Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://www.mediafir...

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    900s
  • max time network
    888s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://www.mediafire.com/file/g1db159l920zrne/RoClothes_lerp%28%29_0.7.9.zip/file
  • Sample260731-ejnw9acc76
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 37 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.mediafire.com/file/g1db159l920zrne/RoClothes_lerp%28%29_0.7.9.zip/file"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1532
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.mediafire.com/file/g1db159l920zrne/RoClothes_lerp%28%29_0.7.9.zip/file
      2⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {7bc45208-e367-47d5-8bda-89937daf76f7} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:5392
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {9fba16db-4815-4cef-a2fb-692fa6bc6a56} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:2348
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3832 -prefsLen 25164 -prefMapHandle 3836 -prefMapSize 270279 -jsInitHandle 3840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3848 -initialChannelId {a690c620-aebd-4021-baa1-40d03271eb44} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:2244
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27274 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {1efdf950-b0c9-4f0d-986c-336c0b020c7a} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:4372
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2680 -prefsLen 34773 -prefMapHandle 2900 -prefMapSize 270279 -jsInitHandle 2780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2916 -initialChannelId {28681e96-fecc-4efa-a962-9e64417cfa85} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:1924
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2916 -prefsLen 34957 -prefMapHandle 2932 -prefMapSize 270279 -ipcHandle 3244 -initialChannelId {c492c394-835d-458a-aec3-fcb115f48e94} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:5104
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6180 -prefsLen 32952 -prefMapHandle 6184 -prefMapSize 270279 -jsInitHandle 6188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6080 -initialChannelId {ceafc206-7fa1-418c-93e6-f045a2cc123e} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:5560
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6336 -prefsLen 32952 -prefMapHandle 6340 -prefMapSize 270279 -jsInitHandle 6344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6352 -initialChannelId {46530245-a6ee-4b43-8d05-be761dfc320d} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:3508
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6520 -prefsLen 32952 -prefMapHandle 6524 -prefMapSize 270279 -jsInitHandle 6528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6536 -initialChannelId {bb7db91a-f09a-4582-a9d1-65e7ddaea3bc} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:3268
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6524 -prefsLen 32952 -prefMapHandle 6528 -prefMapSize 270279 -jsInitHandle 6536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6776 -initialChannelId {4e2577a9-141d-4682-870a-35f3f8999fdc} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
              3⤵
              • Checks processor information in registry
              PID:4424
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6460 -prefsLen 36766 -prefMapHandle 6444 -prefMapSize 270279 -jsInitHandle 6448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6704 -initialChannelId {037c5493-d50d-4894-bb1f-a5952518b65e} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
              3⤵
              • Checks processor information in registry
              PID:5092
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6412 -prefsLen 36766 -prefMapHandle 6420 -prefMapSize 270279 -jsInitHandle 6216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6140 -initialChannelId {2d747180-1a23-4eb3-8f0f-05daf1201b48} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
              3⤵
              • Checks processor information in registry
              PID:612
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2992 -prefsLen 40511 -prefMapHandle 7344 -prefMapSize 270279 -jsInitHandle 6528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6188 -initialChannelId {aafc4f58-0d9d-4ccc-8574-93cc043a6ca5} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
              3⤵
              • Checks processor information in registry
              PID:1584
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7696 -prefsLen 37396 -prefMapHandle 7700 -prefMapSize 270279 -jsInitHandle 7704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7712 -initialChannelId {faf482db-a975-453f-a821-2fd0fe691a2a} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
              3⤵
              • Checks processor information in registry
              PID:5304
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7928 -prefsLen 37396 -prefMapHandle 6756 -prefMapSize 270279 -jsInitHandle 7696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7932 -initialChannelId {f6f332b6-ac19-47e9-ad0a-4b91c922d1e0} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
              3⤵
              • Checks processor information in registry
              PID:2452
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8040 -prefsLen 37396 -prefMapHandle 8044 -prefMapSize 270279 -jsInitHandle 8048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8056 -initialChannelId {a818ec94-8ecc-430a-8cee-a880e64cc537} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
              3⤵
              • Checks processor information in registry
              PID:364
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8220 -prefsLen 37396 -prefMapHandle 8216 -prefMapSize 270279 -jsInitHandle 8212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8268 -initialChannelId {645fdd24-9460-4c85-970d-a451498850b0} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
              3⤵
              • Checks processor information in registry
              PID:2116
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 5388 -prefsLen 40630 -prefMapHandle 8436 -prefMapSize 270279 -ipcHandle 8496 -initialChannelId {05315710-cbbe-4729-9eb7-3b92ad7287a3} -parentPid 2812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2812" -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 utility
              3⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:6060
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:1772
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            1⤵
              PID:1648
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
              • Suspicious use of FindShellTrayWindow
              PID:6800
              • C:\Windows\explorer.exe
                explorer.exe /LOADSAVEDWINDOWS
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:6952
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:6312
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:6340
            • C:\Windows\System32\SecurityHealthHost.exe
              \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
              1⤵
                PID:4672

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    activity-stream.discovery_stream.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\activity-stream.discovery_stream.json
                    • Size 75KB
                    • SHA256 770512b24eaaa5ddc8974bcf706453ceb8037a2bc8006897f714760bb41aa615
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                    • Size 16KB
                    • SHA256 a1cd7af67850c1a86ac02ae7370068afd6d079c348ad7ec13954d5405c54f236
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_arts_and_entertainment.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                    • Size 67KB
                    • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_autos_and_vehicles.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                    • Size 44KB
                    • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_beauty_and_fitness.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                    • Size 33KB
                    • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_blogging_resources_and_services.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                    • Size 33KB
                    • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_books_and_literature.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                    • Size 67KB
                    • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_business_and_industrial.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                    • Size 45KB
                    • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_computers_and_electronics.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                    • Size 45KB
                    • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_finance.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_finance.json
                    • Size 33KB
                    • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_food_and_drink.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                    • Size 67KB
                    • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_games.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_games.json
                    • Size 44KB
                    • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_health.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_health.json
                    • Size 33KB
                    • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_hobbies_and_leisure.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                    • Size 67KB
                    • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_home_and_garden.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                    • Size 33KB
                    • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_internet_and_telecom.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                    • Size 67KB
                    • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_jobs_and_education.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                    • Size 33KB
                    • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_law_and_government.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                    • Size 68KB
                    • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_online_communities.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                    • Size 67KB
                    • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_people_and_society.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                    • Size 45KB
                    • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_pets_and_animals.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                    • Size 44KB
                    • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_real_estate.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                    • Size 67KB
                    • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_reference.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_reference.json
                    • Size 56KB
                    • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_science.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_science.json
                    • Size 56KB
                    • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_shopping.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_shopping.json
                    • Size 67KB
                    • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_sports.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_sports.json
                    • Size 56KB
                    • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nb_model_build_attachment_travel.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_travel.json
                    • Size 67KB
                    • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recipe_attachment.json
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\recipe_attachment.json
                    • Size 1KB
                    • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    webext.sc.lz4
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\startupCache\webext.sc.lz4
                    • Size 105KB
                    • SHA256 0833120826416848e82f6fb93c2315849896b44c6e4018456d65bec68b70e4af
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prep_Activatable Class_Hermes_perf.cache
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                    • Size 599B
                    • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    remote-settings-startup-bundle-
                    • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                    • Size 545KB
                    • SHA256 f94b4c6ade16df118dd11ca9d48c7e657d0f3c2e8cbffaa6dfb0e0db9e63478b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 11KB
                    • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 502KB
                    • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    6824f4a902c78fbd.customDestinations-ms
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                    • Size 27KB
                    • SHA256 5a62b552b8baacf3a040640f957c56d9264c9c1ee7faa7df97a848d63c58b293
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    6824f4a902c78fbd.customDestinations-ms
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                    • Size 19KB
                    • SHA256 d053cecf090e2586f4ecb3df795f10bef1edc35e162cfd1574cb275724e79b15
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    BJOKZEORZJTFNAD9GG53.temp
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BJOKZEORZJTFNAD9GG53.temp
                    • Size 24KB
                    • SHA256 d224225f400beaa0f77badfdfc6c332a9ec9cd82f3d6eeab0b2fe168cd262ff5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AlternateServices.bin
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\AlternateServices.bin
                    • Size 31KB
                    • SHA256 8738aab2b2667f60c16f13c803b771f96c7a3be48b6e6fff49d1eff4b4e71ae8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AlternateServices.bin
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\AlternateServices.bin
                    • Size 8KB
                    • SHA256 c481e9f767c1ae45e6791ab00f074374266d39e094c1f6223e8fd8ffbd9a21f5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AlternateServices.bin
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\AlternateServices.bin
                    • Size 13KB
                    • SHA256 24012932b67c59f14b2b238dc52da2300a460eaf8e8ee9826c4758cd3dd4e5b3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AlternateServices.bin
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\AlternateServices.bin
                    • Size 30KB
                    • SHA256 21c663e45677202f45aa38865b0b84a8a192392c3efae7fa3eca8674ec249865
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AlternateServices.bin
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\AlternateServices.bin
                    • Size 30KB
                    • SHA256 3a77fff40a981578ef25be32991988c2b13a7b23852589424738ce092c1c7bf7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    addonStartup.json.lz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\addonStartup.json.lz4
                    • Size 4KB
                    • SHA256 34d75832e34847d9e977b5c0bf7b45519a7e168d8808046bc916eeaef04fda37
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    bookmarks-2026-07-31_10_294-s-VwlaDA_TJmWaj7A7kTBFKhKgBzRXe5eGbGBh0=.jsonlz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\bookmarkbackups\bookmarks-2026-07-31_10_294-s-VwlaDA_TJmWaj7A7kTBFKhKgBzRXe5eGbGBh0=.jsonlz4
                    • Size 861B
                    • SHA256 4ff52efcd61ba011e6c51b2928e2fdf7ac417edb098c2fb8131d0db43212b4ac
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 7KB
                    • SHA256 7fe8ac9a6af810abd7d4ff0c1e14b83ca0510de0d9e69f5adee3cf931caa188c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 6KB
                    • SHA256 ae155598751d505b19e26b1bc1553d094a31d439dafa872f0b55e172ed039adc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 5KB
                    • SHA256 4c90fc5d1a747c9a9a2ebf17b62d43840203c706503881ffce5ed1dad14a73db
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 7KB
                    • SHA256 995509bc9f8ccbfb597bdc4e4664ff321ebe5e5392d6263111aa98b7abcf75c4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 131KB
                    • SHA256 ae7571a22574c43ebca57076fb82512549f6d6788911d5d9927a3ca883bd3e17
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 75KB
                    • SHA256 d1dfe92be172c1da25c69a18f4e6483f684c919f947ceec79936c6a09068c982
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 75KB
                    • SHA256 d880ac738157049579f3e5cf4fd483849611d301f1a61f47fa35618432e1f745
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 7KB
                    • SHA256 af3e9676c94cf7acb140fb005423d22f5c00bbada9633b22612911908d7240c4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 41KB
                    • SHA256 c2c9c89d54dcb4c71a68cf82f25625573a214b701a9b65e07b0f0d7c707fe7a9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 41KB
                    • SHA256 c5ab57df7e36dc3cc00f6e9883aa6c1ac610d9fda91538f2546f86528cfff342
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    events
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\events\events
                    • Size 5KB
                    • SHA256 95e04b76f50a721783a1da6322e2b879af44bb6aa3cc2cf8bdf4c3ea8a810146
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    events
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\events\events
                    • Size 1KB
                    • SHA256 9878c5c21412138c11bf7898469c011d4bfb34a2cb028b7cb47a267d5bcd14c3
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    1348fb49-f2b9-4917-b674-74738e0eb9c2
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\1348fb49-f2b9-4917-b674-74738e0eb9c2
                    • Size 235B
                    • SHA256 9cd47289ed1430ccc776bcc3847433046db309f3fa22cc1598bf42c1873d9e55
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    5e04c515-4724-448e-861b-3957b6a8500b
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\5e04c515-4724-448e-861b-3957b6a8500b
                    • Size 883B
                    • SHA256 bb171aea0438bdb8cd6d4f8ce9abcdd39eab8cc1d158dda976cc95f19ee07653
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    5ecc74eb-0a21-43ce-aa49-5716ec599f74
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\5ecc74eb-0a21-43ce-aa49-5716ec599f74
                    • Size 235B
                    • SHA256 25b63c92940208ba1ce4745b8fe648fc9f10ccd0223429136541354ccfca7474
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    7e9f7dc2-518c-4488-a78f-6c7c4774b690
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\7e9f7dc2-518c-4488-a78f-6c7c4774b690
                    • Size 886B
                    • SHA256 7cb000107b52a143538495f27f5df0a2b2074d4e82c29a816bc15eb3c3d8ba7d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    dae00bfc-5a15-47a8-80b5-7805d0fb2607
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\dae00bfc-5a15-47a8-80b5-7805d0fb2607
                    • Size 16KB
                    • SHA256 a1f874d5342353a744163e6481ea85f6ab4d30be9160cd5f8a3a31b5a772944e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    f566404f-c7c2-40d9-9d87-412ba11114da
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\f566404f-c7c2-40d9-9d87-412ba11114da
                    • Size 2KB
                    • SHA256 6c6543b895a3ffbc9924901acbd234610d5c3b9f489bb844777ac0630903604c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    extension-preferences.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\extension-preferences.json
                    • Size 942B
                    • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    extensions.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\extensions.json
                    • Size 16KB
                    • SHA256 51f1512986ddca362cedaea97a12d332b73f9a983c070e3a3599a692323b191e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                    • Size 1.1MB
                    • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.info
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                    • Size 116B
                    • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    manifest.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                    • Size 1002B
                    • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    widevinecdm.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                    • Size 21.6MB
                    • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
                    • Size 12KB
                    • SHA256 a65a398fd1df3d048ed933d618f27f72fff35467364aa47efcb01b08bffcef0b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
                    • Size 12KB
                    • SHA256 e39f5271e841886a6211685d334d3c66cd74fe0cef8be93a3c243fa823c2bc09
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
                    • Size 6KB
                    • SHA256 c888a3fc2d4902fc4c70f6f1c4c5641efaeb2e20994a72023ced2e1ab1ddac82
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
                    • Size 8KB
                    • SHA256 84fabf71bb79ae0d7400dfef022e1aeeb3f0fc82ff4c04b2a35bdb5640d7160f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs.js
                    • Size 12KB
                    • SHA256 b9f636fa0f08b7aa672f0295a5e0758ea30adfa2a46eb89c56fb4c0dc0020357
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 9KB
                    • SHA256 038c2c29d25bf47936942e4ed4c287b0fc5fc7e4b55d882bdd8d944941303186
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 12KB
                    • SHA256 394ce2e0034cca76de5a27193382196396bd9126f2d0a0225efb4d3d1cb9f5bd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 12KB
                    • SHA256 a99dcbef07a94eb342cd74756908d456f0e1fa65a6670e5c632953c4c53d59cd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 4KB
                    • SHA256 7bcefd1891ae7f46aae82e34c6032c89cffc761fd88554c4aede73f7120addb7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 4KB
                    • SHA256 b6642ee044ade605d3d6849cfa5e54ac901229af9c33d1119a3daa4e4073a4e4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 8KB
                    • SHA256 aec5985c42f640925c2b5678a879cbc291f8f287cf6135636ae6fbc7735eda3f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 9KB
                    • SHA256 374406f7e5f69916aff0f48e2babd1315d7ded29a187442a2551e0ea80661b21
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 12KB
                    • SHA256 38a853ae5ad2cecfdce3e36c8d9d83dd2b77e27d7a528420f6a62e289fbff291
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 12KB
                    • SHA256 f816c4ae76834e31eb5539d8946387483298c8f8c71db870c1ede2f17aff88b3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.jsonlz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.jsonlz4
                    • Size 9KB
                    • SHA256 0efc5416f46194cb6d9d111baa908fc92ae22295622460695ecc4e2305d781ea
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    {0fd591c0-5711-43c4-bd87-61c44345ce66}.final
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\storage\default\https+++www.virustotal.com\cache\morgue\102\{0fd591c0-5711-43c4-bd87-61c44345ce66}.final
                    • Size 72KB
                    • SHA256 f0a21164df0b6c57601ce9fdb0646f7ab9af0e5c9eda47291cd1f22543465a75
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    RoClothes lerp() 0.q6Ng9gIN.7.9.zip.part
                    • Path C:\Users\Admin\Downloads\RoClothes lerp() 0.q6Ng9gIN.7.9.zip.part
                    • Size 47.2MB
                    • SHA256 b49e1e2a632aa4a2b9b446d52d9a903a4bd42b15ee1f8727b6fd59d24e1328f4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/6312-1820-0x000001C6801E0000-0x000001C6802E0000-memory.dmp
                    Download

                    memory/6312-1834-0x000001C681DD0000-0x000001C681ED0000-memory.dmp
                    Download

                    memory/6312-1832-0x000001C681900000-0x000001C681920000-memory.dmp
                    Download

                    memory/6312-1851-0x000001C681B60000-0x000001C681B80000-memory.dmp
                    Download

                    memory/6312-1866-0x000001C6940E0000-0x000001C694100000-memory.dmp
                    Download

                    memory/6312-1822-0x000001C6801E0000-0x000001C6802E0000-memory.dmp
                    Download

                    memory/6312-1821-0x000001C6801E0000-0x000001C6802E0000-memory.dmp
                    Download