750939712D82C02ADEC5D0A455C898DC369480FF1102B8F5A7ECB325
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 abf4bb843ae4530805050f3942e6ad71659a7fcd305af9e0b67bd42b0399a9bd
MD5 3fc7b90cbf23cfc0e8c05a8ab82fa0f2
SHA1 c4930079f3bb4c2edcc8105609d99b0940e1809e
SHA512 63fff1a250c97808a8a9dabb725c7344c2f3b3c5ac995524655b03dced26793fcbbcc29a35ffeaf47b11f3c9b5a06ff18f04bffba206f3b551d84d4cf7177c93
SSDEEP 96:V2IYb81jzjmj9UvyWT0AQTzLKsc4vk67WyqwvfVcmhA:VH1i9UvJty/hewHVZhA
TLSH
T16F914B9FBD0BBF7A1938A00880C42ACE45D074D7CCF00D38DA24B57A02A5BA66E59359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 0e0684d43aba0492cfa12bb283555c431394c7b68b26f2cd0844ad4c739404fc
MD5 1c903130c10636fc1cc451111a383cb5
SHA1 b9d87be510bd4c3d5303f4d909f4a988173a8169
SHA512 9107997f48a9e2ea913f8cbfb13c40a410c37b14560e0924bfa3a13c233a3126f4afde60d05d06d67313be39f387c7b6b44800bfff2c570de99acb24c72a95f1
SSDEEP 24576:NoJA7oKv6uRA8c2XgsFEcuyaRh5Krbsw9kIEWtY6PX9QC/bqjXTN1gLwF2I:NoQTv6gAEXfFEcu5Hw9XEKYpKbq8EsI
TLSH
T1AF462AF860D1A253F3824073B54953EB21FFD00D5037DE4857A85AA9A478CEF8E17B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download