xworm | 45f3b2a158163f09cfbf248a2fa76f2b3b011b8abc35835230ab81597db43802

Analysis

user interaction
yes
max time kernel
749s
max time network
745s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
123645.exe
Size 84KB
Sample260731-2wv8essepd
SHA256 45f3b2a158163f09cfbf248a2fa76f2b3b011b8abc35835230ab81597db43802
MD5 e3a5cb4262f94dd45dab2d497cb49adb
SHA1 df7c2195fffccc1cdbecaabd883151d32ff9d67d
SHA512 708e8d68674b734aa9ddf95514476a2c72eb780efa506155fcf197aeed7f8e1babd7d34c48c3df4315553a0c9fe85de9f673c5ce67a0387a1adc4a8159e9618c
SSDEEP 1536:jLOhmFlCRUh1sLJVQr9rcYTJzQ5f/sksVQgUnH85CDxQ+vD7N2up1jSic:X/X14wJrcY2/hUxUnHuCMhic
TLSH
T1A783023F3B012A31EAE656760BE2E1B825B4C7469D6C8EEDC8D3751BBC980CC7C4515A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

7326.info:2686

Attributes

install_file
USB.exe
localhost
127.0.0.1

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4272-9-0x0000000000400000-0x0000000000418000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3652	powershell.exe
64	powershell.exe

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3696 set thread context of 4272	3696	123645.exe	88

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 40 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4272	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3652	powershell.exe
3652	powershell.exe
64	powershell.exe
64	powershell.exe
4272	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	RegSvcs.exe
Token: SeDebugPrivilege	3652	powershell.exe
Token: SeDebugPrivilege	64	powershell.exe
Token: SeDebugPrivilege	4272	RegSvcs.exe
Token: SeDebugPrivilege	3088	firefox.exe
Token: SeDebugPrivilege	3088	firefox.exe
Token: SeDebugPrivilege	1640	firefox.exe
Token: SeDebugPrivilege	1640	firefox.exe
Token: SeDebugPrivilege	1640	firefox.exe
Token: SeDebugPrivilege	1640	firefox.exe
Token: SeDebugPrivilege	1640	firefox.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4272	RegSvcs.exe
3088	firefox.exe
1640	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 4272	3696	123645.exe	88
PID 3696 wrote to memory of 4272	3696	123645.exe	88
PID 3696 wrote to memory of 4272	3696	123645.exe	88
PID 3696 wrote to memory of 4272	3696	123645.exe	88
PID 3696 wrote to memory of 4272	3696	123645.exe	88
PID 4272 wrote to memory of 3652	4272	RegSvcs.exe	89
PID 4272 wrote to memory of 64	4272	RegSvcs.exe	94
PID 4976 wrote to memory of 3088	4976	firefox.exe	109
PID 4976 wrote to memory of 3088	4976	firefox.exe	109
PID 3088 wrote to memory of 3940	3088	firefox.exe	110
PID 3088 wrote to memory of 3940	3088	firefox.exe	110
PID 3088 wrote to memory of 3940	3088	firefox.exe	110
PID 3088 wrote to memory of 3180	3088	firefox.exe	111
PID 3088 wrote to memory of 3180	3088	firefox.exe	111
PID 3088 wrote to memory of 3180	3088	firefox.exe	111
PID 3088 wrote to memory of 3180	3088	firefox.exe	111
PID 3088 wrote to memory of 64	3088	firefox.exe	113
PID 3088 wrote to memory of 64	3088	firefox.exe	113
PID 3088 wrote to memory of 64	3088	firefox.exe	113
PID 3088 wrote to memory of 64	3088	firefox.exe	113
PID 3088 wrote to memory of 408	3088	firefox.exe	114
PID 3088 wrote to memory of 408	3088	firefox.exe	114
PID 3088 wrote to memory of 408	3088	firefox.exe	114
PID 3088 wrote to memory of 812	3088	firefox.exe	115
PID 3088 wrote to memory of 812	3088	firefox.exe	115
PID 3088 wrote to memory of 812	3088	firefox.exe	115
PID 3088 wrote to memory of 812	3088	firefox.exe	115
PID 3088 wrote to memory of 1404	3088	firefox.exe	116
PID 3088 wrote to memory of 1404	3088	firefox.exe	116
PID 3088 wrote to memory of 1404	3088	firefox.exe	116
PID 3088 wrote to memory of 1404	3088	firefox.exe	116
PID 3088 wrote to memory of 4388	3088	firefox.exe	117
PID 3088 wrote to memory of 4388	3088	firefox.exe	117
PID 3088 wrote to memory of 4388	3088	firefox.exe	117
PID 3088 wrote to memory of 4388	3088	firefox.exe	117
PID 3088 wrote to memory of 4276	3088	firefox.exe	118
PID 3088 wrote to memory of 4276	3088	firefox.exe	118
PID 3088 wrote to memory of 4276	3088	firefox.exe	118
PID 3088 wrote to memory of 4276	3088	firefox.exe	118
PID 3088 wrote to memory of 1280	3088	firefox.exe	119
PID 3088 wrote to memory of 1280	3088	firefox.exe	119
PID 3088 wrote to memory of 1280	3088	firefox.exe	119
PID 3088 wrote to memory of 1280	3088	firefox.exe	119
PID 4244 wrote to memory of 1640	4244	firefox.exe	130
PID 4244 wrote to memory of 1640	4244	firefox.exe	130
PID 1640 wrote to memory of 64	1640	firefox.exe	131
PID 1640 wrote to memory of 64	1640	firefox.exe	131
PID 1640 wrote to memory of 64	1640	firefox.exe	131
PID 1640 wrote to memory of 2376	1640	firefox.exe	132
PID 1640 wrote to memory of 2376	1640	firefox.exe	132
PID 1640 wrote to memory of 2376	1640	firefox.exe	132
PID 1640 wrote to memory of 2376	1640	firefox.exe	132
PID 1640 wrote to memory of 2732	1640	firefox.exe	134
PID 1640 wrote to memory of 2732	1640	firefox.exe	134
PID 1640 wrote to memory of 2732	1640	firefox.exe	134
PID 1640 wrote to memory of 2732	1640	firefox.exe	134
PID 1640 wrote to memory of 2164	1640	firefox.exe	135
PID 1640 wrote to memory of 2164	1640	firefox.exe	135
PID 1640 wrote to memory of 2164	1640	firefox.exe	135
PID 1640 wrote to memory of 2352	1640	firefox.exe	136
PID 1640 wrote to memory of 2352	1640	firefox.exe	136
PID 1640 wrote to memory of 2352	1640	firefox.exe	136
PID 1640 wrote to memory of 2352	1640	firefox.exe	136
PID 1640 wrote to memory of 3824	1640	firefox.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\123645.exe
"C:\Users\Admin\AppData\Local\Temp\123645.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3652
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:64

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {e1226224-bfb7-4f3a-b279-62c5f21e749a} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {6d69725d-f23b-48d7-b8af-1b42428fd3d6} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3024 -prefsLen 27276 -prefMapHandle 3052 -prefMapSize 270279 -jsInitHandle 3056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2880 -initialChannelId {92b68ecc-7366-4892-9938-b9bf0adf628e} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:64
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3004 -prefsLen 27276 -prefMapHandle 3008 -prefMapSize 270279 -ipcHandle 3808 -initialChannelId {ea10f979-00dc-478b-b4f8-6daca52b035d} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4364 -prefsLen 34775 -prefMapHandle 4368 -prefMapSize 270279 -jsInitHandle 4372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4380 -initialChannelId {ade41ed4-af58-49ab-a5d5-be766eaac112} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4980 -prefsLen 35012 -prefMapHandle 4976 -prefMapSize 270279 -ipcHandle 4932 -initialChannelId {df9bc1ea-3b7f-4675-b907-baa84dc8097f} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5084 -prefsLen 32900 -prefMapHandle 5088 -prefMapSize 270279 -jsInitHandle 5092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5064 -initialChannelId {15dc4e73-0fef-49bc-b612-55b51e5b8af8} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5372 -prefsLen 32952 -prefMapHandle 5376 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5388 -initialChannelId {ddd14b9c-4919-466f-ab7c-db1aef493a60} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32952 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5576 -initialChannelId {f53bacfc-855f-46a7-935b-3e05139acda0} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1280

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2040 -prefsLen 31598 -prefMapHandle 2044 -prefMapSize 270887 -ipcHandle 2132 -initialChannelId {9b933a16-c16d-4a1b-aeb9-97285b501072} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:64
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2540 -prefsLen 31634 -prefMapHandle 2544 -prefMapSize 270887 -ipcHandle 2552 -initialChannelId {a0ce9911-3d9c-4ef3-8625-3f6cd463312a} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3800 -prefsLen 31824 -prefMapHandle 3804 -prefMapSize 270887 -jsInitHandle 3808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {a6da989f-db8c-4154-9464-dec568d25ec1} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 31824 -prefMapHandle 4016 -prefMapSize 270887 -ipcHandle 4100 -initialChannelId {7d8f4cb1-4511-43e5-86f3-3d10628d27eb} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2552 -prefsLen 39380 -prefMapHandle 2544 -prefMapSize 270887 -jsInitHandle 2576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1236 -initialChannelId {652d6150-cbe4-458d-8c2a-10cd1deac97c} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4968 -prefsLen 39380 -prefMapHandle 4972 -prefMapSize 270887 -ipcHandle 4980 -initialChannelId {006bf392-cf55-4156-98e4-76bae27fbeff} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5520 -prefsLen 36322 -prefMapHandle 5524 -prefMapSize 270887 -jsInitHandle 5528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {fc9bc41c-ad35-44b8-8bbf-bc2b523a5b32} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5724 -prefsLen 36322 -prefMapHandle 5728 -prefMapSize 270887 -jsInitHandle 5732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5696 -initialChannelId {d98b7d62-bdd3-4d5a-8c2b-236ec9b6d4f4} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5908 -prefsLen 36322 -prefMapHandle 5912 -prefMapSize 270887 -jsInitHandle 5916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5924 -initialChannelId {e7c8e0fd-4450-43ea-8eb2-9fdd00aeeac3} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 cc4417ec3b24f841013e58fc6e64b341ca3ba82dff58ff07cd579696a2e9bd17
MD5 72bbf4e285f708c11e2a500b5b1a606f
SHA1 4dc38795f5717edb1b014224a7c5d1e24ec97484
SHA512 b7b137e6a1b4fc60ab61ef8358c5e39186b9b754426e1fd1216db2346acf5f55c13266fae2ed14dfa1fdfd6a50915f4798b58e1973593157155f6e4ced3c5692
SSDEEP 384:vsf+BY9i+V5aCNM3ui4izJk5o72TVK6seYwME/F03SoZZfYSgojEDkSQ0gdMtkKF:Efr5XGuiHeq2TVNfruSEW2ED/Cm3
TLSH
T1BD82E76E611F16C3C49613B8E11B045FE8F2DE8D531A13D87B1E9F3B8AAC69E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\activity-stream.contile.json
Size 5KB
SHA256 8a925d48dd395880a3b9009007245e96935cc7c7d489bce90a27242db5d45cc6
MD5 49a9a0f02759fabe40d1cf4a6e65d112
SHA1 85323261c5a2c5eedc325daac2bf4a7f79a30e1b
SHA512 bdc3f3f896f40d9f75a51a0bed2181b9d480d5798cd97607c15d592c5ae24e15667e93d0ea24dadf284f266af68a1087e4e10fdeae81fe3098ec1ff3b433c5c5
SSDEEP 96:zb2CiJ+FnDXA9EKTZKYzb4C/1Nc6DCRcxbCCwa5IpsYob:zpy+NXW95f92wCRcxNwEIsYob
TLSH
T12BB12ABFC66584676B7375D0391B33E8E243B20BA5E9DEACA3C19C00922929545FDC89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\activity-stream.discovery_stream.json.tmp
Size 75KB
SHA256 ba4fbeee3cc92748b37ce33713a716cd016bc8b2c02c143a8f29aa0c74f9e00a
MD5 1c52fe554a760dac849a6a314a952504
SHA1 e4ebe663bcd729494d74bf4c0fc5b069bd9f4c5e
SHA512 365299ce9bc7a8768b240e30dad4c6afd58d0b4ebc7532409dea1b6bcb2fd0f6c059b7d4d8008b3c14a25ecb98e0a113ce52ba70ce96c2a0aaaf4812e4f172ac
SSDEEP 768:SBy0MVj2RfzOE0mjnvxB39DDbvuzCaPRRCqe0lR0mEoPz3HwqJYlHY:SwTqjnv5bvuCQRLek0DoPzX1n
TLSH
T128730AA396B871FF1F9537D71C0BBD5B92E64145E34606C8EDECCA1C80CC6A4123A5B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 2f15782fa54849005ad0b98b3b9b8a235f5f0129dc7277bd2d51df23ef8aba12
MD5 6e4468588bfee77402fd1826b79ee87d
SHA1 c013bd17f7b0ab1e751f6e4338fa34e1b3b42345
SHA512 78ee48c4727ba39001979e2a77a0ed8ff8afd275210c17b21ad3f1a5fcda934491088c200498e0295026eadf402f221a2ca5bccbc928dbe6c41df2ddfcb38c0d
SSDEEP 384:HwCe7iO024YeDL84KKDL849B7SOEAd9KVRaAcP+AWRMAwub:QqZYeDL8lKDL8CB7S/AmVAf+hRMlub
TLSH
T11E729E3E9F013CAC1597C0E8C5B852D98D1877A3DFE6806D22683D0DCB98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 2065a793b8a8319d7fce64a2dd7e92face1b59250c8a2feabdafb1c6ea62b3e1
MD5 7c1c07769933bae9709aab2f765f4166
SHA1 d42fdcf604e3669a34a27d5e5d2b57a2c1c6c633
SHA512 da1803b77a07ee853a322625c329b5904d9db4e63802138282901dfce1ccd3f0df957a4de2dbfee4536030f7229be995ec4a93d7bf038dba7ecc555bea0e7081
SSDEEP 384:HwCe7iO024YpDL84KKDL849B7SOEAd9KVRaAcP+AWRMAwub:QqZYpDL8lKDL8CB7S/AmVAf+hRMlub
TLSH
T1A1729E3E9F013CAC1597C0E8C1B852D98D1877A3DFE6806D22683D0DCB98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 16KB
SHA256 676cfd2bec16ffb215a7f6fa106e50773efc4d01b4e32d7882ff24cf635a100c
MD5 54d2a61a350f40c2d0bb06cb8c465e75
SHA1 2f60ca03c9276565514dcea650c025060901fbd9
SHA512 461c10eb580303dbeda21b1d801f05e330868ba4a81f6ef28439af262847e28ca50d7d7276e93d8fa76fc9ab8b3816d0866129a9735b330bfe6a57bccc69fbc0
SSDEEP 192:8py+NXW9Xf92wCRcqNwEIsYo/L0Bzmoy72e0Bzmoy7oirNfoEHjGPl2BadE4ProT:cAfzrty6PtyLhfdDE2Ba/rIVy8eY
TLSH
T14E729EBFCB94885D1F92A4439C3E27A4AC17F2178BE9E6ED23C43505829A36594F81CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BB95D0607349D05725D5FE01D4FB300E319072AD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\BB95D0607349D05725D5FE01D4FB300E319072AD
Size 11KB
SHA256 ec356e1f687a833bd523bfcbe4a9c8e4596c6f4af585d64e5c3cc1be107387af
MD5 2f64b7d1a8880c02465972f0d39ebb97
SHA1 fce9bd531330bfe122fad0cf680e2ba61d62a645
SHA512 e0bc307ffbc9b1dea986083fb13ac49354444983ee2fe27a005a103f43aec2b043e8aeb2aa45f200a736da52c147b848dbaddb3bc6cb618d63ebed1748398da6
SSDEEP 192:2RXyFRl6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDTT:2RXyFRlvI2Efy0vI2EfnaGUzHODWoh17
TLSH
T119427E7ADD61586E0AF09197D9BC686D0C46EB03EEC7D1E93D193504D9C03A9A3B82CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0F48A0632B6C451791F4257697E861961F06A6F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F
Size 256KB
SHA256 1ca0a69ca7af18e9d64a346d0da4b0636494b6685f4d2db0a6d4fc9547014bfc
MD5 19902e3635245e1cbe43eca84eaed877
SHA1 8aa876f89a51211b2c16da6ac06df718c1b1e44d
SHA512 bc1d7e5513fd999f837b0155034dde9e62c0e0047b6b6fbe327d9d08cb1118831c38a852600de6e0c6484eb276e17b85ad7fa5f6a4012d95818bce64bc9f845d
SSDEEP 1536:HYCYFszNjeqK9DaCHrLQhjSPrhvkcIKXqa2tt3AE21zMOCfS5BFTQ68Ct5X+2M1K:5x7c3qa2tt36MOCfufuFi3
TLSH
T1F84409F7D6AC30FB07528ADC6C1D72CF62AF4239DB5209D6FC688148C3C9A65107679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E473D920361435DF4BBBF194E406FE372015579A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\E473D920361435DF4BBBF194E406FE372015579A
Size 11KB
SHA256 2fdd24dfe4c61526a211328e399338ad42eab2d7655f91692734140269c18395
MD5 67db05ef8794db7804f9912151620f23
SHA1 da368a7132d4b06fdcce91993b891248d9ab371b
SHA512 e391937fd28b19fcb40c4ba3b01adcc78232d6343957aad1bd85d3cbbcf749ab97c3721ba6b935164f477387e26f78bbbb1b87486e0c71bbe27671a792788ab7
SSDEEP 192:ttwP6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDlHdKj:bsvI2Efy0vI2EfnaGUzHODWoh1B9M0li
TLSH
T1DB427D3AED5058AE1EF1959BD6BC69681D46EB03EDC2D1ED2E193104C9C03F9B2B91CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache-child.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\startupCache\scriptCache-child.bin
Size 534KB
SHA256 63f0ac578360c8797e9b84d60383b615ca24d00f17da0d498bef5c8caf90aa86
MD5 3ddb77b77473d50bec56bcc002930254
SHA1 45b7309c533b657a0eab0bdd82565f5b09f9c600
SHA512 b247dc0e82ccbbfd4eb5f47e6afb9f511cb1946706fb9017b589af91a9fd313ce7609f1f7d777515e9e07179ad6361991247e05101e8d09154940c1262b3d6d5
SSDEEP 6144:JFCUbu1hjktpJn2pmYXHqjOcpEIvSW2psu:H7ubotPnpv9h4b
TLSH
T1EEC46111EFA64E23C418037A44F753313A31E1451BEAE3276F8F7629BC673A91D8A95C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\startupCache\scriptCache.bin
Size 10.1MB
SHA256 c061b0a43d2cd828aa2cd469da6b79732c83321edebc82d070ac28ed8c609424
MD5 8fc748a78e68d74f9e9ca9e4a5c21cee
SHA1 e6d0ce633cc42580f3fab6675568c26d1b401c34
SHA512 34c805675925a1e070f47cd966e439b1fa1afab2dd0b31446229d3cb01342769a7812cbcd013af814ff00b0513163e780f38819722b52e6df87e5c944ef71e56
SSDEEP 49152:UkVvxHNHhFDzwH6f8e5v8by38zYPHpJFVFwjdhCX2EDj/BUbSm:Bv1F/wafp5PnRmS9u
TLSH
T1DBB68215EF664E23C468027A48FB53313A30E08547EAF3276F8F7129BC6B7691D8995C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startupCache.8.little

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\startupCache\startupCache.8.little
Size 8.4MB
SHA256 c94ab3b54bf1c63b14dfa399b12eb136c866dd3280e6ce1a4b3ff6e13967eaeb
MD5 d80547d6aff5a532198a232110d4c64d
SHA1 80d5835bbc2ddf870151f2d19b72030b00a43fde
SHA512 d28ff818ee8c6300476bf2fb8a244a55d24c9f5fcfa2d288f675b90fef181ce1e249014558375823204849c141e14a998e56fc7943b74739b9495bfa104eeae9
SSDEEP 98304:vr3qsdOh6eNdEeq13DAAnZi6lwJdNTngVVIKFGHPbOR:TLddku3MQiuwXND1PyR
TLSH
T1449602B6B3550697C425191AE87A0A3937A3414203E166AACF78533FFFC724C1BC6E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urlCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\startupCache\urlCache.bin
Size 3KB
SHA256 97d1417cfa2f15881594074faa0781ba6f32137c9f13b1e9d3d3d7102c7f3524
MD5 00fac3a5766c11643d84aa7ac6b77d7f
SHA1 da65fd68b12c0b59446ea1c5c24392dc4ed564c6
SHA512 c1c9cbb582c9bd2713fbc7de77574b4ad8fc8d1215d23f5a646b92b1f9b54820a1eebe7f4f616a3b871fa77e06628e5aa6a6395684c2c6aa7b231b1cb89ceea0
TLSH
T16561D392E43F203BBD62A8FB6D95C175B42049CED1CD20DDBA9663D4209E7DC034EB1A
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 0d91b7049e61c230dd3b4890d5b6a498b0af2939862a786a9a7976355d9189bd
MD5 b352740cea9676e6d881d09af34052ee
SHA1 b167405b2f82c96a502f85f4a35ee26add0ca002
SHA512 e4d520395eabf81f6d8689caeac4d9eff3893f93ebfe8d4ba37f0c476e7adf78c701f24cdd2ad121457866017e143a4abf602e7d2f44205e5eebf10d89074764
SSDEEP 3072:X3lsYyMzUC1Pvr2jxRiaZ2WLsEoeNcycoNHhF:FsWUmaemLl1t/
TLSH
T1A0B3AFF6DBA2C97D59FFD42C9BC2843EFD267404B3E72009C9132654A1C6FB86679248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4ts31zmq.m5i.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ts31zmq.m5i.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a7853dd1-229d-4e7f-b1e4-c14476c4bfcc.zip.tmp

Path C:\Users\Admin\AppData\Local\Temp\a7853dd1-229d-4e7f-b1e4-c14476c4bfcc.zip.tmp
Size 3.7MB
SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
MD5 3850f642d336e5b283975359ae18e3d7
SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
TLSH
T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\AlternateServices.bin
Size 2KB
SHA256 295527bc14bc7f7759c4a53a0043edd09b361cf32bf43aded7482247f3f6a39f
MD5 a501a80f759df28f47da02aec6cbdbc5
SHA1 fa005a49f351d45c3baf27814e4b635736ea32c0
SHA512 bf8780880b5b62ced10567407631ef5d4ff819f36f3736c68653cb3b64d6077a4909038f8d59995ae9305d12f0374efd2fb24acdffc10c323ecd91c484f6ef8a
TLSH
T17F51ECB302730070E41806B4E80138088D3B2776867AD8C41751EAE682C2EAEA0DE8A4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\SiteSecurityServiceState.bin
Size 2KB
SHA256 46d02cb2916e8d8c56f1794fb899cfb16997096ad5c95cc306d0111327609876
MD5 990856e47ec09ec56a975691eac77f69
SHA1 806e022328079159f5d578e96bde7fedb3d6c5db
SHA512 6c856b5e1e8c41f413e790a85d9cbdfa65ea99288331a9baba3605a41ad2e3c4a4c4c3892d70cda569f935894f801a778308ae913ec24550692b847e5e5f1f73
TLSH
T15541373B7E5BC562F490D634F85D40521CB623575661B054BE5C4FD23048E5B209D281
MD5 SHA1 SHA512 TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\addonStartup.json.lz4
Size 4KB
SHA256 913d0f96215a834f65f1e247559a6a6afa53ccc691791e380e2a4c60fac56c84
MD5 fb3f8c20cb5aa79dd16096e8ecdf8bc7
SHA1 c9471d07f116cd48b244b891c693003e2f6abd70
SHA512 206a2d0968dc1c099a8dcbd25d88b87cc3b86afec4e20ad34e8dbf677cf8a43b8909df384ccfebedb9a0d5920dd59b35028f8094a5c189650685b6e4fdd497b4
SSDEEP 96:Nc4f4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NRy52xxhD8rGvm6ApwnHUuhN
TLSH
T12BA17DB6D142EFA1FD32C04788D93FB2E6A6AB7410A9C8D4F16AB1290C64E735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bounce-tracking-protection.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\bounce-tracking-protection.sqlite
Size 96KB
SHA256 83e2a5c9d65ed4f819fd9bd6a52715e7d92eb7665d12e9f6dc431496c2b758f6
MD5 87b094ee8bf6b3236413e045af531f39
SHA1 35b84680882ae729f75eaaaf14047adaf5f6746f
SHA512 0c47f8a39b1342ee8be869ae5e146cf2693fc118f9ae9588a03f08a26a756e2c1453c860d42060f505fc19bd47512d7becf73bf2680e233f1e7c3c10f6d88a4b
SSDEEP 12:DBl/WhnB8/ykS2lcBDMGEJKM+vcBDMvYkMBAlO:DLsB8akrEDE+vED8YfAlO
TLSH
T18CA3C68F0E702680EDC420B0D7828EEEAA1EC32DCB13279202A000B29D0206019220B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\broadcast-listeners.json
Size 221B
SHA256 1cf5c260fa290ab3a69e94ceb30fb22f6c5587f9d8584d199f9954cdcd28e37e
MD5 115dd8fa4f775038e91253f63e055f85
SHA1 85ac14b10cff8575f76f15219a982e9408daddce
SHA512 c35e08a5c05293dd52a36393fcd6f986edd7ceb83a8bccc07153daa46a4be81508fdbe013b2b781ac86a9ce900eaa6e40c630e82faa79a26ef8d54b86acab88c
TLSH
T196D0A90A10122C7F8A896229E0042B820AAA20496270A13D83AA64540A6AAEC40091A0
MD5 SHA1 SHA512 TLSH

Submit Download

cert9.db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\cert9.db
Size 224KB
SHA256 185a55a9b1f6e1679815e9cea9344f463dd038616eff0f44b814e285a1a1a030
MD5 19792d1e975025ede43ec2a37416c91a
SHA1 c3009e207f2e2ae166b96dd145ef54f6922440db
SHA512 de0f5bea8f161ac0930efefaf6a7bfd0990721943f530829e23041de1c4e2a810bf147b786a73da3d2b06b3b177aa8151e5a73400d48e5c6f65d7d71f40aad86
SSDEEP 192:zOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vguHaRPNnKoP70/+:K1zkVmvQhyn+Zoz670cPVPQW
TLSH
T11E242FC2F820745ADF8A6D31B662DCF33D7227414385A422CE289D3F1D64A1F67A68DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

content-prefs.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\content-prefs.sqlite
Size 256KB
SHA256 cb094929393d9779bbb5cb44da04caf0b304b67509dc99e4f9b99b77539e19d2
MD5 be3c562ea7e8d1c8e68c790481914f4c
SHA1 dd66dd963beafa2bd4f9a4aa2acf615d95b35a61
SHA512 ddcd4ac6df0a5307fecba86a8ea44c74836c6425608ecfb4dbeed7b847a639c59f9ef326afb1bf0d98619368f0e2f7c88938c4eb175979090aebd3af556a748d
SSDEEP 24:DLSKvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:D2Wwae+QtMImelekKDa5
TLSH
T1644426174A917408C0B014B1D4636F22AF3D405B8933E7B23ABC183A4F886AAFC791E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 acd1da5826536cad31511955284219398fdc7544ae4cc8afa46128ede45fd058
MD5 64008359bf878ab8acc460fc96157f2e
SHA1 92d57e6c2f865a2beb8032a3c8c7ed11154389b0
SHA512 1667f49cc862f847e4ab59030916a4884ba03087677a228eda9e4253e24a0146058241e21c202d8d6cb39a8bf2ff5e48dbcb62aab088af257516f7b3a14fb6c2
SSDEEP 96:J9SdF95/7bkW60rcEbWyUR6lWZzFc2FXFrFFFl/dd66JozGzgClKtmc0d/UK:POv5zbowbbWyjMt1d66JozGzgCl6mc0d
TLSH
T188C1CA28F2298A3BD408023BCDA61B814F36389B984E7F1535DC64482D5B2DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 ace91c995c79f04129ec498371779d407acd577315cf394e02632296c8c682b9
MD5 725aa883146d5fe4e618ae2065431c09
SHA1 986d338e87ffc212bab12144f3a4440a64cbd50e
SHA512 f5f0aa7c4ec2d37aa7cdb2567901d3b54de5aa43336bf7882ca536e3c84a473ba3c734a8ef999452fd7bf76bf29c5c7d651815330c0fd90e88da58c9d0163b34
SSDEEP 384:ud66JozGzgC1jY0CiEwYP74hxGcmhuEh3yIKDCRW8Kb9bBD3boWbWyjm:/ES0DAOxGcmhuENtKDCRW9b9bBLWN
TLSH
T192C20F84F72A963FD41552BBDCA507001F79B88A98092F573A4D64686C872DC3EAE07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 41KB
SHA256 4b59e3078d425f406aa625beebb17d629b50283d426bab67485054989f7ec9cf
MD5 a229f97cce77c515a767db27e66481c6
SHA1 5923cb99b5708445e273a8e6d2ab4985f1759944
SHA512 0c9f24f641ba6509fc77104684ba8f2dfcfafbddc2871fd32849d6c62f0636eaa0edfc79c77dfc8ccb18d0be8167bdd45283b9dc31099d2bc858a985aafa9f57
SSDEEP 768:fJzEAP7aZrH6GFKy6GcmhuiKaKP4CLEWymMFBDblbDbfb9bJbmbYb8bfpNZyu:VP7wrHVKsKagpNZyu
TLSH
T15D130144EB1E953FD42812BBDCA60B002F39F889591A2F67364C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 6c07bc699b2a4cdaa1f2a1be0349c1626dd8e6e2905adc59df82d50bb67e9cca
MD5 489647082acfee32baedc879b6484245
SHA1 174b42d314fb6d338557da88ab0d01968f288e03
SHA512 f3f1594c3296c3649687ed8e79e86babc91fb0346c060535eefb47632acb2e6284ce90475952dbd28c735b999053e7da087e7b0e812fe71436191071648335d2
SSDEEP 384:X0CiEwYP74hxGcmhuEh3yIKDCRW8Kb9bBD3boFbWyjyd66JozGzgC1jd:X0DAOxGcmhuENtKDCRW9b9bBLJeE/
TLSH
T1BAC20F84F72A963FD41552BBDCA507001F79B88A58092F573A4D64686C872DC3EAE07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9f59e7f7741bd6668eebbabbb15953fa6410359898791d3a629aab48600e10c4
MD5 0e3dfef5107b26220ab6dec001197d48
SHA1 cf455b500efb389d061789d44b764f1ffa808ac2
SHA512 52f68fcfeea7b2873d38eef85d7754c7b39829f76fa8a138761b34a517b5e5182c3fbe043759a9a7114a29b4d7649ca80500c899b23826826f9202892933b317
SSDEEP 192:LOv5zboPMZbWyjO221d66JozGzgCl6mc0d:UbokZbWyjyd66JozGzgC1j
TLSH
T142E13068E628867FD404027BCCA20F854F39389A9C4E7F1535DC644C2D572DE7A9E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 41KB
SHA256 b6681e793ab28a538953b2bebae1b21f6e6c43cdd4a0c8e4b0a853815f69109a
MD5 54e964f1ff6d1d0f095ceb881cdf0228
SHA1 41d3c046da37c9b43c6b94fcb398c3484356ccb5
SHA512 62701bbac2760a35ae25ca3c30974e43107f04ea3c63d51404d4053cff211d6831c6d94a2a9cc4cd5835440d76f181625a907a8376fb882a8cc247fb22140114
SSDEEP 768:PP7aZrH6GFKy6GcmhuiKaKP4CLEWymMFBDblbDbfb9bJbmbYb8bfpNZyfdSEW:PP7wrHVKsKagpNZy4
TLSH
T1A113FF44E71E953FD42912BADCA60B002F39F889591E2FA7364C64686C872DC3D9E16F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 41KB
SHA256 472a7cfdceba041d814be90da953711148dccaefbd3dd3dd38bb5693267ccc79
MD5 5dd0a3ac3c77f8a917eda6c04324b70b
SHA1 bab09b8f3f1b33ce01b4ebf6dcfe4fb9875ff2ff
SHA512 dceea5fae93a121cd659565c53969e951b238a4fa6e39fbc0e3fe33780d103de95cdc188c338f7b38390229d1f0712917819a7ece65ece07fee5194c2b9b8489
SSDEEP 768:uEFCsP7aZrH6GFKy6GcmhuiKaKP4CLEWymMFBDblbDbfb9bJbmbYb8bfpNZyu:fP7wrHVKsKagpNZyu
TLSH
T18C13F044EB5E953FD42912BBDCA60B002F39F889591A2F67364C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ff445e1efacb70b165673b4160f4c7c0a85f8fcdcf2285f628625bbfac13ec23
MD5 385cf3d4971e3dda2454eef25191723a
SHA1 327156ce42f709d14e3651030f7aa445b08ef2d7
SHA512 faef06627bb73a2725839ffed4795d97a26373fd879cb34f41306a24dcf94786a69656ec43064d7623e70919b0781597110d80e1f5609f84160e3eb9c385e243
TLSH
T10D21495C39B84D6AA9CFE79CB442168E93758E1204871C430D43EF8DCEC2AE9326A43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
Size 3KB
SHA256 6126965366c251b3f1573f98b2c1aa26b45c86f55553fdbb0c451190feb6e8e4
MD5 520f4f369536fa7db9022a5a2dea6cd6
SHA1 59f26995c480e005539c60e6474d5e86aed70309
SHA512 9bbb99f41d41ace71438e822e9a55fbd6e40dd648536adc1e28f6c92d213ea07c295160df2f17beeb326c92e86a6b979e7ea59baf1817231168e5833778c01e4
TLSH
T140719D08667A4C7A6CCBD39CF842068982A5471384C71D874DD7EF8DCE936AA315F43E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 fa7c3a1c1cf4ee45383c954f734089ef35b02e9733341d1c28fe985a30f00698
MD5 eadabda7cd04bea044a2b25c3c099c7e
SHA1 335d197ce39c6f228291cd073822d6042d80f627
SHA512 ba9e948ece901a46b951dfe4521c6410feae939ca7452df890f4fae40960090291d6a41f6ed274a0e240f707b8abd501abb49be3ed48ee327a022c4b531d2829
TLSH
T107214CAC39B84E6A99C7EB9CB480068E53754E1744871C534E12EF8DCDD1BD9316A43C
MD5 SHA1 SHA512 TLSH

Submit Download

0f046537-e1ef-488c-af3b-bb0ee6a96496

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\0f046537-e1ef-488c-af3b-bb0ee6a96496
Size 886B
SHA256 49d76277feaf672d2c8223db17184d3fda009918bdd7c3ccc67065490784953c
MD5 2ca8378a18be90e31038ccf00ff81574
SHA1 2041879c6d69cc775c64f193324fbdbd575aef11
SHA512 a10a868d452d8f502841b4394eae914498aeaf3b226195a19060c49c0f09c895bfce90a982fbc94ec0c6b194c139957c58ceb0844acdc6ef0a8deae78da90925
TLSH
T1BC1100459A38BDF2AC6882CB95A277868BE07023C0C698007ED45A180DBB52FA676307
MD5 SHA1 SHA512 TLSH

Submit Download

21f474c1-3f5b-4369-b744-f301f457d11d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\21f474c1-3f5b-4369-b744-f301f457d11d
Size 235B
SHA256 6415fad37d1c09de89a77ee8173611576119ff8a8df9a297a44bdfdb8433dc14
MD5 57a41c02b2f8ce787e775410377f1c17
SHA1 5fb8f0f9ce9c05a264e3701878e22943305e7fb9
SHA512 03a20a1d139612848c0f50cc9c877402381ddcf791359fa9011275889ce69f96ddc72a93e356035bf2e922c87c78f76dd58ff568d9218f1a617b99518c81afdf
TLSH
T1E3D0A7985498675E58185F07B5B0AAC631988C3364B46810DB6245B899FD9C5419385A
MD5 SHA1 SHA512 TLSH

Submit Download

38a65a1a-2a41-4dbf-98f6-6572f42db8a3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\38a65a1a-2a41-4dbf-98f6-6572f42db8a3
Size 235B
SHA256 f0c2515c5b118e83022cb00b52b65f4bd1e291145396dcf1546be7bfce0ad77d
MD5 76982ae044db7e6e6eaa30af8812c9cb
SHA1 1f912a1d6c5da0a0de215d13bdae6394ff48c4de
SHA512 e363671787aef29a7659434c1bb73fc3e1201eb1524002bbd80e3fc4760e04b7ea571b2359ce0a0957b197c1b1929332ffd7cf76df81b183544321c3560d3f21
TLSH
T177D097842888672E88241F03B0A069C6B5858C3390A8A82099A045B5EDF89C9C161827
MD5 SHA1 SHA512 TLSH

Submit Download

4074171a-bc7b-4046-b85a-12f80d1f9a40

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\4074171a-bc7b-4046-b85a-12f80d1f9a40
Size 2KB
SHA256 1c8e3e2dc39144d7414513d6e2061a0238400f436cb0e4c9962e622f8336c9a7
MD5 48472af747398c83512e3ad12c06d9e0
SHA1 d8cde9d6dd28ea76bde40d894d8bda4a330b8dd5
SHA512 264ccbdc0d3d8cc98b76227074c81a7f7e24ba59cec14f11ea9d651353c724f09e822702be66b571c6e89096c1d99f4e07edbc74951af8e3c4d8de87d76f0d21
TLSH
T19641546D3A785CF78DDAF18DD882378E5364490340C65C832E92EF0C8D9A65E337A52B
MD5 SHA1 SHA512 TLSH

Submit Download

40c73c67-f176-4fac-bd0f-6c77176892a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\40c73c67-f176-4fac-bd0f-6c77176892a7
Size 15KB
SHA256 a3d1071b082183941bcd9bb2bbfed4d50358663c5e509c79117f057f766d8ea7
MD5 8ed63c2f5f10cea9894c96ecbe4bb8fb
SHA1 18b7d1cf952784435f3d286a28bf1dfef13bbf59
SHA512 2dc503f33ddf243d0b93525cbeeaa66a37fa0e04f6634fc6aaef98dd80e5e28d2ffd0068a5f5b6d8545c13ad4d8f4bc6a60973a65259ee376ab6f53737e3db2a
SSDEEP 384:z/tjz+6K+9E9P3Et0XAaa3eCL7tbRjScR5q+2:u+m/nAaauCB2
TLSH
T13172B8566420497A8691E3A8D4FC7FC7E6F528CF4C419FCA9BE0BD086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd47d2d4-0111-458d-9f26-50941a1fe6b3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\bd47d2d4-0111-458d-9f26-50941a1fe6b3
Size 4KB
SHA256 fabff0a175b3e3d0a266fb4fe68a870542d24e7a9094b76bb7f8bf4d66a076d4
MD5 e28f9326a943e3b259d96b947c7b5f83
SHA1 14c203600166c343e25ac3248177984b671a7336
SHA512 bde0cb5dd90d1fd8a7c1d04f5889ca2d46b05cb7262846a6bacb16ec62fd5cc9a013b7167d8bd3f15658072c8b6034f6b88e57e1d91ae15a3c8e2ed3ee76857e
SSDEEP 48:/AAKUzvNh5mSxy8hORCqswWV+e76NoSpG/Zp3MUB13vFBuv+X0zRTSfPw7YXp:FNfe8aVWoxgv+2XuS3w7Q
TLSH
T118911E0862795CBB6CCBE29DE443178983B4475390C22C875DC6EE4C8E9366E326F43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc50edc2-cac1-4239-9b18-dcf3ee990240

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\cc50edc2-cac1-4239-9b18-dcf3ee990240
Size 883B
SHA256 a97af3a7b3ba524f5d4dfdd4fcbf317e8612388144cd922357f5a8f3105731ce
MD5 36b16e092d2c7b1e473e1ab8c29e125c
SHA1 d10a34f92c6d81f063f1e08d9b3e0494de7c0950
SHA512 1dc6b097a7c1ec6c324cbae45adc8fed727e3a7b752c951a59b492eeabf9c9fd53e216815ecc0084ea013117c21c308dc726eec8b7b29ea9eeccfab29cdc9425
TLSH
T1BD110441913879B2CC68924BC59137478BB4642384C554403EA11D080C7E91E577634B
MD5 SHA1 SHA512 TLSH

Submit Download

ce5b2b8c-7c61-48ee-a700-998bf3caeffd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\ce5b2b8c-7c61-48ee-a700-998bf3caeffd
Size 235B
SHA256 43cb7105e041770f943ce0e3506f14940b48917683bb6e24f3e3c0a15fc055be
MD5 ea6403eeabde464e706426308bc63214
SHA1 884b33e950c24ee053e6a1d7108dd0d1e1f345bd
SHA512 c224596c9d019f5a0fe7c2b46e588c4e3b5fd37b415ace15b2b39fb74b51de3753c048a2bc0ba98d990f24e3bdd9aa564f40cfca75d50b1c46bdeb5c62be3722
TLSH
T17AD097842CA82F9D08040F0BB0F029C231844C3320709810EA61023889F9AD4825391B
MD5 SHA1 SHA512 TLSH

Submit Download

e26d2f87-8796-472b-88ec-e8da3b53cf2d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\e26d2f87-8796-472b-88ec-e8da3b53cf2d
Size 897B
SHA256 d3c2590a1bdce2c5b3d6a3d0aed2b3c0f28c48f7329532d308b17e89b28b930b
MD5 7b4d13a85bd4637db69a7606628a5fd4
SHA1 05530517c9c9234b69f29dbe0c8b7f7fd0854e40
SHA512 bf9ff4b17c6cd80a9c9e0a971283d293837b4f150b0280f1bc6fc3d15f5e82fe4a660dfb0d6cb28145228b1ba0c73a78827e4ae2716912cb6fdd952e066374ee
TLSH
T163112791D538B9F2CC68D38BD59137938BF4741380C55D107ED05E080DAE52E6776307
MD5 SHA1 SHA512 TLSH

Submit Download

domain_to_categories.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\domain_to_categories.sqlite
Size 96KB
SHA256 c7baab1cd8662625bc822a3c3c7b57973b927cd5c26192d6cda60ed9ecc0ed07
MD5 7231237395096e88196ba0ffd7ac0ac6
SHA1 d303ddfed1d4341f30ed79abbc23ce51f651bd35
SHA512 6220c9908bfa889f1db84625dc214127ee76c40c97a0d2b81df251253d4a8cc7ba6387d94f751a8f092850ce8a86d5c7e0d7938b85ef763813c4ab4a0834055c
SSDEEP 12:DBl/ATMbUSoQym5H9L9ftirhP81MONd4/F0LA6Gr:DLbbv5XvtQhP8W5/b
TLSH
T1A6A32B1F1B1CB840D4C356F26D8329067634D50B8913BEF03B9D84004F066481C35AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extension-preferences.json
Size 942B
SHA256 56d9dfe54a41438ec90ae6cdeacdbfadb3e3b04f5403a220e844a1775e1ba21f
MD5 f7cfb3ac426cfb2cc708ae6cc3faaafa
SHA1 2d612ef73543a5018e08bc1760d7931ed03feb4f
SHA512 31095c5be304f0cedf7eaaa2efde632f3f6a67bb26b8ae31a6069af8a60b0c659edebaab99a7719d09aa1640d2d9e080555f4f79253c13f4050840649c968534
TLSH
T15A11F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extensions.json
Size 16KB
SHA256 d162b37c7ace856a5d9b0f926e26f72a498392aed493a0842e68d88362674021
MD5 0f57aa171e402ebb6fc1f9421af0051c
SHA1 24a9b096f0e31a47f75a32f6498586a939079453
SHA512 57148fdfb0d3726686b97cc708c8d1d284205075286176f7db1846bb710c9f3809e70a1c20e8b22b2cd31560db47b0f7c940c2c6c25d2233d591e10b41964d43
SSDEEP 384:AkI4vyUmldvXf8dhWnV94z6196opL4HBL4PlL4HDL4HfL4H6d4h4:nI4qRf/0Xen4K6W454d4P4j424O
TLSH
T13172521545048EB8294FA79BAA367E01C37D533B60845C78F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 12KB
SHA256 91c2c412450571873bc8a0a84e00a9a7cd0eb986232021711d7ce077abebbadb
MD5 6a7f246a035461544cab61d46ba7e9e1
SHA1 44002046f1d61a8b341140e1711507a11fa69c80
SHA512 8a86a810783a33cd2e2b22f2106222f043ee20743d6b228373ad6ec1acc33be129adc36cd8326f92876f0f07d57931ad7183f355cb8a30d151e75a93e43c023a
SSDEEP 192:/ntgBrLqRFfmdXISSvLR24/39ShOBw88ZlmLQveg:dXRxwr3L
TLSH
T18F42BA3861549A3F24B6327DAC654DA069710237B7BFBCE205F99981048CF3542FAAF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 7KB
SHA256 d01bc33f8196658affb042949343eb2fb19ed2a3f9f610e25e5510d1477f0723
MD5 8d6af281cda1584b2cc10643c1351a8b
SHA1 d535f1681a763aaf478ebf31348be14b916103c8
SHA512 5e34c8649b466e93c6c7863f08fcdd122f56ac4e7a192e4745b1268012cb6f91c8a08e87188f8bc7046c79ee019ab1bb2a2b6116be64b36988b13e124df85902
SSDEEP 96:xHhUTUZfvqGqqkf+dXObzS2SSlDdv9jvnLHH4/3htuBw88YJ8L4cn/MVzW:/QRFf+dXISSVH4/3htuBw88Kg
TLSH
T1EFF10E785108CB7F68B6376CAC6889715AB2023BB7BF68D710B994C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 12KB
SHA256 11d188983e311a3c65f4cd7f3a4f73d8b00646015dc1adc7690a2d1c5c2e4812
MD5 742f45ba4c216300cb483073c6a126d2
SHA1 591af2f09bd7e9708864901de968634dd0068f4e
SHA512 7fed0d642ff25047ca1b80ea9f8626ed32f48e5f209ef03a3eab01d9573c4ae457156e2a57d3b0faedf7d715aba6d37a6ee89d955aac109ae59a088dba236318
SSDEEP 192:/ntgBrLqRFfmdXISSvLR24/39ShOBw8OZlmLQvei:dXRxwJ3V
TLSH
T13842BA3861549A3F24B6327DAC654DA069710237B7BFBCE205F98981048CF3542FAAF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 3ce6e8855b6dbe4a96507f95c22bfc99dbb8ee8b25dedf4a2ea36ad32d5d68bc
MD5 a8d7471d194d3a74d12ae2c9cd83989b
SHA1 ded85d9e028b6e27f3ed2bd57f03e296f980b8de
SHA512 08b451ac4fb8973c39ba1991b8cc0662ea6f1878389f2d23a026631b5d22993a70e5388b7c1b7c2d50c96044b361858d1093e9b5619f6d2b043538db88e3d22d
SSDEEP 96:xHHUTUZfvqGqqkf+OM1zSdSSlDdv9j8nLHH4/39Bw88n8L4cn/MVzW:9QRFf+OMASS6H4/39Bw889g
TLSH
T125E12E7891088F7F64B677ACAC688D316AB2013BB7BF68D750B65484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 12KB
SHA256 393891bd42ff7e52418e321ea9fa353018992bc3aab9b94ca928c11f43b64d7e
MD5 85baf78db79e7e80043f5dc3edef3c96
SHA1 b11c221dba06fab5975e801d81f0da2861f5790f
SHA512 207b3948b85339ce2343c1a9d0be20d88a3d34300c9a1bfd636040756c34ee91c942fc942817dfacf6c7c21b84ba71225f123fb636703dd95162e0428d12e9c1
SSDEEP 192:/ntgBrLqRFfmdXUSSvLR24/39ShOBw88ZlmLQvei:d7Rxwr3V
TLSH
T10542AA3861549A3F24B6327DAC654DA069714237B7BFBCE205F98981048CF3542FAAF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 06fc31eedcf8f2f654a65bbdfef16c8d0615558774f5fb5e4ad3651617a45d0d
MD5 9d415e087c9a1b2e301c681ec072d2ce
SHA1 3d432ba5e74dec0778f26ff78d439fd1cf9d538a
SHA512 ec495e7043c136782ade440b21d152b3e7c03dfa15f9893b1adcdb43058a5db667d7fb1735b136c195d8731fac68e982b608af7357e38b9bd60acd6cb7ce58a2
SSDEEP 96:xHHUTUZfvqGqqkf+dX1zS2SSlDdv9j8nLHH4/39Bw88n8L4cn/MVzW:9QRFf+dXHSS6H4/39Bw889g
TLSH
T105E13E7891088F7F64B6776CAC688D316AB2013BB7BF68D350B99484055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protections.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\protections.sqlite
Size 64KB
SHA256 f47973dd13805200a469d534a0ec50e224f0c12ae77d93a0e5bcc267af19c145
MD5 63b6f9d979a2cd96d93c105805cafcfc
SHA1 5fc70ce8799617202d1b2a350f6d596b65d48e54
SHA512 ca475720928bd40abab686efb8b890fdccef59c292b26263d41bfd9dfe8f35d21405820e10505fa7cff49eea5ae57ffdbd6ca73d5cf6e1cfe67f5994d2823b90
SSDEEP 6:ltBl/l4/WN1dR4BEJYqWvLue3FMOrMZ0l:DBl/WunddfJiFxMZO
TLSH
T1BF53225E47387021C0891372ABD323923F3CD2FA93232E836A100C358C0A023B822AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\security_state\data.safe.bin
Size 3.2MB
SHA256 fb4dff2ee246c2c7d6b2eb12f645be5acee66cbbad617e8a499b1f7f94a54243
MD5 7340aef01d894d95bb5314115e772b83
SHA1 7b62585e444c6be6a3b8251a693286080a9ea2d1
SHA512 fd710c559a3f9ed7a6560343116d469748adb363f81e3ad1beef8ab4643b82ee49139efabdd2bf1a94fb3616d3a318120695f276aeefdbcf8cdb54cbc73a1ad6
SSDEEP 49152:0W7F2gG0m18VYm1Km1Rm1VnxyWFaPm1vAthmwCLPx+4vyv1Cp6:dwgGSOxyWFanhTh4q1Cg
TLSH
T1B0F54BC65B147982DFC69F75B1D4C433ADB122C07A9AE8828459C4A27EC73E97F8406F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 a4657fd14d9c9201bbc4eb46cd601aa3b0d607363f3d7845d17eb5855713c535
MD5 4247b2574f36cb746b58defe77b11564
SHA1 818487373f26461fd9baa6cc52bc6e259e272dc8
SHA512 db90a9eb6ae76e274f33c0784bf9d9c0985fdb294f21e82e741c2e886f9b3b6762a16a9df1abba6c4aad8d6c240ce5a04c928d2a934cd8f359bee6b65c13fc38
TLSH
T11321DA86FF1F38FA21968285D0C51FD8DF907021862CDCE0D9D9A80193C4A6B72AE706
MD5 SHA1 SHA512 TLSH

Submit Download

storage.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage.sqlite
Size 4KB
SHA256 1db39598ae2ee67e7a598723a6ec07a3b74ab17ef166a2614785c74c43d1c5c3
MD5 701bd81ab9bb9fb95ec393a557d20be7
SHA1 7f6d6f5a146ac2e0c5f5424da7d7199ca8b6662d
SHA512 4f6b7a82f3361c2f452f0093fb0286acfa898528a2933f501bfe627993899cc77e136c435a0cebd95457c72c604b030b46dc07fb7b2b937d67ce3dd46179fc5d
TLSH
T1CF815C8D1F247A00C0B057B1E5E00EE35E3E111E4B5B95C72EA011FACAF35966B164BD
MD5 SHA1 SHA512 TLSH

Submit Download

1657114595AmcateirvtiSty.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Size 48KB
SHA256 b0e39387e37887d7706707da40cc7d3548797e5f76dc493e81ffaa70f36d0840
MD5 f0aa0fcf1ed9f0bdd333f9fa7b2fe9b5
SHA1 39a43d930e88bcfbb90fdea8fd208f569770921f
SHA512 fb8083613a8cc354ee85bb6b7ce4d7a63bf51a95775a6dc0a76babd16d8e4b61a116d40210a4e0f5fe64f1476219f045370ca894ebd78fdd839a4185ac4f4903
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEmkB7:Oa16S6CKnqlizbxV+2xVeU7X2B0mK7
TLSH
T117237FCE3F07A511C53AF0B178A08D51BC5E321D07222AD679D0DAE4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1
Size 1KB
SHA256 755b8939c63b1fcc9acd05cd33ffed675397516d37b5bd8f3a03875e25d3fb43
MD5 594dfe7bf408250eaa7a5923d1222039
SHA1 4a9caca87d0f9e47d061029d2155633009840ae9
SHA512 261f97c039f22104f858f5ce24e4a7fd70913c8fe95bce0405c2ac546d5ba9b45b97b67b81d5dc895257fad3da475fd08de959c2ca29a71c5e00a97f9f68c433
TLSH
T1FC11B5D22A2DBCB522107417E63F18B699A433F0C28D84206226C9F12B2F2A8A251B43
MD5 SHA1 SHA512 TLSH

Submit Download

100

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\100
Size 1KB
SHA256 7ee77869171db942343af7e2174cdfdff91ecb9e29b3b4b230f5922758d62ee8
MD5 bab1fe1ed0ceedf6e4b1408c7e327c0b
SHA1 e1fb6a296f407c65ab99a8ebcc62e4cd0f6a06bf
SHA512 47ca1a0d7d15eae988fe60857e383d5e1d10bf2b4d9344a34ec74c88abc7bb83bac23b80392492eb21edab726fe6fe583274bd0fa616f4dcf82968f676248613
TLSH
T1FC3108A23F137ED931DBF5BB89674595184E90AC75E0A09C0D3A3680F749EAAC8FC44C
MD5 SHA1 SHA512 TLSH

Submit Download

1000

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1000
Size 2KB
SHA256 d8dfd459cb1254ca1b38712c7aacb8dbe70968e2b9ca959f8f4dfabac477672c
MD5 a31373f6b80fdad948b8fa80c21b843a
SHA1 35495470d3c18ed831f8af053b3546509a7f99cc
SHA512 418e728e256650b1a61385baf7d2eb98fb8101fc6cf2064103753720a0fb72e197993b5ded435ff42b47398c557a2359ab51c0cc8b7e157b4ee8756a627c64a1
TLSH
T1F2412C616E66B9A52392EA28EF511337634003F883DD71C003E5FA41DBDCB9E70CB686
MD5 SHA1 SHA512 TLSH

Submit Download

1001

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1001
Size 2KB
SHA256 65a065d8f0f0b59e4bc050d4f38e20c9227406bd621c32299657828126fe598f
MD5 b75f5c09b91fe39a6af8f80958201e47
SHA1 2802d81c4be02582cc27f10d428f5b892f8a99b2
SHA512 acf319ab6d195c0b30545b902a814afa7d1fcc2313a0108a6f928abb4fe99f41fc26470b813c134bd964c73958feb207cebd594c64ac6bf5e3abf955465259be
TLSH
T13C414E178F515E4B39F3EC0BE401A852B705C353F859B44B9F5D7E02270DD259938D84
MD5 SHA1 SHA512 TLSH

Submit Download

1002

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1002
Size 1KB
SHA256 8d497c4356db1f17221721ddb602a5de77829ca8b9b73c54d9034af66cd52248
MD5 4a84883567331403a4b3afe28d6a1e4e
SHA1 b0becb61fce1d29c326b1cd8f5eedc65c6b37699
SHA512 3bf1b34fe74ae3a21f8682be6c89b1a90d66dbf0302deb51be5e81cfe7b4d3661ac71e3fa93a7805a89dc84a0355f19f82d27dc66bf71fc590e3603aab5522e6
TLSH
T15F2171C6CFD54F473D27D065FF8C17B19A204A9E6D00663FE801F096AB40956050AC8A
MD5 SHA1 SHA512 TLSH

Submit Download

1003

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1003
Size 1KB
SHA256 e057aee447230278205a8f0cc4d7fb5054a311febf79f272e5bb4efeacbfbb93
MD5 8593ed4275b15ab3980787094db38be7
SHA1 01a283dc9e05fa72e17ce06462a7e8804d442985
SHA512 8404a611a0620d90dd7514050c99b6c46300808d1622ddbf8f04215ee85502c549ba38aec834a2b0da8fbdd75c20b47a249088db3a8dbcc92788d2708793ff48
TLSH
T18E31B751DF903DCF22B37482DC7A52DD4C4F9AE592AD92A61D44318ED238726C16D8CE
MD5 SHA1 SHA512 TLSH

Submit Download

1004

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1004
Size 1KB
SHA256 e41f784cddd9ac3598e0258784831181fc8dccce987e7db71c6ce134e24e0fd6
MD5 b72b3dfc6de85c1bd14f598c5e5779d0
SHA1 d335611c757b1166a30298bab55f77effd455743
SHA512 8c078192e250a7ac48111813aac1e567488bd0c8ff0bb38ced89317c1d22ec1d1dd40bbaa10c593e86d1df9108828e0f15071cd9aea1705f8be00dead4d217d3
TLSH
T14D31FB2B7ED03B5D04129DB4CE9BC237741C65A8D9D3546C45C17E495BBCD0C871D2AC
MD5 SHA1 SHA512 TLSH

Submit Download

1005

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1005
Size 1KB
SHA256 2d2aab66e8404758b5758de10db64fea402d592c6547b312637e9b3497df0e7a
MD5 0240272fb90ba54827ca111347c1fe74
SHA1 251dfce05fab2e25bd59dceeedd1f85e22ad4643
SHA512 98bf32a0cd23a74d1bb48ecc004e98903426aa8c6500ff1322fc8fbd5853eea7944382f236edd4025a5408bf1fe3c12e09adb8bc7d2f49d07c68dc758bf53006
TLSH
T12D21B4AECF42AA4824C76339CD2604A1D7385D625CD426F77E5B3C5E4A8AC2A1C6D98C
MD5 SHA1 SHA512 TLSH

Submit Download

1006

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1006
Size 1KB
SHA256 bbc372d9ecdf9fa392a04587c4d036f042f3f09c6f0914cc81e10d9e8e8a3a02
MD5 6e3c8666986ff5ce21cfe29011ac6169
SHA1 a3e951798c975c5604e20430debcb61937866750
SHA512 2ed3939722ee460349cb0a7edf605ca345bc9a0062d895a5296bdfdb7a81a475bba912c9fd2b2f38e994e8b2016cee6121c983262158f3114f5449216b3862cd
TLSH
T10231C5D60B49388B2A47DBF3D907A05788628E9D4A95F1BA4848A3D10380A217076B0A
MD5 SHA1 SHA512 TLSH

Submit Download

1007

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1007
Size 968B
SHA256 88a0f8993576590f88eb47c537e02214b477c44580eb23ac4233563fbc8833bb
MD5 d628d41f567fc46921969902145bfd8d
SHA1 d08e87c40773a7ca45cf5b960e2adbc6a0e28238
SHA512 505c1a39b75fee86fe8a482f1f6a0c090b6eee8232e6619cc27ef552fcb97744c38f011e33caf98e3edb94801247d4bb8c06f7db7908a3424c2b52f699100dc1
TLSH
T1F211949BCE8C2E05B0F9F402DA7923982065896752C8F4B532902911DF48A13286E8CF
MD5 SHA1 SHA512 TLSH

Submit Download

1008

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1008
Size 2KB
SHA256 cf9549b1295f7f5940d1eecd85224fe71746a9062b3324375a1ba76e6d1076db
MD5 edd100de1c1bcf83ccacaf5bb99a4fd4
SHA1 8699a34a97286f9ee5cd295d3b725eb392978c34
SHA512 d3a0efc062e0170c3ba1ca6738bcb411795f21a7f75845362b57176fe35524d5622793bd66bea1aec9263d7a9ef849192c68a52ab13dc3f5e312aee525b4f4f1
TLSH
T1D7410A9A870EF9850570B978EC3E6781529037698AEAC5543CDC7D65C9C5C2F776500C
MD5 SHA1 SHA512 TLSH

Submit Download

1009

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1009
Size 1KB
SHA256 443bf4f46b3a2720d0ba9bbc784a03b12825dc517feed3a95b166c4794e74e17
MD5 8579de02414fb1853d16bea0d771f8b1
SHA1 fd3735bbeb9617ffa9ca2bece073c127826c0d9e
SHA512 583dcdfcc5843d5e8a694124fd245414f76df620dba9454617791580f69ca960ac5438f1c0e793b3be41eccdab98b7c28f4c77ae8ee745ce9c7a7f3410e55062
TLSH
T11121B74298813ACB709FF0B4E5BD57901129FAD2C187E19B14C0AC47F7844272099CCC
MD5 SHA1 SHA512 TLSH

Submit Download

101

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\101
Size 1KB
SHA256 088bd1a2e7c9544c4dc555fbf9a888c314f577c8a74a9eb6273d5d3d4ee6437c
MD5 244f7f74da40ef6718f137abbc7d35de
SHA1 140ecf7fe43a5c1b678fb9aeb24b2bf6b34581df
SHA512 7530eac976df9fd9b6c9db016c2f6bbdb32e2ba5622c7242c3ca56700bbf0b1d3dc548a704f2ff0636cfa115c06266390aca0946a28d5c81f03d5b15e93eabe2
TLSH
T1AB21A5BECE4C0B944AC7E130995A49E73120EE91ACD270E7687D75CE858C62D36F40DA
MD5 SHA1 SHA512 TLSH

Submit Download

1010

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1010
Size 2KB
SHA256 fe56ecf6adb40303a3d2f3230cb1bce74e7bf150fc1b0259a27cfa966145794e
MD5 89d5af2e1597aa0bdb32cc757edef259
SHA1 387fc1eb66cb38f4e6b2a2f9f57884af115c8364
SHA512 6d7329ea86eb646b887ed1f7acf633e3496f10d8b337ac43b8a2cde260fb29ea38e36732ec15ed8cc77c3b4132a8766a53017c57298d59c4590bae94563346cc
TLSH
T1D9414B4616393C9DD77CF214DE050619A3C603E9AE9EE074010574C38338B7EE08A7F8
MD5 SHA1 SHA512 TLSH

Submit Download

1011

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1011
Size 1KB
SHA256 60648f145bf38277b4b0ccd07d340860acf0271b1c5c7ee45d1a32d1ca4f3382
MD5 977e4fe797ccfcf410f23af98501afe7
SHA1 3b38799ce750822a9dc70b024c10eaa4a9a0c277
SHA512 588c386c9ef3587b998738de1f6d789c01da89d7fbb5b792c14ebf5384d9473c070d1c2ab5c2e61543ba6131b1861511140be9265e37f5cb268621797f83f959
TLSH
T1CB21C60FD9353E6909C6EA24EC2257EB40717DA60068D0D615C872C64F2DB5E20CB717
MD5 SHA1 SHA512 TLSH

Submit Download

1012

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1012
Size 2KB
SHA256 a6ba61ac5f4cc0f9765d5d0f0def7f6c14969571829df90422bff82e1730c78b
MD5 fe33c71e51f1f63406f6f6a2c1fe1e9a
SHA1 696474c6d35a3375a8b02a049e44bc699287653c
SHA512 88b7dfe2160018341c84a3aa61818ca9a2157cf867fa79ed334527959b40e44dbed35ed154844a3b9fa22e15f3aeab3ea2422849b6e2b34fd859b752f723861b
TLSH
T14A411B555FD20CD925A3650AC9534929C6D378EC9EC695550368F84FBB4AA2D002FCA8
MD5 SHA1 SHA512 TLSH

Submit Download

1013

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1013
Size 1KB
SHA256 16ea89d4baa39529d7a84d5152867a4c6ed6867198c4dfa1648b1f43ce6a3f6f
MD5 01fa152e7031386cac385a1776e5b5d3
SHA1 f8f8807f140ec3182b2b87fea1df352d465b2de2
SHA512 6d01e135e2a66989c86598d649dc7ce1d701cf8d4a7b6bc42d100670703e22fa5af0793c2c96e13683651140d1fa94cfcdaa7daab44631a769bd08973fd58dd7
TLSH
T1D621E6D223C0E97DCA34C73F1508C60A96E98C281BBA2A095C295A78348D180CBD8B8A
MD5 SHA1 SHA512 TLSH

Submit Download

102

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\102
Size 1KB
SHA256 d843127bfb3bef1d3f8447573c8fa9838209229355d03b74ee6108eaf49186a8
MD5 99a119622685d490b16cef151c79e75c
SHA1 a2186414738cc2d486b82fbe12beb4050f7bfcba
SHA512 eb50f882e4214a372642ed91ee8f201054bad9419860e99f2699634a62d97e23178a8166696d89572746baae311de297907d0997041622a942236a5b7136a932
TLSH
T10821A5BADE001F500B8BE0D1E859169811306F52DCD6117D5D823CE3D08E29F04B849B
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 c232c91bca652872a982df283f13c922930683a128903b7a1c8325174340b1d2
MD5 20925f361a834a08521f3fa88410395f
SHA1 39f060a7230fd9391fd8adbbe8ea4d4db050d845
SHA512 3f0ac5dfbac3b0d2832f7efdfb66fd0cba73239ec97cd5cf401453cdccb57144c5b5319057c8940ca7a94ae2187c22fb6d9f45296ec39485236c64e7ee58c642
SSDEEP 49152:H7snfswyaP6ryMtpBd5C9S8ARzMUghuRPbPxYUpq:bqfs7aP6ryMtpBBRzMUghuxq
TLSH
T11C1639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 17.1MB
SHA256 16285c99614b5f3af6b19debc7ce9032715bbb7cbee7c10141624579864eeaf1
MD5 cd623db6b00d00b10e00117b53c5b5c7
SHA1 ef03a4462175f7953b576dfafa942f1da9f0126f
SHA512 949cac630c5c76ca2f7a4186efdd76942495eb0aeca239c218445a01d9438aa75621a3dbbf87dc4d3a0cd5705b93cdf0e795085541592c76f8ab937dae50e05c
SSDEEP 49152:DLqLyhaeUo6QC5zYYwCGJgyUvwZDkWlJU+qvrj+P9t1pdAReyBu51WEGelLpb0cq:e0yKgEFlLpb0xQmFKj
TLSH
T18D076C9275E0DA91EE0146B6B31F43DB313FC1CC24E685942A78BA6C595329BFE6F340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

memory/64-63-0x0000000070930000-0x000000007097C000-memory.dmp

Download

memory/64-54-0x00000000062C0000-0x0000000006614000-memory.dmp

Download

memory/3652-46-0x0000000007E80000-0x0000000007E91000-memory.dmp

Download

memory/3652-44-0x0000000007CF0000-0x0000000007CFA000-memory.dmp

Download

memory/3652-16-0x0000000005A90000-0x0000000005AB2000-memory.dmp

Download

memory/3652-17-0x0000000006270000-0x00000000062D6000-memory.dmp

Download

memory/3652-15-0x0000000005BD0000-0x00000000061F8000-memory.dmp

Download

memory/3652-14-0x0000000002FE0000-0x0000000002FF0000-memory.dmp

Download

memory/3652-26-0x00000000063C0000-0x0000000006714000-memory.dmp

Download

memory/3652-13-0x0000000003030000-0x0000000003066000-memory.dmp

Download

memory/3652-12-0x0000000002FE0000-0x0000000002FF0000-memory.dmp

Download

memory/3652-50-0x0000000007FA0000-0x0000000007FA8000-memory.dmp

Download

memory/3652-49-0x0000000007FC0000-0x0000000007FDA000-memory.dmp

Download

memory/3652-48-0x0000000007EC0000-0x0000000007ED4000-memory.dmp

Download

memory/3652-47-0x0000000007EB0000-0x0000000007EBE000-memory.dmp

Download

memory/3652-45-0x0000000007F00000-0x0000000007F96000-memory.dmp

Download

memory/3652-18-0x0000000006350000-0x00000000063B6000-memory.dmp

Download

memory/3652-43-0x0000000007C80000-0x0000000007C9A000-memory.dmp

Download

memory/3652-42-0x00000000082D0000-0x000000000894A000-memory.dmp

Download

memory/3652-27-0x0000000006950000-0x000000000696E000-memory.dmp

Download

memory/3652-41-0x0000000007B50000-0x0000000007BF3000-memory.dmp

Download

memory/3652-28-0x00000000069A0000-0x00000000069EC000-memory.dmp

Download

memory/3652-29-0x000000007F780000-0x000000007F790000-memory.dmp

Download

memory/3652-30-0x0000000006F40000-0x0000000006F72000-memory.dmp

Download

memory/3652-31-0x0000000070930000-0x000000007097C000-memory.dmp

Download

memory/3652-32-0x0000000002FE0000-0x0000000002FF0000-memory.dmp

Download

memory/3652-40-0x0000000006F80000-0x0000000006F9E000-memory.dmp

Download

memory/3696-8-0x0000000004EF0000-0x0000000004F0E000-memory.dmp

Download

memory/3696-3-0x0000000004F20000-0x0000000004F30000-memory.dmp

Download

memory/3696-4-0x0000000004C70000-0x0000000004C7A000-memory.dmp

Download

memory/3696-5-0x0000000004F30000-0x0000000004FA6000-memory.dmp

Download

memory/3696-6-0x0000000004F20000-0x0000000004F30000-memory.dmp

Download

memory/3696-7-0x0000000004C80000-0x0000000004C9A000-memory.dmp

Download

memory/3696-2-0x0000000004CD0000-0x0000000004D62000-memory.dmp

Download

memory/3696-0-0x0000000000260000-0x000000000027C000-memory.dmp

Download

memory/3696-1-0x0000000005280000-0x0000000005824000-memory.dmp

Download

memory/4272-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4272-11-0x0000000005550000-0x00000000055EC000-memory.dmp

Download

memory/4272-72-0x0000000005750000-0x0000000005760000-memory.dmp

Download

memory/4272-73-0x0000000005750000-0x0000000005760000-memory.dmp

Download