Analysis

  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    838s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/08/2026, 02:40

General

  • Target
    https://www.unknowncheats.me/forum/phasmophobia/485776-phasmomenu-pappyg.html
  • Sample260801-c5xeeacd76

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 3 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 8 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.unknowncheats.me/forum/phasmophobia/485776-phasmomenu-pappyg.html"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.unknowncheats.me/forum/phasmophobia/485776-phasmomenu-pappyg.html
      2⤵
      • Downloads MZ/PE file
      • Drops desktop.ini file(s)
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2104 -initialChannelId {63738a47-d458-4e12-bbb6-92df0f99685c} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:4416
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {1a03f68d-7448-4003-8d91-cf144aae5063} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:3320
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 25164 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {613cc27b-2bda-4091-9cd5-15bad2610a8e} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:2584
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27276 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 4104 -initialChannelId {0f1f895d-5450-4bd6-aa2f-ebb23065cc62} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:2436
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3212 -prefsLen 34775 -prefMapHandle 3048 -prefMapSize 270279 -jsInitHandle 3168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2788 -initialChannelId {49bb08ab-14a1-4845-bf10-2603d97afe1c} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:2420
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4900 -prefsLen 35012 -prefMapHandle 4904 -prefMapSize 270279 -ipcHandle 4860 -initialChannelId {47a81a77-0c7e-4c72-90ff-fe259ab3db8a} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:1228
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4852 -prefsLen 32900 -prefMapHandle 4832 -prefMapSize 270279 -jsInitHandle 5016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4900 -initialChannelId {7075746b-1b27-43fb-abcf-527532959267} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:1568
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5116 -prefsLen 32900 -prefMapHandle 5076 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {34e8954a-ee7d-4807-9bd2-3aeaf3b1b4b1} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:1544
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4720 -prefsLen 32900 -prefMapHandle 4724 -prefMapSize 270279 -jsInitHandle 4728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5584 -initialChannelId {f2f08623-bdde-4bec-b4a5-7e66e654dd5d} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:3720
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 32952 -prefMapHandle 5168 -prefMapSize 270279 -jsInitHandle 5248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {f1b2395f-a369-4e29-b0af-3186156701c5} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
              3⤵
              • Checks processor information in registry
              PID:1392
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6572 -prefsLen 32952 -prefMapHandle 6576 -prefMapSize 270279 -jsInitHandle 6580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6588 -initialChannelId {94117faa-7016-4e4c-8f28-1e73681e68bd} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
              3⤵
              • Checks processor information in registry
              PID:2396
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6752 -prefsLen 32952 -prefMapHandle 6756 -prefMapSize 270279 -jsInitHandle 6760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6764 -initialChannelId {7cc5c07c-0b59-466a-aaf8-2937a1ef5f30} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
              3⤵
              • Checks processor information in registry
              PID:2704
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6936 -prefsLen 32952 -prefMapHandle 6940 -prefMapSize 270279 -jsInitHandle 6944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6952 -initialChannelId {4f7e4c29-01fa-4841-94bd-0d749619dced} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
              3⤵
              • Checks processor information in registry
              PID:2124
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6588 -prefsLen 32952 -prefMapHandle 6920 -prefMapSize 270279 -jsInitHandle 6744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6704 -initialChannelId {0d1dcb61-bc57-4e06-82f1-ceba0d3a8521} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
              3⤵
              • Checks processor information in registry
              PID:4836
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4604 -prefsLen 36639 -prefMapHandle 6516 -prefMapSize 270279 -jsInitHandle 2976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {8a1b35d3-1914-42ad-a8a3-8b78bdfad9c6} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
              3⤵
              • Checks processor information in registry
              PID:4884
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3244 -prefsLen 36639 -prefMapHandle 5328 -prefMapSize 270279 -jsInitHandle 7536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6412 -initialChannelId {2d40a0a0-346b-4126-82a9-ccbb34463075} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
              3⤵
              • Checks processor information in registry
              PID:5232
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5312 -prefsLen 39758 -prefMapHandle 5296 -prefMapSize 270279 -ipcHandle 7940 -initialChannelId {a690f4ed-18a7-4ab8-921f-079a6bc1fa5f} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 utility
              3⤵
              • Checks processor information in registry
              PID:5312
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7536 -prefsLen 39758 -prefMapHandle 6412 -prefMapSize 270279 -ipcHandle 5296 -initialChannelId {0c5b4674-83d4-4807-9a07-5ec6d782b554} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 utility
              3⤵
              • Checks processor information in registry
              PID:5368
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6928 -prefsLen 36639 -prefMapHandle 8240 -prefMapSize 270279 -jsInitHandle 8224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6024 -initialChannelId {1f8b87ba-2c34-43a7-ac5f-86a32c37cbfc} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
              3⤵
              • Checks processor information in registry
              PID:6032
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8256 -prefsLen 36639 -prefMapHandle 8260 -prefMapSize 270279 -jsInitHandle 8264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6368 -initialChannelId {f5fe589e-6eff-4672-ba71-f00df80e4ff7} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
              3⤵
              • Checks processor information in registry
              PID:6044
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8436 -prefsLen 36718 -prefMapHandle 5320 -prefMapSize 270279 -jsInitHandle 7916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7928 -initialChannelId {37e48576-c44a-4f51-a419-f0ed9ab096ed} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
              3⤵
              • Checks processor information in registry
              PID:1584
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7040 -prefsLen 36768 -prefMapHandle 7004 -prefMapSize 270279 -jsInitHandle 7828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5848 -initialChannelId {27ef5beb-bbce-48b8-8c3d-7b255403df18} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
              3⤵
              • Checks processor information in registry
              PID:5184
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6960 -prefsLen 36768 -prefMapHandle 8452 -prefMapSize 270279 -jsInitHandle 6172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8368 -initialChannelId {e0b53531-6da4-46d6-b736-42e83b6b5518} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
              3⤵
              • Checks processor information in registry
              PID:6052
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7548 -prefsLen 36768 -prefMapHandle 6924 -prefMapSize 270279 -jsInitHandle 7040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5420 -initialChannelId {65fb36d1-5132-4844-be4b-ccd17c122d96} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
              3⤵
              • Checks processor information in registry
              PID:5456
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5144 -prefsLen 36768 -prefMapHandle 7040 -prefMapSize 270279 -jsInitHandle 5224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7548 -initialChannelId {39c2287a-b863-4147-8bd8-3e8a88df52d6} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
              3⤵
              • Checks processor information in registry
              PID:5020
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7732 -prefsLen 36768 -prefMapHandle 8352 -prefMapSize 270279 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 864 -initialChannelId {9d7e01e5-5146-4df3-bd4b-d04d3487ab7c} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
              3⤵
              • Checks processor information in registry
              PID:6028
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7284 -prefsLen 36768 -prefMapHandle 5796 -prefMapSize 270279 -jsInitHandle 7772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8352 -initialChannelId {aa18832d-29dc-4758-b8f3-61e4d8a9c163} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
              3⤵
              • Checks processor information in registry
              PID:2632
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7040 -prefsLen 36808 -prefMapHandle 8312 -prefMapSize 270279 -jsInitHandle 7176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7828 -initialChannelId {af9b40e2-153b-4a74-92cd-3ba40553ab97} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
              3⤵
              • Checks processor information in registry
              PID:5264
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8860 -prefsLen 36808 -prefMapHandle 8864 -prefMapSize 270279 -jsInitHandle 8868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8840 -initialChannelId {01e40645-26db-403f-95ea-d1e49e1b48f0} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
              3⤵
              • Checks processor information in registry
              PID:4324
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8860 -prefsLen 36808 -prefMapHandle 8900 -prefMapSize 270279 -jsInitHandle 8884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8996 -initialChannelId {12ba669d-013c-4668-8e5f-483c999c9727} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
              3⤵
              • Checks processor information in registry
              PID:1172
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8228 -prefsLen 39927 -prefMapHandle 6976 -prefMapSize 270279 -jsInitHandle 6988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6996 -initialChannelId {aef2876b-50a6-4c9a-b1a2-80128a90bc4f} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
              3⤵
              • Checks processor information in registry
              PID:5696
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9492 -prefsLen 36808 -prefMapHandle 9496 -prefMapSize 270279 -jsInitHandle 9500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9508 -initialChannelId {fef0e20b-432d-4087-9ff1-1f040b2c2dcd} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
              3⤵
              • Checks processor information in registry
              PID:3492
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9100 -prefsLen 37291 -prefMapHandle 9112 -prefMapSize 270279 -jsInitHandle 17060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8880 -initialChannelId {13e70d36-c7c4-4f88-8d20-60e04ab9154d} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
              3⤵
              • Checks processor information in registry
              PID:2320
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8944 -prefsLen 37291 -prefMapHandle 8948 -prefMapSize 270279 -jsInitHandle 8932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11820 -initialChannelId {2285c7e2-b3ea-4531-abdb-3c985e5c8627} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
              3⤵
              • Checks processor information in registry
              PID:1756
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14088 -prefsLen 37291 -prefMapHandle 17060 -prefMapSize 270279 -jsInitHandle 8880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9124 -initialChannelId {2b7141c1-8a99-423e-a166-af7dd23b614a} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
              3⤵
              • Checks processor information in registry
              PID:1748
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:5440

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                activity-stream.contile.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\activity-stream.contile.json
                • Size 5KB
                • SHA256 1aad4933621688b53835c152d55b346e830ab1ee4a359fd86d70242397bfab1c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                activity-stream.discovery_stream.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\activity-stream.discovery_stream.json
                • Size 75KB
                • SHA256 2903e95278c0d2ae4c23448269447ba3aafcc3094a3d75829cc315441516ea22
                • MD5 SHA1 SHA512 SSDEEP TLSH

                0181963C241E6D0381B874A3125B233E8532A25A

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\0181963C241E6D0381B874A3125B233E8532A25A
                • Size 1.8MB
                • SHA256 5803c9d94a7e5060a491d3c750411aca229aa1c2c6607c037e1763fa55d252bb
                • MD5 SHA1 SHA512 SSDEEP TLSH

                102B2AD07FADDB28B54B067D77BB518EBA04A2B4

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\102B2AD07FADDB28B54B067D77BB518EBA04A2B4
                • Size 29KB
                • SHA256 6b1d0e76f43eb33e28eeed10f5d170caf23643897bcc6eee8844a2574c2150e6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                1AEEF8BF2BD44F2BF5D041130C82D78C07479480

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\1AEEF8BF2BD44F2BF5D041130C82D78C07479480
                • Size 1.8MB
                • SHA256 bf0ca65a24a5ad438b9d0dca5cb9a4ba3c2d94c76b73900a12b752ba59510487
                • MD5 SHA1 SHA512 SSDEEP TLSH

                1BB3564D7F08A2EBE38797FBB5D844D675D5CF18

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\1BB3564D7F08A2EBE38797FBB5D844D675D5CF18
                • Size 33KB
                • SHA256 e8d049d8b1e12075609da8f86d734949003b1f249c62b9ae6603072eb095ec87
                • MD5 SHA1 SHA512 SSDEEP TLSH

                228FFB340791196AB7879B25CC73BB53C3721032

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\228FFB340791196AB7879B25CC73BB53C3721032
                • Size 106KB
                • SHA256 ad416d6fbcb0d50682d5e06c06faefbc8802f315e27f7a6e337769cb342127d1
                • MD5 SHA1 SHA512 SSDEEP TLSH

                246E838FD25ABB7598492D35FF8E5BBA2F9082E2

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\246E838FD25ABB7598492D35FF8E5BBA2F9082E2
                • Size 535KB
                • SHA256 b0ed0d52800c6ca6404638a033f2c87db02a4d389fcd1fa13f85489df04f5abe
                • MD5 SHA1 SHA512 SSDEEP TLSH

                2685AEEF63D3159525183A0D68C75F8FFC2E8EAD

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\2685AEEF63D3159525183A0D68C75F8FFC2E8EAD
                • Size 24KB
                • SHA256 96fc25466297cad08c957ce57916db1652e899e23aa8014652669d0ea517bd2d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                2C08B4EC4B7DE5A5562662F23AA1F3C8E5DEAFA2

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\2C08B4EC4B7DE5A5562662F23AA1F3C8E5DEAFA2
                • Size 38KB
                • SHA256 5151e77844a5278f8b10223d20450ed12777a6ca5062b0a270e872663775cb14
                • MD5 SHA1 SHA512 SSDEEP TLSH

                2FB653A8C4D05A9E2D62C8AC0FD20BE05354DF3F

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\2FB653A8C4D05A9E2D62C8AC0FD20BE05354DF3F
                • Size 46KB
                • SHA256 f564d532fd81fe5367b8e50f4e44791cde14e241c4b84f69381557d26a3e093b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                30D970914EC9ABB26B9431C22E3B6B281E44B397

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\30D970914EC9ABB26B9431C22E3B6B281E44B397
                • Size 41KB
                • SHA256 59b8ec0ba83a1c09c81f7c521797f2aa9e88b95d6cb2b4718e6d897833b865b9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                318223F5ED8A9BCC63ECD8DB979FB700A83FD8E1

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\318223F5ED8A9BCC63ECD8DB979FB700A83FD8E1
                • Size 82KB
                • SHA256 67f9d799d63ff0be41b851302180cbd3ba8b30502c1c1b9ad29d3f6963a152b9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                33EA575D85F036D41948D968272B44E6072862F9

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\33EA575D85F036D41948D968272B44E6072862F9
                • Size 17KB
                • SHA256 6794500e6cdc92318547be5bc5b46f52c164fc1e8a522857e5d557480a24633e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3422D8495CBA632908AC08995F8EBCAC01F31631

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\3422D8495CBA632908AC08995F8EBCAC01F31631
                • Size 48KB
                • SHA256 4a78cd0f958429abb56c949697d4fe2ca1bdaae00610d092dfd44cf52e32dd4d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3580176A4B9A28D23F7BE355F0AC69EBDFF8E148

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\3580176A4B9A28D23F7BE355F0AC69EBDFF8E148
                • Size 14KB
                • SHA256 4f1a558fd396f17c940f1682502efefda653a1da9c26111ba40df7d9fbb8e013
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3E629EA88211B67B155AFC2AB405052C59B5EF86

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\3E629EA88211B67B155AFC2AB405052C59B5EF86
                • Size 14KB
                • SHA256 f858e17ceb40c4eca1fbbe33187e387c93adfb89819e59d48aa6e7f475374ddc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                43F583765842B5F8937BC04EEB9857115461CAC5

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\43F583765842B5F8937BC04EEB9857115461CAC5
                • Size 316KB
                • SHA256 1e48074a8ed6158a6fc1ca801ccb56f91f886f5f552c97b46d000edcd6d6f718
                • MD5 SHA1 SHA512 SSDEEP TLSH

                4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                • Size 16KB
                • SHA256 9c2b627bbaac518ddb289ef27c37cc63cd6d3949f7cc9267a8c61c3d825e7110
                • MD5 SHA1 SHA512 SSDEEP TLSH

                5A60C810C3030E570101259CD030A40FD96BC19E

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\5A60C810C3030E570101259CD030A40FD96BC19E
                • Size 163KB
                • SHA256 a8fb36d52411fdc1c3c7fc37838ff2e2d034b0b840ee0cba17402aa6ad7d39e8
                • MD5 SHA1 SHA512 SSDEEP TLSH

                5B92F07706A659C85946C66BC6D1C61EAF53DAEB

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\5B92F07706A659C85946C66BC6D1C61EAF53DAEB
                • Size 146KB
                • SHA256 5effdb09055f22b26d54c473c12eb88c489e15276f347bb3179cf423cbd70000
                • MD5 SHA1 SHA512 SSDEEP TLSH

                5F9E3C68BE9471106C65714ACE43FEE6C72CD001

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\5F9E3C68BE9471106C65714ACE43FEE6C72CD001
                • Size 12KB
                • SHA256 9888fa13459c73eb00bb8a980602fe0b7ac8f104f02a0213002672867af9043d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                60CD904AADB0598CA3C707B8E9C57EFA0611580A

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\60CD904AADB0598CA3C707B8E9C57EFA0611580A
                • Size 427KB
                • SHA256 5896b3c6d0294b854b52f6bbaa53931ec5897d607faf083491a806a7a3ccef3d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                60F21472CE19D106587DA99AB6E2A0326E0988F9

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\60F21472CE19D106587DA99AB6E2A0326E0988F9
                • Size 31KB
                • SHA256 76baef403a6d0a79fcf0d41e1bacf2e479e1d584400807d27897432e3a65cfab
                • MD5 SHA1 SHA512 SSDEEP TLSH

                6D89348819C8881868053197CA0754F36784BF5F

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
                • Size 16KB
                • SHA256 a0fcad962d7ca3cc28b2756b76e77bf5400d841074682548dedb1b237e396454
                • MD5 SHA1 SHA512 SSDEEP TLSH

                737A93A238FFFD954614AF24834691F2D9AE23E7

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\737A93A238FFFD954614AF24834691F2D9AE23E7
                • Size 39KB
                • SHA256 17f5a5ed8c08ee362956cf540d37fe92f0bee2a077279a2df8a0554a8421e79c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                80EBB4F2A17699A99791F292A298A52C0D488DF2

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\80EBB4F2A17699A99791F292A298A52C0D488DF2
                • Size 14KB
                • SHA256 09809d8e044c411c7021de52c43a4cd23abf7eaf3d38e0144dc8c2da00bb7795
                • MD5 SHA1 SHA512 SSDEEP TLSH

                8BA62BEC97E0A683769424FBA26A64543BDCEFB2

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\8BA62BEC97E0A683769424FBA26A64543BDCEFB2
                • Size 876KB
                • SHA256 41b115dbe7b39ebd62d2e01b1af200520db1b14680053ac0c68e58f844efb283
                • MD5 SHA1 SHA512 SSDEEP TLSH

                93EA0FEF3DDAEC579300070AA59DA08C175030A1

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\93EA0FEF3DDAEC579300070AA59DA08C175030A1
                • Size 57KB
                • SHA256 04238eaaf7e6ee7b40a61de05188baf86e07c33664dcb43210a25368b7a2b19e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                97232C12BF83A788AE445919912F242A5E7BAD1C

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\97232C12BF83A788AE445919912F242A5E7BAD1C
                • Size 1.7MB
                • SHA256 ce561e7df6d907af572c2884f89ae73e7a5160d897aa83976bfec3d5fe8fc14f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                A5C0B2BCC4FF7DFCFFE98946C03F4445F3CA2009

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\A5C0B2BCC4FF7DFCFFE98946C03F4445F3CA2009
                • Size 208KB
                • SHA256 04a5e87a26d63d5667bcbfa014f891be6c9164dbef5784cf6d7720d0251acce9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                A8D50B11A12AC380F16ACB70283CF437C79369B7

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\A8D50B11A12AC380F16ACB70283CF437C79369B7
                • Size 93KB
                • SHA256 4865aea02a239809e443f9e03972b22c415ebaf574ef73291c105da7d78cb232
                • MD5 SHA1 SHA512 SSDEEP TLSH

                BB94F17C3FA653031A7A5466D92A03F0DF9FAD6B

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\BB94F17C3FA653031A7A5466D92A03F0DF9FAD6B
                • Size 63KB
                • SHA256 bd400fdd99396a9700ead79bba20788e91049e40f055a7fdbe09f4549cc32c84
                • MD5 SHA1 SHA512 SSDEEP TLSH

                BCA5ACCFEDBB7C922F55D5C1C3C754404FBE9E2F

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\BCA5ACCFEDBB7C922F55D5C1C3C754404FBE9E2F
                • Size 116KB
                • SHA256 8ac606344dbc3ac28f8d933333d20daa2f488bf338cbfaa308d093a36fb689fd
                • MD5 SHA1 SHA512 SSDEEP TLSH

                C6FBD21D5F20C2D3DAD2F6DBBFAA719F222CBAC7

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\C6FBD21D5F20C2D3DAD2F6DBBFAA719F222CBAC7
                • Size 20KB
                • SHA256 381786c815a564ce8bea2d4d99a83e579eadd1495f1bd6af8cc89cd4e72297e6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                C7F0422939D9E20A3140CACCF1CCDA37E485AC3A

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\C7F0422939D9E20A3140CACCF1CCDA37E485AC3A
                • Size 19KB
                • SHA256 df8e25c513e75e0c78aa2719e8507987181c0896d9b144b9cc1c0f4c0b06f269
                • MD5 SHA1 SHA512 SSDEEP TLSH

                D65FC3AC448AAE804F767B18872DF3628AD4BE9C

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\D65FC3AC448AAE804F767B18872DF3628AD4BE9C
                • Size 256KB
                • SHA256 d8a0f33a2bbf4ede944871fc337999e917e38464282450a5ce66a2a009798e0f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                DA8FCCB48AF223BDFB7AE8D0FE994961271F56CD

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\DA8FCCB48AF223BDFB7AE8D0FE994961271F56CD
                • Size 2.1MB
                • SHA256 ec0fd4cb327b2612e803e5f9c7b67e9eaa7d2fc470c78aef4ab7ee375473e348
                • MD5 SHA1 SHA512 SSDEEP TLSH

                DD2FC28F1D66C77271BD4A9D99B4401EFC59B324

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\DD2FC28F1D66C77271BD4A9D99B4401EFC59B324
                • Size 12KB
                • SHA256 0430de49d560cfed22d82a3fcf991ec118e895458d9fb0d8658d6e9244569232
                • MD5 SHA1 SHA512 SSDEEP TLSH

                DE62A49075A9508A20823BB598F79A5B0944C41E

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\DE62A49075A9508A20823BB598F79A5B0944C41E
                • Size 56KB
                • SHA256 04d6bc3b69084e2372b01b153c915a6d4b82fc6172119a7b3f7ce87b0b1cd63c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                E6FFA6BFFEAE906F784FDCBFDBAEB0DD38579C66

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\E6FFA6BFFEAE906F784FDCBFDBAEB0DD38579C66
                • Size 21KB
                • SHA256 64dc78e39114e48d5110457e2ab8058cb6536617347dbdd4993a2e5bc3e330f2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                E6FFA6BFFEAE906F784FDCBFDBAEB0DD38579C66

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\E6FFA6BFFEAE906F784FDCBFDBAEB0DD38579C66
                • Size 23KB
                • SHA256 1ce81bcaee8bc79caa4a69faf3a6aa18cb407b7cdcd7a6e828b83f0a944646bc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                E9F6CBB6593FDA15AA3323A306E54D6E35C7BBAB

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\E9F6CBB6593FDA15AA3323A306E54D6E35C7BBAB
                • Size 36KB
                • SHA256 8f8ae8fbd263aed7d4641719e4dbfda412e4d9a6e57bfee592e9023a9616b176
                • MD5 SHA1 SHA512 SSDEEP TLSH

                EA6D42951471B8370FEAE789C414CD37843B80D4

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\EA6D42951471B8370FEAE789C414CD37843B80D4
                • Size 1.0MB
                • SHA256 3c5d09c218ed534ab1f5a3be7c749a7a066512006d374480bb8dbdb94010e48a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                F2EF927AF3DE5156788EB7889BF02F5DE2084BFA

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\F2EF927AF3DE5156788EB7889BF02F5DE2084BFA
                • Size 1.6MB
                • SHA256 958ef3525806685f53255a4b4543f368ec2987d7f23f67c3605c044a154078a9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                F67E0F0681D742A9D9A4D74A732714F62C948E48

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\F67E0F0681D742A9D9A4D74A732714F62C948E48
                • Size 127KB
                • SHA256 484dc7c08532930025c7c2e227104538217dd84b6ef6fa67fe5ea3c24a435abd
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Cap0qyjYru9HYlu6yWyt6dXmw_M10aGhq9pWQ4JijRE=.ico

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\jumpListCache\Cap0qyjYru9HYlu6yWyt6dXmw_M10aGhq9pWQ4JijRE=.ico
                • Size 848B
                • SHA256 db61c2274766be8b4c21de190f9198fda428b234d3434b8873a67883a351b66a
                • MD5 SHA1 SHA512 TLSH

                nb_model_build_attachment_arts_and_entertainment.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                • Size 67KB
                • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_autos_and_vehicles.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                • Size 44KB
                • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_beauty_and_fitness.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                • Size 33KB
                • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_blogging_resources_and_services.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                • Size 33KB
                • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_books_and_literature.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                • Size 67KB
                • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_business_and_industrial.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                • Size 45KB
                • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_computers_and_electronics.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                • Size 45KB
                • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_finance.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_finance.json
                • Size 33KB
                • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_food_and_drink.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                • Size 67KB
                • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_games.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_games.json
                • Size 44KB
                • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_health.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_health.json
                • Size 33KB
                • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_hobbies_and_leisure.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                • Size 67KB
                • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_home_and_garden.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                • Size 33KB
                • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_internet_and_telecom.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                • Size 67KB
                • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_jobs_and_education.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                • Size 33KB
                • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_law_and_government.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                • Size 68KB
                • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_online_communities.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                • Size 67KB
                • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_people_and_society.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                • Size 45KB
                • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_pets_and_animals.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                • Size 44KB
                • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_real_estate.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                • Size 67KB
                • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_reference.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_reference.json
                • Size 56KB
                • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_science.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_science.json
                • Size 56KB
                • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_shopping.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_shopping.json
                • Size 67KB
                • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_sports.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_sports.json
                • Size 56KB
                • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_travel.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_travel.json
                • Size 67KB
                • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recipe_attachment.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\recipe_attachment.json
                • Size 1KB
                • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                • MD5 SHA1 SHA512 TLSH

                webext.sc.lz4

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\startupCache\webext.sc.lz4
                • Size 104KB
                • SHA256 3dc97d3ca020b3152950a3e3fa755c0ab8ab394de1627833992c3b6064f68312
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ee23e1dc-4342-4b7d-9265-906cabfcefd0.zip

                • Path C:\Users\Admin\AppData\Local\Temp\ee23e1dc-4342-4b7d-9265-906cabfcefd0.zip
                • Size 3.7MB
                • SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
                • MD5 SHA1 SHA512 SSDEEP TLSH

                remote-settings-startup-bundle-

                • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                • Size 549KB
                • SHA256 1a9b181c03212cfad281dbbc2ee10b3bbc52edf4b2d36af09616e949ad2a96c5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 11KB
                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 502KB
                • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                • MD5 SHA1 SHA512 SSDEEP TLSH

                6824f4a902c78fbd.customDestinations-ms

                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                • Size 18KB
                • SHA256 9a313a9e56398a732aad52c2de9832438dca66880f58756ea6df649a868b9bf8
                • MD5 SHA1 SHA512 SSDEEP TLSH

                6824f4a902c78fbd.customDestinations-ms

                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                • Size 20KB
                • SHA256 5e16b3b9e05e7030347245677e154dcf7c4b40d4aa9b2b4ccd59c56f72cbb546
                • MD5 SHA1 SHA512 SSDEEP TLSH

                6824f4a902c78fbd.customDestinations-ms

                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                • Size 20KB
                • SHA256 0bb26668f097960e0e945f0e3af0e6c00a5b3b082eabcedc51b67329ceef462e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                AlternateServices.bin

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\AlternateServices.bin
                • Size 33KB
                • SHA256 fd7aa0f35b72b64793afe24eae639fbdcc03082195b4ca5f2900e10519fff054
                • MD5 SHA1 SHA512 SSDEEP TLSH

                AlternateServices.bin

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\AlternateServices.bin
                • Size 33KB
                • SHA256 d801560c6ac14925abc5ee198ce371362ef93549770ff6b116ae153fb88673c4
                • MD5 SHA1 SHA512 SSDEEP TLSH

                AlternateServices.bin

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\AlternateServices.bin
                • Size 33KB
                • SHA256 31b73085707605b14f4535b88371c4219219e1b549fdb42b9cda7070ade6412d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                AlternateServices.bin

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\AlternateServices.bin
                • Size 33KB
                • SHA256 5488ed9669430b3df5be4dd8ecbac06bc52b8f13c7bac3642bcdc5884145d330
                • MD5 SHA1 SHA512 SSDEEP TLSH

                AlternateServices.bin

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\AlternateServices.bin
                • Size 10KB
                • SHA256 c848cc43c76d11815c7657ebf7c93104d5d92968230e9f31224da83b0d4ccce3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                addonStartup.json.lz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\addonStartup.json.lz4
                • Size 4KB
                • SHA256 f6e38bc238797be4546365b2f2dc32472127bb6c447d1edbbff7dd28b356ab40
                • MD5 SHA1 SHA512 SSDEEP TLSH

                bookmarks-2026-08-01_10_qLw4K9m45maT_D78J5qu0rBjNZQ8TqUxYmN2faPaYg4=.jsonlz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\bookmarkbackups\bookmarks-2026-08-01_10_qLw4K9m45maT_D78J5qu0rBjNZQ8TqUxYmN2faPaYg4=.jsonlz4
                • Size 858B
                • SHA256 82975b0983175ae56d26652150863aa89026e1e302c5e6f5d4a8e9e6d54276d8
                • MD5 SHA1 SHA512 TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 24KB
                • SHA256 444883aed1b7d240a96448e77978e177e940643eeb9e73528e6a23d2d4c1de4f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 28KB
                • SHA256 68561c0ae2bb6537fd0f869bb4e693f7a05166224ae4407789c3932156a5c0b5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 101KB
                • SHA256 86c7376f59a93ac7701e027ab9ef3db4f36102ef55e11077b5d7bd9f1433c50a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 27KB
                • SHA256 1508d87a4f01b20bc1753adb3d5b9577ed17d38f661a9565a3897e7b5c0d08fe
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 130KB
                • SHA256 4fea06063aca465fbb9d65b42366b36f5d45c7eae05f0817977fd41340d88825
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 130KB
                • SHA256 55894aa435bea080e5adbed75a06ec223fa3eb368b4d13d8b62fb0e2ce9f7e01
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 130KB
                • SHA256 deb759e35545864f9951c78b7d939549def9388efa8bbb5effb19daddfffbf6e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                events

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
                • Size 1KB
                • SHA256 270ebf211eabfc336a7bdde8f5b1d63537bb6f461d014e9439029aff5d989220
                • MD5 SHA1 SHA512 TLSH

                events

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
                • Size 5KB
                • SHA256 748ed4a6d5139b8e7de93c2d0a73a96fed69fe7a326bd4b1b4e54c77bd4052c5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                011db55f-bcc7-4245-9a29-db388dec36bc

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\011db55f-bcc7-4245-9a29-db388dec36bc
                • Size 886B
                • SHA256 5b0595829fc3156ec0e8950cf41e3473712571f766ee020dd316e1544fdf877f
                • MD5 SHA1 SHA512 TLSH

                3e09b4cc-1ba0-4338-a702-5a10b69e1876

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\3e09b4cc-1ba0-4338-a702-5a10b69e1876
                • Size 2KB
                • SHA256 f4912abc744a4fec5c56e94b996257ad8a9c0e90cec98c1157cac21212afa163
                • MD5 SHA1 SHA512 TLSH

                7fa0c622-aa67-44bc-a9a9-5c825ef1beac

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\7fa0c622-aa67-44bc-a9a9-5c825ef1beac
                • Size 871B
                • SHA256 f0c3b5b9acdc2a4959f1aa1b06c34041214f0823cad680bbd93316b47cf125bb
                • MD5 SHA1 SHA512 TLSH

                d7e791d6-ac4f-4312-8c5e-a648dcfa14cb

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\d7e791d6-ac4f-4312-8c5e-a648dcfa14cb
                • Size 235B
                • SHA256 7f3ba36feca3c2a90dedf35fc37b55b22ab910f36ac381cfd66c59f9fd614306
                • MD5 SHA1 SHA512 TLSH

                df239494-f53c-47d1-9bd9-0db1cb5e2cb5

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\df239494-f53c-47d1-9bd9-0db1cb5e2cb5
                • Size 235B
                • SHA256 e18c1bae53b2ff6d525d4890a6a20d66d12a0b958cb853d92534742dc8354a5c
                • MD5 SHA1 SHA512 TLSH

                extension-preferences.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extension-preferences.json
                • Size 942B
                • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                • MD5 SHA1 SHA512 TLSH

                extensions.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extensions.json
                • Size 16KB
                • SHA256 66af9b86cf29de352b627922250b68a3684acfa44d07929079eeba4f9d500aa6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                gmpopenh264.dll

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                • Size 1.1MB
                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                • MD5 SHA1 SHA512 SSDEEP TLSH

                gmpopenh264.info

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                • Size 116B
                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                • MD5 SHA1 SHA512 TLSH

                manifest.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                • Size 1002B
                • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                • MD5 SHA1 SHA512 TLSH

                widevinecdm.dll

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                • Size 21.6MB
                • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
                • Size 6KB
                • SHA256 12f8c1797d3b9e6989170f7668cb94825c5e5bc8aa355d2ae37c980eb5bdb72c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
                • Size 6KB
                • SHA256 05e9763380b280eba40cfd6d014a615f380a33f39d1a54888da24fd042790485
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
                • Size 12KB
                • SHA256 97cfb3256a7aa34a45d6afa376491a2b5f6b85408060ec85740a7bc3372e7eac
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
                • Size 12KB
                • SHA256 ce2249c458747e3c393d0d7cf3d717e3f4beeadcf5da229fdaa1f48ccbb4be5f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
                • Size 12KB
                • SHA256 71891ac9ee665c088c1a9eda55ba3a9829a77ce841056299ec8aefc28a4f5277
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
                • Size 6KB
                • SHA256 5e4a891e6560b23f8bd2ec946ee88435739f9af0f82fd1d9cfd33b3be91a8b0e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
                • Size 7KB
                • SHA256 ad4e73ad7d7c61dd1e61cfe5680f139e756238d0f18a9e6d1e2a3bb11c5dd57a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
                • Size 5KB
                • SHA256 5dee3d4239da6fdc5e81f48b3fd349a7e5e0081c9873017c4c55b4e0ac187ade
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
                • Size 5KB
                • SHA256 252732b13ecef6e42d6c1cc9b0bdd7ffe93afc8b170d765b83be6266d762daab
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
                • Size 6KB
                • SHA256 05fc2d15f9924c42b30ebf4a75796946287b17e1c3ae490ab4fa86d776bc4057
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
                • Size 3KB
                • SHA256 589085f0a4e248ec555f2f6f75d72e2171d2aea2a2441e5fd463e3b9c9cff547
                • MD5 SHA1 SHA512 TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
                • Size 3KB
                • SHA256 7bdf700ffd1f258edbcad44a9f4afb8c261e6b0e721fdb12e34cdab226a3711f
                • MD5 SHA1 SHA512 TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
                • Size 3KB
                • SHA256 ec0daf695e41919ac0a5c9649dcaeaa3e937b1d75699c3757f84cb5a679cf26a
                • MD5 SHA1 SHA512 TLSH

                recovery.jsonlz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.jsonlz4
                • Size 10KB
                • SHA256 9ebe3b987c0e0c17a7a2205c7859e9c709cd25d8a1bda0304013e7f149bb7cf6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3870112724rsegmnoittet-es.sqlite

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 6.4MB
                • SHA256 79e8e3e460c6fec9032cdcf30e33b2428e890d5d927e3aef0a4c843f0e712ef9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                PhasmoMenu v0.5.9.2 By PappyG_[unknowncheats.me]_.exe

                • Path C:\Users\Admin\Downloads\PhasmoMenu v0.5.9.2 By PappyG_[unknowncheats.me]_.exe
                • Size 7.2MB
                • SHA256 781628abba06ac9744fed39849238ecf170b90ca6df9d1b95becd847b717ba3f
                • MD5 SHA1 SHA512 SSDEEP TLSH