Analysis

  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    895s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/08/2026, 00:29

General

  • Target
    https://hirxs-workshop.net
  • Sample260804-as2r9aaa98
Score
6/10

Malware Config

Signatures

  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 3 IoCs
  • Checks processor information in registry 2 TTPs 28 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://hirxs-workshop.net"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:424
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://hirxs-workshop.net
      2⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4944
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {c3bf0eca-e308-4a62-8446-ef7294d1f262} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:2476
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2276 -initialChannelId {57c42ed9-9228-420d-923b-b1ca10b1fc10} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:568
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3688 -prefsLen 25164 -prefMapHandle 3692 -prefMapSize 270279 -jsInitHandle 3696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3704 -initialChannelId {49872d85-f6e5-4765-b865-ff13c013b955} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:1804
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3852 -prefsLen 27274 -prefMapHandle 3856 -prefMapSize 270279 -ipcHandle 3928 -initialChannelId {254701da-149c-4803-ac58-677df31c4374} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:6088
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2960 -prefsLen 34773 -prefMapHandle 2780 -prefMapSize 270279 -jsInitHandle 2964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3636 -initialChannelId {664e4e86-3a89-4f3f-adef-fbb210343842} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:6068
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3140 -prefsLen 35010 -prefMapHandle 4280 -prefMapSize 270279 -ipcHandle 4356 -initialChannelId {c91b8381-ce4b-4e04-a685-0c126c96cdab} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:2220
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1680 -prefsLen 32952 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {68275d82-aa26-4861-9fea-ee6e7ea18689} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:4848
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 32952 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 5688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5696 -initialChannelId {a7cd1014-84d4-497c-ac38-0835d03fe6f1} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:1692
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5868 -prefsLen 32952 -prefMapHandle 5872 -prefMapSize 270279 -jsInitHandle 5876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5884 -initialChannelId {85d5cc4e-24c2-442d-9af2-4b2c67144a0b} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:2576
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5912 -prefsLen 32952 -prefMapHandle 5900 -prefMapSize 270279 -jsInitHandle 6000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6076 -initialChannelId {6fadc674-984c-431d-bd74-0d94e5cc438d} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
              3⤵
              • Checks processor information in registry
              PID:2960
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32952 -prefMapHandle 5672 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6052 -initialChannelId {eabeabaf-c845-4ead-a6a6-bbe7e60235cf} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
              3⤵
              • Checks processor information in registry
              PID:2332
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5872 -prefsLen 32952 -prefMapHandle 5656 -prefMapSize 270279 -jsInitHandle 5644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5672 -initialChannelId {7adb8cb3-dc76-452d-a74d-1932109be395} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
              3⤵
              • Checks processor information in registry
              PID:5308
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6548 -prefsLen 35062 -prefMapHandle 6628 -prefMapSize 270279 -ipcHandle 6636 -initialChannelId {18e07ff5-0869-4199-b1b3-060c6f41a234} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
              3⤵
              • Checks processor information in registry
              PID:3316
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6620 -prefsLen 35079 -prefMapHandle 4676 -prefMapSize 270279 -ipcHandle 6588 -initialChannelId {3e13f13f-578f-4e03-a2dd-65fcca26e363} -parentPid 4944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
              3⤵
              • Checks processor information in registry
              PID:668

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              activity-stream.discovery_stream.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\activity-stream.discovery_stream.json
              • Size 76KB
              • SHA256 6f788f7649f9a6ff5ffcb5a9359ead28640d188ad5f7993cb40dbf484add140a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
              • Size 16KB
              • SHA256 b54e3258390f19ca8a3e8812b2b0d460db63a496b897f341409edf63d4d0c511
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_arts_and_entertainment.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
              • Size 67KB
              • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_autos_and_vehicles.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
              • Size 44KB
              • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_beauty_and_fitness.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
              • Size 33KB
              • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_blogging_resources_and_services.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
              • Size 33KB
              • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_books_and_literature.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
              • Size 67KB
              • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_business_and_industrial.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
              • Size 45KB
              • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_computers_and_electronics.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
              • Size 45KB
              • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_finance.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_finance.json
              • Size 33KB
              • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_food_and_drink.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
              • Size 67KB
              • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_games.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_games.json
              • Size 44KB
              • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_health.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_health.json
              • Size 33KB
              • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_hobbies_and_leisure.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
              • Size 67KB
              • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_home_and_garden.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
              • Size 33KB
              • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_internet_and_telecom.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
              • Size 67KB
              • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_jobs_and_education.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
              • Size 33KB
              • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_law_and_government.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
              • Size 68KB
              • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_online_communities.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_online_communities.json
              • Size 67KB
              • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_people_and_society.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
              • Size 45KB
              • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_pets_and_animals.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
              • Size 44KB
              • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_real_estate.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_real_estate.json
              • Size 67KB
              • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_reference.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_reference.json
              • Size 56KB
              • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_science.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_science.json
              • Size 56KB
              • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_shopping.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_shopping.json
              • Size 67KB
              • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_sports.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_sports.json
              • Size 56KB
              • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_travel.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\nb_model_build_attachment_travel.json
              • Size 67KB
              • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recipe_attachment.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\personality-provider\recipe_attachment.json
              • Size 1KB
              • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
              • MD5 SHA1 SHA512 TLSH

              webext.sc.lz4

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\startupCache\webext.sc.lz4
              • Size 105KB
              • SHA256 16b4a9fa6995edfc73222abcba400b8c89f805ef0d18d345c171235991abd745
              • MD5 SHA1 SHA512 SSDEEP TLSH

              7fc7fe86-b0cd-4c56-870a-59d8391d4712.zip

              • Path C:\Users\Admin\AppData\Local\Temp\7fc7fe86-b0cd-4c56-870a-59d8391d4712.zip
              • Size 3.7MB
              • SHA256 5294294bc8f81626cad76fa46c1fdec8df4f6d7a05576adfecbaa571149f3daa
              • MD5 SHA1 SHA512 SSDEEP TLSH

              remote-settings-startup-bundle-

              • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
              • Size 549KB
              • SHA256 b609fc4417f0caf46180210cd6d5926a79bea001e60cee165629180c896fadff
              • MD5 SHA1 SHA512 SSDEEP TLSH

              tmpaddon

              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 502KB
              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
              • MD5 SHA1 SHA512 SSDEEP TLSH

              tmpaddon

              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 11KB
              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
              • MD5 SHA1 SHA512 SSDEEP TLSH

              FCWM5B0QEVL47G4XXX7M.temp

              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FCWM5B0QEVL47G4XXX7M.temp
              • Size 7KB
              • SHA256 b368babcdbd7d2da76646b0b8fdc41b2263140b21441e8d7909b193428b17aa1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              AlternateServices.bin

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\AlternateServices.bin
              • Size 21KB
              • SHA256 6bad54b5d2d77f5b19c49405a5d92deeab950024b733ed59b2dd596ea1a07121
              • MD5 SHA1 SHA512 SSDEEP TLSH

              AlternateServices.bin

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\AlternateServices.bin
              • Size 10KB
              • SHA256 b4b6e8187ac1b322c84a58e919fbcb08ada19ad2dede28bfa7f56a5bd982ae7d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              AlternateServices.bin

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\AlternateServices.bin
              • Size 16KB
              • SHA256 75f0699eb7778f48201b73734a88bedc5a60f01b013aedc17cca5cfbd368403d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              AlternateServices.bin

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\AlternateServices.bin
              • Size 21KB
              • SHA256 ed220ca7e30afc33191ade6644132953b35a557e9a2acecaef0f9baabd602600
              • MD5 SHA1 SHA512 SSDEEP TLSH

              AlternateServices.bin

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\AlternateServices.bin
              • Size 21KB
              • SHA256 0dd81567cb083a9418c92d550e2504403c9846809e7ab621ea1964af350b89b6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              addonStartup.json.lz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\addonStartup.json.lz4
              • Size 4KB
              • SHA256 6fe56668b3682522125f02f1d1d3e263c946eacf38542e66870054fcd40b1ae4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              bookmarks-2026-08-04_10_hOoLeizBieVMWEDUaP7pPIliPTh_MzPbOjRCaI5fjNI=.jsonlz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\bookmarkbackups\bookmarks-2026-08-04_10_hOoLeizBieVMWEDUaP7pPIliPTh_MzPbOjRCaI5fjNI=.jsonlz4
              • Size 856B
              • SHA256 6f2501ba48e548b0b87d414cbf7bc9e80e656fbe38b3df2e63ea5687afb24c75
              • MD5 SHA1 SHA512 TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
              • Size 35KB
              • SHA256 23317496619be81aee9345d436989c96ab452748a29656a793cc16d9ba5e82fe
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
              • Size 35KB
              • SHA256 00df8f320a976e9792dad9039e1faf4efd48169a690d72d2b749b70089863095
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
              • Size 6KB
              • SHA256 982524428a2dd7bd67bd9288af44cdc0821925f33c374895f4d63cff0453e21e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
              • Size 35KB
              • SHA256 a4348a531932c124a0b56065d04ed0d0c2c4a611028e50fafdf0b5e5f31de0d3
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
              • Size 5KB
              • SHA256 dbf66bb7ce5359795863211e4deb07a22039b837e3094b68869dd98c2c95ab59
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
              • Size 7KB
              • SHA256 ec0c7366d80818b8b62a2d8e4679d7ca3835d3519ac3203eb5f487b0d97d41c7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              events

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\events\events
              • Size 1KB
              • SHA256 9d8b19fdc2ed9d0d3228402dc75b52ed5e0ee91d4a9c60ccdb250d9cc68ffc1f
              • MD5 SHA1 SHA512 TLSH

              0bffb067-9d72-4e2a-b9a1-0cd7930df4b8

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\0bffb067-9d72-4e2a-b9a1-0cd7930df4b8
              • Size 235B
              • SHA256 8d8fa5d7171e4516cd6e09ef65e159538ea8e0f9944b519ef8f7d8813fd2ae94
              • MD5 SHA1 SHA512 TLSH

              4697916b-cb89-46c4-81ad-33d72e4e5c49

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\4697916b-cb89-46c4-81ad-33d72e4e5c49
              • Size 931B
              • SHA256 de8f335d760ffa1ef4a05bc72bdf5fd5fd59b260efe380d026e22a7a352a37eb
              • MD5 SHA1 SHA512 TLSH

              653b4e6d-1035-4eb5-9fff-9bdda8ec8b27

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\653b4e6d-1035-4eb5-9fff-9bdda8ec8b27
              • Size 280B
              • SHA256 f97db290c56c1b85ae771425fcc62110e18ed08acbdb6a14f461bb7e91e228a3
              • MD5 SHA1 SHA512 TLSH

              6c3616f4-4ad3-4934-870a-95af70d6fe50

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\6c3616f4-4ad3-4934-870a-95af70d6fe50
              • Size 871B
              • SHA256 78b0e25bc56b03db3e6d0c91645b14768f614815cf62c5e84615ded9749c58ed
              • MD5 SHA1 SHA512 TLSH

              f9654bfd-f027-4e7f-82e9-049dfa54b35f

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\f9654bfd-f027-4e7f-82e9-049dfa54b35f
              • Size 2KB
              • SHA256 d9091482589028283ae072b2afbd9766cc38bd0b63a706e9d1293595b7c85379
              • MD5 SHA1 SHA512 TLSH

              extension-preferences.json

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\extension-preferences.json
              • Size 942B
              • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
              • MD5 SHA1 SHA512 TLSH

              extensions.json

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\extensions.json
              • Size 16KB
              • SHA256 5117308413ad635944cb86d04305ca7d92c2f3de463f690311afbfa2c929f66c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              gmpopenh264.dll

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
              • Size 1.1MB
              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
              • MD5 SHA1 SHA512 SSDEEP TLSH

              gmpopenh264.info

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
              • Size 116B
              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
              • Size 1002B
              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
              • MD5 SHA1 SHA512 TLSH

              widevinecdm.dll

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
              • Size 21.6MB
              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs-1.js
              • Size 12KB
              • SHA256 e2e2fd0cdc07dfdc24ee63697db3b46b7db9121821bcc23b10f7c311deb5bffd
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs-1.js
              • Size 7KB
              • SHA256 78aa54d39a9f888ccbdcb530bc4f9d5cd5c2cc7a9e5aaf68d144b2f7429b7919
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs-1.js
              • Size 12KB
              • SHA256 a2f73d6643b47fa5752fc5ec27ba0baafd2771249555a0bf9355c1374c08b085
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs-1.js
              • Size 6KB
              • SHA256 5f205f7982a33d437dc6bcc0c8236ec568e899a272d3ac2a60a766f922241a09
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs-1.js
              • Size 6KB
              • SHA256 7c3ed281c5ecb7b24498ff4baadb4a7777a43837649b252b4a91391d4325cdcd
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
              • Size 6KB
              • SHA256 b4232815df7436a474b58bd3380927b47867b54db7718fc12e547101005d12e4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\sessionstore-backups\recovery.baklz4
              • Size 10KB
              • SHA256 03f2ec689817b7075a79a8a303331492729d6bb5a419518530c979150965d371
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recovery.jsonlz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\sessionstore-backups\recovery.jsonlz4
              • Size 10KB
              • SHA256 6da21cd41e81ffd822f08c5d31189cd6a96a2785b71f50f4c9adfc2d59948292
              • MD5 SHA1 SHA512 SSDEEP TLSH

              2926346687feisraebbaatsaed--hte.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\storage\default\https+++hirxs-workshop.net\idb\2926346687feisraebbaatsaed--hte.sqlite
              • Size 48KB
              • SHA256 fede4cd7e8994fa8a33bb5b12dff4520ca4c730cc121acec7ed79501e4479666
              • MD5 SHA1 SHA512 SSDEEP TLSH

              usage

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Chirxs-workshop.net%29\ls\usage
              • Size 12B
              • SHA256 742d84a3e1f1cf37358de170afddfd8f351098be79fa1ef99873781c4bd94a67
              • MD5 SHA1 SHA512

              3870112724rsegmnoittet-es.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 4.5MB
              • SHA256 75cddfd57258a3d61aaf291c24f483606a40094bf6878a6c3f12a939f94d6a74
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3870112724rsegmnoittet-es.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 6.5MB
              • SHA256 264cd61350dbd652adebbf066370fcc5ec8c9fa47f8ab4b762c8dc8dee1d1c24
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3870112724rsegmnoittet-es.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 6.5MB
              • SHA256 4c0f72833bbd08862268fa988d17024e491ac4b588de0b6544c1df208adb9651
              • MD5 SHA1 SHA512 SSDEEP TLSH