a26a9f1d9b8c053ab89e243a23b2301dfad71ce5fcb186fd76aa22bf9479d165

Analysis

user interaction
yes
max time kernel
145s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NoveNTweaks (1).ps1
Size 13KB
Sample260801-ccptvsvfpe
SHA256 a26a9f1d9b8c053ab89e243a23b2301dfad71ce5fcb186fd76aa22bf9479d165
MD5 5c3a8e74f6831ecb84a33102b1406224
SHA1 daacb0bc5aee1bbb7c91eb59f0c1c14592b2e7be
SHA512 b5ce93bc55c6acb2c37485ac6b50dc2c8bd390533e40f724514d77a2d7a1c090e0d05b3d8eceafa59fb7f544c226d9b29819387ba5f1f0a1e744330f6f4dd1e6
SSDEEP 384:Wx6gGrHbWxlSggaRmKUsLN2Pa1wt3z2bdCjZEO:Wx6gG2xlSZwrUsLN2Pa6zGCjx
TLSH
T18F522E6CBCC5585B5BE7015B2D59D408BCA1C52B928C1DC4F68C82A4FFE536CC2F26BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1188	PowerShell.exe

Checks processor information in registry 2 TTPs 29 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1188	PowerShell.exe
1188	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1188	PowerShell.exe
Token: SeDebugPrivilege	5888	firefox.exe
Token: SeDebugPrivilege	5888	firefox.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 5888	4652	firefox.exe	91
PID 4652 wrote to memory of 5888	4652	firefox.exe	91
PID 5888 wrote to memory of 4724	5888	firefox.exe	92
PID 5888 wrote to memory of 4724	5888	firefox.exe	92
PID 5888 wrote to memory of 4724	5888	firefox.exe	92
PID 5888 wrote to memory of 572	5888	firefox.exe	93
PID 5888 wrote to memory of 572	5888	firefox.exe	93
PID 5888 wrote to memory of 572	5888	firefox.exe	93
PID 5888 wrote to memory of 572	5888	firefox.exe	93
PID 5888 wrote to memory of 2404	5888	firefox.exe	94
PID 5888 wrote to memory of 2404	5888	firefox.exe	94
PID 5888 wrote to memory of 2404	5888	firefox.exe	94
PID 5888 wrote to memory of 2404	5888	firefox.exe	94
PID 5888 wrote to memory of 3824	5888	firefox.exe	95
PID 5888 wrote to memory of 3824	5888	firefox.exe	95
PID 5888 wrote to memory of 3824	5888	firefox.exe	95
PID 5888 wrote to memory of 3776	5888	firefox.exe	96
PID 5888 wrote to memory of 3776	5888	firefox.exe	96
PID 5888 wrote to memory of 3776	5888	firefox.exe	96
PID 5888 wrote to memory of 3776	5888	firefox.exe	96
PID 5888 wrote to memory of 5696	5888	firefox.exe	97
PID 5888 wrote to memory of 5696	5888	firefox.exe	97
PID 5888 wrote to memory of 5696	5888	firefox.exe	97
PID 5888 wrote to memory of 5696	5888	firefox.exe	97
PID 5888 wrote to memory of 460	5888	firefox.exe	98
PID 5888 wrote to memory of 460	5888	firefox.exe	98
PID 5888 wrote to memory of 460	5888	firefox.exe	98
PID 5888 wrote to memory of 460	5888	firefox.exe	98
PID 5888 wrote to memory of 248	5888	firefox.exe	99
PID 5888 wrote to memory of 248	5888	firefox.exe	99
PID 5888 wrote to memory of 248	5888	firefox.exe	99
PID 5888 wrote to memory of 248	5888	firefox.exe	99
PID 5888 wrote to memory of 256	5888	firefox.exe	100
PID 5888 wrote to memory of 256	5888	firefox.exe	100
PID 5888 wrote to memory of 256	5888	firefox.exe	100
PID 5888 wrote to memory of 256	5888	firefox.exe	100
PID 5888 wrote to memory of 6556	5888	firefox.exe	102
PID 5888 wrote to memory of 6556	5888	firefox.exe	102
PID 5888 wrote to memory of 6556	5888	firefox.exe	102
PID 5888 wrote to memory of 6556	5888	firefox.exe	102
PID 5888 wrote to memory of 204	5888	firefox.exe	103
PID 5888 wrote to memory of 204	5888	firefox.exe	103
PID 5888 wrote to memory of 204	5888	firefox.exe	103
PID 5888 wrote to memory of 204	5888	firefox.exe	103
PID 5888 wrote to memory of 3748	5888	firefox.exe	104
PID 5888 wrote to memory of 3748	5888	firefox.exe	104
PID 5888 wrote to memory of 3748	5888	firefox.exe	104
PID 5888 wrote to memory of 3748	5888	firefox.exe	104
PID 5888 wrote to memory of 4520	5888	firefox.exe	105
PID 5888 wrote to memory of 4520	5888	firefox.exe	105
PID 5888 wrote to memory of 4520	5888	firefox.exe	105
PID 5888 wrote to memory of 4520	5888	firefox.exe	105
PID 5888 wrote to memory of 6356	5888	firefox.exe	106
PID 5888 wrote to memory of 6356	5888	firefox.exe	106
PID 5888 wrote to memory of 6356	5888	firefox.exe	106
PID 5888 wrote to memory of 6356	5888	firefox.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\NoveNTweaks (1).ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {97a27b2b-e7d7-4344-a3c3-6ff9db457494} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2388 -prefsLen 27133 -prefMapHandle 2392 -prefMapSize 270279 -ipcHandle 2400 -initialChannelId {a5249f18-63c0-4790-ada6-1620dacbfba3} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 27274 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {fb3fbc61-9de2-4fb8-bfa1-a8a95ce95096} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3984 -prefsLen 27274 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 4064 -initialChannelId {149af534-31a3-4b61-81da-a0d4f52428d5} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2836 -prefsLen 34773 -prefMapHandle 4508 -prefMapSize 270279 -jsInitHandle 4512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4520 -initialChannelId {0ec1279d-10a5-46a9-aa63-237dada9c090} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2752 -prefsLen 34903 -prefMapHandle 2856 -prefMapSize 270279 -ipcHandle 3248 -initialChannelId {a05bcf78-f83a-4d54-8ddc-2b5ce9b92d6b} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5288 -prefsLen 32793 -prefMapHandle 5292 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {ce39da87-b52e-4301-bf6b-5523dbbb4248} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32793 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5292 -initialChannelId {6366aeea-fe7e-43b3-a473-94430e7a68d6} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5696 -prefsLen 32845 -prefMapHandle 5700 -prefMapSize 270279 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5712 -initialChannelId {59082d57-323d-4759-b125-1a07aebe0d51} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 23804 -prefsLen 37427 -prefMapHandle 23808 -prefMapSize 270279 -jsInitHandle 23812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 23492 -initialChannelId {3eb31171-23ee-4035-8d65-f23f8409d8c5} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:6556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 33688 -prefsLen 37427 -prefMapHandle 33160 -prefMapSize 270279 -jsInitHandle 16100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 33148 -initialChannelId {9ca8371d-2161-41b8-9acc-cf7703378350} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 33660 -prefsLen 37427 -prefMapHandle 34284 -prefMapSize 270279 -jsInitHandle 33648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 33624 -initialChannelId {f446b0e5-8899-4f08-a488-956fc4ab9659} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5560 -prefsLen 37427 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {6b9d53bc-e576-4066-9458-ae1f53a516c5} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5392 -prefsLen 37427 -prefMapHandle 5404 -prefMapSize 270279 -jsInitHandle 23484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5364 -initialChannelId {096c9eed-dd13-4def-ad60-c72d5e1f4b73} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:6356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 34748 -prefsLen 37469 -prefMapHandle 34784 -prefMapSize 270279 -jsInitHandle 33228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 33324 -initialChannelId {78c218b5-c905-4660-ae16-51f64a77081d} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    PID:6536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 33344 -prefsLen 40722 -prefMapHandle 33864 -prefMapSize 270279 -ipcHandle 33288 -initialChannelId {5252ff07-c136-4b88-b38c-6f0402514837} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 utility
    3⤵
    PID:3916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 33668 -prefsLen 40722 -prefMapHandle 34096 -prefMapSize 270279 -ipcHandle 34736 -initialChannelId {f860817d-5dd7-45e5-9b2f-70d0f10e50e3} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 utility
    3⤵
    PID:3600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 34788 -prefsLen 37469 -prefMapHandle 34420 -prefMapSize 270279 -jsInitHandle 33992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 34764 -initialChannelId {de8953f2-5218-4171-9f66-ccc695786a39} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    PID:6852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15688 -prefsLen 37469 -prefMapHandle 35104 -prefMapSize 270279 -jsInitHandle 34432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15684 -initialChannelId {d2c74b66-78d6-4477-aaa5-4307bf3caeb9} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    PID:6756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 34592 -prefsLen 37469 -prefMapHandle 34560 -prefMapSize 270279 -jsInitHandle 34564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 34572 -initialChannelId {072c6926-2623-4ca1-9228-131cd644ea1a} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    PID:6764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 29f33c790fad74574f1b91510f8fbc36c6b7d21d3f64b4960551fbdb6b482534
MD5 0293608f007345f82a093e13155b69ad
SHA1 04dd32b3246c13f19791923e3af8647b2b2158e4
SHA512 78453a5dbff1313ccf34479e7429ea9bba413a11be4d41cb3952773c38590295c1b2dc5fd3a85c752ac7030c80ebb32afbfb5eb99037f5b44d7f38ced40125b3
SSDEEP 384:HwCe7iO024YilDL84KKDL849B7SOEAd9KVRaAcP+AWRMAf9i:QqZYilDL8lKDL8CB7S/AmVAf+hRMk9i
TLSH
T1E9729E3E9F413CAC1597C0E8C4B852D98D1877A3DFE6806D22683D0DCB98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5EBD1D64ADA7EAAE49C63712B6A57E346C54CDE1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\5EBD1D64ADA7EAAE49C63712B6A57E346C54CDE1
Size 814KB
SHA256 3684e1533612ab91eca78cc837a3567e4f168679af52860ef46502118d1a48a8
MD5 a025e68dfe828838b55fbe96d3c5c57c
SHA1 d26c6079f5eafa3883b0a4d519a72a8e667816a4
SHA512 3dbc8f6d1e6e33d56130f1c45e50225e535b9116a98d38f4e53df833ded28cae581fdc38b5d0621238f8a6c91e321b25b7874a7fcb7bac88cc536d7556d4cc37
SSDEEP 12288:Gq0MI4OUe9eivcPg9XozBiEFF4k27plDVp11Xfd7aAfSh9vzLkQvXYjyM1srAek5:zJI4Ve9e0wg9XkBtHK
TLSH
T15205E82BFE415E53C82103B140EB27363B39D4966792F32F2ACE7626BC1A7790D6159C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

867c7183-442f-4c1e-bc34-d30249ac817d.zip

Path C:\Users\Admin\AppData\Local\Temp\867c7183-442f-4c1e-bc34-d30249ac817d.zip
Size 3.7MB
SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
MD5 3850f642d336e5b283975359ae18e3d7
SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
TLSH
T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\AlternateServices.bin
Size 10KB
SHA256 e77d74436cee5df7d55335794d83e38de7e615eadfd1e46e089083939f0d6194
MD5 cc2ee8ae460a3d835a61d6cf01be583c
SHA1 6be6c9f28073f57c5333065765f21da3ded0ddb1
SHA512 d6a3bf01446e5f2f81412ed0ff44f2c93be82afb0c08e7d37c989bf6c6e0054179de3223cd427bbf170f9527c11f44ccb28e2e74cb7058b5e6937f4dc93016ff
SSDEEP 24:JUuhMZlL+lz7eT9BgUTE9VvIXbE9FsXZC9lgXMJWN9VxWAIk6q9Bbik:JcL4iBjTmB+bm8ZwAMJM/pR6I97
TLSH
T1CD2249F36B726463F0A28FB1C099748C9C335325486ED594C744A5E712D6BA9A03FBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 36KB
SHA256 d38705b0565b91999638db2be947b384b2c4c4b567366c9a1f8d5b057b89b10c
MD5 b29629ba16e07da2fb463f4d13d37aca
SHA1 e2220e4e27dbc2c60413eb0bc3a3eb4bb0ea8336
SHA512 ff4fde6ea8fe0fb462b382cb0a6864a7b886ed7d6ca9c44d198888d9c7e1b35c981b40fddf07b32d368b45f614eacee3227752a0df14f7c4345405f045d0770a
SSDEEP 768:thcyCoCQ+/wV/H7Gcm+uHSCeOyHdKiqVCZrPZME/8yHblbXbZbLbqbSbhbzbFbZs:tZCoCQ+/wV/0S1HdF4CXe
TLSH
T14FF20F44EB1E913FD42912BBDCA507002F79F88A99192FA73A5C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 fb9d352af1eee8a4abc108093ea83eba11ef6cd68641e6157af77d843eebf0ce
MD5 4fe6251a60ed8e4c0e6a980a273b94d0
SHA1 9607e88b2222b1f2b38b1e4b3cc0f9808f0a4d2c
SHA512 7ffe91275b136bffb5affda3dd364c221dc77fe49826970a567a490377520e0c66d067ce0676bfbc6c76fcca7df8c1438ff9b10cdab5abae5a30c4bb1b362773
SSDEEP 768:vh8Uyi1DXZj+tghGcm+uTN1rBy4KPg5Zq/8jIbwbibLbMb2:viuXZj+tzNhBy46
TLSH
T171E20044EB2E913FD42912BBDCA547002F79B88A99192F573B4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 69ac3853e6424fc428f1da5a935759815ad70f01d60c821f2664227895af6bea
MD5 2e73c3d3dd566bc5ca63c544607d5965
SHA1 d9913a992d4a881c2b69356a84c5dd8bb5f18950
SHA512 5546f2a2f97b6069b31ddb414f1afbe9da089273c706f6165081203c4c18e576dfd1821b3eed9b391b7812d16b70ee35337644d2f49f2e356c6db1c2b1e9df95
SSDEEP 768:vh8Uyi1qFsK0tFpGcm+uehCARCTq/8DNbSbpbMbc:viHFsK0t/hCAv
TLSH
T1C5D20044EB2E913FD42912BBDCA557002F79B88A99092F573B4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 eaef04ba43c8108a13c43478213072c4b6b528f6bd869d1a3db61b20dd22c425
MD5 082f6d8be0b1477eaffe47b26395eefd
SHA1 180f94a220e14c8ee9e71fc2c7674535d7c19efa
SHA512 243caa9bd8645342a7332143b75c2d93a36976a98443caa2046c8b40a20da7b44565851ba037d9fb74464e1532ff140f71f28784205db8117c8ea2e2ce4f93aa
SSDEEP 768:4XZj+tghGcm+uTN1rBy4KPg5Zq/8jIbwbibLbMb2t1gh8UyC:4XZj+tzNhBy46IiC
TLSH
T117E20044EB2E953FD42812BBDCA547002F79B88A99192F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 36KB
SHA256 9ad0e5cebda600c5bb61287a7fd95f9f8c950cdcbabdabf0e93273bb60a402c9
MD5 378298e6563f4a41263c82682f51b7cd
SHA1 d5605417d8db316dbbd84f444cff720634e8deef
SHA512 99f6d7262ac0c1f4b5573ada9b9450215a31d0003e7324673039a4c3e358d80d3409fd493064508a65996c95daa14816e43de78e33878ad535ab09275668ffda
SSDEEP 768:CoCQ+/wV/H7Gcm+uHSCeOyHdKiqVCZrPZME/8yHblbXbZbLbqbSbhbzbFbZ4CXwt:CoCQ+/wV/0S1HdF4CXJZC
TLSH
T1D1F20F44EB1E913FD42912BBDCA507002F79F88A99192FA73A5C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
Size 1KB
SHA256 217e7459cd8c64c75863ea70adaa32172ec41b02a641aabddc60110525757ad4
MD5 ce2ba858e8b97dd3316da1498b813c9e
SHA1 234644848b419c940c59547dbb9b8f56ee90464b
SHA512 55a586c488a5cc217a0147a46936c3562fe2e5a54e63d77852527bf45d3f88bc97048a748b352d4cc42c411921a5992b2cffdfae8039f5068b5632a67bce5518
TLSH
T10A21499C39B94D2AD8C7F39CB442028E533A8E4744871D934D52EF8DCE91AD9326A438
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
Size 5KB
SHA256 a8291ed65019fa1e30f8a9307ccb9fee9ce0860a6d69b45b8c3f8c39a07aae20
MD5 1c50d8d444f9c4056374ee98b8b47717
SHA1 cd23b8b069a76b6bef7ebe885fe1d2bbe1690a91
SHA512 e3a852c166997f5d4f9caebbac24cf59779e0e0ef8a52873ddffdc17daeaae32ae78a9ec77add1923170a72d0e3688cc542e1f127880cd19301f076ab2b429ee
SSDEEP 48:YrdjbYsOoavoSc/ScFh0UK+i/ao3OoCS0ZFXXqZqvCjyvNI35synpzl3+p+xi/Wb:WYo1h03yS+xx9WBJG+/YBNg4vd0
TLSH
T106B1105C21B90C7EA9DBD3ADF847028D43EA4702C4871D874CDAEF49CD9AA99325F439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1006aaca-df05-4fb3-a71f-58e8165591c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\1006aaca-df05-4fb3-a71f-58e8165591c4
Size 2KB
SHA256 aefc4962b1cbdad2e9f9df420e37dd5523f2191fb5029c02671b09ff4ec811c1
MD5 70dbce812f896f3bee47875930784354
SHA1 1c36bd698a2f48a2feff17b31e9cfcbcebd10fc1
SHA512 ce6c9af1a0aac2ed65ed27a173ffd5421699ee3e422bbcf21c480c717a1b08ad0e45b88c5f02a1d3ef0905fd5dbc9c8f604cad323689d61627c7907af3609033
TLSH
T14D41415C35789D769CDBF25D9481338A8360890350C36C832D41EF0CCDA76AE636B82F
MD5 SHA1 SHA512 TLSH

Submit Download

20c99b87-b3c7-4ada-bb43-59c58e4c6d4c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\20c99b87-b3c7-4ada-bb43-59c58e4c6d4c
Size 235B
SHA256 9a3bf426f12022a3da20bc9075551b5e4bf42d7bf3b0b00128c13e57abcb1a08
MD5 ed4c7cb4465d60ae5b3d0b534bb5a4cf
SHA1 42fdc5498dae61ad55df366143c818d9f42aabf3
SHA512 b49c410c32e81258b0db372a5b6dee390151f3ed795bd3b64e8c83e9729e816b7d8b79e2e8e33d904e4ebe62549a375ec931b34831e69eaf59b9ae4e93032d86
TLSH
T1F6D0979024883B2D48300F1BB0A0AACA30888C3314745C21DAA2B9B89AFD9C81151857
MD5 SHA1 SHA512 TLSH

Submit Download

53e9881a-6718-4564-a889-733b76338314

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\53e9881a-6718-4564-a889-733b76338314
Size 235B
SHA256 ed6d28d96213b8a9523b402f88c33e407222d7a36031b78a667d6f52b1111d10
MD5 814a5e2145649b1238f615e926eb5ea1
SHA1 fd3e4fdc363d71ad295caecdc3e58788e2874f10
SHA512 e2693333fceeb38276a8114270e870a14f73f266d8d302d9e0ff2a53ba892c75a53689a54a6070c4fd7e6619300501978b8a186fce2956d07da8fe8354e4e632
TLSH
T178D0238514C87B2C08200F03F0F028C370684C3720B09C70D75000B88AFEEC84352C3B
MD5 SHA1 SHA512 TLSH

Submit Download

5cc75239-5949-4d39-a544-a01287e9ad02

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\5cc75239-5949-4d39-a544-a01287e9ad02
Size 886B
SHA256 1efefe87ff530c293c66f8ac0e91fc3c40523ff3b7c40270e53ebe3d6f9a3238
MD5 68a85b1405132f310e0e410f4babfc66
SHA1 c322dc1827503b7f0b05818ea6c225fe57e7d478
SHA512 b9fbfe6d152618e087e2dcb8327aaeb5fa222b8889e9e7105fde3c02535006cbc0df3fab698e43fdbd35374437ee965011a0349cced66a41a50ca65bcfa8378a
TLSH
T18D110040C678B6B2CD79D25BD8E43B428AD47423C1CA18047EA45A084DBA11FDBABA0B
MD5 SHA1 SHA512 TLSH

Submit Download

70b23ca2-89fa-4270-bf5d-57b94c203fc2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\70b23ca2-89fa-4270-bf5d-57b94c203fc2
Size 871B
SHA256 fa55489a1fdb80864f40c27eecb87209f6eb80e0761dc59f20561fed3cd925f6
MD5 c01801e3e7894f470757b877ad6c28a5
SHA1 5fedace32d53f0ce1bce20baa62fa16bcb890398
SHA512 337535b636dcea0affb5683d7823936e5747213b9e1b5e36e7596e2fdb6f021042b4888238f3b64fca38ae35efd9f18a300c0ad33963ea2462be7911f8115ced
TLSH
T10711C041C734F5B2DD78934BC9A53B568BE8A41380CA54043DB45A084E7E51EE7AA64B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\extensions.json
Size 16KB
SHA256 3d5d43fa47e669a52864a69765957e4572def9e73584476823c155c2638f5e52
MD5 873c16048a6a6b8cd6007d480e62db10
SHA1 2a3fd98c70607ea58cca5f00267ca3984e924dd7
SHA512 82f550b3032b52b7950a9501b5123a76e1c6acd9602ba583d6803625336c735baa88651c285ce5cfef4089d6d4f0528bdbcf06762ac5afc820ed34730bcabc95
SSDEEP 384:UkI4v2UmldvR8dhWZk94zP96ohL4H8L4PtL4H2L4HxL4HNK94hTo+:7I4eRfiXi+4Z6C424l4c4J4w4P
TLSH
T1C672531545049EB8298FA79BAA367E01C37D473B60845C38F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 10KB
SHA256 0a5b5ee6204a0748a43d4df34424c28004eef25e833759e2964a5566368360b2
MD5 9321884c65b674ca0c9af95c5dce12cc
SHA1 6a484de8c1665ef48da8fc316035d6c2e0447d2e
SHA512 47652b0d22d8ea822883acc42d1e9373f79099178a13b47c9cf1012cbfea5dd5c29665f827fa141594183dd74826d99c98d150f0d0df441b13c669d0c6f4f4b9
SSDEEP 96:xHEG9TUEqGqSvfW5lObzShSSlvdv9judnNWRH3Tem96xTXAtks2OBw88YWOIq6SX:3KRYfW5lbSSFRXnCOBw88YQvdOLM6Ku
TLSH
T19632DA7C5144CB2FA4B3327DAC2649741AB20237B6BF7CD305B99986045CF2441EAAFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 12KB
SHA256 7c958af6d51ebc2f03904da3c060a607b2fb5075e9a4d582ca8963f862b6ab54
MD5 8cda84b0c560569e01f8f0847ed8b8ae
SHA1 58f762e4b669aed3eb38a4e1d76902cf84ff327f
SHA512 4c9d339f8ad0fe51f08e1ea40c6132c9b32f1e45cedbd85db8ee747321c49dadb0c002b7adf8946e5cbcc2d6cdfed764218bd7e2d713131942b8bc8ff13114cc
SSDEEP 384:VwRXswTHj/Khyu8k07HEq0InrLDHGZfUKCt8577W2pmjx4VCQ1ZD7El:aRTHj/Khyu8k07HEq0InrLDHGZfUKC2m
TLSH
T10E52AB7891408B3F65B7327DAC3649A01AB14227F7BFBCD209B98982045CF2441E6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 6KB
SHA256 1a4637ee9255032f33a892dbe6adcaaee3f0c4f8fbbbba229dc6687311fbcebd
MD5 5744422448e61f8c8378f8885e9c83a8
SHA1 04b9be1e358b9b4089fe8fd709ffd5503661f5fd
SHA512 7046cfcbf501c425a02e7d4e1949ebb04829aa73b95c6d7fa433a929fe8d2a146257421662d7fd22ab316fa001f45a49263cf653371b4fd579d4fa13e709f5f7
SSDEEP 96:xHTGUTUEqGqSvfk5l1zS08SSlvdv9jzVqnNHKm9fBw88u8L4cn5VPB:oHRYfk5lF8SSlVs35Bw88vT
TLSH
T19AE1207855088B7F74B677ACAC688D315AB2413BB7BF68C610BA5484015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 dff3d892368a07a82bb302562e4b387cb1651abf8a7b73b9f0ddee28a7a5097a
MD5 e4b1093ca57cc7c3c592849fce9ba8c1
SHA1 f736dbe7e685674434c39ab8bfad43f2fbb04b08
SHA512 a31058da44c963ea57cf184ff1ebe4458c422685c5fd070c73c1a98be567194500c04f39eca95f20c6e4d0e91b6732388603cbbe860db01204a27bfad242e426
SSDEEP 96:xHTGUTUEqGqSvfklN1zS08SSlvdv9jzVqnNHKm9fBw88u8L4cn5VPB:oHRYfklNF8SSlVs35Bw88vT
TLSH
T1F7E1207895088B7F74B677ACAC688C315AB2413B77BF68C610B65484014CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 3f20f2e00b9d6f6d0b7f6c68bbe561122e434bbf96fb3755f4e302f3b4aa5112
MD5 4d7f6ef7bc814de7fe25d998df4b397f
SHA1 9e3cf0a41aa1aa023fe9a99855e721642ba6e412
SHA512 3dceb241406e7fddfd0824b2dea5326a2e295016213efa6db2472b6919bba7d3ae2b4e25119ec180c1af43fef794926dfc3b7ac0d931d778c0edb7f0a2c42a08
SSDEEP 96:xHTGUTUEqGqSvfk5l1zShSSlvdv9judnNHKm9fBw88u8L4cn5VPB:oHRYfk5lMSSw35Bw88vT
TLSH
T134E1207855088B7F74B6776CAC688C316AB2413B77BF28C710BA5485011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 7KB
SHA256 60387fba4ac0be3adea6bb46256f27c46a356e75e3bbba72d5ec621e1955a953
MD5 3a6b5e3b0823a424727e01720223d262
SHA1 ac5c1e7f449b3f07583005a4098c1895fd76ec87
SHA512 a0eb63231a7ec14b1a27103b158218d14d469c0a609d114ebfbbc9a1a7e95c0362d65f962021a38f4757e394a3612ede647187ec2dbccc97e0170b0674e3650d
SSDEEP 96:xHTGUTUEqGqSvfk5lObzShSSlvdv9judnNHKm9fBw88u8L4cn5VPcGS:oHRYfk5lbSSw35Bw88vE
TLSH
T1E7E1307895088B7F74B677ACAC6888315AB2413B7BBF28C710B954C5011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 7KB
SHA256 b67bfd96ad166f5f655e988117b6087ebbc3d3cf17b4c8eb977ab99ac5e25d21
MD5 62a4200b8314408b93b1f513bb4e3331
SHA1 413a1525e49b848018325febc425245d040d6337
SHA512 98eac4955dd81aa3bf2aa1c3cf40bb1767eb0f72ad2e65597c10a769c5ea18f7de83d87817db4c291f1b28944d797301c0c351b97041945e036d1727a5b4af69
SSDEEP 96:xHTG9TUEqGqSvfW5lObzShSSlvdv9judnNHKm9fBw88KY48L4cn5VZcGS:oKRYfW5lbSSw35Bw88Lu
TLSH
T15EF10E785108CB7FA4B277BCAC6849305AB2013BB7BF68D610B944C5011CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.jsonlz4
Size 887B
SHA256 ab4243530661220b9709a4beab3c23c28d7bfa432673bb1e37fe84280d94f2ca
MD5 4d137419a7ae860cfd12e47bd2a5f577
SHA1 92449883b598eef8c0552d2f77061c78e99fd470
SHA512 f7fecbb340cf5056071fc5cb0fceeef0fd1da834962bc13da740777d9f8683d4ec31d4f12b32f138dd3ab2b0788bd250527a8a7f74cbe153996ff9208c664d10
TLSH
T1B4119681AE4651B39A50B02FA0CEDFFE8FCA503606771824E24DA70001683DEB5AF308
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 13.9MB
SHA256 7a760cc9c4d06894bfee644ea2168777cbbe2f6df653e05cbdf05f1ebd62aad6
MD5 be116b897e5c75043e9e3610657312b7
SHA1 34225e5c55e7bd0c16408e9b8fbad4f8e51c1b87
SHA512 08f56bc13aa905eff8b3d65c971ae60c53b6b4e68bb5aadfb0f8dbeadd561500186ecf0610b25c6dcd765e0c89f6ba2ccac755d58e715932a940270a41c9e4de
SSDEEP 49152:nZdqiU2/aeUT6QC5zYYbVIOWtH1w6ek+k6wEK6vMd1RWOB9kiXDYN5CznmqMv0kG:9S2qmqeFRapAxKrlr8M0mh
TLSH
T1CBE63A9270E0D692EB0186F2B31F43EB317FC1DC20E589941678B65C596329BEE6F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KCYRKIb5.zip.part

Path C:\Users\Admin\Downloads\KCYRKIb5.zip.part
Size 4KB
SHA256 f654a7c1b8b971befb48b98db93af49be0db65cc8dcf2b0a84b2f3fa72d470cc
MD5 524f6a0598a51f36484a5f673c3cdf42
SHA1 0aec804e04b849ea8d6aeecfed79539aba45f999
SHA512 7c01aea94a30f0dd566b9ce7a9587bdfbf5009e329ff1e9b7e2839380f0b56e8f140e3190acf279e72d0fe0e993124c29cf9a5bd83d97f42d2a899c50a772b6a
SSDEEP 96:JMHTB6Oiz8os9lMsitylQGHeVelY5jKyug8Y:JslC8oYaZtyGL5WyuBY
TLSH
T18B816D242D9795FBE01E01BDF34E3B7A4C64B3013D2F83449D3361D1D94BA18506A2E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-11-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1188-12-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1188-15-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1188-14-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1188-10-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1188-9-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1188-8-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1188-7-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1188-6-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1188-5-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1188-4-0x0000019CFAA40000-0x0000019CFAA62000-memory.dmp

Download

memory/1188-3-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1188-0-0x00007FFBE067F000-0x00007FFBE0680000-memory.dmp

Download