Analysis
- geolocation tags
asiadelhiinindia - user interaction
yes - max time kernel
900s - max time network
902s - platform
windows10-2004_x64 - resource
win10v2004-20260513-de - resource tags
arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows - submitted
04/08/2026, 12:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1533940485851185232/1534178098814386197/sdk.zip?ex=6a732e32&is=6a71dcb2&hm=4876a747c57c129456b22ce491a71ab35108ffd28f8f264a00bd9ace65db109f&
Resource
win10v2004-20260513-de
windows10-2004-x64
13 signatures
900 seconds
General
- Target https://cdn.discordapp.com/attachments/1533940485851185232/1534178098814386197/sdk.zip?ex=6a732e32&is=6a71dcb2&hm=4876a747c57c129456b22ce491a71ab35108ffd28f8f264a00bd9ace65db109f&
- Sample260804-ptxbgseq2y
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe -
flow pid Process 148 1996 firefox.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5920 NOTEPAD.EXE 904 NOTEPAD.EXE 5824 NOTEPAD.EXE - Checks processor information in registry 2 TTPs 30 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 35 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\hpp_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\h_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\hpp_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\h_auto_file\shell\open\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cpp_auto_file\shell\edit OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cpp_auto_file\shell OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cpp_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cpp_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cpp_auto_file\shell\open\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.hpp\ = "hpp_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\h_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.h\ = "h_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cpp_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\hpp_auto_file\shell\edit OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\hpp_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\h_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\hpp_auto_file\shell\edit\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\hpp_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\h_auto_file\shell\edit OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\h_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.cpp OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\hpp_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\h_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cpp_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cpp_auto_file\shell\edit\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.h OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\h_auto_file\shell\edit\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.cpp\ = "cpp_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.hpp OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\hpp_auto_file\shell\open\command OpenWith.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\sdk.zip:Zone.Identifier firefox.exe - Opens file in notepad (likely ransom note) 17 IoCs
pid Process 2352 NOTEPAD.EXE 2336 NOTEPAD.EXE 5580 NOTEPAD.EXE 5724 NOTEPAD.EXE 5920 NOTEPAD.EXE 1956 NOTEPAD.EXE 3972 NOTEPAD.EXE 5648 NOTEPAD.EXE 5824 NOTEPAD.EXE 2128 NOTEPAD.EXE 3364 NOTEPAD.EXE 5960 NOTEPAD.EXE 4868 NOTEPAD.EXE 5060 NOTEPAD.EXE 904 NOTEPAD.EXE 4736 NOTEPAD.EXE 2732 NOTEPAD.EXE - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1996 firefox.exe Token: SeDebugPrivilege 1996 firefox.exe Token: SeDebugPrivilege 1996 firefox.exe Token: SeDebugPrivilege 1996 firefox.exe Token: SeDebugPrivilege 1996 firefox.exe Token: SeDebugPrivilege 1996 firefox.exe Token: SeDebugPrivilege 1996 firefox.exe Token: SeDebugPrivilege 1996 firefox.exe Token: SeDebugPrivilege 1996 firefox.exe Token: SeDebugPrivilege 1996 firefox.exe Token: SeDebugPrivilege 1996 firefox.exe Token: SeDebugPrivilege 1996 firefox.exe - Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe - Suspicious use of SendNotifyMessage 20 IoCs
pid Process 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe - Suspicious use of SetWindowsHookEx 40 IoCs
pid Process 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe 4548 OpenWith.exe 1900 OpenWith.exe 1900 OpenWith.exe 1900 OpenWith.exe 1900 OpenWith.exe 1900 OpenWith.exe 1900 OpenWith.exe 1900 OpenWith.exe 1900 OpenWith.exe 1900 OpenWith.exe 2684 OpenWith.exe 2684 OpenWith.exe 2684 OpenWith.exe 2684 OpenWith.exe 2684 OpenWith.exe 2684 OpenWith.exe 2684 OpenWith.exe 2684 OpenWith.exe 2684 OpenWith.exe 2684 OpenWith.exe 2684 OpenWith.exe 2684 OpenWith.exe 2684 OpenWith.exe 720 OpenWith.exe 720 OpenWith.exe 720 OpenWith.exe 720 OpenWith.exe 720 OpenWith.exe 720 OpenWith.exe 720 OpenWith.exe 1996 firefox.exe 1996 firefox.exe 1996 firefox.exe - Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 5032 wrote to memory of 1996 5032 firefox.exe 85 PID 5032 wrote to memory of 1996 5032 firefox.exe 85 PID 1996 wrote to memory of 3980 1996 firefox.exe 86 PID 1996 wrote to memory of 3980 1996 firefox.exe 86 PID 1996 wrote to memory of 3980 1996 firefox.exe 86 PID 1996 wrote to memory of 1048 1996 firefox.exe 87 PID 1996 wrote to memory of 1048 1996 firefox.exe 87 PID 1996 wrote to memory of 1048 1996 firefox.exe 87 PID 1996 wrote to memory of 1048 1996 firefox.exe 87 PID 1996 wrote to memory of 552 1996 firefox.exe 88 PID 1996 wrote to memory of 552 1996 firefox.exe 88 PID 1996 wrote to memory of 552 1996 firefox.exe 88 PID 1996 wrote to memory of 552 1996 firefox.exe 88 PID 1996 wrote to memory of 2912 1996 firefox.exe 89 PID 1996 wrote to memory of 2912 1996 firefox.exe 89 PID 1996 wrote to memory of 2912 1996 firefox.exe 89 PID 1996 wrote to memory of 4448 1996 firefox.exe 90 PID 1996 wrote to memory of 4448 1996 firefox.exe 90 PID 1996 wrote to memory of 4448 1996 firefox.exe 90 PID 1996 wrote to memory of 4448 1996 firefox.exe 90 PID 1996 wrote to memory of 3876 1996 firefox.exe 91 PID 1996 wrote to memory of 3876 1996 firefox.exe 91 PID 1996 wrote to memory of 3876 1996 firefox.exe 91 PID 1996 wrote to memory of 3876 1996 firefox.exe 91 PID 1996 wrote to memory of 2260 1996 firefox.exe 92 PID 1996 wrote to memory of 2260 1996 firefox.exe 92 PID 1996 wrote to memory of 2260 1996 firefox.exe 92 PID 1996 wrote to memory of 2260 1996 firefox.exe 92 PID 1996 wrote to memory of 1344 1996 firefox.exe 93 PID 1996 wrote to memory of 1344 1996 firefox.exe 93 PID 1996 wrote to memory of 1344 1996 firefox.exe 93 PID 1996 wrote to memory of 1344 1996 firefox.exe 93 PID 1996 wrote to memory of 380 1996 firefox.exe 94 PID 1996 wrote to memory of 380 1996 firefox.exe 94 PID 1996 wrote to memory of 380 1996 firefox.exe 94 PID 1996 wrote to memory of 380 1996 firefox.exe 94 PID 1996 wrote to memory of 4712 1996 firefox.exe 110 PID 1996 wrote to memory of 4712 1996 firefox.exe 110 PID 1996 wrote to memory of 4712 1996 firefox.exe 110 PID 1996 wrote to memory of 4712 1996 firefox.exe 110 PID 1996 wrote to memory of 3368 1996 firefox.exe 111 PID 1996 wrote to memory of 3368 1996 firefox.exe 111 PID 1996 wrote to memory of 3368 1996 firefox.exe 111 PID 1996 wrote to memory of 3368 1996 firefox.exe 111 PID 1900 wrote to memory of 2352 1900 OpenWith.exe 122 PID 2684 wrote to memory of 2336 2684 OpenWith.exe 125 PID 720 wrote to memory of 904 720 OpenWith.exe 131 PID 1996 wrote to memory of 4056 1996 firefox.exe 135 PID 1996 wrote to memory of 4056 1996 firefox.exe 135 PID 1996 wrote to memory of 4056 1996 firefox.exe 135 PID 1996 wrote to memory of 4056 1996 firefox.exe 135 PID 1996 wrote to memory of 3664 1996 firefox.exe 136 PID 1996 wrote to memory of 3664 1996 firefox.exe 136 PID 1996 wrote to memory of 3664 1996 firefox.exe 136 PID 1996 wrote to memory of 3664 1996 firefox.exe 136 PID 1996 wrote to memory of 1692 1996 firefox.exe 137 PID 1996 wrote to memory of 1692 1996 firefox.exe 137 PID 1996 wrote to memory of 1692 1996 firefox.exe 137 PID 1996 wrote to memory of 1692 1996 firefox.exe 137 PID 1996 wrote to memory of 6092 1996 firefox.exe 138 PID 1996 wrote to memory of 6092 1996 firefox.exe 138 PID 1996 wrote to memory of 6092 1996 firefox.exe 138 PID 1996 wrote to memory of 6092 1996 firefox.exe 138 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://cdn.discordapp.com/attachments/1533940485851185232/1534178098814386197/sdk.zip?ex=6a732e32&is=6a71dcb2&hm=4876a747c57c129456b22ce491a71ab35108ffd28f8f264a00bd9ace65db109f&"1⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://cdn.discordapp.com/attachments/1533940485851185232/1534178098814386197/sdk.zip?ex=6a732e32&is=6a71dcb2&hm=4876a747c57c129456b22ce491a71ab35108ffd28f8f264a00bd9ace65db109f&2⤵
- Drops desktop.ini file(s)
- Detected potential entity reuse from brand GOOGLE.
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {011cb2d3-9b30-4a46-956a-c64c8a194d4c} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:3980
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {923e0637-ea5f-4abd-8aec-ffabbd3579e4} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:1048
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3608 -prefsLen 25164 -prefMapHandle 3612 -prefMapSize 270279 -jsInitHandle 3616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3624 -initialChannelId {13be551a-8aea-45c0-ba2c-c8db92d65a49} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:552
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3772 -prefsLen 27276 -prefMapHandle 3776 -prefMapSize 270279 -ipcHandle 3844 -initialChannelId {3299123b-3dd7-41f3-ab5c-4835da6a5465} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:2912
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4276 -prefsLen 34775 -prefMapHandle 4280 -prefMapSize 270279 -jsInitHandle 4284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4292 -initialChannelId {370a4b7d-2c3e-413c-87ab-f41ae608c1f5} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:4448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4776 -prefsLen 34905 -prefMapHandle 4772 -prefMapSize 270279 -ipcHandle 4712 -initialChannelId {adc48eb4-0330-407c-8089-f00f680e87ef} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:3876
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4964 -prefsLen 32793 -prefMapHandle 4968 -prefMapSize 270279 -jsInitHandle 4972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4980 -initialChannelId {e1725e30-2c46-4234-a5f5-e4d87a70f3af} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:2260
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5268 -prefsLen 32845 -prefMapHandle 5272 -prefMapSize 270279 -jsInitHandle 5276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {eb70f558-5a54-4af1-bc81-096f926438e7} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:1344
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5424 -prefsLen 32845 -prefMapHandle 5428 -prefMapSize 270279 -jsInitHandle 5432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5440 -initialChannelId {4405ddd8-f4b8-4a61-aa14-b61bdde7ee99} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:380
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6596 -prefsLen 40420 -prefMapHandle 6648 -prefMapSize 270279 -jsInitHandle 6332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6476 -initialChannelId {9325a8f7-c81c-4e15-8cad-bf9df43e937c} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:4712
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15672 -prefsLen 37318 -prefMapHandle 19060 -prefMapSize 270279 -jsInitHandle 19084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6832 -initialChannelId {ff7e9797-b54d-4c1d-ac4b-ed271385582f} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
PID:3368
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8484 -prefsLen 37318 -prefMapHandle 7996 -prefMapSize 270279 -jsInitHandle 8524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8440 -initialChannelId {909bf8ce-81bc-417b-8d8b-ad1370120e30} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
PID:4056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14320 -prefsLen 37318 -prefMapHandle 8780 -prefMapSize 270279 -jsInitHandle 15820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14324 -initialChannelId {8892295a-20e5-4782-8045-efa5fcd4ae78} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
PID:3664
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15460 -prefsLen 37318 -prefMapHandle 14276 -prefMapSize 270279 -jsInitHandle 15440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14320 -initialChannelId {9e71aa88-8b2e-4c0a-90a1-c43a924b83ae} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
PID:1692
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 15796 -prefsLen 40539 -prefMapHandle 14524 -prefMapSize 270279 -ipcHandle 18568 -initialChannelId {c34f89cb-ca49-4345-a9da-a1672e671d33} -parentPid 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility3⤵
- Checks processor information in registry
PID:6092
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4912
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4548
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\strayCache.h2⤵
- Opens file in notepad (likely ransom note)
PID:2352
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\strayCache.cpp2⤵
- Opens file in notepad (likely ransom note)
PID:2336
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\strayCache.h1⤵
- Opens file in notepad (likely ransom note)
PID:2128
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\sdk.h1⤵
- Opens file in notepad (likely ransom note)
PID:5060
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\sdk.cpp1⤵
- Opens file in notepad (likely ransom note)
PID:3364
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\mappings.hpp2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Opens file in notepad (likely ransom note)
PID:904
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\classloader.h1⤵
- Opens file in notepad (likely ransom note)
PID:4736
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\classloader.cpp1⤵
- Opens file in notepad (likely ransom note)
PID:3972
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\strayCache.h1⤵
- Opens file in notepad (likely ransom note)
PID:5580
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\strayCache.cpp1⤵
- Opens file in notepad (likely ransom note)
PID:5648
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\sdk.h1⤵
- Opens file in notepad (likely ransom note)
PID:2732
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\sdk.cpp1⤵
- Opens file in notepad (likely ransom note)
PID:5724
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\mappings.hpp1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Opens file in notepad (likely ransom note)
PID:5824
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\mappings.hpp1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Opens file in notepad (likely ransom note)
PID:5920
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\classloader.h1⤵
- Opens file in notepad (likely ransom note)
PID:5960
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\classloader.cpp1⤵
- Opens file in notepad (likely ransom note)
PID:4868
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_sdk.zip\sdk\net\minecraft\client\MinecraftClient.cpp1⤵
- Opens file in notepad (likely ransom note)
PID:1956
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\activity-stream.contile.json
- Size 1KB
- SHA256 4f3c3c8a5548a33275d0fa6f29d118aa80a2325bd62e1f9c95297d5ccac9a6d5
- MD5 078b06b420f3ab7dff525b4e5ae7a382
- SHA1 89e8cec244d11d43032b9094644c4cbb10dbfdad
- SHA512 80858c45738c9bdec3743ff72dce082be8ad9bb395a3405bb810f37dae99c56d894adda80837747e6d75c5f1a683297d34f9397f588788feb6b5c00d46d3094e
- TLSH T12131C89B85C4E8936B13A4F83E573F9CB1A3B1C640E8DC0CA725DC1192ED2864055584
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
- Size 16KB
- SHA256 0c08df32e7366d94264f1644703f0416d64d3139653e08672b5e36e427449924
- MD5 4f7216acfd92f7b0016d0dc30274c559
- SHA1 7f1f60357015aa5bdfef5de9eb3ff2c80a0b4470
- SHA512 9e99e43f270686916283422d3241ccd82140b139196331a840ffbd2d623ad4f1b31af1a1b50f87184a69c42965633e3ab4742ce74c28c48e620c0bb4b9da82dd
- SSDEEP 384:HwCe7iO024YIDL84KKDL849B7SOEAd9KVRaAcP+AWRMATFY:QqZYIDL8lKDL8CB7S/AmVAf+hRMwFY
- TLSH T1D6729E799F413CAC1997C0E8C0F892DA4D19B6A3DFE6C06D21683D0DC7989A9B1F548F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\5336AE3DAA22C0EB405AF915E44818145DC30798
- Size 112KB
- SHA256 0a4e7cbaf88633303538fa151607f79ca0199b5935b947979a806abb534f3270
- MD5 5ae0379d0fcdd554e3516c4183a1ca53
- SHA1 a93963ccf61f380da57e89e980f96da696ce7fea
- SHA512 a5dc57f213a139e273c74bd3410a3468c6a0b86eeaf11dddf5c3b307879b7dee01eeab7310635b9654927bb85e306a6e27b94206e8857cd13fec40de1fc3b5f9
- SSDEEP 3072:BaELcG+aukFxgM9qHRX2gBsZcHgQ/QWnx3AwbL0dsy6eb/t4ny6eb/th:RLLukJ9GRX2WicAQ/hxQwEd19h
- TLSH T1CFB3D0FB0406285E1F709BE6722232ACD177714EFDE1DCF4D5606EA184A0FB7A058E66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\startupCache\webext.sc.lz4
- Size 104KB
- SHA256 2195d98e14d0331cc4884f454c3e415d38a4f4fd0fba92885330bac2be4bfa87
- MD5 427aff69414e38e60665df85c5ca7540
- SHA1 c82da8c19c3c86a62b8a11311aee37efd8daecef
- SHA512 3ee337b2ccc8b46e7d14bf36fd7d9c93ba347a21e5a69f6d1b1938efe7ca9b511422074474c8ad3992fa7092406b127e32411d878b55860dbbb392acbc348f6f
- SSDEEP 1536:jTrliJxXDDk1X9gz3dpwc+ZyIFJwJZPF2O/Z3CJl+i5pqpqVdszCE9r/KF9KxZoX:j3lVX9gzMjZBiZMON0+KqYszbk3X
- TLSH T138A3AFFADBA2892E69FFD428AB82C53DFC222400B3A73409C963375155C6FB46675748
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\f087b0bd-7c37-4d6b-81df-f9bcfe924e5a.zip
- Size 3.7MB
- SHA256 5294294bc8f81626cad76fa46c1fdec8df4f6d7a05576adfecbaa571149f3daa
- MD5 6e6eff9cacb0aeecbbcebaf19691e55b
- SHA1 f52be47f67201bd0482d31718b6b0febcbdca819
- SHA512 b8e1995dbdb15440b555b070390840ed2cc818a236971cf1bb010e5066f21c800a5126dcc8fa1dd0ba537228c11d52d64e2f5de858c61de245d71ad0877a054f
- SSDEEP 49152:5RbNPT07llToFbIa/uaVJJlHtxuCToqN1Si2GdMD2hOkilOU53nOKMJ74+wQfIcz:zbNvIXcDtxjuCdMDGOkM51ERfIc9d
- TLSH T13206F177D65C1609CDCF83BA850C2FC29B4FCFAE80D4A9EB6A6A95715CB31E21F44844
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 479KB
- SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
- MD5 09372174e83dbbf696ee732fd2e875bb
- SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
- SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
- SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
- TLSH T189A42315F4A41CDCE8B5200CCADED74501995084F126FE2A5D32EEEADDDF683E26C8E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 16KB
- SHA256 023df8a9c0a93ef201bdd7a9621aed17ceb9b12e25e6455277f792a8f537561a
- MD5 22d484db7be20e2f6361aa64d177b6d1
- SHA1 0e3c8abb4ace1eb8ec46b345b6b5e122449851f2
- SHA512 7446072ba4fb7d00a8d68622c26d504318aecf833b624ef5bcc180c8317178b9e3cb02d7dd8b9b08f0ee318aad2f8adcaed2849e8d6421775d4e804fb877c15c
- SSDEEP 96:GMq/PQ/VNBrycX86M+pnlZCycX86M+gclO+K4ju4xl0O+2ulv99W:GBw/jBrJXtplZCJXtjll0w06
- TLSH T1D872FE001BFB09D6F5F34B31B631B742AA77FD025B06561ED18692880A73B50D52EFAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 21KB
- SHA256 31cb1824f1650cb231039e8cb388e81898ddb2278958d30a9474e0ba04e46a12
- MD5 fdbc6bd71378ff1e36bdaf57007a2529
- SHA1 d6e84a1b8fb3f9d428fa4ca5b476e2865edea363
- SHA512 6618167cd86b3cbecb1c83d50d96eb8593a8696cb569b86745e6d9d565efd50a53b958f6f53160f4d2d1026276d6966bd700f04a74b2e7aa9d848ee7a03f50ea
- SSDEEP 192:bcJ/TUBrJXtpMD2NJXt0Ga4JXtpMZCJXt+lM0wp6:bcJLUdJrMDyJmG7JrMsJImNp6
- TLSH T139A2EE002BFB19D6F6F35B31B631B742AA77FD025E16461D908292480E72F50D53AFAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 21KB
- SHA256 a561af53bcdd3e344176baf9f11ed6a87019bd39ad2f9b6b3db4b15d13e0a675
- MD5 c7549ae263b9d88d0ab6540a70eae8c0
- SHA1 4fb5dd6d4babf32cf8b935236b99ffae550d4214
- SHA512 930cbee7b7594fa33be3bb820e480a52976da951ccfa97438b72659dd4234f44da72db639d5180cbf96db077302973092984ac727a4d1e995cf9aaacaf763037
- SSDEEP 192:d2T/TeBrJXtpmD2KJXt0AaNJXtpma4JXtpmZCJXtUlm0wB:d2TLedJrmD1JmAeJrm7JrmsJGgNB
- TLSH T135A2DD0027FB15D6F6F34B31FA31B782AA77FD025E16491D948292880E72F50D52AFA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 22KB
- SHA256 4268d4999dafda588d1be364484c1a196872d5b85c57bd0bc5337f35d1e74308
- MD5 f654506aeda9bb1981878f7d6047c5ec
- SHA1 5051d4e0b57aabe6a6c128183c4aa0bf25e5ebb0
- SHA512 49308b3c5995b6b26f27bd6c95857b807e83e864bb9468d9d1239ce9116acb48d9e6367421e7b842e72a534c088d378ec61f349f77fcd7c8f18f3afd9d6a893c
- SSDEEP 192:FOX/TqBrJXtpiklTxI4D+D2KJXt08aNJXtpia4JXtpiZCJXt7:FOXLqdJrikff6D1Jm8eJri7JrisJZ
- TLSH T138A2EC0027FB15D6F6F38B31BB31B782AA77FD025E1A490D948252480E72F50D56AFA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 7KB
- SHA256 a4aad9e305dbf65e3a895d838485e1a59d815a21cebf61c968449eb71aaf1393
- MD5 bf428c6d3bc2b24ffb757489606b8286
- SHA1 ffaf9c34e638b733f7f29e4fc4f94808fddd42bb
- SHA512 8460925369329d6bb45620b8425eb8b904389fdc704fa566912a56b2db1df89e6a873ed73ff81be273867d4c2bf01c243b5b430adb745373a02f1c58e86dead0
- SSDEEP 48:gZ0dCJ5UgdwNzzlw0dCJ/6Bdwrzla0dCJ/adw5zBDX0dCJVHv197dwizW:qMa/PA/V5v99W
- TLSH T1AFF1CB011BF709D3F5F38631B6327B42A677FE01670B461ED18662880A72764D16DF9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\AlternateServices.bin
- Size 10KB
- SHA256 28ffbfaa441a4215db49a908fb1fb9f7ff52a78d35b31b89df6a92041eb60cc7
- MD5 3516149f1feccf7c5ccdb6278d29d34d
- SHA1 1d6dc5ebdb08049b8801e7f443d8704f4b79d8d3
- SHA512 e267a6fc568c2fb6f4d8a4fafff57779ce3762ee26a9b6e7ee50a3e0c51c855747feddc1e6fb18377e00731d12065623d8a00794a53ccb65f02e89c38f0aff3b
- SSDEEP 24:L1uhMZElRp1uWzBn+lz4rmY91PFD9xpF69BCFuj9VvQFf9FVF:LslfkEBn44rmSdFxfFYcFuRBQFFLF
- TLSH T1CD2281F35B76A462F0A68FF48059718CDC331326556D9884D684D4F702C6BAAE07EFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\AlternateServices.bin
- Size 20KB
- SHA256 7fef2f530f8887e161bcab7a257279191ea7f8bee002eb4f9a1a31c8dd6bcc10
- MD5 02f41bb5853dc9498550defcecf6d6e0
- SHA1 b952c0e94938a2c053d44299139c2fba43df19b1
- SHA512 f4b2c9de09041d92875809031d3ca29ffaa05b381c69eaefca61b751b017f8e8c1847de5987a62357fbeb7b3f968c497371ffc6206c5dd13114507303d453921
- SSDEEP 96:LufkEBn44rOylFphBFTFFlBZF0eFgI56EFC0FCOFbRzFjgyx2QzFdEMFDxFVxdF:LuZ5r5/PTjXnnv7z1g22QzjffP
- TLSH T100927DF36F766463F062CFB48098B18C9C330326456DA584E684D4E702D6BA5E17FFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\AlternateServices.bin
- Size 20KB
- SHA256 eee572e072fcddf0a07fa8d791ebfde43d24ff0d364824560ae0fafbbdb7b428
- MD5 3b48946a6d85151cbdf0042d88292567
- SHA1 e35ac40b1647842af342453c81eed4d7493630d5
- SHA512 5759729561f8dcafd98a99bd741b11fadca4b701413863f4665892d2a3976c389a73231001a7e32bbe4f158ec84355cf87c3242ece93f0f00fb2bc101b36986b
- SSDEEP 48:LslfkEBn44rB1HSD1HWHhF7MaFtJRtv3FF:LufkEBn44rjyx2BFAaFtbx1F
- TLSH T1889268F32FB22467F0168FB44458708D8C371215446DA584E680E8AB07C6BA5E0BFFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
- Size 41KB
- SHA256 bc1a40edde7751d2988eed657689461e8fb2436a63718907d63577ccfc39bcdc
- MD5 8fbf22fd0b8e95cda0b0e28deb8e3a21
- SHA1 ae340789c49fc7fa0213c1ad8ac989d72cb8e4d0
- SHA512 9bad8390edf9524fb6b96f06db1c6a17ee866ccdb7313e5746ffc801dfe4a926fb90ca856df6267148203ef9b3c6b4d6672052c6094fe99cefa25998ae2add97
- SSDEEP 768:RnC8r4xgwKr1GcmhucjesIKDtbkMp58fozphb9bTbObcbDbgb5bmbsbDH+ASJyaT:k8r4xTKdsIZH+ASJyapJhlMgFd
- TLSH T10C131144EB1A953FD42812BBDCA21B002F79F88959092FA7365C64786C872DC3D9E17F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 72aa50083d56438c288d09c62ac57e56606bf3023be612b79fef01a2adda6df2
- MD5 9dd454be7dad8b6937ee809502ff5287
- SHA1 555cfa5b8725df52f1210e227b65c990c0d4c5f2
- SHA512 2dfb4570dd86993d7eb0d15cba209c6faf3300d4d2d7e1f8689196cefee847bb038c555dd73cf6bd6bb700d69450ff9b6659c987c5c761c002de7b02352a5849
- SSDEEP 192:+Ov5zboPXZCWyjru1d66JozGzgCl6mc0dz:Vbo/ZCWyjMd66JozGzgC1jd
- TLSH T1C7D1FF58F629863FC815023BCDA52B510F76398A984E3F2931DC251D2C563CE7A8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
- Size 41KB
- SHA256 a200e70c2fb4a9675e8dab19d0e3d48b579c3d82a22bc0dc55a1ea4ec340a285
- MD5 64546197a0c854b84030c1cabc58d241
- SHA1 df0f31ce9a6321c2bae7383266c901c1cfd96f99
- SHA512 8a50946254a81aff414c376e87a0eb58bf101e7c734a041182cdef1b01843a1fcc40af709ccd950173c9ea343aa427496ca84c318c0938cfdcfe11788090162d
- SSDEEP 768:d8r4xgwKr1GcmhucjesIKDtbkMp58fozphb9bTbObcbDbgb5bmbsbDH+ASJyapJc:d8r4xTKdsIZH+ASJyapJhlMgFy
- TLSH T1D7131144EB1A953FD42812BBDCA21B002F79F88959092FA7365C64786C872DC3D9E17F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
- Size 120KB
- SHA256 7dd07b2a39881316ab8d6454212aed80ab9314c52cc9199c55aa257cd58997c5
- MD5 2568b6ee7666e03fb9898fd830989307
- SHA1 1d4eb832089157017646767674e600a8e5cee643
- SHA512 01fab4a46605724974b40a86d4c156344d00f6f4861d1a868d17e92f9f2f0662d64feb83b97b3d63190819ad05945e4c4cd3db2b341cfd27684cd97befabd3f9
- SSDEEP 3072:K+/z6msV0txdwSQXGZEkOnN0p3KNnSplUK4svdhxE2:K+b6msV0txdwSQXGZEkOnN0p3KNnSplP
- TLSH T194C3F084DB1A407BEC2446BBB4D627283735F4644A595B0B3AAC00752DCB3FF2D4E66E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
- Size 41KB
- SHA256 ff48b831c5f37c853116465153a62a292ad2b01a2107e621bca6dd2f1f2012c9
- MD5 0ccf86d6dace2ff96777db8b1ebbc467
- SHA1 6142c957682db6cbdfe48b959517dc86fa043606
- SHA512 38717cf5fc06a5bc6bb544ee82e687ac668cb7d8342fdbfdf39d8fde2b55e3ce6c8943bcfdb08c33af767138d667c634fd38cde59bcd9fd669f4da6e04d6ee5b
- SSDEEP 768:fEMnC8r4xgwKr1GcmhucjesIKDtbkMp58fozphb9bTbObcbDbgb5bmbsbDH+ASJ7:E8r4xTKdsIZH+ASJyapJhlMgFh
- TLSH T104131144EB1A953FD42812BBDCA21B002F79F88959092FA7365C64786C872DC3D9E17F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 9127768b574dbb74353f9d9ad43dd805add7ef733770c9d9a9110a4e5edf6105
- MD5 b03162b05d55cf1a9c9def0d5cf06dde
- SHA1 97721fa4fc1914c3f324a9a8e79095c49b81086b
- SHA512 364948616b90591e60a3bae0ca19449de83b68cd1b7abbeddb08b5801fffb52692a5da5e1dab6a8ecaa14ba1b5ebfd51fa70d73782b0c282e1aa4db90b56f95b
- SSDEEP 96:cHSdF95/7bkW60rcECWyUR6IWZOnFw2FtFyF7A/dd66JozGzgClKtmc0d/U:MOv5zbowbCWyjru1d66JozGzgCl6mc0d
- TLSH T1F3C1F168F629863FC805423BCDE52B510F763946984E3F2931DC65192C5A3CE7A8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 e8742e97251599684d90130ec0651a9e0e2898d7d9c086e0b13a27e9149fc4dc
- MD5 df22b7e700d35f4167503fe14ef41346
- SHA1 62c524c6bed88e4e148980600ec78e9512385b89
- SHA512 0e39581819673e7d920d23257bf47ac8fc3c04f0ef74cae88a0656291ad06035bdc44ec009d06d3d0e82d863cc1095b6e265d26ccd986d8213a58c84ae89c144
- TLSH T11F213A5C3EB94D2E69CBE39C744102CE57918E0744872D475D82EE8DCE91AD932BA43D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
- Size 5KB
- SHA256 05521205e0b2da756415d9ac51f62b7325259b5d91b715b2ee968d16d5ffb669
- MD5 d56d2e9183ff04bd58a1a388706824af
- SHA1 9ed43fc613aacd5e2d395f2815014af67f7ec95a
- SHA512 47416e9fae41eda4d20f52dc91bbf7dd1077675f0c30f7341b176a2d17387d178b41a8011e8a5f75d06d8e8cc26e6c364bbd3fbca72eb02d181d03bdcdc82410
- SSDEEP 48:Ya229YAxtrKOavvc6/OBOxxuUJVTtzZTJ123Z1YspYI3wDdfN5L27ghQ6CCEZzM8:+z/YGxbJX2FOLygL904oNs+ts8
- TLSH T1D2B1EE192B7E5CBE6CD7E3ADB441028D42C9474384C72D870CDAEE4D8E5765A326F42A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\17d1d5ab-19ab-47ff-809e-cc8defcfded4
- Size 2KB
- SHA256 e02a21f6d2f8e05334dd784eb1dba4c97a5754f280e2b4cc64e8e3b1617565b7
- MD5 eaa7a9d92e371baadcb415aaaf8f37bc
- SHA1 816400a0284d734c5ce5f5f28ff3630338580aa4
- SHA512 257f68cc747cb06a61d2c3e6c0e5e2abe2d2c3d3cc8c84b1ad16954b4d359fa72d440516da50d40711fe8f8fab49fde4a4ed28a3a9485a71107eaea82d68355a
- TLSH T18E41111C75789CB68E9BF58DE582338E57B04A0210C61D832D91EF4CCC9969A336E63B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\23ec8c75-1371-4751-b3d0-6f3a751f6b4f
- Size 15KB
- SHA256 4d57b1700c77724ab62345dea27488918bd3468f59d6808b62652b269d07a3b6
- MD5 6325b5694afa9b377744d62f46fb6af1
- SHA1 a5de8a7be4eeb59b906e2fcffd2778dbefab9a8d
- SHA512 783d779a7e8cf3347a91d4b60a5071b209f94e42b641e7bf03f80b8fd59546438f4a59a940afd81f4f1bc651c9e4b4dc0f87e3a2eaed6ddc5cf2c8c23f7c4436
- SSDEEP 192:O5tb1MHhVzeBcRg/DyE+8K0tXo0k7rCRz+sEQiHnVT1pxghyAm8FOLxbDguCh:xHj65/DyB4XDk7rCRqsl2EpSxb0uCh
- TLSH T16372CA565820457A8651E36998FCBFC3E6F638CF4C019FCA9BE47E086DDE06E112784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\3f306f34-4069-4395-865f-e627f95371b6
- Size 235B
- SHA256 53a52fa78a588c142261573013794d343ac96ec57e66427bfadc71da0e8f4a43
- MD5 ec4822e21da5611f773e201c83419917
- SHA1 00db76759c92317b214a6194381dcea675d36fca
- SHA512 cdce3b6078a58628cb822860b27fb7c062b8ae2d8ebfd29429e9cab891505a7e48343b42de4ae5bc07f3c3dee5f70aef682652c890a0a142c6a32dde811d8a0a
- TLSH T1ABD09786A898739D08100F07B0E0FAD230844C3710A09C14C5A04178DDF9DC842D181E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\4cfc67d2-25a4-4ce1-bf09-87eb1f1ee052
- Size 235B
- SHA256 6ff9c2845d79075bee419aee01c2690fac97902b8cde976c723b35982e035fe8
- MD5 b944910c32555a5e12cd7a8ac426e483
- SHA1 2b2834aae0c8e9f5193f67bcc8964305604d58e4
- SHA512 2ba5f423a030e3717f9709690a9242d6c387c67fd567e2ade0da54b430688a1de06f23c539da8050605ccddd4957453bf97cdb34ac3bac81ab4cd3b2f1fe9444
- TLSH T178D097812488276E48080F07F0A02EEA3184CC331061A810CE558474A9F89CA0221C5B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\7b3f69aa-0010-4c7a-b353-e521e2a20fcb
- Size 886B
- SHA256 f4c43569614b953cc818acb5af9ac61971ac230c4ea327ca4dd9c91060c076c7
- MD5 f6c4a4a16b10ad34929507cd23f9132c
- SHA1 6665572bc4721f48c15e186f4ed6449eddfac339
- SHA512 637914aa84a181e0846ce96e2ce1f166ad5b167d3acfe0fab128bdcb90dd6397eac281a279b3465c6efd116c4133d594cda1e0a08fc1e2094171d44229750eb6
- TLSH T1DE1123819634B5B3CE2AE24B99E477538EF4322391CA1A187DD00F180CEE70E6357E0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\a9a9c8bf-ca0d-45ff-9ca2-c3750005cf55
- Size 883B
- SHA256 31b09f870c5c7e14b67d62e563ac32f85bc53963abaa54e71a9ae1283bc3e20d
- MD5 b1acd2059d1d2c881596cb5a66e5b4a0
- SHA1 3d8a517549663a919c4e8b1e3aff26ad033cdeea
- SHA512 10c60564621db45ff4bb1977a762b20804ead5ebbaeaa103e453f9eede6c78dcfadf2688c37dfb4e3aaf8e15fc9bd7d6c71a033f735d2e5513fa2274527f7e12
- TLSH T109110040E535B5B2CD69920B9A9077528FF8761380C950183DE14E140CAE61E636A70B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\extensions.json
- Size 16KB
- SHA256 3e85ec9802b2e1c88d9c43e8bc9a128b03b3ec40222c6a35afc711c0bebfb9a1
- MD5 09b1f7a130d74692279e8b16d044dc24
- SHA1 b44f3aeab68d99bd7722baf6086fad0e8f2cffe1
- SHA512 69d6ac0c02152597105b78930cd058e06e3d9e81aafb06fced9180786239588ec82f085e4873fec827c845198cbcf9b41a08d4d075e95d318f833a238ba2a198
- SSDEEP 384:qkI4v3Umldvc8dhWA94z196o3tL4HzlL4PTL4HeL4HCL4Hd54hQ:NI4PRflXV4H6Ct4p4H4E4Q4H4y
- TLSH T13972421545048EB82A4FA79BAA367E01C37D473B60845C78F4DD8FC842FB5B902BB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
- Size 1.1MB
- SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
- MD5 842039753bf41fa5e11b3a1383061a87
- SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
- SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
- SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
- TLSH T1D9358D0AF1A311E9E41BC074867EA622F639344D572568FF169587203F77BC0AB3AF58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
- Size 116B
- SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
- MD5 2a461e9eb87fd1955cea740a3444ee7a
- SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
- SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
- TLSH T176B022002803B0B0082282030C380AA02A3A3382E020082CAE2F03E0838832303AC0E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.2830.0\LICENSE
- Size 473B
- SHA256 afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59
- MD5 f6719687bed7403612eaed0b191eb4a9
- SHA1 dd03919750e45507743bd089a659e8efcefa7af1
- SHA512 dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56
- TLSH T1CBF0DC7ABA23532345DA03C7011540D53B270BF4F25422D0E3A880E9336B178C1FE484
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.2830.0\manifest.json
- Size 1001B
- SHA256 25a702dd5389cc7b077c6b4e06c1fad9bdea74a9c37453388986d093c277d827
- MD5 2ff237adbc218a4934a8b361bcd3428e
- SHA1 efad279269d9372dcf9c65b8527792e2e9e6ca7d
- SHA512 bafd91699019ab756adf13633b825d9d9bae374ca146e8c05abc70c931d491d421268a6e6549a8d284782898bc6eb99e3017fbe3a98e09cd3dfecad19f95e542
- TLSH T111115B00DD388D9326E4BAA21CC6580957661DAF4CC27E98379E161D8F1C8AFA37376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.2830.0\widevinecdm.dll
- Size 18.3MB
- SHA256 eb98fa2cfe142976b33fc3e15cf38a391f079e01cf61a82577b15107a98dea02
- MD5 9d76604a452d6fdad3cdad64dbdd68a1
- SHA1 dc7e98ad3cf8d7be84f6b3074158b7196356675b
- SHA512 edd0c26c0b1323344eb89f315876e9deb460817fc7c52faedadad34732797dad0d73906f63f832e7c877a37db4b2907c071748edfad81ea4009685385e9e9137
- SSDEEP 393216:FPRzXYeXFyjsrZuvpYl5SJIhw7PJeP9TZHZMaMq0Vrq8P:DFyjs0pYl1hwDJeVT7erq8P
- TLSH T1D817E04AE26310A4E85EDCF4827AD972D0743C4E0376A7EF16D876356E727C06B29F09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.2830.0\widevinecdm.dll.sig
- Size 1KB
- SHA256 d363751b0ee48517da1b56c17ffcd78dd57f25b092b09879667db10338077621
- MD5 a19ec48b4b28f3aa9c32150dca8c0e39
- SHA1 02981e40b643c2a987d47bf58f42b7f3ca5aaf07
- SHA512 718a24e1fb45ab0fd3db5a5c45b0e0061d9061d8615e2a8d6db2150bf72267e96774094a6fc07a250d5bbbc5133a1cb635d8f7adc5b1751fa99327fce9555941
- TLSH T1F52196EDBE6421545984963E1FECE022DE3131C2B93018BB466BA3C3789336025C437D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
- Size 12KB
- SHA256 1651935a5f0e829abce52ad43d320e095850994a9d7a0d77e2341c22b7b2e551
- MD5 897e3b9d39715b6ab4747df73d9bcf70
- SHA1 93e194197fcdcb74c9acb3b887b48d19e18b0ce9
- SHA512 b5c352f36e96948330e4544a068088198d2b8b29df33c522f1031c6dec1a0bc0331db675b9466bb90d1ff4e4175f230b86fc02f58e6c6da323dfa6fad1956988
- SSDEEP 192:xWWCRnfO9nbtnSSLLRFkjz1Bw88P9o1GDE:ECRebwFZA
- TLSH T1F642BC3856008B3F34B3327DAC2549B059A54237B6BFBCD625F99891045DF2841F6EEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
- Size 6KB
- SHA256 2a210849525e0eba545944245fa0e98df9e243c0dcaa7f3d554e270dadd107ea
- MD5 71b5a14b9b830cdfea0eb954cb045cba
- SHA1 86183893d9192edfd523c273fa2732621e6fc94d
- SHA512 9a1e5c75419ca214b13a20dfe3ff29d9e59a31432cf4665018a2ad52f94d97efae9b7fe740265c5c6cc509061b314999b924b0c1e75bf336ed11f80ae4b4518b
- SSDEEP 96:xHgUTUPWPqGqnfLbt1zStSSladv9jXon3H8RNBw88n8L4cnFpC:yfWCRnfLbtQSSgc8HBw885
- TLSH T156E11E789508CB7F64B6776CAC688871AAB2013B7BBF68C650B554C4054CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
- Size 7KB
- SHA256 3cc8a085e5e42d4ba653a23a887594c3a6aa15538c4b42aeba71b41f616b0a4b
- MD5 c45546da298e2c4f83d2d409548946e0
- SHA1 7ccb9ea4fa805d2b66b56bf3c28773b7511460b1
- SHA512 c03ed53df8f0fec82f3cc87e20200cc68b1ec25622e4d0d8b8fdb08a5447a95c1f4b3cc52cb967f09c02c697db6254d39e4b10432d19f0ac27cb2102f751b681
- SSDEEP 96:xHgxTUPWPqGqnfLbtObzStSSladv9jXon3H8RNBw88BB8L4cnFKnC:yWWCRnfLbtnSSgc8HBw884
- TLSH T134F1FD789504CB7F74B6776CAC6488716AB2023BB6BF68D650B954C4050CF3842F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
- Size 7KB
- SHA256 0d1d10e7bdc7cf564e82ca5b7cee68e242feae6eed251447bda7a4a523ff0759
- MD5 d73f54630cb675800de2181a435236e1
- SHA1 358434b7ac744033a1216095cc6b8464d19ac495
- SHA512 c6dcae99e22fa2dba160bad300ad4215321d7c36736f17e05ed13685cf0dfaa2397647cf9caa4c4b76f8856680097434598f3023d2fd4825c645e034eda128e9
- SSDEEP 96:xHgxTUPWPqGqnfO9nbtObzStSSladv9jXon3H8RIBw88BY/8L4cnFKnC:yWWCRnfO9nbtnSSgc8OBw88Z
- TLSH T1EAF1ED789504CB7F74B6377CAC2489715AB2023BB6BF68D650B954C4054CF3842F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
- Size 12KB
- SHA256 f0b99c5c3ce2844eea306fb08064730f594bb4ffa35c23fe83a44750408d7df5
- MD5 5f83ad8e2453941b90f75ab990425aed
- SHA1 eaba3adf378a8971030311095d6f7a15adde98b4
- SHA512 6eb914c17250cc26e38808c5ae00012db4ffcc65bdff43591cec1ebe43b7552544bf22257cb714577f31a7b5fb3b39a718f0fde172f191069e9a32e474971f1d
- SSDEEP 192:xWWCRnfO9nbtTSSALRFkZ3ecOBw88L78Vqfy:EXRLwvhq
- TLSH T11642DB3C5604CB3F20B232BDAC2549B079A10227B6BFBCD255F99891445DF6441FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
- Size 12KB
- SHA256 77d980c32284d5381796025ae8aadb57a90f2c04cf20ea9d1964c2b423cc4ef0
- MD5 2a656612ecd031e27185eb08e0492608
- SHA1 44824b9fae877dce41be0d43c31c8d761ea1aea6
- SHA512 ab71f83096f751bfc787f7426aaf5f6209a05914ef18f200a9e9ee2d15ae554081d7975d63bafb41008f210536f6dee174721a7421875ef1cf5a8a5d1d80313e
- SSDEEP 192:xWWCRnfO9nbtoSSgLRFkZ3ecOBw88L78Vqfy:EyRLwvhq
- TLSH T11842EB3C5604CB3F20B232BDAC2549B079A10237B6BFBCD255F99881445DF6441FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
- Size 12KB
- SHA256 8fe43c01e4996033f3f6264e2ef451fd27edf10d32152d519d2d138ef7f8dd60
- MD5 293d3f64aa9b3e89853aa97a1a4cca94
- SHA1 bd204c7b8975a2bceae2b15be42d0fb5fa8e1e62
- SHA512 31c924e6a6481362aa03e0c4d6dec5b6c8eb8a87f627be834517806efc61a1af59f4b51ee659156c6667d8fe65354e2351e018ea135fc223aa80693a64d36bb9
- SSDEEP 192:xWWCRnfO9nbtUSS5LRFkZ3ecOBw88L78Vqfy:E/RLwvhq
- TLSH T18442DB3C5604CB3F20B232BDAC2549B079A10237B6BFBCD255F99891445DF6441FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
- Size 6KB
- SHA256 7e8cd9e3e621276cd57f6df68248d8cacdc63deaaa219e0ff09d50dd92577b86
- MD5 7824772bef12690da530b2abebb7bc5f
- SHA1 c009d134893533a4cddae9473624490703115537
- SHA512 447f6c08bf30fa11876e98ee5df0a4b3bdeae16c7d915487348fc8e2a3b0fce0fcb3dc4deb81123779df0da3c82f6bb1642c1263e90d70c6589043cbedcd0c6e
- SSDEEP 96:xHgUTUPDqGqnfLLy1zS/SSladv9jfkn3H8RNBw88n8L4cnFpC:yfORnfLLy6SSb8HBw885
- TLSH T198E11F7895088F6F64B6776CAC688871AAB2013B77BF68C650B554C4015CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 1KB
- SHA256 6a202ef9fd273a15fa5b070df4657ea327438ce94bb4a54191647315ab145377
- MD5 cd790086fe2f354050c27b33981f9b5b
- SHA1 bea634bcc16684afb504a982ee1eaa806d7ff165
- SHA512 99e6a9071ef682684c43edd3e2f82142db309a4793d75c9e8f4a4f9e0b611de225bf8305f918ff795def208c9d64efcf11ca317816895a79715f0cd4d4edc2ca
- TLSH T15C21E9D358B73DF03A52955D808E4FF997543035447858F0C94E8A4AA0CFA4F73CA80C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 1KB
- SHA256 86f4bb17df21742ed7ed724ac4db5f76390c545922179ebebef88af905f96286
- MD5 46ea292719fdf399ba27175fb25297be
- SHA1 738367f59aee7a298340c32f40c40a8703b499ea
- SHA512 6c695f674aa96608060c9a63933cabea6c19b7e68268651336609f81e578c196081b883c4ec0de006e9b83936b91b6a13c3a923ea804a4afe34c341b35ab7f1d
- TLSH T18421B79398F73EF97BA25118D4488FF1DB95346248750CE0C94BDD4122AF59AB3CF118
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 29KB
- SHA256 710f91b3f1227848c217c1873b7c517ab87b44302a3e1243dc3b8fa10225787b
- MD5 257788f70803dc4df930dd3ded3bc6a3
- SHA1 e2e0b517cf9c518cd0d734536c6baa78d1f60a23
- SHA512 46f28eac407bc9c62ec8e471f1a14ff06571122e962816a78b981ff991fde4ea58f5a3f9735e86dd677c1dd3776891280dee158b30e0d85b694b2171b0a6fccc
- SSDEEP 768:+RSY5qsD9K0eLoC2zg/7wxWMgusXyt451kLUyQZA8:czQb8Bd/f+RA8
- TLSH T140D2D0139E4A2EFAFEA60508C0FE150E4BF1A11784753096BB53795FEC73DA9410DA2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 29KB
- SHA256 1be747c281223173ff2a19b309dfa69a6514504b54e45263dff1cae4c3a4887c
- MD5 73591a51a88edab60063a2c9dfc94e2e
- SHA1 2e91cc16b7fe195fb445d2424ed147b73f6ec5b2
- SHA512 22efdde6fb1b7f241a0b495be031a208753aff2c213d36bd16fcfb108360b5989279e50b786a689a9bcc9db9c9fc156941c5a0c66c5f0e90915e465f426aa93c
- SSDEEP 768:+RSY/qsD9K0eLoC2zg/7wxWMgusXyt451kLUyQZA8:clQb8Bd/f+RA8
- TLSH T107D2D013DE4A2EFAFEA60508C0FE110E4BF1A11784653086BB53795FEC73DA9410DA2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 29KB
- SHA256 b1a3bb478603a9c0413ec3b98161b9012caf3a55c34ef1e290a2a6aa6df77d2a
- MD5 2b2fc3e986b1fbecc579244c09879833
- SHA1 3858a27e8547d4def7a6ac10f36527e50495e6cd
- SHA512 c7c944e4907044c6f562ac0be43c0c95f80ad63e090dd4c15de5b4753a9d363744fadedb2c42b54eb6664b6068446af28ca376716f571e44599e1d76c93042b1
- SSDEEP 768:+RSYOqsD9K0eLoC2zg/7wxWMgusXyt451kLUyQZAG:ckQb8Bd/f+RAG
- TLSH T1DCD2D013DE4A2EFAFEA60508C0FE150E4BF1A11784653086BB53795FEC73DA94109A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 29KB
- SHA256 ee4a4553c8626b0bce5cfa5c66e825a000d1082f509e1850aa246fcac879b4a4
- MD5 411fd14e35b4286b4c336a756e1329bc
- SHA1 2ed1dc7b102fb45e6860f5eb07849dc2c74c047b
- SHA512 bf1d708ad77d7b6147f0fd002c311e75163e5d7c40198ae8b8900326e164ffd66057c2348551069ccbd483b20df19e9aebf0c8bba272bda4137729847e864273
- SSDEEP 768:FRxGgppE9K0eLoC2zg/7wxWMgusXyt451kLUyQZAK:ZGSxb8Bd/f+RAK
- TLSH T1CCD2D0139E4A2EF6FEA60508C0FE110D4BF1A11B84653092BB53795FEC77DA94149A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 30KB
- SHA256 d095465bef007d44dd06ed6108e0745ec2c674f897dfb6d4aaee7524bb6ae06d
- MD5 7c81ecdac8f5233e6847d663232ce665
- SHA1 8ebf483a4d7259accdf608047b24ea7b0ce5c803
- SHA512 7b657da2a3cffdb304cb9984fb7afc8c2fb2ebc721f9227dc087c7bc639b58e5f2332492f4c03e833bf3d6db02c52b287c134426f8b4b1da9e32d32fe44cf392
- SSDEEP 768:ZOGlppE9K0eLoC2zg/7wxWMgusXyt451kLUyQZAz:AGdxb8Bd/f+RAz
- TLSH T14DD2E0039E4A2EF6FB960408C0FE210D4BF0A01B85A530D2BB63795FAC77D99414DB6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 29KB
- SHA256 8abe1d721b2584051eb71c10f7d96e742323d95b9b80906454a64b541e6788de
- MD5 667246cd7776247f4375144f89cae7f5
- SHA1 b49bd91ce0c23bfb29a7773fe644ff5932ab10d9
- SHA512 c87e46c5369d10c417dc174bb8d0926ce44a9f32e70f683f35634a251b050696bd44265565a602b494777e67379461943a91cd1affca85b0d2f77da81884ff95
- SSDEEP 768:LOGJT5R9K0eLoC2zg/7wxWMgusXyt451kLUyQZAz:KGzeb8Bd/f+RAz
- TLSH T10BD2D0039E4A2DF6FBA60508C0FE250D4BF0915B85A530D2BB63795FAC77DA9410DB2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 30KB
- SHA256 30b4f8283bbd100c7b11a6603a6a63683d40eafb4f2b422e7b0e544a6c3e7c9e
- MD5 9f4b773d6e5779c2ad6f324c2a7a3585
- SHA1 82b087b7f004491e26921b02b215139182dcf722
- SHA512 27fee99ae043e995bf6b883c371608c83e29a0e50fa8501050b225bf231d085dea088a4cd0196850c71e62c0e6c27931f426087c10660d6ad8f0f8a18c518a7b
- SSDEEP 768:8OGnu+4m9K0eLoC2zg/7wxWMgusXyt451kLUyQZAj:7G0Tb8Bd/f+RAj
- TLSH T1FED2D003AE4A2DF6FE960509C0FE250D4BF0901B85A530D6BB63755F9C77D99410DA2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 30KB
- SHA256 b6904a11b2f66e6c57199f7678695c5071ab4bbd882fa325469716c921249660
- MD5 0d802bd93e9161c9d53707c38b51d587
- SHA1 e9c6bd3a62f145307465fb117cb0271aececa5e7
- SHA512 80bdbe60759f950171897b0b12881e4f6c4c6139da9e82bfeaaf5de4abd7034cd035eba1785f4662fab54ecc71f495515e8e95bae83e6bcab3d491f3028866b8
- SSDEEP 768:LOGnfd2WO9K0eLoC2zg/7wxWMgusXyt451kLUyQZAZ:KGJrb8Bd/f+RAZ
- TLSH T1C1D2D0139E4A2DF6FAA60508C0FE210D4BF1901B85A530D2BB63755FAC77D99410EB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 30KB
- SHA256 3a8322ee0883c043c2576643babb56cccd0c8f9a33dbb531295ee0358e453865
- MD5 05ab9dcd1ea49a1319e59c9bd7f3b99e
- SHA1 c41f11dea7af0c7114a7ea6b7dec5258591aa249
- SHA512 803023f0edeba3df55943f0345c26e2ce1f6fadfb76b27071c34ed3d319daffe21822e14cb645325500b12f7e7260822cfdb17a4beab0e89b7cb4016f0194fe4
- SSDEEP 768:VOGnSnj8ey9K0eLoC2zg/7wxWMgusXyt451kLUyQZAs:UGuVPb8Bd/f+RAs
- TLSH T1ABD2D013AE4A2DF6FBA60109C0FE250D4BF0901B85A530D6BB63755FAC77D99410EB2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 30KB
- SHA256 ffc0aadc40a60d9027f44e2fe21fa26820fcc9a55ea70eb298524936edbb1bb6
- MD5 56d19fae80c70a71011e18f9d17b7fc8
- SHA1 e562f263d3f5a7f2665dda40099028ed37d64e8e
- SHA512 47a17307601602b72e71ae9a48dbd33584db6b79d820fdb194a9c0f756b69bcad2dae991704644fd6df735f65337685ba8d8434c0c5027535f90c2072b0e8d8e
- SSDEEP 768:OOGnSfj8ey9K0eLoC2zg/7wxWMgusXyt451kLUyQZAY:NG+VPb8Bd/f+RAY
- TLSH T1AAD2D013AE4A2DF6FBA60109C0FE250D4BF0901B85A530D6BB63755FAC77D99410EB2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 30KB
- SHA256 a645a593bca5de4578d3f78254f01b73c31bb609f4142d5774a0cb87c46dde2b
- MD5 cad6028ec1974fc266349aa289cd6cab
- SHA1 71494d1f7ec4ebb7e17e67af32c228f3a139e071
- SHA512 f117fe1f90547a6a440b63db3469ce795a1c573ab3ea6f5d4d6f86dc75a710d109c1faa06d4a26cbbc9e0184d475cc392fc64a58124f21a13fb42d79b83756a9
- SSDEEP 768:bOGnSfj8ey9K0eLoC2zg/7wxWMgusXyt451kLUyQZAEp:aG+VPb8Bd/f+RAEp
- TLSH T10AE2D0139E4A2DF6FAA60109C0FE250D4BF0905B88A530D6BB63755F9C77D99410DB2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 39KB
- SHA256 b0c6f56338e0797b01abd938bc5bf517c932d3934e773f5cce3b997e8ac3c51b
- MD5 5f5d7add2fffee36e3d3e7253579f9ea
- SHA1 cf5ade7ce0a8f17be28b2bd9294286bfd8938d75
- SHA512 2585e74c11fd9c68e81d7688b467fb76623a334ea98d772b6bf767c98e0433e73a2d1a97ee6f0e808378be991898b58cadb901b5452a42365c0c9dc803427718
- SSDEEP 768:H4VQ+jpn4AFKM1aHNOoe+BLHM4IgPKdpPX5NgMD0ybg/ffCnN2:HVM1atTeSf4XMugH6nw
- TLSH T11703C0234F097DF67F680519C0EF2A4D0BD0E05348367089F7937EAA48BEE59860DA9D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 d4188dafc647d36a5f952b0ef31fd62d08e428f578cf383af1a875bc682480a1
- MD5 6eed508af1054b1fcfcb627079eeed7f
- SHA1 96b426f14ef53b9b1395c89549328383984083ed
- SHA512 aaf62829c6833b08395f5a2dfc2cb864da1a64b43530e87a7b1ca02e919a2f9b7e94fdf80e674a862137327ea830668c698a90c412151815c09b99560b5d4818
- TLSH T17521B793987B3EF57B724559C0884BF19B45313340750CE0DD8A8D0662CE889A38A519
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\storage\default\https+++chatgpt.com\ls\usage
- Size 12B
- SHA256 073547a751fb90e67afbd6fa04bdaa7a689e95725d851e24c801d4ec38483ccd
- MD5 3c584a822e18ccd9ed12665140d93b08
- SHA1 8e7deed2d78330e40d1891d9b2b3d09ea01364e4
- SHA512 1a117dc1f91d238b9b6c308a74daed7d1a63c6819b9f333d4a3f1c6e842e513d3ed45f5452eb64b8baacb2517b8a4c03c92b1ef4662c72634a83ad5448110267
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 6.4MB
- SHA256 c84cc6875f18fe00846ec2762c6e31c07204601c82fec289279368a301321988
- MD5 5ddbfbd2c82de6da08dc760aef5b0e33
- SHA1 ca49d51ee8076aa4a7d3fff8e493041b549fb7b5
- SHA512 c45cfdb25aa66468102b7adfecf0b1576df1d85ef9b9d067e61db6873ebb02c27a94f993a2f31b11e5b37a50df396d48896af1baa02ef0268ffbd96ee0eefe69
- SSDEEP 49152:EL9LyHaeUT6QC5zYYoWvJ5bpaLHefHgJR62hOCs1PFnzH94LsAjCdENTgva9AFeW:cm9tAjCdENTgTKva
- TLSH T1AB665CE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\5VGFjrfG.zip.part
- Size 9KB
- SHA256 65ee23fec4e8440fb4b29ef695015512228f45de900d0c2963eea2793384a36b
- MD5 bdc6ff4a644226959d3d134cac67ddb1
- SHA1 66c5d2913da67716bc15856df1c532803ec18d12
- SHA512 21e6f34448bc209ce156c289cb4f450efc320a021e96dda340655af92658a509dd7405548b75a2d581ff6cf31e1a1e96e5914d8b12a0440c98fe23e43233aec9
- SSDEEP 192:AA8H3S6eoORexMqS6FNRXqkQ8lJ974IiTKcNQI+W97:AAKFeoOgHFNRXzJ974IBSQI+W97
- TLSH T1BE22B736E469BD11EE3FF371418E8E0982D5562B0D083A9E3F70461979FE6C02BB5B42
- MD5 SHA1 SHA512 SSDEEP TLSH