Overview

overview

8

Static

static

3

deskreen-c...64.exe

windows10-2004-x64

4

deskreen-c...64.exe

windows11-ltsc_2024-x64

6

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

Deskreen CE.exe

windows10-2004-x64

Deskreen CE.exe

windows11-ltsc_2024-x64

LICENSES.c...m.html

windows10-2004-x64

6

LICENSES.c...m.html

windows11-ltsc_2024-x64

8

d3dcompiler_47.dll

windows10-2004-x64

1

d3dcompiler_47.dll

windows11-ltsc_2024-x64

8

dxcompiler.dll

windows10-2004-x64

1

dxcompiler.dll

windows11-ltsc_2024-x64

1

dxil.dll

windows10-2004-x64

1

dxil.dll

windows11-ltsc_2024-x64

8

ffmpeg.dll

windows10-2004-x64

1

ffmpeg.dll

windows11-ltsc_2024-x64

8

libEGL.dll

windows10-2004-x64

1

libEGL.dll

windows11-ltsc_2024-x64

8

libGLESv2.dll

windows10-2004-x64

1

libGLESv2.dll

windows11-ltsc_2024-x64

8

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-ltsc_2024-x64

8

resources/...tc.dll

windows10-2004-x64

1

resources/...tc.dll

windows11-ltsc_2024-x64

8

resources/...trc.js

windows10-2004-x64

3

resources/...trc.js

windows11-ltsc_2024-x64

3

resources/...eps.js

windows10-2004-x64

3

resources/...eps.js

windows11-ltsc_2024-x64

3

resources/...zip.js

windows10-2004-x64

3

resources/...zip.js

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    900s
  • max time network
    813s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 08:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LICENSES.chromium.html
  • Size 14.6MB
  • Sample260804-kljcfa1wex
  • SHA256 6965e1b04dc81a012981508299e28542abff2bc7f418071c264f0b53e0c63f34
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 19 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
      2⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3736
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 1940 -initialChannelId {acbd71aa-1093-4d69-bc5d-385f84dc5b1d} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:2072
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 27133 -prefMapHandle 2404 -prefMapSize 270279 -ipcHandle 2412 -initialChannelId {6320681f-fc4a-4737-9f9d-ddea8ccf38b0} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:908
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3704 -prefsLen 27274 -prefMapHandle 3708 -prefMapSize 270279 -jsInitHandle 3712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3720 -initialChannelId {fc1409ae-d5a3-4d7a-8de4-94a8dcc6e053} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:5068
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3876 -prefsLen 27274 -prefMapHandle 3880 -prefMapSize 270279 -ipcHandle 3768 -initialChannelId {6d68c6e3-8874-4a32-b4f2-b34b97bb6ad1} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:252
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3076 -prefsLen 34773 -prefMapHandle 3100 -prefMapSize 270279 -jsInitHandle 3104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3064 -initialChannelId {4e0eff80-73ad-4f27-86a6-28da4e502528} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:2540
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5112 -prefsLen 35010 -prefMapHandle 5116 -prefMapSize 270279 -ipcHandle 5124 -initialChannelId {9db2de5b-b196-407c-97d4-59401f055f5b} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:808
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5508 -prefsLen 32952 -prefMapHandle 5460 -prefMapSize 270279 -jsInitHandle 5416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3060 -initialChannelId {c2a6f5cd-539b-4f77-b653-e2a333e329e0} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:4184
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5648 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {77c13d01-5e73-4465-9f14-0c203e23e6fe} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:2836
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5808 -prefsLen 32952 -prefMapHandle 5812 -prefMapSize 270279 -jsInitHandle 5816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5824 -initialChannelId {d570b364-0774-4da1-9a58-edd02a06742e} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:3044
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:4676
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5136
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:3920
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:5328
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3800
          • C:\Windows\System32\SecurityHealthHost.exe
            \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
            1⤵
              PID:4252

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  activity-stream.contile.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\activity-stream.contile.json
                  • Size 5KB
                  • SHA256 70305a754bd19f25ddcfc4b11380e005d9c116e6233410aa64ec24c4c8b69695
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                  • Size 16KB
                  • SHA256 75617c81c4cdeb24b73d96a77d084c3c7cea9f1637a85ae1113ad1e4eb20ae23
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_arts_and_entertainment.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                  • Size 67KB
                  • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_autos_and_vehicles.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                  • Size 44KB
                  • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_beauty_and_fitness.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                  • Size 33KB
                  • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_blogging_resources_and_services.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                  • Size 33KB
                  • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_books_and_literature.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                  • Size 67KB
                  • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_business_and_industrial.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                  • Size 45KB
                  • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_computers_and_electronics.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                  • Size 45KB
                  • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_finance.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_finance.json
                  • Size 33KB
                  • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_food_and_drink.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                  • Size 67KB
                  • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_games.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_games.json
                  • Size 44KB
                  • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_health.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_health.json
                  • Size 33KB
                  • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_hobbies_and_leisure.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                  • Size 67KB
                  • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_home_and_garden.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                  • Size 33KB
                  • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_internet_and_telecom.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                  • Size 67KB
                  • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_jobs_and_education.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                  • Size 33KB
                  • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_law_and_government.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                  • Size 68KB
                  • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_online_communities.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                  • Size 67KB
                  • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_people_and_society.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                  • Size 45KB
                  • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_pets_and_animals.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                  • Size 44KB
                  • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_real_estate.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                  • Size 67KB
                  • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_reference.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_reference.json
                  • Size 56KB
                  • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_science.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_science.json
                  • Size 56KB
                  • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_shopping.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_shopping.json
                  • Size 67KB
                  • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_sports.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_sports.json
                  • Size 56KB
                  • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_travel.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\nb_model_build_attachment_travel.json
                  • Size 67KB
                  • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recipe_attachment.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\personality-provider\recipe_attachment.json
                  • Size 1KB
                  • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  webext.sc.lz4
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\startupCache\webext.sc.lz4
                  • Size 105KB
                  • SHA256 763ad93de20ef7003b5b95dd227d6a9d2173f1d175741d0fbd85af809855c33c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 599B
                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  2f18b87d-65cb-4e5a-b2e3-208166d612a9.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\2f18b87d-65cb-4e5a-b2e3-208166d612a9.zip
                  • Size 3.7MB
                  • SHA256 5294294bc8f81626cad76fa46c1fdec8df4f6d7a05576adfecbaa571149f3daa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  remote-settings-startup-bundle-
                  • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                  • Size 549KB
                  • SHA256 cd5033ba8a5324e99f397173ea74bbad695449c3d055e7d273f0fa911d1b4d25
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 11KB
                  • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 502KB
                  • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  O4GD943L0D5G9G5CQ9XB.temp
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\O4GD943L0D5G9G5CQ9XB.temp
                  • Size 7KB
                  • SHA256 6e8320d6dfd27b4a2bbb9e643dc8f8944d0bc5ced28363e127888d845cfedfd1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  addonStartup.json.lz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\addonStartup.json.lz4
                  • Size 4KB
                  • SHA256 c29e97546b8bdcb73b5abef63137360ffcef3746e6d259e2c769e23c3330389b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bookmarks-2026-08-04_10_llQXYk4lO_fKvmV-NMeJtCAtHFEWZ5ficIKt9gpDQRA=.jsonlz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\bookmarkbackups\bookmarks-2026-08-04_10_llQXYk4lO_fKvmV-NMeJtCAtHFEWZ5ficIKt9gpDQRA=.jsonlz4
                  • Size 858B
                  • SHA256 f5f2eca4bc3c8e62e428d7a3f5e3f4c7640c3eb62accbcbfac5dc2cf5fd3aa32
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 7KB
                  • SHA256 8e2fd68d34b3efbda91305e31236d93e791a1f42faf49cb464e8b68d84be56f3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 30KB
                  • SHA256 068c0b86f49b00a7294dc1312c8bc180855135a9be4678a2b1d54531dd9e550c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 6KB
                  • SHA256 6f649b81cee329d277e4be1e1a7465b4988674c6e19eb263f61a032882445b88
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 7KB
                  • SHA256 22c427d700248e369d062b12b8b354a81ad89dabce6a17b9c24824cda8add1f1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 30KB
                  • SHA256 d2fb00591c249f4e803feadd8a725b2fdf03e38a486b8474923545a0ad4709ba
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  events
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\events\events
                  • Size 1KB
                  • SHA256 912230168423ad9306da6aa205c36c24368b96d79080d47752e9e73b95f17ed7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  1691b354-a53f-4c8a-9c7e-5a6539d6c648
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\1691b354-a53f-4c8a-9c7e-5a6539d6c648
                  • Size 2KB
                  • SHA256 6844b44cea62a22809d742efc89dc8921df010606457f6bc422585f2d290f295
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  59d78487-68c9-4aa8-84fe-62067687a1e8
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\59d78487-68c9-4aa8-84fe-62067687a1e8
                  • Size 883B
                  • SHA256 3b211aaf84fcee62ede38405fc301fc2fc5e9467fede8139ec52a8cd03229b04
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  a0898194-1d7d-4da8-b72f-6fd82c4b12a6
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\a0898194-1d7d-4da8-b72f-6fd82c4b12a6
                  • Size 235B
                  • SHA256 46ca9ac1a735d299c088f6b2d91d959ca89c5c825e58cca43892e29797136d81
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  c6c005e1-3b7e-45c0-bf69-0a5fd6037799
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\c6c005e1-3b7e-45c0-bf69-0a5fd6037799
                  • Size 4KB
                  • SHA256 7657c8f2e4a5d40dd7ca536f259a1488866f660ddbf2749f0ae83473926c96b7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  d88e4963-e605-41fd-afd4-41056c4d43d9
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\d88e4963-e605-41fd-afd4-41056c4d43d9
                  • Size 235B
                  • SHA256 2f974ece5394a3f395b2ffd4338e16ceac8d62ca9ba59f661c5e8b9b4099bc73
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  dcb9a6e1-4477-44d9-8acb-bf23ddae6b8d
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\dcb9a6e1-4477-44d9-8acb-bf23ddae6b8d
                  • Size 886B
                  • SHA256 ce6715c973bc5c34d6fa4817e022c52f7454fda0343aeb8f68891a32e781e2cb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  e16085a0-525c-4465-af2d-d770f92836b5
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\e16085a0-525c-4465-af2d-d770f92836b5
                  • Size 962B
                  • SHA256 324c28586fb6b07bb2705e389da396744c35b607c8568c04e8630ee5c65c003c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  e3f07cb0-8c93-42e9-9cf4-f29e7648ff29
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\e3f07cb0-8c93-42e9-9cf4-f29e7648ff29
                  • Size 235B
                  • SHA256 5d8766a920671abba717b13e8e632bd01589782ecf42dd5c85633c6b07e344a5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  f9e0da35-0f89-4530-9216-91e59a1103fc
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\f9e0da35-0f89-4530-9216-91e59a1103fc
                  • Size 16KB
                  • SHA256 0e09802248fa5813e233ab67aabfb8128aba53b198ef390dc6024519f12eae19
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  extension-preferences.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\extension-preferences.json
                  • Size 942B
                  • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extensions.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\extensions.json
                  • Size 16KB
                  • SHA256 d57690a8fa6a573e2a5e813b42a505f96f6f3f1bef808090fdbbf2a7f59928a3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                  • Size 1.1MB
                  • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.info
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                  • Size 116B
                  • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  manifest.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                  • Size 1002B
                  • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  widevinecdm.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                  • Size 21.6MB
                  • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
                  • Size 6KB
                  • SHA256 8a8e2a097bfd006cbd86c0bde52e8386a3523e5ca2ba33bf82a9c8ce0d86aa61
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
                  • Size 7KB
                  • SHA256 00a3b3fa155a7ce6f04c16b8b9cc7f868c68e05b378482ae99bce924b6c56a92
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
                  • Size 12KB
                  • SHA256 7d0cb7d9a7789a84d6ebcfa6c727ea81ae712ae8b2d214f0471a85d3fd13791f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
                  • Size 12KB
                  • SHA256 b35cd08b4ab8c21e1e3c9f84b1c9e83a325d0cb321fea48917bfb551e2a37859
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
                  • Size 6KB
                  • SHA256 0e86f837faa180006c622ee1c8f015766b8c2415f9973f7ddb012aedf638a5df
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
                  • Size 1KB
                  • SHA256 1c955264ed8c4766affbd3a8475442768fd1f6c672566e48ac9f2572aae71875
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  recovery.jsonlz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.jsonlz4
                  • Size 1KB
                  • SHA256 426ddb77536b8852c714192dc64ca1bf4b5e89a62044fedeb962e08b3eeeaf34
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 7.1MB
                  • SHA256 cb866911524c936a1a3c6cecdf6ab0ef7285750d37aa1f9d878482e6c06494e6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/3800-688-0x0000028483360000-0x0000028483380000-memory.dmp
                  Download

                  memory/3800-680-0x0000028483120000-0x0000028483140000-memory.dmp
                  Download

                  memory/3800-682-0x0000028493540000-0x0000028493640000-memory.dmp
                  Download

                  memory/3800-668-0x00000284C7980000-0x00000284C7A80000-memory.dmp
                  Download

                  memory/3800-714-0x00000284938E0000-0x0000028493900000-memory.dmp
                  Download