Analysis
- user interaction
yes - max time kernel
900s - max time network
903s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 06:45
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
900 seconds
General
- Target sample.html
- Size 165KB
- Sample260809-hjkrdaseph
- SHA256 11d3073cef62844edce38889679f7405d2970e3b831e443a26fbde840e13a053
- MD5 fe323d0be71c6b0472f2aa278759e91f
- SHA1 78fbedb57201aa41e453387642a74e8f0e2b694a
- SHA512 7c2c088882fe848dbd8e1dcad8e0e202c63bcaeb3599a65d86e4c4a29f67e7fbfa7828c9c630f2a56a3cf2c853b47eb45b66661197b1829e6792406e557c9514
- SSDEEP 1536:MgvgZ4KbwiVAUE7eIpRfsKquPKquPKquPKquLJ4OC3lNzsP3/Hl8EC3saS7gzlpT:Y4KbhZE7eIffs4OYT3mIzI6y0
- TLSH T103F3C77FE5C44007153309F0F6B4770C6EDB918BE9CB4D87ABBC4A0A6BC6DA7A814958
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 16 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 13 discord.com 47 discord.com 461 discord.com 1 discord.com 14 discord.com 119 discord.com 120 discord.com 424 discord.com 12 discord.com 52 discord.com 162 discord.com 400 discord.com 401 discord.com 8 discord.com 15 discord.com 54 discord.com - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe - Looks up external IP address via web service 1 TTPs 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 54 whatismyipaddress.com 184 whatismyipaddress.com 189 whatismyipaddress.com 1 whatismyipaddress.com 27 whatismyipaddress.com 188 whatismyipaddress.com 359 whatismyipaddress.com 360 whatismyipaddress.com 16 whatismyipaddress.com 52 whatismyipaddress.com - Checks SCSI registry key(s) 3 TTPs 44 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID ShellHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID ShellHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe - Checks processor information in registry 2 TTPs 55 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\DOMStorage TextInputHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1" TextInputHost.exe - Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ firefox.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1520 TextInputHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1520 TextInputHost.exe 1520 TextInputHost.exe - Suspicious behavior: LoadsDriver 10 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 816 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found - Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 4736 firefox.exe Token: SeDebugPrivilege 4736 firefox.exe Token: SeDebugPrivilege 4736 firefox.exe Token: SeDebugPrivilege 4736 firefox.exe Token: SeDebugPrivilege 4736 firefox.exe Token: SeDebugPrivilege 4736 firefox.exe Token: SeDebugPrivilege 4736 firefox.exe Token: SeDebugPrivilege 4736 firefox.exe Token: SeDebugPrivilege 4736 firefox.exe Token: SeDebugPrivilege 4736 firefox.exe Token: SeDebugPrivilege 4736 firefox.exe Token: SeShutdownPrivilege 4048 ShellHost.exe Token: SeCreatePagefilePrivilege 4048 ShellHost.exe Token: SeShutdownPrivilege 4048 ShellHost.exe Token: SeCreatePagefilePrivilege 4048 ShellHost.exe Token: SeShutdownPrivilege 4048 ShellHost.exe Token: SeCreatePagefilePrivilege 4048 ShellHost.exe Token: SeShutdownPrivilege 4048 ShellHost.exe Token: SeCreatePagefilePrivilege 4048 ShellHost.exe Token: SeShutdownPrivilege 4048 ShellHost.exe Token: SeCreatePagefilePrivilege 4048 ShellHost.exe Token: SeShutdownPrivilege 4048 ShellHost.exe Token: SeCreatePagefilePrivilege 4048 ShellHost.exe Token: SeShutdownPrivilege 4048 ShellHost.exe Token: SeCreatePagefilePrivilege 4048 ShellHost.exe Token: SeShutdownPrivilege 4048 ShellHost.exe Token: SeCreatePagefilePrivilege 4048 ShellHost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 1520 TextInputHost.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 1520 TextInputHost.exe 1520 TextInputHost.exe 1520 TextInputHost.exe 1520 TextInputHost.exe 1520 TextInputHost.exe 1520 TextInputHost.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4048 ShellHost.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe 4736 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5732 wrote to memory of 4736 5732 firefox.exe 88 PID 5732 wrote to memory of 4736 5732 firefox.exe 88 PID 4736 wrote to memory of 2032 4736 firefox.exe 90 PID 4736 wrote to memory of 2032 4736 firefox.exe 90 PID 4736 wrote to memory of 2032 4736 firefox.exe 90 PID 4736 wrote to memory of 5688 4736 firefox.exe 91 PID 4736 wrote to memory of 5688 4736 firefox.exe 91 PID 4736 wrote to memory of 5688 4736 firefox.exe 91 PID 4736 wrote to memory of 5688 4736 firefox.exe 91 PID 4736 wrote to memory of 4532 4736 firefox.exe 92 PID 4736 wrote to memory of 4532 4736 firefox.exe 92 PID 4736 wrote to memory of 4532 4736 firefox.exe 92 PID 4736 wrote to memory of 4532 4736 firefox.exe 92 PID 4736 wrote to memory of 3328 4736 firefox.exe 93 PID 4736 wrote to memory of 3328 4736 firefox.exe 93 PID 4736 wrote to memory of 3328 4736 firefox.exe 93 PID 4736 wrote to memory of 4656 4736 firefox.exe 94 PID 4736 wrote to memory of 4656 4736 firefox.exe 94 PID 4736 wrote to memory of 4656 4736 firefox.exe 94 PID 4736 wrote to memory of 4656 4736 firefox.exe 94 PID 4736 wrote to memory of 5536 4736 firefox.exe 95 PID 4736 wrote to memory of 5536 4736 firefox.exe 95 PID 4736 wrote to memory of 5536 4736 firefox.exe 95 PID 4736 wrote to memory of 5536 4736 firefox.exe 95 PID 4736 wrote to memory of 4812 4736 firefox.exe 96 PID 4736 wrote to memory of 4812 4736 firefox.exe 96 PID 4736 wrote to memory of 4812 4736 firefox.exe 96 PID 4736 wrote to memory of 4812 4736 firefox.exe 96 PID 4736 wrote to memory of 3428 4736 firefox.exe 97 PID 4736 wrote to memory of 3428 4736 firefox.exe 97 PID 4736 wrote to memory of 3428 4736 firefox.exe 97 PID 4736 wrote to memory of 3428 4736 firefox.exe 97 PID 4736 wrote to memory of 3020 4736 firefox.exe 98 PID 4736 wrote to memory of 3020 4736 firefox.exe 98 PID 4736 wrote to memory of 3020 4736 firefox.exe 98 PID 4736 wrote to memory of 3020 4736 firefox.exe 98 PID 4736 wrote to memory of 3312 4736 firefox.exe 99 PID 4736 wrote to memory of 3312 4736 firefox.exe 99 PID 4736 wrote to memory of 3312 4736 firefox.exe 99 PID 4736 wrote to memory of 3312 4736 firefox.exe 99 PID 4736 wrote to memory of 6016 4736 firefox.exe 101 PID 4736 wrote to memory of 6016 4736 firefox.exe 101 PID 4736 wrote to memory of 6016 4736 firefox.exe 101 PID 4736 wrote to memory of 6016 4736 firefox.exe 101 PID 4736 wrote to memory of 2400 4736 firefox.exe 102 PID 4736 wrote to memory of 2400 4736 firefox.exe 102 PID 4736 wrote to memory of 2400 4736 firefox.exe 102 PID 4736 wrote to memory of 2400 4736 firefox.exe 102 PID 4736 wrote to memory of 4692 4736 firefox.exe 103 PID 4736 wrote to memory of 4692 4736 firefox.exe 103 PID 4736 wrote to memory of 4692 4736 firefox.exe 103 PID 4736 wrote to memory of 4692 4736 firefox.exe 103 PID 4736 wrote to memory of 1228 4736 firefox.exe 104 PID 4736 wrote to memory of 1228 4736 firefox.exe 104 PID 4736 wrote to memory of 1228 4736 firefox.exe 104 PID 4736 wrote to memory of 1228 4736 firefox.exe 104 PID 4736 wrote to memory of 5312 4736 firefox.exe 105 PID 4736 wrote to memory of 5312 4736 firefox.exe 105 PID 4736 wrote to memory of 5312 4736 firefox.exe 105 PID 4736 wrote to memory of 5312 4736 firefox.exe 105 PID 4736 wrote to memory of 5224 4736 firefox.exe 106 PID 4736 wrote to memory of 5224 4736 firefox.exe 106 PID 4736 wrote to memory of 5224 4736 firefox.exe 106 PID 4736 wrote to memory of 5224 4736 firefox.exe 106 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\sample.html"1⤵
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\sample.html2⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27061 -prefMapHandle 1964 -prefMapSize 270140 -ipcHandle 2036 -initialChannelId {597c6d3c-e1f8-413a-9702-ea7d742d7930} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:2032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27097 -prefMapHandle 2436 -prefMapSize 270140 -ipcHandle 2444 -initialChannelId {0ab7f7c6-0568-479b-88ef-17218cf717b2} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:5688
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27238 -prefMapHandle 3844 -prefMapSize 270140 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {bdde97a8-8f90-49ed-a69c-50d247ad8775} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:4532
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27238 -prefMapHandle 4012 -prefMapSize 270140 -ipcHandle 4080 -initialChannelId {5e2a846e-bd5e-4738-84b7-58e00d700318} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:3328
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4584 -prefsLen 34858 -prefMapHandle 4588 -prefMapSize 270140 -jsInitHandle 4592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4664 -initialChannelId {4192c3b5-b0b1-4c8d-9df0-c893064d15e3} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:4656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5576 -prefsLen 35130 -prefMapHandle 5764 -prefMapSize 270140 -ipcHandle 5776 -initialChannelId {5eddcb2d-a3ac-4dbe-b60a-cefee4f38faa} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:5536
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3168 -prefsLen 33071 -prefMapHandle 6000 -prefMapSize 270140 -jsInitHandle 5740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5652 -initialChannelId {eaf8e80b-82b0-4c3b-8f59-83094c3d75ec} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:4812
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6164 -prefsLen 33071 -prefMapHandle 6168 -prefMapSize 270140 -jsInitHandle 6172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6180 -initialChannelId {c3a41ac3-459c-4a22-96d5-474e7ab4558d} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:3428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6352 -prefsLen 33071 -prefMapHandle 6356 -prefMapSize 270140 -jsInitHandle 6360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6368 -initialChannelId {17313c6e-9e6c-43ab-a83b-f493db1632e0} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:3020
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3972 -prefsLen 35199 -prefMapHandle 3976 -prefMapSize 270140 -jsInitHandle 3960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3948 -initialChannelId {b849e81f-5dad-44d9-b82e-30420fb20fd2} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:3312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6988 -prefsLen 36955 -prefMapHandle 2660 -prefMapSize 270140 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6848 -initialChannelId {8653527c-cdd5-4a54-945a-5b91f368f375} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
PID:6016
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7200 -prefsLen 36955 -prefMapHandle 7300 -prefMapSize 270140 -jsInitHandle 7304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7208 -initialChannelId {20b50680-dc41-411c-acad-6014d6990534} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
PID:2400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7448 -prefsLen 40093 -prefMapHandle 5296 -prefMapSize 270140 -ipcHandle 7232 -initialChannelId {4fa3ddc0-90fb-49ed-b559-33539616fbb4} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility3⤵
- Checks processor information in registry
PID:4692
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7924 -prefsLen 37006 -prefMapHandle 7928 -prefMapSize 270140 -jsInitHandle 7932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6132 -initialChannelId {88176d11-185c-4e91-8135-a12a152ae67d} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
PID:1228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7624 -prefsLen 37006 -prefMapHandle 7232 -prefMapSize 270140 -jsInitHandle 1620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5356 -initialChannelId {ce7cfafd-39a7-4a85-8293-1c614d508986} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
PID:5312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6404 -prefsLen 37006 -prefMapHandle 6456 -prefMapSize 270140 -jsInitHandle 6444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6420 -initialChannelId {8ad5afce-dd83-44e9-9ded-7187fbefe930} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
PID:5224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7408 -prefsLen 37006 -prefMapHandle 7404 -prefMapSize 270140 -jsInitHandle 7324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7332 -initialChannelId {48db216f-e0b1-40fc-8bc0-5917307f370e} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
PID:3392
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7884 -prefsLen 37006 -prefMapHandle 6476 -prefMapSize 270140 -jsInitHandle 8132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7676 -initialChannelId {d2a9e329-c2c1-49e1-8177-ae412e5aaf4f} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
- Checks processor information in registry
PID:5664
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5364 -prefsLen 37166 -prefMapHandle 7908 -prefMapSize 270140 -jsInitHandle 6520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7132 -initialChannelId {fe6e1d27-75f2-4b65-9210-7250fb961271} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
- Checks processor information in registry
PID:4212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6056 -prefsLen 37488 -prefMapHandle 3108 -prefMapSize 270140 -jsInitHandle 8100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20036 -initialChannelId {11583bc8-9778-4c0a-8026-a51a655df3e1} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab3⤵
- Checks processor information in registry
PID:7020
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20828 -prefsLen 37488 -prefMapHandle 21880 -prefMapSize 270140 -jsInitHandle 21884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7760 -initialChannelId {a2a7bc69-0b5a-47ab-aaec-0d2d4c989eee} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab3⤵
- Checks processor information in registry
PID:5768
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6228 -prefsLen 37488 -prefMapHandle 6184 -prefMapSize 270140 -jsInitHandle 6852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20688 -initialChannelId {e8e34084-62b8-4499-a510-13ba2066b4b2} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab3⤵
- Checks processor information in registry
PID:7156
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19712 -prefsLen 37488 -prefMapHandle 19620 -prefMapSize 270140 -jsInitHandle 19344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19640 -initialChannelId {03767dfa-5e24-44e8-9f1e-eb0d74bd248f} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab3⤵
- Checks processor information in registry
PID:6268
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8312 -prefsLen 37488 -prefMapHandle 20072 -prefMapSize 270140 -jsInitHandle 19528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20064 -initialChannelId {00dbbabd-fc37-4deb-831f-a272706d2007} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab3⤵
- Checks processor information in registry
PID:3380
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6540 -prefsLen 37488 -prefMapHandle 20160 -prefMapSize 270140 -jsInitHandle 20352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20144 -initialChannelId {b710d657-178d-4fa1-8050-281fe315946f} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab3⤵
- Checks processor information in registry
PID:3832
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14188 -prefsLen 37488 -prefMapHandle 22092 -prefMapSize 270140 -jsInitHandle 14036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13932 -initialChannelId {2fffcb9a-9e41-48b7-b1cb-9ee85aaca0cb} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab3⤵
- Checks processor information in registry
PID:6716
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14100 -prefsLen 37488 -prefMapHandle 14104 -prefMapSize 270140 -jsInitHandle 14068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 22048 -initialChannelId {9749d5b3-9374-49b8-a918-b773335b09a0} -parentPid 4736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab3⤵
- Checks processor information in registry
PID:2920
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5076
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:2612
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca1⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1520
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:7040
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵PID:3432
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F41⤵PID:5176
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4048
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:2228
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding1⤵PID:6532
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F41⤵PID:2568
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:6704
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\activity-stream.contile.json
- Size 4KB
- SHA256 ae7186853066e2cd0283ccef4f34d25174c501320a9e96a3024f5b848ca73eb2
- MD5 5df531638241c2df95ae6098f2e183c4
- SHA1 e4524f0dc2d3393bd0223a0acf56fd02da7917e4
- SHA512 6ace1a04f14156223d357d5464965b89ece766bf5150841c7ab2d239ad46bbbd77afdcf040e1fc9fe1b732de9630f2953911610e540b8575130e9ef4cb4482d3
- SSDEEP 96:TsOCBudAACZilY7mT+mRCpomKYm4C/06D0Vb:IwdqElQmRCOrcw0Vb
- TLSH T156A1FCAFD86545525712ABD03C4B1B28E283B187D7E9CB5CF3557E22409C72D019CCC9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\activity-stream.discovery_stream.json
- Size 75KB
- SHA256 2a5b7d1320b9167a6baee1cb1fd802f2073a572f8c261507efde052093b2a67c
- MD5 a8e53085b655a8128986915228c6e1b1
- SHA1 5d94251af80b5b74f8af1d36706705a179dfd31d
- SHA512 ee7ddc4a31c15cd9bd0c351359b5c372a0822efb282600846ec9ccbb81cf313322107c1f8d4ab1698f7fbf65226f56c083b33c6a4df28da39448cb539a8fe71d
- SSDEEP 768:GywUWf/QkO4Z8dV533Rh0vnoRGCdbTP01bhBEaUQEzxthgzhLkIRFqiuU:dQ3vRv6jdXP0Sa4rOLkiuU
- TLSH T1E273F8A396E4B1BB0BE137CB2C0F795B62D64159E34909CCEDEDCE1C8198764023A5B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\doomed\4846
- Size 22KB
- SHA256 dfd644539da26ed757d998292740801d1fb8fc09c0e4608f921bd5f74240a87b
- MD5 285f03d7f2935223af2caca08a2fc070
- SHA1 7dd009a2a075933c083dc02e426209fa328525fa
- SHA512 2b27bd2941933dceb5b83b23be37c31bb3a6b96f3bd425bbcf12471d777adb47789cc1a5a8788177432d9489133fe497740401efd34ffaeef53b29059bcdfe08
- SSDEEP 384:HaRV2rd7b0Zck4C4TWwLVvi9k7M5h6F6OG0F6OO87NxWqWJ:EV2rl0ZcS4jLtYh6wf0wf87w
- TLSH T116A2B86E7D8A7243D9D3D16880A6AD1C8F73415EF751FBC4780B020A7E3827A7A5353A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\2A931695C1B20CBE1C27134F2AB95B9C00F5B7F7
- Size 11KB
- SHA256 82a2c106aba1722b91cc1a5900b59473da1b356be5d79c787dc2197aa7a32a09
- MD5 a072d1e2a0607f7a7c82d2a97bb71782
- SHA1 9a0fc69100727ce3dc1cf5ac751e18c59223a9a5
- SHA512 166e18a01328fbdbb25d0332a14e97179596f8f24c16a1f84faa4bed1b09024b6bd43a5822874684b6b58e8ebc5930b0115f4ffeb3fd5895ed145e19e0def889
- SSDEEP 192:bUQp8ai0Jigiq46120JOCLz7hVfDxUK8FQnQamtmTVVnFnQamtmTVVXWU587N6fQ:gaO0JHiq910S33gtwVRpgtwV187Nb
- TLSH T10C428E7F1D663F162BB1FBD18985A6592C01F943AFF2D2E5700812C1BD4C3F996264C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\479EA4DD22E7C1B395684491DAB945C6076FA710
- Size 24KB
- SHA256 2a047df80348b2072f20075c5fd862cdd7c8fc69babc42f789284254feb7c0f2
- MD5 cb0fab5544f4e77c07495e74036b913c
- SHA1 84381a13578c061d99f2fc7a0a9b6d3d0a99810a
- SHA512 31c4ac719c26ae90f9c3cbeda69754f1e5d3040f5abf00f6fd6d8815e7a0b59f9e74bf8eac4855531b9ea05f3e272a4ee2dff7accb26be096ef36034389c63ae
- SSDEEP 768:wUQ7u5RDqgt0Rpgt0187zp17z41NwA1naXMF4gYp17z41NwA1naXMF4gh:f5r0RI01Y1Q1NwA1na24z1Q1NwA1na2p
- TLSH T10CB208FB081A1A4C2F7987CA8A1A325CF837614D7CC9EDE5E0515D1A6888FF7F009E95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
- Size 16KB
- SHA256 266e5a511cd58c64ac33a18e57f9346d1e910714b0ae8c96a18b4b65834f1c94
- MD5 da370b004180d79fdc8215653a6b057b
- SHA1 653b4638fe682a73e41b63a3f021b241ecaf8d77
- SHA512 4475badbda9964fc2c694f51b52fea7dad57e7e459edd7b69953461ff931f7c61ad52570fd57919022a03a1075f352f33bda8470b1e5e3430799db12e1cd5f68
- SSDEEP 384:HwCe7iO024YvDL84KKDL849B7SOEAd9KVRaAcP+AWRMAC49:QqZYvDL8lKDL8CB7S/AmVAf+hRM/49
- TLSH T14F729E3D9F413CAC2597C0E8C5F882DA4C18B6A7CFE6806D21683D0DC7989A9B1F549F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\53FAE09009DE1901ACE92F1730AC9F987AC2FC4B
- Size 2.5MB
- SHA256 7be596259a3f4cddd4570c0634ded9e46ab392f33bc01a51059a31fbcb4ecdf5
- MD5 4dacc6da4239177440a1d0b68f601a29
- SHA1 5c33f2230095657a0711d38ee98eab39a0339bd9
- SHA512 f6f24b5962519d693d6e6d1c30fc15fd33383a66fdce37dee2766290db81831146303ebc6d2c418706648f8cba05331db3469dd3aefc0cd4b1a1cf6f5518de7f
- SSDEEP 24576:9NSY8soO83XrNV6q5oZBue3xVu+CWNIMX5NAMAnC91+Y15ZYs+lDa6jBjdKH2MG:zzotnRVRofuUbp6jBjdKW7
- TLSH T16EC5F727DE856F53C8A482B880AB23753A74E0866FD3F72B65DF7021BC193794D6216C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\5617C2BB77122AC13DC0FB65336A8386EC872F9E
- Size 22KB
- SHA256 4065e3a1ccd450fc6d2f87a17ea5f7cda735efb97d96b29d71171ba8ca35bc65
- MD5 45632a20cdf1a14202570e28eee0fd10
- SHA1 f6295853f12ed034660e75263ee10de45976c9d4
- SHA512 27fee1967f5c3c9691037a01c7cf2b20a5c4445eaf71491c7e7efd29e9c27b062ff045de041d87b52382656ebca68e6fc9b953bd530ecee391d3d8224ac513fd
- SSDEEP 384:T8vtBhPAbDEzuxzELThZV8cA9uRzlYHfO+RFQdutpLwyIlCHyP/WOCXGTvuUmsdu:ovHCrEL3UEZY2dunsyI8Hy2HsvuLsdu
- TLSH T1B0A2D137AB010F1816D39EBAD1EF9FC75D04E193EA8591EFAE04370EED481B043509A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\6E70ABF9E72706F76D3B5CD11A33881EA27D7805
- Size 24KB
- SHA256 1877a92d0dc79e9013aa2d629c33e0ce4e6fe45b552487f2d30f6ce3e2bc755f
- MD5 46b80a17e5e1dae9c2ed53f6722d2e6e
- SHA1 e63284d42b09fd07e71eff8b16ce81eb0148f138
- SHA512 9ab9d0f967cb5a75c102d4264dd25ec0fd2c341c53cdbe72bb0ec693991f92bb6cac08d6550b4a224a2a4805a6efca20384a6aa4246d31c297d6551abdf04bfb
- SSDEEP 768:CZfTG952Nvgt0Rpgt0187Zp17z41NwA1naXMF4gbhp17z41NwA1naXMF4gbJ:CRTG952Nq0RI01u1Q1NwA1na24Mr1Q1L
- TLSH T10AB207F308194A5C3F7987CA9A1A311DF927615DBCC9ECE9E4408D166848FF7B009E9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
- Size 16KB
- SHA256 6214c64516783b989089771372a6f92796416ddd041ec31c3bc5c4a12fc5681b
- MD5 c7617a7d2b3111a5a94f0de577ba4e61
- SHA1 de20d802c25d04e03ec4ef6b7ca5cdd3581eb325
- SHA512 91f9674879e7f897fa0c8411b8bf775206f62f58f4334c6e6623a6f018d717a289c8fafe3d26f7cd2d68c54610e8422bd95269c677ee2d561870fef9b5036038
- SSDEEP 384:HXkRyiO024Y1DL84KKDL849B7SOEAd9KVRaAcP+AWRMA9:3mZY1DL8lKDL8CB7S/AmVAf+hRMI
- TLSH T1EF729E3D4F003CAC25A7C0ECC5E982AA4D08B7A7DFE6C06D21183D0DC698969B5F548F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\AFCC05D05B51A20A03D7CF4F9468BDC7DF61EFD7
- Size 3.3MB
- SHA256 d78e6d12fceb02f0ad9b232efda7559250a14896fa7470174c3b6f408a3a7706
- MD5 76877559f5112645a0ba07e46b17d650
- SHA1 b7c3f766d982acc77d4eb49720aa8ad12c4cd0fc
- SHA512 40283586ec7d3d1012f4b7c24a76a9010d45bdaa0ecffcdf9a3e380f241cfa9937eaf9b0beb8c10381326073c3e1fb3c2283b249773ef79d35de0b8fe47cffde
- SSDEEP 49152:w+VJfHfaitNph5/4VJVJWxovo8m9z6gapU5ntlurIlcLL:dYjm9rtl2IlqL
- TLSH T12EF5B54ABBE51711F6F31B7568B716342A3AFCC2AA74D34E15455C1E2C32BA08C21B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\B4E24799D38A06A9FB52F2E9B30ABE78B7B69CFD
- Size 68KB
- SHA256 5b88efccaf0996d1b8f643526df6bbe53db59e432bdcf02d90ca4b81908ddd4f
- MD5 2cec25f5382998a08ed5fbdfb97e3a06
- SHA1 f6803bad868b4b58efc0e43f38971fe83be9b7f9
- SHA512 befa51eefa29ec7c703505d99b7b15a6be7d7b2a39c08cc8581f90ff214048a2efdb40963a94f67580f40c908a29bfc8e8d144a7cdd2e8ab43d9c6e2c534cd3f
- SSDEEP 1536:tPHNBfpMjLgHJmIXo5hKVGptETcMKbPH28jEvsw80RI01I:lfp0Mowo58o77MKb/28gvz80RI01I
- TLSH T1FC63023CB8DA39522DEBB9F0C42945C92886F523DBF1D1A53ECA1994B68C87473CE11D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\D6DB21750140E84B3959DE14CDB1E01B80208ED0
- Size 19KB
- SHA256 7d2efdd7478c80dac08d488a2f587f8be9b50c3a21829e8e42bd1d463be4b147
- MD5 a8c705c056e7ceb0ef5552a3cf4f4ef9
- SHA1 2e39eaae86b56c2dae57ad6f60118a1c6cff6623
- SHA512 b103bade6e9253e0bb4c88afdbefc0bc691aa67fd7c1ccd82710c65b2560c8b8e9e2a58367abe1245d20fc93eda0cef656e7301989e11e757e588f3ba8b715d7
- SSDEEP 384:H+0eUG32pLREUX2Ez75SbbEvJgtwVRpgtwV187NMxe:H5bG32fZGEzebYJgt0Rpgt01872xe
- TLSH T11092C0BF2BB569022FD377E24242E94E3C0AD1975F96C2E9B8025181AE5F3B4511758C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\jumpListCache\pgvkyFEmrsHfr8uRAtZHxcDTJEmSq6A9OP2VVuYV4EQ=.ico
- Size 609B
- SHA256 e5dc5320473de19e5255f32d0f9f352fcc23a03c254e82511999deac249d91cd
- MD5 6e62ae713951b6193d202ddc3d2152cf
- SHA1 abf75bd80bd84ed39792adf69dddb5a8b3b84bb4
- SHA512 8dff4541bb496449c0c0e93a1c60108dff8e8f7cea437b8027ce51bc22881a687597c511df4c32cabdd1c165aeb46b89c410e58563e18c449e84eddbbfa8725b
- TLSH T1CEF0B1E3B10933B08DC8CC710806B000CC8E2B69228BB318483B8A0A08CF4F9029CE8E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\6416930c-df0e-465c-8e66-264cdb0a908a.zip
- Size 3.8MB
- SHA256 0c21f80ad1b3796c49429949e6a3d52cbe9c3b5b4c317690a749d80076396d0c
- MD5 2d6fbb131e74f2bdbcc6e31d29b4a611
- SHA1 8d7f58b2786c678f2502e83642b70183d80f64b3
- SHA512 b3e43f1fa9c6dcd683c39cb32662e00753979618425cde33119510b8dd1e39b2e9ec29fcfe56fc9a8d4615e71d4412688d2f8cf1e2ee2b460a4c82d756d5e874
- SSDEEP 49152:VdfjDwQTlRDkFv8OkaeyRNcFXJpaufQGndS+m+Zg/eBmMadCQ9zrqy0RHQmkAHY6:Dfje8DTM0JpzsQZg/umMk9J4NHYUlo0
- TLSH T12006E075D65C3609C98F83BEB50C2FC3984C4FBE8C54A96F6A6A97715CA31E63BC4840
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 19KB
- SHA256 a9d000aded683e42c81941451e2952f559309841a8750c92ed5cf6225d6beabc
- MD5 c4383eea4ab396ba1daf19bd6fe0fec3
- SHA1 7adfe2f16ba3b9e193308fb534ed551832f974fa
- SHA512 d99bf4c2292e0f243d0ddfc7fb9e97637d431a3af20a71240b76fb858c1e75df684c122d964c466e8dfb7ce1783f9ce5385db88560fe3177680526bfbd190ab8
- SSDEEP 384:xiqfRq3RqbrlUqmiqF6qfQq0VHqTUPdqT8kpSXAqHkf:LP+
- TLSH T1B3924F015FF70A51F2F79D72AE72A342AB37FD128A0A654E8141514A0D73750CE6AFA2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 19KB
- SHA256 40e6eec3bd54ea29a7fabee0863221b03436b0e973bf482e0fc23794242a2ff3
- MD5 90d297ee1710c50afafde72577970b27
- SHA1 73995ba0ddaefde6f06df52f01f9dfd9dabb5291
- SHA512 08217971e2239c45411e8dea44b26ea31396f0f942b2e101e598ab8352f10c11856f66c7c6ee09c7352492897e102d7fc0487c9b3cc8522937e16849b2997973
- SSDEEP 384:Biq3RqXRqbboaqCSq08FUqHlUqmiqtfq0OtqT:7M
- TLSH T1829271015FF70A51F2F7AD72AE72B212AB37FC128E0A650E8141514A4E33750CD7AF66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 19KB
- SHA256 ef86ddf91cee92c78867d0b173bf83f8f2f3bee0de3a8ec531ec24ac68dfc37b
- MD5 474b5471183adfe547c1782999f6a626
- SHA1 97bb354a0f8986b1594a0cb27110fca4d6fa1a88
- SHA512 a0d98458e07a4eb8f20915b3a9a90af1cf9d1d396447dc52b5ce134b7c59500bdb9676795bcf4d5f82add5c602ca0b21c8ae77723812c09b8b6dd5cc6bd1e775
- SSDEEP 384:3iqlRqNRqbBoaq0fq0otqGSq0iFUqVlUqgiq8:+7
- TLSH T1F39261015FF70A52F2F79D72AE72B242AB37FC129D1A650E8041514A0E33750CD6AFA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 20KB
- SHA256 d9d7c3bd9e726d7a131d9b89c7f3e532d26efeb81d80a065d4e50affe70d3783
- MD5 56408a774f64c1bec17eb1919d7a3fba
- SHA1 1d71503352bcd3e633f9eccbb84a42b5646d8a79
- SHA512 29870fdddac2467822810c0fad7ae53785f02361ab2ced611254b41cd4e20aea813303f5d668a9079455181f5c94ffdecd889fb6fc86f295f3a9949cb8860aa8
- SSDEEP 384:eiqERq0RqbwiqWSq0dQqrdqgmq4lTBqsld/qE:S
- TLSH T1209250006BF70A51F2F3AD71AE727352AB37F8129E1A555E8141514A0E73710CD7AF63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 19KB
- SHA256 046380d1b33e000547cf65992c1e61a37a2572eabf7756e2e8702d399fbbd6f8
- MD5 321e92e24e2058c035aaafefd6455b65
- SHA1 e5a9c6d3456c346aaf5fb06d8d4e0786ff7e1b29
- SHA512 c59cc15821c21c8812730f7b5608d6f04154c21cdcc921b118644a009c19ccf313077025a297940d54610f3a7dfb35361b2c2d4d00ee7df479b951555320649f
- SSDEEP 384:siqSRq2RqbyiqwlUqDlCHEqDSq0/QqFdqimqG:n
- TLSH T1E69240016BF70A55F2F7AD72AE72A312AB37F8128E1B555E8141504A0E73750CD3AFA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\O6Z5MKWDOZ3QTHG8UUOI.temp
- Size 19KB
- SHA256 be3dca1dc7d6da3d13c10292dc70b22c4b866b0c2c71e1f1213174f2c13988ed
- MD5 9a6ba36768274e86e0fb564a89e67c03
- SHA1 7f54e3af710a8fe1f97fc7ced2f9b2bdeb701965
- SHA512 e39efe80598fabf4e5be41ec7954af9960f68e839fbe83c0ca89835e865e8006e35ddd2f202260bd9f0353b34469ecafcc6999b63a093ddb1f2aa214aab644a1
- SSDEEP 384:7iqVRqdRqbxQq2dqBmqJlTBqVld/qS3qSvy3qS:1
- TLSH T1229241006BFB0A95F2F3AD72AE717342AB77FD028A1B655E814151490E72710CD6AFA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\AlternateServices.bin
- Size 5KB
- SHA256 aecf1a951d32f1d8032196e0d47dcf31ed926c1f078ad1f54bd034232e7ac66c
- MD5 ffdb5b2c846c5adcb5b71542ab4fa687
- SHA1 e318855b9093e366d6230f931d22152f903bc484
- SHA512 ba01d643ac729fd8aa3a385a43d393f4eb464b65db7f3811f3b6d349d758ebed057d280a0514ae83bca7c21a16755480666ddf34e80d58bc6d6b0c9a38c62d48
- SSDEEP 12:tQphMQSQv3e78c9qncmOLc9l9PacE/deqncmkOe9feWhlacE/wQ/ncmO2QKTQFhi:tuhMZLqm47JqsN9Waym2VT
- TLSH T130B175A3A7B74433E0615FB490287285CD72078A48F89ECD5BB0E55607D5B8AD0EEB6C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\AlternateServices.bin
- Size 10KB
- SHA256 4e23ab7e5dc485cd5a6db341954373d52a74bb5265dcf155d3fc38f1cd3f6185
- MD5 e1af236130875d36766452ea5d7ca845
- SHA1 acded6a502e2f8197c4b5ce50efa69b4b2c4c5c9
- SHA512 dbd84d6825b5f43e35418f51293376a2303ebf83500aaafcc3353ab8c2b3a03d11ccb8988b7de1a63ae3d15679312a6070e699364deb2c269dc7649101cfc586
- SSDEEP 24:uuhMZsxqm473qsN9W0ym2VTI+lzm91/zY9B0HM9Vvu:Py73v9Wxc4cxmSeBu
- TLSH T11C2254E36BB65023E0A24FB080587249DD331A1549ACD9C8D750D8E707C1B99D06EFBC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
- Size 153KB
- SHA256 f7113b74ceffe9f13f0845b3bdeeb67cb98efc8bb83a25c482b7bd72d5f80b3b
- MD5 2a14be74a32fd9066bef2b8c2c596bce
- SHA1 53d2ab521fdc2846a53454f91863ac85dfb373b5
- SHA512 6708fe24da51118b66f3e1b2f3d3408f520c1dcf19949a6b174d70586762c3dea50723922905399b60d154b742c1e6a8b73486c35ffb2d355976e87ad487d3f0
- SSDEEP 3072:v7aLxDoXMiiBdqr/6YrcJwbdRqQq4zrvYEyFFfHA:v7qxDoXMiiBEr/6YrcJwbdRqQq4zrvYq
- TLSH T116E3BF84DB17407BEC2485BFB496173C3735F4654A599B0B2AAC04712DCB3BF2D4AA2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
- Size 149KB
- SHA256 2acaa42f45d4960bff2aee975a087ae3104f003add9f2e1e0a6e5fc62fb0b22e
- MD5 c15a1ab91c9349396b425a99e80f359c
- SHA1 f9b0ecfe66941dcf927d80261d493f7021456fa7
- SHA512 7c8400137ed138b2066dce70521187e1493c1790ca8e9677faa895c9adaa4a89e53bd3a29b76ab498b99889c65f8b592fe9ecd21b79e2f58cccd51440bae4be7
- SSDEEP 3072:jSP8wAA2ry+QLd8c3FUd/Po910SHq4zrvXEyFFfi+:jSEwAA2ry+Qp8c3FUhPo910SHq4zrvXr
- TLSH T1E6E3B0C4DB17407BEC2485BFB496573C3735F4654A599B0B2AAC04712DCB3BF2D0AA2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
- Size 107KB
- SHA256 071b5307a29bff3579e1834de940a1180179e27271cf89a5f8aa3f42d9e1ed88
- MD5 7513c4959aa2941150d7e010ffc19ff6
- SHA1 05ae835ba2e999aa70d156f7690ae1787d900bad
- SHA512 00b9abdf82bda40466254ac302b8f64efb0e9f29f926acc2c8dd9bf64d60fb05210db973941787722cbb572d6a728b59dd208c93ccec5efdc1a6e6a2f7ac0cb4
- SSDEEP 1536:zr6ds2snfxkbZRRvIjCRcz5rsbrUHvNzrv0EyFFfyXy0l:H6dFcJkVceRq5EOvNzrv0EyFFf+l
- TLSH T107B37ED4DB1B407BFC1485BFB495673C2625B4214A599B0F3AEC04661DCB3FF2D0AA2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 05f825714182fcfc0fe23c7841f1e3541d52096998be0ff1004155193dd8001a
- MD5 d8e450662882725967703d76ae276c4f
- SHA1 13bf2eaad3b1033ad54603793d2217b05fc27d1b
- SHA512 7a2637677f81c55242e69157228e7695f66ffebd41fdff411a334819c4a6c43bbca3a130c72a9a858aa76a5545c0b50794017a486766e455b8f8b1f888df4048
- SSDEEP 192:70QXYw81d66JoztdzgCl6mc0dAtOv5zbo7WNZCQyjj+o:vmd66Joz/zgC1jqCbouZCQyjd
- TLSH T146E10DA8E628863FC418427BCCA60F454F35389A9C4E3F19359C651C2D5A2DE76CE1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 5e1cdcc8e8f814d1c754ae944478903b7893079d2e55f504631be3fb3766dd75
- MD5 ba511237061482871c250f34a527b902
- SHA1 6b2945243fb5810d8ee83364eb066260b77dcf5b
- SHA512 31a6bdfe8ccd0b186f2098e7c85ef904f9f3e5b0fa5e2e85395c50e89abeb3d6d1980e04d1b9be0636d26f75116157fc843692275029f90aaf07dbf8fc010001
- SSDEEP 192:g0QXYw81d66JoztdzgCl6mc0dgtOv5zbo7WwCQyjj+o:wmd66Joz/zgC1j+Cbo9CQyjd
- TLSH T103E11EA8E728863FC418027BCCA60F454F35389A9C4E3F19359C651C2D5A2DE76CE1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
- Size 150KB
- SHA256 db4c14b9222ca3d1d7884b679d5f5886d05edf52accaccff8b1dabea38d99a2b
- MD5 f7947d17297f13bfec844e758b9413de
- SHA1 6149f41433e684e06f4f3da0c54c8838756a0297
- SHA512 4f8e50b38276b52f442341a2ac85f864900732b131b497bb6d21b5a7b46421f296e60ac236ef26c48d20752e78fc15f9845782610d13f08d6ce1c459c6ef820c
- SSDEEP 3072:pmwB2H57bxPPg00BuNL/hLNBy7tzq4zrvlEyFFfnM:pmm2H57bxPPR0BuNL/xNBy7tzq4zrvlK
- TLSH T1FCE3CF84DB17407BEC2485BFB496173C3735F4654A599B0B2AAC04712DCB3BF2D4AA2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
- Size 4KB
- SHA256 48b121e5c9b19f37042756ea761d8cccf09c9c9550d00eb7110c22600c6518ed
- MD5 0c1b298c90db1be716f00b74fa236489
- SHA1 6d859dfd38e9691520ded9809b2e51b744cc9e7e
- SHA512 4dc1f5ac047e24e01cad1a7deeec278a16af035f6a81c47bc2fadce1bf9653460c5203f38cc6801e4609f3d81742e64cd10974728a5b63e3db456d723f800c53
- SSDEEP 48:YqiF0NBenxzTi/2cn+Li/fU+KvUiIi/PLpUvLi/KinpBi/kyzZ9Bi/8zPv9SUftK:A0q9C+E2v3HGqplyz9LQiAEyDdztt
- TLSH T1A8A1AC38307A1C3B53FF9B6A1AEF1258C9E946C2CC4D2E578D89DE8844CCF82730A255
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 637b1f2c73e0599196677ff019e62f386f48abc376b588d1922a8a7c1871ccd7
- MD5 a61b9917037d9c28b0645f1e211e0128
- SHA1 5df1333dc691333b15dc145cbdd0eb9c062a24da
- SHA512 3e71a3e78341fe024cdbd6e233d390a797986404c06359173a333c8de51a517597015855e26ed01fadd12c3ed1128fc8356e18603ac57418e9a6774a448de0d1
- TLSH T160118C9C3EF88E3AA9DBE26C7441138E53554E1A45471C879E12EE8CCEC1BD9326A439
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
- Size 5KB
- SHA256 6850a4a9c024011959b57ec961c78f25215f3b9d9647a80a0ff419f7d64bce13
- MD5 bdb4b8502ac8c155645165e566a4275a
- SHA1 c4bba03c528426472b70a12320ec312776c8a10f
- SHA512 53b0811e60c73644a0bb1d8916ecf59eba1c54951fc167dbb0bbf8657293a5f6c8a4c65834a197a6c34e26385854fe4b85e861889aa08c6ae3286a48b7200e24
- SSDEEP 48:Yp4xbYABbeOVnUCi/sE3OjR16PwjH+ph3ZCt/9UCt/x3eRM8WYmbiHLdnzL9B4ai:nE+N1r60LTewYt1B4cEyTdxw/
- TLSH T13AB1011C29F90CBEA9D7D39CB445039D43D94B03948A1D8B5DDBEE4C8D8AA9E321F139
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\06cadca7-b413-493c-b4fa-1950c1cf13b2
- Size 886B
- SHA256 b53ee0395153fa4bbdc755dec1037f0d672bcd9197f118e1a3f8824b82781f03
- MD5 6ab8479a6a36e0dff37faef893f2233e
- SHA1 48ae9f59479e7e27a4e0ed4e3bd58b3caf7333f3
- SHA512 8446542953084d0f290bdf3f04da23560faa731353e1feca9a85aa26a40e243825f0eed244d9ed40ea933eee22968fd9bee0c8023049c1524d7ac92a3a21bbeb
- TLSH T1151100A1976475B28C7C929F84E53B538AE4B82380C648187DA05F1C4FBE60FA2E6707
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\07af96c5-cb4b-4063-b713-749433aa5e75
- Size 883B
- SHA256 914a8e2472273faf333816c9a750a4ebf3b4f5654fbb62603fd34497a4cdced7
- MD5 bfe01487fed026960c3b9e55c16c4679
- SHA1 174f303bfaa2e98ec864ea0f4121cd2afa90bfac
- SHA512 c7274a0ac98883b08af1d449ae42b3611ef8df216af0a60681fcc85dd2f5dabe39a30dc2388f165a5982c6f8fbb9854ecc3410923d5b1957b184ec1ac0605d1e
- TLSH T1A1110491922175B2CD38929F85963B1687E4B81390CA44043DE55F184F6E61FA7A6B0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\08a9c91f-502e-407b-9095-a93e0309452d
- Size 281B
- SHA256 e8e266ec2c20cd5e4f7bf5d6dee1472d480bc1b33b20f6f5e176e5352ea8b96b
- MD5 1b0ba36e9bd543823bbd8a76748800ce
- SHA1 714f9e606c266ed47492cb81051976b8535396a3
- SHA512 8db3e54b0208ad5947a0ffc482a0fa76ce4755412c5070d5885213749229cade4374df09a7139845eec62b64793809de4249bd6583164f76da728dbea9da2f92
- TLSH T1C6D0EBC1BC8837AC4C280F1BB0A024E230618C3B28F09820A5D10A244FFCED94110C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\293d3d22-5604-4738-99f8-517c17b94dc7
- Size 235B
- SHA256 c523e1c314a81270e205053b855cfcbf40d150c5ee08d61f2739bb26791d6951
- MD5 3ba91a29c10f83a6766bbf4586670e2e
- SHA1 fc68d7665d893928a7d9d89ac9bafa94c2554e7e
- SHA512 e2be785714420dd40e3f1df6d7f3ce0594f434adc862cf7d0516703a68117202a074bf893f6322a07a2ee121d1067caf55e2f6d77326cd9180a871d9f09d8d53
- TLSH T169D09784249C736D08140F0BB0A068EA34948C3315A16851C9600A7499B9EC88351D16
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\7dd721b5-2624-4e3d-a8d4-3095132ad4b6
- Size 1008B
- SHA256 e497079077c8347571ad35026b524c4b3effa0778b5ec752f1fb18dec2a13796
- MD5 ea61f4a8e320470bfa32f20568cc5813
- SHA1 cad077bcefc625f2c31cf728d4be0b65ad002978
- SHA512 024eac053da06e7ca0af8c59764d78a40df4ff7bdd8ff4f7d6936f4a1fc2bffccd357bd1216a489e5f0e4cc1fdfa15f872a263da59abf5eb98d9273c428b8b1f
- TLSH T17F116891572435B38C7CD29F84F837529BA46813C0C518047D901F144EEE51FA3A7703
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\a5c5aaa4-2ad8-4c82-9f07-6e447bbc47f4
- Size 10KB
- SHA256 8b257a07d0bbf37a0946aa79028e6e163684c70fa3b59d2937ca7e61d71dda1e
- MD5 5ea9070a612cdad635884583f7dc1924
- SHA1 df7070375f3a046593080f5ead31e32214c77b02
- SHA512 5cd8901b0b21942f94b4d008a92efd9d9bfa0505d18dcf9866eedd16d39d6d66b2b387abac3fafcdcd5624b7c16306ba6f734161a10fdd6f3b5a61f45ea14b86
- SSDEEP 96:FurNDToC/1L7jFwJdVloa+VFobrDjtDmx+DrfolUKoFE0X1vSqRTeOYB1B4ya8Tn:FuJTVNBOTvNSkebJBTwoNjcltAs2
- TLSH T17322622D76F90CBE9ED7E69C9482078D43EC478390C51DC75D93DE4C8D8AA8A325F12A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\b0a729d7-5f6d-4da6-a7e9-172dec4c3fec
- Size 2KB
- SHA256 d1e81a30febfc8ac7eb90e0b40fe6d5bc052c9c891531db5f70ea57a3eee5154
- MD5 499e7c5cc49135639ea85e03109d4178
- SHA1 13fa3694a641fe3786e4a935bfe69de60e646e4f
- SHA512 543c35ad0b4d4ea36e88588909d6714b92224a847e4dd3c550eec029f4bce6542071473275febdd55c5ff59e448bfe40fabea18f82ea76ee72a589ffe707cb0c
- TLSH T14041336C75789D769C9AE59E818232CE93248A0344C718832D52DF0CCEA675E63FA517
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\cbbea231-014d-4e7f-b836-2bc47ed0eb6c
- Size 235B
- SHA256 a1838616a7ba96cbfcaa409d508b509c0d3756b15ae8a2b75d0af6c76a288484
- MD5 134127e903362e17dd2ab7d30b894c1e
- SHA1 fe151c26ed2aec5c93162dcd270360c5998dd7a9
- SHA512 c754e9a3a443330ce1a59c4418b35afb0aee55373eec1379033a1ddd407c8921a8b27219326ee0e6d52666cf4ce8e1d307b14ef7c421864909557795ef4fcb40
- TLSH T153D097C158A8672D08001F06B0A038C231488C331C7C68509B604274AFF8DD84121827
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\ccea9c83-051c-48e1-a9c7-3282be7d8a69
- Size 15KB
- SHA256 d79e8584dcfda62ac6345c6f2a1935e80237a043bd61bd51f4e4f4e393c27a6e
- MD5 23cd3545524793bb555aaaec07d7274f
- SHA1 640a1cbd1b711dcfc98797fddcc29a354fba4bfa
- SHA512 03bffbdde6e6194dc4655d25e432cd484bdc3dc17916414676fe84f67bc1e910ad73bba920b804bc47c12d506caee70889621b36b2b7afb2714b5da896f5daaa
- SSDEEP 192:JJEml06yZ/TI1ZnaK9DIf+/P0Olb25Tg1qBjnsizLG/i61mpdfJVL9bzxTaKeBRt:9UKDuZsiza/i8mjhlTaKeBRLHmU
- TLSH T13662F9566420497B8591E368D8EC7FC3F6F518CF8C029FCD9BE47D086AEA0AE5127847
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\extensions.json
- Size 16KB
- SHA256 5c57102003e69a2bb0c58340a7c6a8b949dff60415d20c924febd97d4b37fd9b
- MD5 0a56c074939330536ec4dbf83e659765
- SHA1 838bb49298e8cf8b1abbe34310fb197fe533700b
- SHA512 97a3c087d00f289ee13320fef912695b847a79e9378d03cacaf5f567ddddf80f7183783e310f2395d391336ec74fd14d3f3c2034ca0ef7463260a77c57042aa5
- SSDEEP 384:LkI4vUUmldvS8dhWp94z7j96ohiL4HsL4PoL4HFL4HwL4Hkc4hb:4I4cRfHXY4Z6N4G4y4F4S494V
- TLSH T11272531545049EB8298FA79AAA367E01C37D473B70845C78F4DD8FC802FA5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\logins-backup.json
- Size 744B
- SHA256 4d5429c010b1cc25899840e3828a9d7ac56ed08e349e8a730e65759f8989ad98
- MD5 188a7ba01ab55670ba97a19318d29edf
- SHA1 4f91fc533b90a6ba6a1fb9833665082a98c62977
- SHA512 6c9930cc6dd587a2457cbe0fc5245fd80db88bb20d4d2d7445c648eb0fa8514e24bff9edb9d660bc74168b91ab17da16e6ac561b4b51232f6b279f1c98bb7dbd
- TLSH T14001C07E18151C226A05D1A800A836835FECE8ABC555A7E5EEB11F096C92ED82841197
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
- Size 7KB
- SHA256 1f4707cd638a05880122f4a0f8dfd0399a34ffe6099a135524824432e86dfc4a
- MD5 7e3b5de43d8c7bcc2408e7b41e36672f
- SHA1 a3f1d18b98ee8795bb28742cb9b1d307ba570286
- SHA512 df5a101cec73210e7f12796dc9cc2b602dd180f07d45a88421f908641bae408085e350cef3e0935e6e76d8d6acbc38c3fa4cd6374d138cd6792f9f56741ca8e9
- SSDEEP 96:xHGqUTUmK4qGqvfuCpObzSWSSlQdv9jhnoRHmBw8828L4cnSqoLxGS:oqWKTRvfuCpwSSR9mBw88fS
- TLSH T10FE10D7895188F7F64B6766CAC6888316A72023B7BBF68D710BA5484450CF3482F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
- Size 12KB
- SHA256 c0d756485ead157f89ef846016917402522fced8d6fc51854f287fd858cbaa56
- MD5 6a908c18d66a5897c80bcf99b1e0aa15
- SHA1 d4a028d703990f6185dcfc56146b989cdf292b9a
- SHA512 2d1f6a13ee3c5df589eaed1a3ba7e0a796f32727a06ca33bce4a3f87c3b269d22b49e1b2984aeae2d2587d4dcc2d433d03e58c9360fd12dfb8511ed50d82c6e7
- SSDEEP 96:xHvq1TUmK4qGqvfuCpmbzSqSSlQdv9jhnoRpwoDRAlJfSvOBw88rXj6nGv8/2v8Z:lqzKTRvfuCpYSSRXLRbOBw88rGnGv8/V
- TLSH T18342DE3851909B3F74F3327DAC294A701951022776BFBCDB16FA98C1580CF6841E6AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
- Size 12KB
- SHA256 d7b260f1be200f6f7b82dbf2ed88e99a0225109c0378fdb93ef43ebc70cedc7b
- MD5 dd2192466259630db3df9e3ec77122b3
- SHA1 7effa6d2bb3a5caabd645c41a4422ac0e21fba67
- SHA512 8c99f1f149bcf49364e42f2b65040738300d9f6ec252841cab6a0e2c37fee7f74c2d052c6d3290ff10d90f00e4f9a94bab2a73082b6ada6aa8f339d6b476637d
- SSDEEP 96:xHGq1TUmK4qGqvfuCpmbzSWSSlQdv9jhnoRpwoDRAlJf6vOBw88cXj6SGv8/2C8Z:oqzKTRvfuCpISSRXLRPOBw88cGSGv8/w
- TLSH T10E42DF3C51909B3F74F2327DAC294A701961023776BFBCDA16FA98C1584CF6841E6AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
- Size 8KB
- SHA256 70b931dc80e25f06f1f81d07cc002b10aa714a89f28fce5dafbc469c8e21659b
- MD5 1fc27d92f1f8b5780d24b50e6db0acc3
- SHA1 2d6d83514a1e48b331fd19a0bfd399d52968624c
- SHA512 e7cdf89d14e1b52ee8f3946b8dc85b4f88334801ae11a6a06ebdfe0aa54f59af06aef68d8348d477d34e4256459c1fffe45b049d5d1465b6e9242cfb5a6a1cac
- SSDEEP 96:xHGq1TUmK4qGqvfuCpNbzSWSSlQdv9jhnoRWRAlJFBw88/8L4cnSqoLxGS:oqzKTRvfuCpLSSR8RSBw88aS
- TLSH T1A1020D785144DF7F74B636ACAC2889315A62023B77BF68DB10BA58C4450CF3845FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
- Size 6KB
- SHA256 397b61e28b41141429d89a2120bf9c717dae75f57e7b19794afe6b646c0cda80
- MD5 574e6668af2b12d283fc6119dae05226
- SHA1 6406f23376086e7f63da3c5448e095a06260bbe1
- SHA512 9cdda1d45c41fc2e17bea01e3f1db282069ad61796a79e4cd3da967e68b66fb4403c2bf4180ac540b7712455114fe5b554f1ac5489f5171dbbc1e8a73dc0f73e
- SSDEEP 96:xHGqUTUmK4qGqvfuCp1zSWSSlQdv9jFnoRHmBw8828L4cnSqoL0:oqWKTRvfuCpHSSN9mBw88fZ
- TLSH T171E10D7894188F7F74B6776CAC6888316A72023B7BBF68D610BA4484450CF3482F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
- Size 6KB
- SHA256 de64c3df5fff9e7ff214fa369164be59f4ea8f7c1cf785507769bddf5cd039cd
- MD5 ee4eee6e9f03ebcf13ab0e6ef0237787
- SHA1 afd24eb89bba5d3b773784d5f878b0e7e2090dbb
- SHA512 dd894b00f0af4003737ab05573f393fa057e3cb5b467a5cb5d0975bf9e47a3bfb4ce36ddb788b6c0435a28500c9cb740ec36123661b0a3244f6b3ea5b180cbaa
- SSDEEP 96:xHGqUTUmK4qGqvP/cy1zSnVSSlQdv9DnoRHmBw8828L4cnSqoL0:oqWKTRvP/cyQSSd9mBw88fZ
- TLSH T19DE11F7894088F6F74B6776CAC6888716A72023B7BBF68D710BA4484455CF3482F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
- Size 12KB
- SHA256 9020406a8907e02551197f97b377f4a145a98036f031eb85b03bdc892966a698
- MD5 3822c58e020932fd3d97b1da8e180380
- SHA1 c85c79b277d8231c1a91eb0b2ab6fc195b23b9db
- SHA512 4bae0f00fe2b1487571fda0726268d3c704b0b1a36266ce8d6be20212e4ef0b5ae468a761dbd2485a69fb2eefe980b28e12e7b933545ee2e3b0c0963f96307dc
- SSDEEP 96:xHvq1TUmK4qGqvfuCpmbzSWSSlQdv9jhnoRpwoDRAlJfSvOBw88cXj6SGv8/2C8Z:lqzKTRvfuCpISSRXLRbOBw88cGSGv8/w
- TLSH T10A42DE3851909B3F74F2327DAC294A701951022776BFBCDB16FA98C1580CF6841E6AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 84KB
- SHA256 2fb9439b403d2ab8ac0d448ebce17913d24acc1436324a6693e4dac53ebc45bb
- MD5 4fe65efa9cdb7e366f5461d9921b3425
- SHA1 4bd61deced16fec3385bae5d956745bd6c94f67a
- SHA512 4407f7bfd05becabef091bce327fcc9be4b1dae880393e96535277fd7a2bf800f6ccbe30e7d4f1b03c419078522658951b5478a1375fda771478112bf98959a7
- SSDEEP 1536:spq1Sr0qea07dUrs/G7Yh2cqI4OTysopRBDBJhrSyihv/ph:tSr0qf6dUe/2cXWsofJlSj1ph
- TLSH T19F8302326A317D5B433C5384C81E2C2B16B99E0257E566ADC30F3CA977FDD589B49828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 85KB
- SHA256 220c2370555de00768600a6fe711249f85a1fbaf3e799461cd3824effccf58a3
- MD5 1869eb8badd5b0ca717f9aa2e47117c0
- SHA1 e371f9ecad26b826bbf06ec7145c1a98cff88089
- SHA512 e8bc00d25ab03725a1353f1e77440d50310f0b07974205327d7d7eb333a717f92bcae53e9b78c89a80c5aee274f54e5b3a4efed0dd80f3515ab68c373d86eb28
- SSDEEP 1536:fpq1Sr0qea07Irs/G7Yh2cqI4OTysopRBDBJhrSyihv/pw:2Sr0qf6Ie/2cXWsofJlSj1pw
- TLSH T15C83023259357D6B433C5380C81E3C2B1AA59E0357E5669DC30B3CAD7BFD9689F4A828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 2KB
- SHA256 b486b403ef4fa77415ac5812e11186409f3bf362eeb3888e54f58ab60e2ac0de
- MD5 e5d279ebb731a7ffcc709baabf9be4a1
- SHA1 f3779ce4930cd37adeaa0b402b70754bfb7672f8
- SHA512 3adda104eb5f9466d1111a1f801965a02f9aa1dcb66c6a8015f42e75e30b600d5424c6cd7df3476d5a2f8976cc1e888ec6fd68f6c77d412c0c1807d478f4534b
- TLSH T1C3515C25783E88B48260F10EC0CC377D1AC134624FABA430C7597D0A925CD1B72AE208
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 85KB
- SHA256 aa22378b0b5222174b8011aebe9c84863ac067e1604c9524c03e6b4c151cca00
- MD5 660d77a65f00342d56aba79cc75c790f
- SHA1 33291004b28a10e82ed6a35f14dc7ce1cc927a18
- SHA512 6da6236b89d055d15615c84a8a678cf0f16c4ff18aa5d30fbe5d99b4fb223c2bbf66daa4e805c6a7dfceac2c225dbb2cbb7f5a819e3e3acc86cee94cd757dab4
- SSDEEP 1536:upq1Sr0qea07Krs/G7Yh2cqI4OTysopRBDBJhrSyihv/0C:PSr0qf6Ke/2cXWsofJlSj10C
- TLSH T1F783023259357D5B433C9380C81E3C2B16B59E0357E56699C30F3CA977FD9685F4A828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 30KB
- SHA256 d891819e8aa65e3a86061cb512ed95cc65bcd5b0b1f069171154f6932bcf950d
- MD5 0bc8e240c1f426aaaa0b6a8d6b124041
- SHA1 b6fda979379b415d3b74838e22cfbd4158aafb5d
- SHA512 0ff58da67c1a42e8e274dd26f890df1bce7ac9170d757f7b4296e906935efd4254f4162b0d0dd613ba0034927c4ac0e74d0d4b36e4a0bb7cc813166a71fb2ca8
- SSDEEP 768:1Q+Yb0AjSrshr9MhzwZlVKeaZKmsuKfIa:1pq1SrMqea07Ka
- TLSH T11DD2D037A230BCB2CB2EB680D55A3C1E21A56E1783F61B66CA067C613FF9559EF45408
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 89KB
- SHA256 0c0de1b62a05fb17a96b9b7370d0d893bf651fd87439140308fcae87af29db28
- MD5 b56d91f02a8434c7637bc459777f56bb
- SHA1 058e81834dde1b8d834d02c346da9a27a1554a73
- SHA512 293c7357fe726041d3e0916289e49cae7d5d90e770f9a9a3b59cbf6465d597fea7201590e4981c2e18139a4a827119494dcaa4cd1dcabad322c4ab750e430863
- SSDEEP 1536:MJUpZIHtvqea07/jDGrs/G7Yh2cqI4OTysopRBDBJhrSyihv/p9:2Upmvqf6+e/2cXWsofJlSj1p9
- TLSH T19E930232AAB63D1B433C3798C85E3D1B1BE48E1346E5656943063CE877FD9689B1E81C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 106KB
- SHA256 c72be4f17c8595bb0589ce66ef91953692d51d4df6ebf317decd57ce8361985d
- MD5 966fc90179ff21bd9b64b9867f0fd944
- SHA1 841b749a521ae85fd840e15d5d03143a634e08c1
- SHA512 d66b90717fc8eee0a2ac142469920c727fd57cfc1552e4acf53073d44ebd4a3ebe5354538a11df77b9994019c1b918fc7324a762c3a1ebc8b83b3711e942bac3
- SSDEEP 3072:jRyZhtSg+yrz2Yaqf6le/2cXWsofJlSj18/:jmj0yf4qf3ecXlofTY18/
- TLSH T131B302319F353D2B433C6284C82D3D171AA89F0396F595A9830A3C9877FD569AF1BA18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 82KB
- SHA256 88268045a0f9dc20b4f597d28ceec954d04bc20ee00b83b6b62b3a5c0b596fba
- MD5 ae012b16a83bd26513cab5c8babbf7e7
- SHA1 9b8d602238be3b121c9783ad282a2b22c03d7f38
- SHA512 5a21f1f7be8dff9c63f84cd26bee0e2ce1f1ec7d850af5cbff88dc6fee71b553fed8f5371503033556d90d3bd47d124a123c58e632bb0fc259f00e8ddc8a6838
- SSDEEP 1536:bpq1Sr0qea07prs/G7Yh2cqI4OTysopRBDBJhrSyihv/4o:6Sr0qf6pe/2cXWsofJlSj14o
- TLSH T1408302326A317D5B473C9380C81E3C2B16B99E0356D556ADC30B3CED77FD9189B4A828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 112KB
- SHA256 4ce7544409d16e7681842bbabe8918f336824b493c92eb24c7bd92c087d7c245
- MD5 a80098b5f4d89290c00907000083d0f3
- SHA1 734fa13363740d2f2d5b40035f0372abd307d6b9
- SHA512 4942d846b1e1e23db643d08728f1fe4b46f20ffc5ed63608fc4c721565edca825316a9de4757cc63e142f5251840f49b65ee9d2ba216111dc6fd60554f94e0e2
- SSDEEP 3072:SRyZhtzXZFsSg+y9N8vtqf6Ee/2cXWsofJlSj10g:SmPty0yLAtqfWecXlofTY10g
- TLSH T13DB3F2319B347D5B533C6384C82D3D1A0A688F0397E595E9870B3CA866FE558EF1FA18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 33KB
- SHA256 819f5707fae553dd2d4274467d58b22c475f6f642036e342e75943d250f32e8a
- MD5 64159c7240c9365ab252ad326d3b5273
- SHA1 677ef581fe50e7587fcb2863ef623cb5811ff671
- SHA512 968527179d3308e7efdf99664c4243be3ed5116bf41209917966e49884443907d207f86ca4df8b55f125e66e3d2a58aacf903ee6c7f9f838761148bfd842a44c
- SSDEEP 768:wQ+Yb0AjSr0xr9MhzwZlVKeaZKmsuAIlLZ34/:wpq1Sr0qea07J/
- TLSH T16BE2D03AA630BCA1872F738095693C1F25E5BD1AC6E60A22CA067D613FBA858DF45418
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 109KB
- SHA256 76bee65ed7daa9423cd8f27a0684ec76b0d6e2e3f5998f0104ca5cd76bc0025f
- MD5 dec33509584a14d4d1af9c82e1fdde4f
- SHA1 7ee51f2c31ff8d8beee4852198a55a25dfa183bd
- SHA512 842f674b4fb9d4b02ed6da1ea986e11b066d6bcd13f9a21c0507222228570ab778091bf127c41423fd81f343556bd1ba5c64012b571fadbc2520c5dfc8ee36ec
- SSDEEP 3072:dRyZhcSg+yfPQBZzLqf6me/2cXWsofJlSj18V:dm20yHCZzLqfGecXlofTY18V
- TLSH T1ECB30231DA363D2B533C9254C81D3D1A0AA85F0387F191D9C70B3C986BFE559AF4EA28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 109KB
- SHA256 8681c00cf0419d672178cb0b4775a77ec330a3bca1f16979a95d728b49b98e37
- MD5 9df7fe1c6344d73cb0cea06cec632df4
- SHA1 1236f03cc7d5ac2939a25dd428dd16a2ffa8bffd
- SHA512 d69436c9f67f97a07770c0ab9d7b87e070ddebb0058fa16879d2a840155f2c18bceeb8e7069c98f9687db09c69f0c3e6b7f9a3244bf1b41e7a97c944f7e8e364
- SSDEEP 3072:wRyZhqSg+y8Ws0+WRqf6Qe/2cXWsofJlSj184:wmk0y8dhWRqfqecXlofTY184
- TLSH T1F7B302319A363D2B533C9344C81D3D1A0B685F0387F595ADC70B3C986AFE5699F4EA28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 84KB
- SHA256 9328e989eb75061d10ebd502b68189e9273067da64becbb15248c4c3f1bb98fa
- MD5 bab304b1b3e5a5df952116e851435953
- SHA1 c57d656e5bdf470b6349e9ae9cb23f257a14179e
- SHA512 17575eb9787697dfaf4554beb156466e0b76d69c39cfa78c9a24b19b5d65dfe45c94e9618f03816b28315e76ab0c4687d0efa8d5f879bc15d18221047d142444
- SSDEEP 1536:Qpq1Sr0qea07Qrs/G7Yh2cqI4OTysopRBDBJhrSyihv/pm:pSr0qf6Qe/2cXWsofJlSj1pm
- TLSH T1D48302325A357D5B473C9384C81E3C2B1AA59E0387E5569DC30B3CA977FDD189F49828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 2KB
- SHA256 913bb186d35efd26e28f9d5145cf279d56c84e344fccc3833f0a5d7301b5f82c
- MD5 08f25708a365fa7cf463b09e954dcc31
- SHA1 f808cb761b0834bc52643806b980fbbc4fdbb053
- SHA512 3fe1e9680503f61b627a931bfb95bdc055c7052b59846bed422014a16a9657ec1e00f82cd8a56c48a57f683a9e8819453e855947ddf3f945f9fe4d26ffbe7bf6
- TLSH T18F411C1E2C2A1FB471A5C50DD0083B6586A734394FF5DC70C38ECB86BADA81DB2DA918
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 85KB
- SHA256 dda6cb247937fd3771a82945b447341eb5a1fd8a6f737c57f7e49b7fc5b593ab
- MD5 b6f702e23dbd4c5bfbe3650805cd7b6b
- SHA1 48de9310c8c36795cdd050650660d59f54ab26e9
- SHA512 050a5b01efeefb2707f8bb10cf4661cd2d77b9aa3f73ef6be69db9ea5409a99d09e62cf5c84702d2911b2ccdc298d16e8fb8bce4fa9af51514f02883838ba74c
- SSDEEP 1536:Qpq1Sr0qea07MrNJvrs/G7Yh2cqI4OTysopRBDBJhrSyihv/pR:pSr0qf6mNRe/2cXWsofJlSj1pR
- TLSH T11E8302325A357D5B433C9384C81E3C2B1AA99E0257E565ADC30F3CE877FD9589F4A828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 106KB
- SHA256 bf6abcba30db107138e80d6c35db4106fb95720bbea1902c7e866fd7e86f3066
- MD5 72ca78dded961564dc3b2d158a51e303
- SHA1 2d705284c8232f887eb2badb6394c750d378402f
- SHA512 0157d94c33739555523034e03d68a9206eec759e3f16ec817531e02131042f61d408abeca82af28d739be2c128a674c0c8b1b927642d2ab67941a71370089f34
- SSDEEP 1536:0xyZhFpDEXjMDBhYMr16Pj1Qqea07Sqrs/G7Yh2cqI4OTysopRBDBJhrSyihv/8Z:0xyZh0sqj1Qqf67e/2cXWsofJlSj18Z
- TLSH T11BB301326E363C6A473C2288C85E3C2B1EB98F0357E5D554870A7CA936FD558AF4E918
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 106KB
- SHA256 4d03cc38af549fa52be201e1866684f2b37975a02bcd813cef0018e5601f2e3c
- MD5 f7ea069053b74db55e11e49d8b3a102d
- SHA1 830f1b4985ae5427d685ea5822c2eca26664fae5
- SHA512 36cf75b8d0b51ee8c9c80fca100a97a9230e7d1de6de46a212108bd67ee2ebfe4d34e156b47873e0d52912d81c984a54b17a49543c9eb0efbbf4df2a38e2f7be
- SSDEEP 3072:PRyZhzSg+yWJBxR5qf6Se/2cXWsofJlSj18A:Pm10yWDlqf6ecXlofTY18A
- TLSH T12BB302319F353D2B573C5284C81D3D260AA89F0387F195A9870A3CA877FD569AB1B728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 107KB
- SHA256 6846b322cd6ee0e1043555f5eff4fe1578f3da8751e0ca5b75321c3ad0615869
- MD5 337402dab3f430bc0538ce2f53e1529e
- SHA1 d32d8206dc0d8b66d919d7e21cae28ade672728e
- SHA512 9646f0106449cc2157e9ee67f1d282cf94207ab9ae579a41c2ffa1781a059683cb8f56a5e0f68c86b51b7d97845b22e7e16545294e99981e5be916d0e6855b88
- SSDEEP 3072:rRyZh3Sg+yZmDIp3aqf6ue/2cXWsofJlSj18R:rml0yZxNaqfOecXlofTY18R
- TLSH T140B302319B363D2B433C5384C81D3D1606A89E0787E595D9834B3CA83BFD559EF4EA18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 2KB
- SHA256 2c8bea40113c78c39e05a1966c2eea2f456d4ae20c16791daa057a297b3681cf
- MD5 42481c436b476b7a12a63fcbed4fd004
- SHA1 2b2949dd172cfdd136d891a55fd1ae585fe46286
- SHA512 fb7f447d9cc0850c630189e2883fa354a4f1d4bc3f4ffc670387742345e8644ac4a17dfcf93e17790d303ad8c9d9ce952ea9f1ceb5ad0a7611f5d36a475481b4
- TLSH T11A413B2A3C3BEEABE395E50CD05D232941E13C930FD1D470C25C5A19EA5995F72ECA08
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 108KB
- SHA256 b74a8783a83d2cd77c771b5788033d8b55cab6c1c36fd5fa15b2ab7c833ef057
- MD5 ee1947562dda3116f8147babc64a5efe
- SHA1 89cb0ee63e3719cc00d2dcb6b299db5763b524ec
- SHA512 d04a83a9553bd0a01017f859e1c1e7b271a479e05f63e3c7b3136b7970404c7fcb8b2b5dbee54af35b8325743d36dd1c7f230960571c6bb73474e04f4d2aa335
- SSDEEP 3072:rRyZhkSg+yEQBTzhqf6Te/2cXWsofJlSj18k:rmy0yECTzhqf/ecXlofTY18k
- TLSH T13FB30231DB323D2B533C5244C81D3D1A0A689F0787E595A9870B3CA86BFE55DAF4EA18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 17KB
- SHA256 b672e1df579f247ef3b254a279faf285e3a7948e965d7b9e5e063c99d64e474d
- MD5 b7ed88159a39727bd2a33310d3e64f8a
- SHA1 81ae51be3ebc19ab7c67fe75f1634b8b64061072
- SHA512 49f3e2734ca0d32a5dc3c2544f0a540672c578c7fc9648c7559f51afbd75a0442eecd55a74032caa673d1b851755aba7e7b5c1fd7b5c13e4a225d5e1b35ae944
- SSDEEP 384:2w9r9MseqdSIIAsVpjLRWea0gKmsuoIHxxUcmAf:2er9MhqwZlVKeaZKmsuTHZz
- TLSH T19D82E131F53E2CBE8F7EA012E98F6D9D72B65C1109C2B5B1C7193201F7FC864959A844
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 32KB
- SHA256 260f60a78383efd12400d85189f795d48150becb528fb1fc63c815651b94c340
- MD5 36d52010e82c9ac3ae748346671363cc
- SHA1 74c31e594d616e1ec561b0c5d3a9aef10d1e08a1
- SHA512 ae1a08b5a74be00eb369e089a09bc0ece0dff9347e30aadf168bce9f37a2b52c4d06afe81e95079a051adc283b1a81f76115200b60f676635f0afa3fab77041f
- SSDEEP 768:wQ+Yb0AjSrwxr9MhzwZlVKeaZKmsuAplLeon:wpq1SrAqea07/n
- TLSH T1E4E2E037A530BCA1CB2E7280D6693C1E25E47E0AC7E61B67CA067D213FF9968DF05418
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 32KB
- SHA256 79dc01f4a90f8b4ad55450f99e4491a787776fcef94c866db28b0d203d35e266
- MD5 f26e771cd7d6b311c175da744b0f0027
- SHA1 2aa9a8e7a579017b7d21e2e48f0c1e1d3c5b434a
- SHA512 5ab857d2cd1fadc7ebedf3a5fcdd515c41530be0d84327f0147e93e841031d48c27d42ca9c59f0632db7cd58ed113c5d0ac25dc39196e259d99889c4e199683f
- SSDEEP 768:/Q+Yb0AjSr0xr9MhzwZlVKeaZKmsuAvljZvPe:/pq1Sr0qea07T9e
- TLSH T158E2E036A630BCB18B2E7380D56A3C1F25E4BD06C7E61A72CB067D617FB9868DF45418
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 83KB
- SHA256 3b70f8dfa73978a898d90e18b05cd83a90f398e7f1fb4579ed71c6887cac2b9f
- MD5 64fa0abb623ad9b0c5583791f65c5e32
- SHA1 e108cd3ba9f066f8676e08dfbdea5d18324a6519
- SHA512 fef80b7dc9eb9eb2902f74abbcdc70f039ca56930751a376c3cbc8d727cfeafe44e904a6aa8b5fe0761a36597545c1b2f7ab5888c9f74066fb4f3ca519827cee
- SSDEEP 1536:qpq1Sr0qea07Jrs/G7Yh2cqI4OTysopRBDBJhrSyihv/p3:TSr0qf6Je/2cXWsofJlSj1p3
- TLSH T106830131A9317D5B473D5384C81E3C2B0AB89E0397E5669DC34B38AD77FD9189F4A828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 83KB
- SHA256 beb9911da0c2efdc6ad7e2c7e708f2c28662693ac19a9021b6f9c196eabd4fd4
- MD5 2b50f24cd47cc9bacda502482fe3e797
- SHA1 ed11cdd4354e83c68008a781be1550e4874f3dd2
- SHA512 88b5fa66834a6f6d4797195c8fa2801dd6f92ad7cdd296889f01922eee5760c45780e5d1b5b084178518f24c767d2a52cdc214b021865c12f05bd7dfec910f80
- SSDEEP 1536:Ppq1Sr0qea078rs/G7Yh2cqI4OTysopRBDBJhrSyihv/p5:GSr0qf68e/2cXWsofJlSj1p5
- TLSH T1C383023159317D5B433D5384C81E3C2B1AB89E0397E56699C30B38ED77F99689F4A428
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\storage\default\https+++discord.com\ls\usage
- Size 12B
- SHA256 6f5f36e9f2975142fc0392cde9a957ae4f8f163dd72d49f4ca8069c6921e7641
- MD5 489ca8e828561a175139d0e828ad3cdd
- SHA1 c15548f5ffce2996e380cbb583d1d31ceedb60c4
- SHA512 5a3f44bb5b1a047c70763a9b463dde777d9d222712c31fb8aed3384bce972a90e617510e02300adb046d6522170ed30723d1cf1c2531731fa1130aea58252e4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\storage\default\https+++discord.com\ls\usage
- Size 12B
- SHA256 e1bcfbde10337986c717c04df90f087a0f0fcf73cda3b485f93c7408970c5bca
- MD5 57bc441c72fcea74b27861b09058daca
- SHA1 db017c3e0d518a8bbd7d6c021033d17f5d1c9857
- SHA512 e2f2432381108ae60c6d04cee126a53a6fa6198914bdedfc45d62e946e27e14a7f7ddccfe04b965cd1374d5169fb71dbf5ef0630931110b1f3e0b098a0f3f64b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\storage\default\https+++whatismyipaddress.com\idb\993782502OBNDE__KSDISG_NLA.sqlite
- Size 48KB
- SHA256 6a49fb61874aeb2e734a6d3cb2b7bd497f5192fe229219bb6e0faad7cacd6aa3
- MD5 7561c99a23f71fbd112f44411357139f
- SHA1 5ca5bc43c8b8d415bcc841ebaf4aa9d484df5df9
- SHA512 f978e60b0f8b30e7ba90e4345d2f9639220d9bcd4fe0e6415f958991b7a3c8c7d655da521a14f7c00ece9159ac17a775b9e6f231a64494927785ca61eebb397a
- SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0ekymuZ2YMvPrWCs/csCvQh:Oa16S6CdFAWrNmuYYMHrWC+c3Q
- TLSH T1052314CE3E07E501C976F0F265A58CD2685B311D171265E239D1C7ECC8B2616EE4F866
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.2MB
- SHA256 3216810da571e20c34cf335e55919367474fca361c61fd01d929ee4e8c127244
- MD5 489ca5ade17665adfdc57c0b3b5ac4e1
- SHA1 0e2a01ff6836568fee798d5584ef1307ca18ea56
- SHA512 eb14ab7740ab4fef38c60c92150685427fc04b3bec73f5648e9ac31e1cf20b1e49fbe7300af259d9e318d7551407a2b4589e1c87b524207b314c6c01f36816de
- SSDEEP 49152:7LGLykaeUo6QC5zYY/1TjJmV/KGPsYz8nLYhDwhzdD8DvTMfA5JSuY0gjl6Uu0UC:qvLAtmgDXrh2rffg9
- TLSH T1D8767EE860E1D252F34644B3719993EB20EFC00C6036CE44579497FAA9748EB8E977BD
- MD5 SHA1 SHA512 SSDEEP TLSH