Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    850s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 20:24

General

  • Target
    net8.0-windows/System.Management.dll
  • Size 72KB
  • Sample260802-y6scqsfc68
  • SHA256 f515ca5c944c332ab706ff0a7c2e53e66d0d9d8a663e9b2691b35129ee22559b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 3 IoCs
  • Checks processor information in registry 2 TTPs 19 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\net8.0-windows\System.Management.dll,#1
    1⤵
      PID:4632
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4368
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4332
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1924 -prefsLen 27097 -prefMapHandle 1928 -prefMapSize 270279 -ipcHandle 2012 -initialChannelId {9e78e97f-f649-4658-8833-79c83dba094d} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          3⤵
            PID:244
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2396 -prefsLen 27133 -prefMapHandle 2400 -prefMapSize 270279 -ipcHandle 2408 -initialChannelId {a22bba73-d434-48c8-aedb-237720468ba6} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            3⤵
              PID:1516
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 27274 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {00208527-9e0c-48ef-93f2-2544d7a36840} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
              3⤵
              • Checks processor information in registry
              PID:5968
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27274 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {d418d6fb-bd3d-4641-aa30-c7f8b39f61ad} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
              3⤵
                PID:3500
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2704 -prefsLen 34773 -prefMapHandle 4484 -prefMapSize 270279 -jsInitHandle 4488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4496 -initialChannelId {6ea3ece7-07e3-492c-a7d9-e7f3f1bd157d} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                3⤵
                • Checks processor information in registry
                PID:5136
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2796 -prefsLen 35010 -prefMapHandle 2800 -prefMapSize 270279 -ipcHandle 2816 -initialChannelId {92ed71e1-c1bc-4d9e-b8d3-5547f3dcfb58} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                3⤵
                • Checks processor information in registry
                PID:4264
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32952 -prefMapHandle 1604 -prefMapSize 270279 -jsInitHandle 1596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5536 -initialChannelId {be7b2433-1c97-433f-aa45-f63dab914584} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                3⤵
                • Checks processor information in registry
                PID:3380
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5712 -prefsLen 32952 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1612 -initialChannelId {073f0db3-85f9-47d4-8723-4a41f9b6bb05} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                3⤵
                • Checks processor information in registry
                PID:4224
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5736 -prefsLen 32952 -prefMapHandle 5740 -prefMapSize 270279 -jsInitHandle 5744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5752 -initialChannelId {e9074024-d61d-4809-95bf-d5bd7a09ea5b} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                3⤵
                • Checks processor information in registry
                PID:5040
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            1⤵
              PID:1580
            • C:\Windows\System32\SecurityHealthHost.exe
              \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
              1⤵
                PID:5880

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    activity-stream.discovery_stream.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\activity-stream.discovery_stream.json
                    • Size 76KB
                    • SHA256 3e75f1ae55e55c3551fb2a9ef18deb454b488b6289e1d898000bf941ab166f57
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                    • Size 16KB
                    • SHA256 755b6ed3098dace8865aad188ed1ab5de74504fcb8f27dbb1f78a0b1815cce2c
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_arts_and_entertainment.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                    • Size 67KB
                    • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_autos_and_vehicles.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                    • Size 44KB
                    • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_beauty_and_fitness.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                    • Size 33KB
                    • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_blogging_resources_and_services.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                    • Size 33KB
                    • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_books_and_literature.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                    • Size 67KB
                    • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_business_and_industrial.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                    • Size 45KB
                    • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_computers_and_electronics.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                    • Size 45KB
                    • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_finance.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_finance.json
                    • Size 33KB
                    • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_food_and_drink.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                    • Size 67KB
                    • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_games.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_games.json
                    • Size 44KB
                    • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_health.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_health.json
                    • Size 33KB
                    • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_hobbies_and_leisure.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                    • Size 67KB
                    • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_home_and_garden.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                    • Size 33KB
                    • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_internet_and_telecom.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                    • Size 67KB
                    • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_jobs_and_education.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                    • Size 33KB
                    • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_law_and_government.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                    • Size 68KB
                    • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_online_communities.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                    • Size 67KB
                    • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_people_and_society.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                    • Size 45KB
                    • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_pets_and_animals.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                    • Size 44KB
                    • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_real_estate.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                    • Size 67KB
                    • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_reference.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_reference.json
                    • Size 56KB
                    • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_science.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_science.json
                    • Size 56KB
                    • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_shopping.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_shopping.json
                    • Size 67KB
                    • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_sports.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_sports.json
                    • Size 56KB
                    • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    nb_model_build_attachment_travel.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_travel.json
                    • Size 67KB
                    • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    recipe_attachment.json

                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\recipe_attachment.json
                    • Size 1KB
                    • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                    • MD5 SHA1 SHA512 TLSH

                    63900390-0825-4518-b039-235c567dea4d.zip

                    • Path C:\Users\Admin\AppData\Local\Temp\63900390-0825-4518-b039-235c567dea4d.zip
                    • Size 3.7MB
                    • SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    remote-settings-startup-bundle-

                    • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                    • Size 549KB
                    • SHA256 1a9b181c03212cfad281dbbc2ee10b3bbc52edf4b2d36af09616e949ad2a96c5
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    tmpaddon

                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 11KB
                    • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    tmpaddon

                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 502KB
                    • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    6824f4a902c78fbd.customDestinations-ms

                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                    • Size 5KB
                    • SHA256 f35d0f9a85a5f36a22503f1133bccbe318af7a19080220c110e134e2baf43b9c
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    bookmarks-2026-08-02_10_PEoONBWmVZTLFqvOVvV6_NHofMeFp-yq9Lu8HXebQSw=.jsonlz4

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\bookmarkbackups\bookmarks-2026-08-02_10_PEoONBWmVZTLFqvOVvV6_NHofMeFp-yq9Lu8HXebQSw=.jsonlz4
                    • Size 856B
                    • SHA256 e3c5ed0ca0bc76dc6b39abd95b1db22be4a3f635312c9b45b0a0afc5ce29489a
                    • MD5 SHA1 SHA512 TLSH

                    data.safe.tmp

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 6KB
                    • SHA256 a39054fb39532e8bf3a2d9c74e70d699c5bdd1a1148d21da6369cc491f1a6e27
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    data.safe.tmp

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 7KB
                    • SHA256 0232d9032b707d7332879feaeef158a03f8ca1968bfac47d7e7389dd48f2eb88
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    data.safe.tmp

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 37KB
                    • SHA256 a4bf2ade9eb298081318b45cdde1b78ce599caf24feea31b8ec283d0a7a21f19
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    data.safe.tmp

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 37KB
                    • SHA256 1d1a419a17fb3111ba624b2ee520885a683c0d67594164a8c08b94199f0e9b72
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    data.safe.tmp

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 37KB
                    • SHA256 37412cf546e20e191375e2edd1ef13061d079b6c5772383fd7331841fb3cdba9
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    data.safe.tmp

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 37KB
                    • SHA256 80e71218025e4d2cb51110f7cbfe8dbb82f9c3ba79d9fdbf425e33256be99b68
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    events

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
                    • Size 1KB
                    • SHA256 779d50586effc2a2b805656171ff4dece54424ab519f8567743bbd1546d24705
                    • MD5 SHA1 SHA512 TLSH

                    20a3eb14-f9e7-40bc-9717-2be83774198c

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\20a3eb14-f9e7-40bc-9717-2be83774198c
                    • Size 235B
                    • SHA256 b028857679ffb8a6806662e85e3f2d9eda3cfd19c10510d218b380ba47029adf
                    • MD5 SHA1 SHA512 TLSH

                    21d4418b-0472-4421-9218-aa024503cbdc

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\21d4418b-0472-4421-9218-aa024503cbdc
                    • Size 883B
                    • SHA256 8ad4fc9f9d77d6696b0d41c637dae229765ae000422eff2abaf17530c1206d5f
                    • MD5 SHA1 SHA512 TLSH

                    5081e0ed-638b-46f7-aef1-cb8307facbe4

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\5081e0ed-638b-46f7-aef1-cb8307facbe4
                    • Size 16KB
                    • SHA256 b9a24df07876a8022dc571455923adec63a4597e911e96824e51d7f9d5449d08
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    5ec2560c-5494-42f9-a6f0-e41a64f7c561

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\5ec2560c-5494-42f9-a6f0-e41a64f7c561
                    • Size 235B
                    • SHA256 8bc4f8224011ac693b4ae09f9c1bf2f4ac61ca965bac1409d75dca3a2db8b9d0
                    • MD5 SHA1 SHA512 TLSH

                    bf06683a-7db8-4fd5-9697-93c337020cd4

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\bf06683a-7db8-4fd5-9697-93c337020cd4
                    • Size 2KB
                    • SHA256 d51ba51ab9c742ab6bfb1b8c96516ab4cfc5c5936be4e471302da86d8ece0e1d
                    • MD5 SHA1 SHA512 TLSH

                    df9692ed-b4aa-4b4a-a742-e887e59fd563

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\df9692ed-b4aa-4b4a-a742-e887e59fd563
                    • Size 886B
                    • SHA256 97df73ed439e50c0159ede4e49c4165af4488d9f8e83c0f18034f7757827792b
                    • MD5 SHA1 SHA512 TLSH

                    extensions.json

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\extensions.json
                    • Size 16KB
                    • SHA256 1e643e0f44fea48b20af451a9c2e9ff6070d78de0339da9d92f635c4ad8632bf
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    gmpopenh264.dll

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                    • Size 1.1MB
                    • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    gmpopenh264.info

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                    • Size 116B
                    • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                    • MD5 SHA1 SHA512 TLSH

                    manifest.json

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                    • Size 1002B
                    • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                    • MD5 SHA1 SHA512 TLSH

                    widevinecdm.dll

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                    • Size 21.6MB
                    • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    prefs-1.js

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
                    • Size 7KB
                    • SHA256 1429183d375ea5ff3ed68aed48e1acc5f03285265ea95e67570de21dd236a812
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    prefs-1.js

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
                    • Size 9KB
                    • SHA256 a62f4384809522afc723f6008f5ad8a0f6b7dd933c00c583a815551d94439b86
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    prefs.js

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
                    • Size 6KB
                    • SHA256 56fb62e7a5334aaa0282763149d4925394082a939fd89c7714be460623a176c1
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    prefs.js

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
                    • Size 8KB
                    • SHA256 2a3daac3c5f7d50aba767f4574b81768b4af104692658eb922fb4da998afc290
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    prefs.js

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
                    • Size 6KB
                    • SHA256 bd2e8d85f4527243e6e35dc886b16fec3e7792edbf106d70087bc9fe5004970f
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    recovery.jsonlz4

                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore-backups\recovery.jsonlz4
                    • Size 1KB
                    • SHA256 ba787d07259de5313ba07a7a444d73e2005437aec523a06d95ab6723f21a7538
                    • MD5 SHA1 SHA512 TLSH