909247ab27a62af891158d0adc3db779a1d5b3448c03bdf621fd21c767c7ad50

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
191s
max time network
188s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
content.png
Size 2.9MB
Sample260727-etscesvglc
SHA256 909247ab27a62af891158d0adc3db779a1d5b3448c03bdf621fd21c767c7ad50
MD5 3633d22d421083133b01f1487e6554ef
SHA1 5ecabc25528b98b4450f20e4df6dcf1181b17a83
SHA512 3fe9bb27216e12a9626e677032b73894581b56da2b9d148b247d7d45217141580e7c273c1bbecd8c3f11251ba8ade4d836ba3fa139ca97b9332621de26db3b64
SSDEEP 49152:OcJaBD4j4FVHifROIQK3SaSpXYhEHvtXhq2JEEDy+nBDh9kr1sSsGmlqaH1oT:OcJau0FpifRbfiHpohEH3q2adohi2jGx
TLSH
T1F8E533EDCBC1CBF0C62F623B4AEE55A0429A155FA393434521B5C6CCE069748D72BF26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5896	mspaint.exe
5896	mspaint.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	firefox.exe
Token: SeDebugPrivilege	4328	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
5896	mspaint.exe
5896	mspaint.exe
5896	mspaint.exe
5896	mspaint.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe
4328	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4328	1876	firefox.exe	94
PID 1876 wrote to memory of 4328	1876	firefox.exe	94
PID 4328 wrote to memory of 4308	4328	firefox.exe	96
PID 4328 wrote to memory of 4308	4328	firefox.exe	96
PID 4328 wrote to memory of 4308	4328	firefox.exe	96
PID 4328 wrote to memory of 5556	4328	firefox.exe	97
PID 4328 wrote to memory of 5556	4328	firefox.exe	97
PID 4328 wrote to memory of 5556	4328	firefox.exe	97
PID 4328 wrote to memory of 5556	4328	firefox.exe	97
PID 4328 wrote to memory of 1136	4328	firefox.exe	98
PID 4328 wrote to memory of 1136	4328	firefox.exe	98
PID 4328 wrote to memory of 1136	4328	firefox.exe	98
PID 4328 wrote to memory of 1136	4328	firefox.exe	98
PID 4328 wrote to memory of 4508	4328	firefox.exe	99
PID 4328 wrote to memory of 4508	4328	firefox.exe	99
PID 4328 wrote to memory of 4508	4328	firefox.exe	99
PID 4328 wrote to memory of 2380	4328	firefox.exe	100
PID 4328 wrote to memory of 2380	4328	firefox.exe	100
PID 4328 wrote to memory of 2380	4328	firefox.exe	100
PID 4328 wrote to memory of 2380	4328	firefox.exe	100
PID 4328 wrote to memory of 1312	4328	firefox.exe	101
PID 4328 wrote to memory of 1312	4328	firefox.exe	101
PID 4328 wrote to memory of 1312	4328	firefox.exe	101
PID 4328 wrote to memory of 1312	4328	firefox.exe	101
PID 4328 wrote to memory of 3548	4328	firefox.exe	102
PID 4328 wrote to memory of 3548	4328	firefox.exe	102
PID 4328 wrote to memory of 3548	4328	firefox.exe	102
PID 4328 wrote to memory of 3548	4328	firefox.exe	102
PID 4328 wrote to memory of 4696	4328	firefox.exe	103
PID 4328 wrote to memory of 4696	4328	firefox.exe	103
PID 4328 wrote to memory of 4696	4328	firefox.exe	103
PID 4328 wrote to memory of 4696	4328	firefox.exe	103
PID 4328 wrote to memory of 904	4328	firefox.exe	104
PID 4328 wrote to memory of 904	4328	firefox.exe	104
PID 4328 wrote to memory of 904	4328	firefox.exe	104
PID 4328 wrote to memory of 904	4328	firefox.exe	104
PID 4328 wrote to memory of 5004	4328	firefox.exe	106
PID 4328 wrote to memory of 5004	4328	firefox.exe	106
PID 4328 wrote to memory of 5004	4328	firefox.exe	106
PID 4328 wrote to memory of 5004	4328	firefox.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\content.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {26c4949f-639c-4cb0-b8e8-8e25e47b6d69} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {5f876f38-8e43-4c98-ae25-7d5939e1becf} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3920 -prefsLen 27274 -prefMapHandle 3924 -prefMapSize 270279 -jsInitHandle 3928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3936 -initialChannelId {4b85703a-5b5b-4402-be36-543b755e4308} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4088 -prefsLen 27274 -prefMapHandle 4092 -prefMapSize 270279 -ipcHandle 4112 -initialChannelId {337fad6e-0b52-45e8-bd6c-d515a9b94f4a} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4440 -prefsLen 34773 -prefMapHandle 4444 -prefMapSize 270279 -jsInitHandle 4448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4456 -initialChannelId {77625953-fe55-4f9b-bdcf-48c17b0f86da} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4844 -prefsLen 35010 -prefMapHandle 4712 -prefMapSize 270279 -ipcHandle 4988 -initialChannelId {8b44ee8e-0fd5-40b3-9f92-5b9e452ba072} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5376 -prefsLen 32952 -prefMapHandle 5368 -prefMapSize 270279 -jsInitHandle 5396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5404 -initialChannelId {863ef3ec-b902-435b-bf56-421ae7033184} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32952 -prefMapHandle 5584 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {0cec9f6c-70ab-41bb-aea2-9f8fd137c43b} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5616 -prefsLen 32952 -prefMapHandle 5620 -prefMapSize 270279 -jsInitHandle 5624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5632 -initialChannelId {b5d2620f-252c-4e86-9cf6-033d91ba7a5c} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4812 -prefsLen 37095 -prefMapHandle 4820 -prefMapSize 270279 -jsInitHandle 4936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6192 -initialChannelId {126e0dd9-48da-441c-9eec-f2934f973752} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 51e6b0e9ccc2c9687c43cd8c8cc105a272b56c2a1b40cc026e0a8e6faa5b6374
MD5 903e87a59aae288e73699ba5a86e83fb
SHA1 e4c04041c6c135c0b1a65795571e7507736f00a5
SHA512 ee85339895ac5deeeece7ef781cdbcbb79c4dc0963bfa2bbb8b94bf4e4ee5a488581ec86261f9383eb161c81016a4f4ab64f8a8fc14ad7ddb013ec582787592d
SSDEEP 384:HwCe7iO024Y+dcs3hk2nhfdDE2Ba/rIVy8eoW+UW+0:QqZY+dv3hk2nhfS2sDIVy8c+d+0
TLSH
T133729DBBDF516C5D1967D989C8AD5769DD04F9ABCFF690B608203049CB84326B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 a42fa2be6836f3453fa5df364fef50acb0fce53f3226495b5b3168374aaf7971
MD5 10f1b8b5d4d1eb4ccbf768dfe11410f3
SHA1 fb3695610dd20f4c3606cf926f4c2f75759a2f3c
SHA512 562ffb813ad6df322701008dc8128b2602142624a8aa4321991edf0058ed55f9b5a386ad5f2938fc31451eca5d43f617c7beb43fba430d6478b4b16e97648863
SSDEEP 768:fM31lpGQdJ2+3Gcm+u55vQKhanZJVnCb7bTbmb+bTyi:+pGQdJl45vQEV
TLSH
T1EFF23384EB2A953FD42412BBDCA51B002F79F88959092F673A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 1c81682620a1ad68fb5d1f30118c17485f1ad58f56d62482167a5cd9995af324
MD5 631cd1692934c1dd8ed785e1ac7ee350
SHA1 669dbd77b10ce431609e00354e4449220d5bec9e
SHA512 37d437b3d907ddb3c81a18ad64634566c84c3b871b18ccdd0400cd76b1c712f995df1a8d70a08642e668b2b36460eeab25ee5cf42a69ec1060430a1bab715d2b
SSDEEP 768:a1KMXpGQdJ2+3Gcm+u55vQKhanZJVnCb7bTbmb+bTyi:SpGQdJl45vQEV
TLSH
T1BAF23384EB2A953FD42412BBDCA51B002F79F88959092F673A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 2affa1fdca25e3838eb544fb7f70a0a6158d59ed920d7448b4ff471df7c1cac0
MD5 c998d8797154e2f86ff10e7b32911376
SHA1 e2c8d62fd542a7b575ea55650233c13636cb382c
SHA512 3e31567009a8be24e23e10789ed4d6d453e37bbfaab21717a1c8f1af4c36961b67c6267f41b0f9740b463aabb1a164911dcfdd8343390546fcd6ecf927ec589e
SSDEEP 768:0CP535/3/LGcm+u/BRYBJV5XbVbIb+bKE1/:V535/3uBXy
TLSH
T18BD20144EB2E953FD42512BBDCA51B002F79B889590D2FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 be16f7137636ec7a891fabf237754c9a410d30b44df769b6a71a14b9fd908fa3
MD5 8014a9df626d384e6d29e3263e879bd6
SHA1 ce574308154b883713e3167e2cfb97ac10b8fc95
SHA512 948a2e47bceab53c9e8a07e9285347c212215ec18c30471b5875d4c37ddf23d7e0fa76a15496d1f79c3ec1ad24eac76a50d923f4b91d3a70ba2c9f3792e4870b
SSDEEP 768:a1l535/3/LGcm+u/BRYBJV5XbVbIb+bKmvG:U535/3uBXZ
TLSH
T103D20144EB2E953FD425127BDCA50B002F79B889591D2FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\events\events
Size 1KB
SHA256 eeebffd2379c7ab2e7bcd036103f1969b3f2fe68098155dfa5189cdcb54d8d66
MD5 e0990af84c7534efa57ee781c2c10724
SHA1 c57c3bd5c3b206fabfeabfa17e3e4832e25dbf1b
SHA512 e9276aca3f7ed16fec0c1a1cfaa3dc139ef8dd344c4f468454d60bf6aa861c3e4067a2fbb5aa3c2f45758284b98f2737b35f2720df5331889db78580794fe025
TLSH
T11721285C7AB98D6A98C6F39DB480028E53558E0605862D470D42EECDDFD1EDD326A42D
MD5 SHA1 SHA512 TLSH

Submit Download

2e7695df-0b6e-4f7b-87fc-28ac6f66906e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\2e7695df-0b6e-4f7b-87fc-28ac6f66906e
Size 2KB
SHA256 c539568828e0dd9c5b462444b6d4c82bcdf7af15472af95aed71db94a2d62eb1
MD5 742681d87853a544e96f6421b68e2888
SHA1 be06a8f5552af4ff1ed30c5dda19920838e58b9d
SHA512 4073b02c0b1c0e85aeaac8661c9600a6edb4f3e41a7f79bfd1c991f8f8223c85b4e1fc1ca6456a7335a6465c66b2e4a90d2678211d9c1c46cb2f5d5d882e1920
TLSH
T1D141245C3A744CB68CDAF15D9481338E97A49A4314C518432D52EF0C8E967AE336A52B
MD5 SHA1 SHA512 TLSH

Submit Download

3e989836-23b5-48cf-ad24-509b6ae4b24b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\3e989836-23b5-48cf-ad24-509b6ae4b24b
Size 235B
SHA256 f561fd08a31748680e29d1603a7ddcce93d7ed9a6d20cc46a00a523e0c770aad
MD5 4e75ba2dd9645ba3a1d50490016182a4
SHA1 346362560fd9a4258d3f04f44d8fcf7ad0e84421
SHA512 1f583ca467b5c574732b504d2ed00ca89674f339eb27922cf8bd94b765edbd85936dd5847ae2ec6f987aa6a992ce1289023ee8712b2460c49963c6fcef73555c
TLSH
T10AD097C86488733D08101F0BB0E03ACA30888C3350B4D820E6664434AEFDDC842A2C46
MD5 SHA1 SHA512 TLSH

Submit Download

71787121-86ec-4dd3-8bc9-528a2b09ff8c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\71787121-86ec-4dd3-8bc9-528a2b09ff8c
Size 235B
SHA256 71300ecd616875a4199938938b5c235abf67e5cfd825b3d2872abb5175641539
MD5 1b4360638c37cc720f64b8c7ebf928ac
SHA1 52dba93fd532356686fd13ffde0d6df3e84e583b
SHA512 b0b0951756a8ae11352dcff83b9ee1c9716dc3b0165e172a8d3315d20cea46f8e55bff0c2459d97beb12b68af72f24d5b8d5be17dbdf2ab8d32ddfd915e998a9
TLSH
T15BD09780388837BD08144F0BF0A068CF31458C3B24A06890A9A2007889FEDC8412382B
MD5 SHA1 SHA512 TLSH

Submit Download

79ec283b-ae8a-4c73-be92-7da73a9c697f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\79ec283b-ae8a-4c73-be92-7da73a9c697f
Size 886B
SHA256 fcd579558120b38f09a375d301ec628c6e3791f37f4a38f879a1db35343f0f6e
MD5 31b4439731dbf580920bc23a2f3bbbb9
SHA1 391149e6de69c756a7e8e20617850e1900268e22
SHA512 dfdcc603b76f704f68a73e1c1bcead1c05e64119ebb4b1b85aaef533d73b9e189abfde15db70a744f0c77de88fe02be11a8a4caac1149b735f154c6844db02d7
TLSH
T1E0110480957079B2CD74915F99E1778387E4B45340C94C143D626A180EEE65FA796307
MD5 SHA1 SHA512 TLSH

Submit Download

92060ea7-9808-4f0c-8bb3-eaad3dc717e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\92060ea7-9808-4f0c-8bb3-eaad3dc717e2
Size 1006B
SHA256 068071154473b9e42ca27e1a9f6dda9bffc0db09b83d9cefda93221414f1d43c
MD5 d3d7e108cf619daee3593944ac926e42
SHA1 c98cba82297adf44e3a00b2dc8336bef0bb4fa9a
SHA512 3acd6a96e566bcb5448ba958648a2522e7d7b25b0ba2e89e2fbfeecfbc7a6f129f7e0c74167897cbaf21a164f21d2bb1430fd3a3d1bd505ab3905f2c75b079e8
TLSH
T1FE1102E54A312013BC64E20EF291BB2B66D6983344DB41446DFE54294EEB53F826771A
MD5 SHA1 SHA512 TLSH

Submit Download

eb685fcc-8589-42e7-b8ea-f6bd97b6d298

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\eb685fcc-8589-42e7-b8ea-f6bd97b6d298
Size 871B
SHA256 8764df82f26a4e8b398cc76c5829204c559ab7b70643a900aa8157fb74e6b20e
MD5 b8e42c225846555dec088353bb15805f
SHA1 420ac31cb567220a8d829ec0aafe9f8757f95044
SHA512 0dc4a552953af56ae0e745776b958f50f8c216f347fc35a741284436fe4c5c5a3ce3fc04139361977a212dd5ac8085899bb0b5fdffac41de7aa865c022323447
TLSH
T13E11E381D534B9B28C78D25F8A9137968BF4B41740C985143D72AA080F7E76FA7A6317
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\extensions.json
Size 16KB
SHA256 0157c825e38e788cf42cd1a647d4b3f8f21b8f05a4bdb9dae7149be29fb81448
MD5 17d36bab6c18723205d5b4bf5ab56511
SHA1 c3723cfcef5d6a484e430b8ec85b990da2ef34e9
SHA512 8699029c376ec61abae804667e419c785cae01874a57c6d744a514b07b7e1fcae5507389927710ccd0285d8edf86b2886e6d97cece5455e8cf090085d4621caa
SSDEEP 384:lkI4vlUmldvB8dhWM94ze96oML4HIL4PqtL4H6tL4HxL4H8Q4h7:2I4dRfSXJ42614q4St4at4J4h4V
TLSH
T1BB72531545048EB8298EA79BAA367D01C37D573B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 6KB
SHA256 c909c1ef18259c4ff6fb73e95e00a063a85ffca9a6fe19f700facedae3d60a04
MD5 675a517b1a14af30f2cc20f87d20ab1f
SHA1 3613eed46c1722bea9e4800dd8e2dd6e7d1d9b62
SHA512 ee0eedf507521dc9f3f2236b68d4a1252527225bc752b4bb42174f46eb3bc7e93aca15fc9e934a399e5eb15710441d20ccfab267905602173100874113399e04
SSDEEP 96:xHLUTUhRqGqUfjYD1zSzSSlcdv9jCPnTRH0wkysLBw88u8L4cndBOR:B+RUfjYDiSSH90wkZBw88Ri
TLSH
T1ADE11F7894088F7F68B6776CAC688C316AB2013B77BF68D750B64484055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 8KB
SHA256 084e92a00ae6ee07c131694cfbd5fdeca24129591c0d486bc856363a0cc03767
MD5 766aba92f1c5bc34e5320b81bbda3d75
SHA1 8abd8ba94a97f9fed839f3d264000ed9b8fe3e7d
SHA512 f07474f49c5664176b9e1b070b0d68ca309966f912b29ba6f3bbd50466b41aedd5917abb67af26a91dc3d3839b8a17c3bdf0c143d43dfbc7b7d07fb5022acbd6
SSDEEP 96:xHLNTUhRqGqUfLuqYDObzSzSSlcdv9jCPnTRWRFhVNdowkysEBw88OesH8L4cndP:BnRUfLuqYDNSSH8RFhiwk6Bw88k8h
TLSH
T1E7021F389004CB7F68B276BDAC6489715AA2023BB7BF6CD650B554C5014CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 7KB
SHA256 4047014a6526722302207b226f4d3ecb4ce73188c9afacf26f6809c7301221c1
MD5 39f996a0936325e9f4239a7ec1148b82
SHA1 b8525f6cc2442575a46fcfcf7ab660a0677dd1c1
SHA512 c25c5688ef245f71c1cfb8091d4a1c1ff1af27ca75646df043a872c52f221e8c85a4a1291c329c3cf40d1aab3a3f07f877b9b7db60756e5dc8498224651b67d4
SSDEEP 96:xHLUTUhRqGqUfjYDObzSzSSlcdv9jCPnTRH0wkysLBw88u8L4cndBOsGS:B+RUfjYDNSSH90wkZBw88Rh
TLSH
T18AE1107894088F7F68B6776CAC6888316AB2013B7BBF68D750B654C4015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 12KB
SHA256 ac45fcff08f8761a443f60bc1e6b4509dd68a7ccc9f76e257050bc27af629737
MD5 ef18ca1fa5dfa261944871f7f0517bef
SHA1 325db835d3b098d8d02cf3cfde5e2a6904536f29
SHA512 92b915fa93b6e5395c489704564f56c8339256b0b696bbb1046c7bf6159675830545db61809b87fd84da37081af7fb2d1a894bc10f3a60552148d8e58a331e53
SSDEEP 192:XnRUfLuqYDNSSHXLRFhiwkcOBw8Oy0DnCXD7h:qMRq3w7ap
TLSH
T13F42ED3890009B7F24F672BDBC655AB119A10227B7BFBCD245F994C2054CF3941E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs.js
Size 6KB
SHA256 ea00de8177b03d8441580147998687d7dcdcfeb84ed0f600fcda6e791a7e3970
MD5 9a2ebf36bf50528ea342df366b65bb17
SHA1 37c7dcf368fc0dd87e0768b56c21c8cc65897d74
SHA512 49fed74ff45c862872a3bf4e2ef0af96f49fd624944ea93c4b8f1fe6981921a20474962cd5afff165378e45832341c57740a49c01ca9099e651c29334c292008
SSDEEP 96:xHLUTUhRqGqUfjyq1zSDbSSlcdv9jQnTRH0wkysLBw88u8L4cndBOR:B+RUfjyqWSS190wkZBw88Ri
TLSH
T18BE1207895088F7F68B6776CAC688C316AB2013B7BBF68D750B65484054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\sessionstore-backups\recovery.baklz4
Size 898B
SHA256 46950d24ef7c9f5e935b04862c3e369ca1a04087bc0a8502345c1eb313b4b3b9
MD5 7919c33a276c831288fde0f809b488d1
SHA1 a8edf5a91faf0cfc39661ddfba4646961cd366ac
SHA512 0e55d1e0e3c237c80b5d1d6d5edd0cfbf666976cbcc425b737c6f3cbed00a25ccfe10de5a1e1003155ccf8436bddb4362074f437ae66aa3f27a982a9ed049ab3
TLSH
T1A0114482A94A51E76B90701F9885AFFE4F8E243746362890F28B6D00A51834A71AB589
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\sessionstore-backups\recovery.jsonlz4
Size 951B
SHA256 9c08e70d3d9f2666cc53e310f0e84b5c33178cd6b8643e217d6e94c5c8d9f816
MD5 e7c0ca1eedb62fe2a3415ae63852fa29
SHA1 bd0af5a9fda2f15c20f4fb1f680850cc9ea28532
SHA512 686cbc3c316b553c0cc6be9be42d4d79903c1dc6c1bab17fcb09bb6b33110725bda1b4e1af7d35306513d232d3ff26a26d0618359320d09322f2a833940274ae
TLSH
T11F11C8C27E1636B70751A01B60CAAFFF4FC9503642766870F6896E01211C34BB16B649
MD5 SHA1 SHA512 TLSH

Submit Download