b18e5cb328994d4284191faf8479d8607a5f4d2366b2f10c9311ec499d1f4957

Analysis

user interaction
yes
max time kernel
202s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TAL_RSA1024_KeyGen.exe
Size 868KB
Sample260809-pcafdsz1a1
SHA256 b18e5cb328994d4284191faf8479d8607a5f4d2366b2f10c9311ec499d1f4957
MD5 d2dc39d83adcce20de74147958e29e77
SHA1 79efc36f702722aa7bce5143726e71d00251874a
SHA512 f4df6e5ad8f3e65b869bcc3f06389303649c3d814ab03d7b875d1a8d2106819dfa78b1813f6ae46fd9b430858f8972ba9bd80f4ced3d8ae14b562e3ee231d8be
SSDEEP 12288:sc9t2SllUsgxJJahnsQDdC4+J/fLYBrmxMWXl4g+rQPscchI7:scLysgxJJknsQDuXyrCMeArQD
TLSH
T1BA152313B8E186C7D3F64BF264B7B8226A3DAC058477164B3BA433757933353120B6A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

google discovery persistence phishing privilege_escalation

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4608	keygen.exe

Loads dropped DLL 3 IoCs

pid	Process
4608	keygen.exe
4608	keygen.exe
4608	keygen.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
108	pastebin.com
109	pastebin.com
110	pastebin.com
111	pastebin.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
722	2336	firefox.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	109	https://pastebin.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a286ab145ec9cd6f	63

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TAL_RSA1024_KeyGen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4164	atbroker.exe
4164	atbroker.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe
Token: SeDebugPrivilege	2336	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
4608	keygen.exe
2336	firefox.exe
2336	firefox.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
1036	Magnify.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4608	4504	TAL_RSA1024_KeyGen.exe	85
PID 3396 wrote to memory of 2336	3396	firefox.exe	95
PID 3396 wrote to memory of 2336	3396	firefox.exe	95
PID 2336 wrote to memory of 5060	2336	firefox.exe	96
PID 2336 wrote to memory of 5060	2336	firefox.exe	96
PID 2336 wrote to memory of 5060	2336	firefox.exe	96
PID 2336 wrote to memory of 2352	2336	firefox.exe	97
PID 2336 wrote to memory of 2352	2336	firefox.exe	97
PID 2336 wrote to memory of 2352	2336	firefox.exe	97
PID 2336 wrote to memory of 2352	2336	firefox.exe	97
PID 2336 wrote to memory of 468	2336	firefox.exe	98
PID 2336 wrote to memory of 468	2336	firefox.exe	98
PID 2336 wrote to memory of 468	2336	firefox.exe	98
PID 2336 wrote to memory of 468	2336	firefox.exe	98
PID 2336 wrote to memory of 4960	2336	firefox.exe	99
PID 2336 wrote to memory of 4960	2336	firefox.exe	99
PID 2336 wrote to memory of 4960	2336	firefox.exe	99
PID 2336 wrote to memory of 3576	2336	firefox.exe	100
PID 2336 wrote to memory of 3576	2336	firefox.exe	100
PID 2336 wrote to memory of 3576	2336	firefox.exe	100
PID 2336 wrote to memory of 3576	2336	firefox.exe	100
PID 2336 wrote to memory of 5460	2336	firefox.exe	101
PID 2336 wrote to memory of 5460	2336	firefox.exe	101
PID 2336 wrote to memory of 5460	2336	firefox.exe	101
PID 2336 wrote to memory of 5460	2336	firefox.exe	101
PID 2336 wrote to memory of 5480	2336	firefox.exe	102
PID 2336 wrote to memory of 5480	2336	firefox.exe	102
PID 2336 wrote to memory of 5480	2336	firefox.exe	102
PID 2336 wrote to memory of 5480	2336	firefox.exe	102
PID 2336 wrote to memory of 5540	2336	firefox.exe	103
PID 2336 wrote to memory of 5540	2336	firefox.exe	103
PID 2336 wrote to memory of 5540	2336	firefox.exe	103
PID 2336 wrote to memory of 5540	2336	firefox.exe	103
PID 2336 wrote to memory of 5692	2336	firefox.exe	104
PID 2336 wrote to memory of 5692	2336	firefox.exe	104
PID 2336 wrote to memory of 5692	2336	firefox.exe	104
PID 2336 wrote to memory of 5692	2336	firefox.exe	104
PID 2336 wrote to memory of 2464	2336	firefox.exe	105
PID 2336 wrote to memory of 2464	2336	firefox.exe	105
PID 2336 wrote to memory of 2464	2336	firefox.exe	105
PID 2336 wrote to memory of 2464	2336	firefox.exe	105
PID 2336 wrote to memory of 5364	2336	firefox.exe	106
PID 2336 wrote to memory of 5364	2336	firefox.exe	106
PID 2336 wrote to memory of 5364	2336	firefox.exe	106
PID 2336 wrote to memory of 5364	2336	firefox.exe	106
PID 2336 wrote to memory of 5664	2336	firefox.exe	110
PID 2336 wrote to memory of 5664	2336	firefox.exe	110
PID 2336 wrote to memory of 5664	2336	firefox.exe	110
PID 2336 wrote to memory of 5664	2336	firefox.exe	110
PID 2336 wrote to memory of 5868	2336	firefox.exe	111
PID 2336 wrote to memory of 5868	2336	firefox.exe	111
PID 2336 wrote to memory of 5868	2336	firefox.exe	111
PID 2336 wrote to memory of 5868	2336	firefox.exe	111
PID 2336 wrote to memory of 6368	2336	firefox.exe	119
PID 2336 wrote to memory of 6368	2336	firefox.exe	119
PID 2336 wrote to memory of 6368	2336	firefox.exe	119
PID 2336 wrote to memory of 6368	2336	firefox.exe	119
PID 2336 wrote to memory of 6580	2336	firefox.exe	120
PID 2336 wrote to memory of 6580	2336	firefox.exe	120
PID 2336 wrote to memory of 6580	2336	firefox.exe	120
PID 2336 wrote to memory of 6580	2336	firefox.exe	120
PID 2336 wrote to memory of 7076	2336	firefox.exe	122
PID 2336 wrote to memory of 7076	2336	firefox.exe	122
PID 2336 wrote to memory of 7076	2336	firefox.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TAL_RSA1024_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\TAL_RSA1024_KeyGen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:4608

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x258
1⤵
PID:1540

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {9466b6e0-cff3-4676-9958-64ba404a79c9} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {7febfc9a-9a75-4ab7-9f64-bbb088b81bc9} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 27276 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {3193006a-8277-4d49-b464-55210540ac14} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27276 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {efc9ebac-1519-45e0-bfeb-56f047de4d3f} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4372 -prefsLen 34775 -prefMapHandle 4376 -prefMapSize 270279 -jsInitHandle 4380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2480 -initialChannelId {60538892-1f42-4bbb-a467-1425c1654fcc} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2944 -prefsLen 35012 -prefMapHandle 4900 -prefMapSize 270279 -ipcHandle 4904 -initialChannelId {2b3494c2-d7ef-4728-b0f9-b221f0fb2ef6} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5108 -prefsLen 32900 -prefMapHandle 5100 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {3fddbe99-2d40-456e-ba5c-4ee8bd465d51} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5156 -prefsLen 32900 -prefMapHandle 5160 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {23692f00-a7a7-42fd-942b-27593361d637} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5424 -prefsLen 33031 -prefMapHandle 5412 -prefMapSize 270279 -jsInitHandle 5408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {9c5b0716-214c-4eaf-81ad-9a050682a6fc} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6240 -prefsLen 33071 -prefMapHandle 6244 -prefMapSize 270279 -jsInitHandle 6248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5688 -initialChannelId {54ffdb22-4443-465f-99c7-c92ba1f108a0} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5648 -prefsLen 33071 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 6472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5644 -initialChannelId {c53de499-d803-405f-af1d-f699a95ce6f5} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6924 -prefsLen 33071 -prefMapHandle 7064 -prefMapSize 270279 -jsInitHandle 6920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7084 -initialChannelId {4878ba17-20ed-4011-9680-048587078886} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7308 -prefsLen 33071 -prefMapHandle 7312 -prefMapSize 270279 -jsInitHandle 7316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7096 -initialChannelId {89728564-dda7-4d5e-81c7-9ef1634c4f55} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6584 -prefsLen 36758 -prefMapHandle 7224 -prefMapSize 270279 -jsInitHandle 2652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6896 -initialChannelId {77b98b22-0690-47a4-a4ef-ac34785934b5} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:6368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6868 -prefsLen 36758 -prefMapHandle 7732 -prefMapSize 270279 -jsInitHandle 7736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7852 -initialChannelId {25b4c30e-d683-4955-8543-a407dab464f2} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:6580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7892 -prefsLen 36758 -prefMapHandle 7744 -prefMapSize 270279 -jsInitHandle 7212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6820 -initialChannelId {ebf4c855-fedc-4792-baab-46b8083d1851} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:7076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7124 -prefsLen 39877 -prefMapHandle 7104 -prefMapSize 270279 -ipcHandle 7144 -initialChannelId {ffb7dd53-19d5-4289-b080-6786d0376b86} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 utility
    3⤵
    - Checks processor information in registry
    PID:5552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7140 -prefsLen 39877 -prefMapHandle 7128 -prefMapSize 270279 -ipcHandle 7104 -initialChannelId {f4baa2ca-8f59-45f6-9100-22f7800a8afe} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 utility
    3⤵
    - Checks processor information in registry
    PID:6312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6720 -prefsLen 36758 -prefMapHandle 7516 -prefMapSize 270279 -jsInitHandle 7512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7172 -initialChannelId {4246fdbc-10c5-493d-a400-179328fdc15e} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:5288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7372 -prefsLen 36758 -prefMapHandle 7356 -prefMapSize 270279 -jsInitHandle 7360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6868 -initialChannelId {b5f5a545-e9ca-45af-b0d8-5f563f868713} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:4028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6744 -prefsLen 36758 -prefMapHandle 6780 -prefMapSize 270279 -jsInitHandle 7024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4500 -initialChannelId {4829aa82-d012-4f88-944b-6a1e24992bab} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:6932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3120 -prefsLen 36758 -prefMapHandle 7400 -prefMapSize 270279 -jsInitHandle 4788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8828 -initialChannelId {586f0cf4-f9ec-4732-96fd-4bf980eb92c6} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:6948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4848 -prefsLen 36758 -prefMapHandle 4832 -prefMapSize 270279 -jsInitHandle 4488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7824 -initialChannelId {a3e8983a-a68a-4efb-8f55-89f86407f45a} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:6780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4516 -prefsLen 36758 -prefMapHandle 7024 -prefMapSize 270279 -jsInitHandle 6780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8000 -initialChannelId {f4143593-8158-45d8-b765-d4facf1701c6} -parentPid 2336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:6816

C:\Windows\system32\atbroker.exe
atbroker.exe /start magnifierpane
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4164
- C:\Windows\System32\ATBroker.exe
  C:\Windows\System32\ATBroker.exe /start magnifierpane
  2⤵
  PID:776
- - C:\Windows\System32\Magnify.exe
    "C:\Windows\System32\Magnify.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DB3803B600B49911A500345FD3798C65EFBC29C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\0DB3803B600B49911A500345FD3798C65EFBC29C
Size 15KB
SHA256 8b0cf0bd0320bfb86c6832198beeb52cce45e5526f602c9ec92fa0ac2440946e
MD5 98c896f5789cb119805e8744e25472f5
SHA1 ace015cc0f36f191b60f3496752119150bebef21
SHA512 d2c3b09978f58269b0d121bc5c94c2fe5e9102b36c67faa1510bee61926e62615e04d39dd550d52c65dfb7f80019e54e1ce87b5e9b8ff260c2bc7f5cefa1bf57
SSDEEP 384:TRQcB6UcZEnIV8/OQF1epwzOXiMRiOzogecZAkjb:2cB0L82GoXSKnecZAkjb
TLSH
T1CC62B07FEE907E151A3AFC504069A7DC9E615843A6E4A4BF791C3CC0C8A763685131F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4C4E21893FA6C14FBE4DBE5D8E005BBBACF7BEFE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\4C4E21893FA6C14FBE4DBE5D8E005BBBACF7BEFE
Size 13KB
SHA256 9da9808d54f46bcaefdbd6097ce053711b58bab2487d835c2df642b09f89c499
MD5 ce41c883a3161091aeaf910361ff4ce1
SHA1 1180f641b1d8cc75c04ed6e97a9c79e2f141dccb
SHA512 bf910704c93c064da616db3b7ab38aebe9b2602d60daca0e0ba3d3d215ba86843437d4b9983cf75b9a5487b8eadd437317f365478e432b25a3e0bc5ffc2a1c4a
SSDEEP 384:yckqje9fTfRCald3fs4ufsGlhY4cW5AKPs5jxZt:6z9fjRt3fs7fsGlhcK7Ps5jN
TLSH
T140527D7A5F013B6417B2BD35AA6B0E2E0D287613D984CEDA7C083175CDC87A37A50CE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 53069ef4cd2461883deb4781a65423b2232cda00747b21dd2b2bfbbe6e999a69
MD5 c11f59590ea23e66a1f18cae1591a982
SHA1 3b4165c6e2bceb54e88e6416f477324779b4f5a5
SHA512 2b98d596d29d0cf4d22278c8fed19e31387270e8afe8359b2a82e8397a1fe6e1e19d4ad699221398cc1523a56f4a15db700ccb7e8c27c4d89080fa81ed2350f1
SSDEEP 384:HwCe7iO024YDDL84KKDL849B7SOEAd9KVRaAcP+AWRMAu8H:QqZYDDL8lKDL8CB7S/AmVAf+hRM78H
TLSH
T17D729D399F413CAC2597C0E8C5B982DA4C18B7A7CFE6806D21683D0DC798969A1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6F1ACDB163196EA2F8F3EA532C41FCA4071D55EE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\6F1ACDB163196EA2F8F3EA532C41FCA4071D55EE
Size 9KB
SHA256 73a5bff8fd92fb1a0260d8ff0f3ad6bc0318932adcbbb6a18d6c82edfd36d2b5
MD5 6aee6bd38749000c629cbbd650e05f45
SHA1 4636f7aa50bf1e87de7a5f9682bca2c9c9fdb82e
SHA512 83dd1eee40fc58434a2c6439fa94a4cc1e81aea4ead164c197dfd2c755366c94dd5ff1597b936a9fd0d9840dbf5be1e5328f965713d6a63aa2523c9e0dd20f6d
SSDEEP 192:EGsL1X5sPTbM1MnAifpbBA9nUXyzam6zo2hpVH+gTJtZAmqxvSX:Bg1psPcKTp1A+iOzogecZAkX
TLSH
T1C0128DBB9D411A584BD6E881C17ABB8EAC6480435FD997DEBCB43C404D0A3B6D85389E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 39c3760738553bbe0c17c75ddf1ca4bd8016fbc4e8e573826d5dd64b17f015ad
MD5 8d45e43e2543f5704b00f5d2a9e18dba
SHA1 3951b86d4e66255049efb5b745b24d066018c12e
SHA512 bb369be14660ffe9d4f6bb7929dcfedd1cbf8294f8c84c1f8f02de24fd3303fb3bc78cce10ad578006e5209055a01fe8a89aed74b6c8fbfbd558f66772973fb0
SSDEEP 384:HXkRyiO024Y2DL84KKDL849B7SOEAd9KVRaAcP+AWRMAB:3mZY2DL8lKDL8CB7S/AmVAf+hRMQ
TLSH
T136728E3D5F003CAC25A780ECC5E992AA4D18B767DFEAC06D21583D0DC698969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B5CC615B6249AC4BC7AB7435D36FDEB71E5FB9FA

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\B5CC615B6249AC4BC7AB7435D36FDEB71E5FB9FA
Size 116KB
SHA256 1a6c6b3a865360f1c349b649ff0d9caf6d5594c6a4fa0503a0d02649dec5ce82
MD5 5180076c3a5622b95ede04a590111551
SHA1 aeea8f4be368b42e81fc82632322b124635e12c0
SHA512 45447500a2dc525085df71acef70d501fd897677f5a929d14b6f5e7ed1fc212954f6f8bd0902a6cda87845c58ef7b33e4ec8e4c50be053cb3d22f161e5f1c1b0
SSDEEP 1536:zwhI0T3inXtDMc4/ZGPEfTsAeKTYFPiGINCe77NqKPiBgiY:n07+o/EAed2/6BgiY
TLSH
T1D1C31916EE505A13C17003F094AB777A3E20E6529F92F32B2ACE7136BC1D27A5D7199C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BC1E0A50723200C60679BE77548D7AC583853E29

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\BC1E0A50723200C60679BE77548D7AC583853E29
Size 37KB
SHA256 70aaf0f190f38ae046be1925eb6f0bf0ca81710265d75bda886c0d5e99e64efd
MD5 4e41b6f3cb4c1280e48b2d1eae9f0f90
SHA1 98b7425107f9b0c0a4b8fe93d53abba12da85430
SHA512 cedc3bf96eb941b5892fab0adfe163893b449f579059a23bc5a5d556a27dd3435067acf21c69b49fdde40b6a89a93811c9e6f289c72bd5235854db3b1205c60d
SSDEEP 768:zmM6ndWSyl1Fu/K25nOXlgx10azkMr1mL9VdGfs2KJfylv9Snm:iHhyl10hFOXuGaI/ofsNJM
TLSH
T12D03E035A1613C652072BCBBE8CECACECD7DA913CC69D10F116F3947006B1BB49A4D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BASSMOD.dll

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.dll
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RJUCE.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RJUCE.dll
Size 308KB
SHA256 56d2fe3beb3c57e3ccb8e7e1feda4cf37145f2f949881abae4a472289cb18b1e
MD5 43816a9f9bc418b0c728c123d22ab3e3
SHA1 74848859db7d6ad2c31be428aaad14859daef221
SHA512 94842c4250b9e1cfa5c74f5498c48e45da604fc7b4ca4d23b0d216f66bdd0bcbfb34b8513a8bc4fede02f2cd3fdcbf304b1d638190065fc41ed57e61a7daabd6
SSDEEP 6144:4whivqdhFlt1/aGA1rplhQgnN5Ytjjy2KeAOd4TBmE/S3x:4Pq/lRaGA1r/N5Qjj1HT4TIP3x
TLSH
T19B64AE00B593C076D27E093019B5AB661B7DB9300EB0CDBB6BD81F1D0FB95C19B62E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 771KB
SHA256 4ad17ef1cc0445aca66988d7be356cb9e95089eee57926e42d57c0e7902a0b7f
MD5 52daa5d93e30df314b36b154e11cc9d8
SHA1 e8d5e90731f1ae392ade5412b5afc676110607d9
SHA512 81c35fe6fa32cdf2f3993a4e7ecc193b5d04965b18bfc431c3001ade158e8411826ec96c7adba179fb05a820b9d73896f0608331ca0e11daaa04e15e7c2efffc
SSDEEP 12288:tpGVQ4KQonRBVrzRNUhYDKCZYQlfmA6A0w+NT:tp1QonRBVrzTKbQcA6AE
TLSH
T1E1F46298DA1285EFF4FA433C9145A214D058B3BCC226E0AFC1EFED69507915F24F91EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SP_9B9377A789B740D3A4ADAD8C377D5870.dat

Path C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_9B9377A789B740D3A4ADAD8C377D5870.dat
Size 940B
SHA256 e7f575b0ee157334cc316f817e3a1d437ac96f9bc4924fde15a083df7085d10f
MD5 a13030dd29adde8debfc4779927f4af5
SHA1 4688a92b4f16951646fe09232e8fff01c8fae6b9
SHA512 0d548c72c2cd57be3d78c3d057aea077a989019d96142ee5cd7265e62424c0e8b64e5653570ab7a077f31ead5091c0587cdc78fd3bf870687ed700a52ad40f84
TLSH
T140119BB710FD1C70D40786B6943D11018627855D4845AFB275557076765751482969B0
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\AlternateServices.bin
Size 10KB
SHA256 6c0e41c8e07612c5c6484880ea1cd93bd3a58ba57d37b65056346ba486599375
MD5 52f4e08b91842f9b724b9a78ddb2e5c3
SHA1 8deb5342f7eed85d9434adf1e236b3c7d9ef161e
SHA512 2afc3ffe29171d942ea230639a30123484a7553541a64b91579dade30ac422ca6896741d5fe80b57fb137759dd85bb2e73d8014ea1e46547f8f08c076ecf10f8
SSDEEP 24:buhMZt91Y19xsOh9BoOv9VvWOP9lOOa5q9F55A5NOG9BbS:hSfuOziOVBWO1cOII56NO89S
TLSH
T1AA221EE76FB26572F0A2CFB4405DB14C9D331726156C9584C75481F346D1A99903FFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\AlternateServices.bin
Size 40KB
SHA256 ef5bb23708ad371ed13ec64c35b26d9d8f1c5114b67b0575a02b527d43bb21d3
MD5 3b8b1c4aaecf32b18bdc6b8a6cfcd43e
SHA1 b5b359e7b041f4ee57724b8a92f6923b20f76ab9
SHA512 0ee48e0ecb381d54e21774877f97c716bf3b47079f83485a9a4d8e4cf490e70cd1e1c94ce96fb493dc36d808c8901414eb91745ec04f78fba0f21989064c302d
SSDEEP 96:A9M4UkEBALIqnI56r8gKb8nDjnuK140//TyIBtste0G/sGbGIWwiC+Masc+/e6TH:0ZjStoWAWuB2B5B
TLSH
T1380371F79FB66626F0A38FB040AD7488CD3322264A559598CB14C0DB1BD5795E03FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 81324393a6ae9779e330de9483f722fd80ed466503f6c6ad4866cb4ff264d1ac
MD5 fa5bf71da8bd022a0940a655aa6ef2fb
SHA1 8575e35464f9d3a4d8e09fc9d5af0fcd7b76b37e
SHA512 628c358456deea9bbce6cf15daaca851e99ba6130e5f42b06386cf7c9fa9301d9513ffdddeb788fb7d899bb3bf4e1334b291c7d67575de0b9cfdbac071139cce
SSDEEP 192:m11d66JozGzgCl6mc0dDOv5zboVZmlyjkxI:qd66JozGzgC1jCboVZmlyjj
TLSH
T149D1EB68F728863FD459023BCCA61B440F35389A984E3F2932DC601D2D576DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 871fc1be84e91457e3687bdae9a5d20e02aeb8f9de39cdb8187f4726bd8d11ce
MD5 897d55622f583c1839fe4327f5f4305e
SHA1 b1a7328aa295c5762085820a717015592efdd39c
SHA512 6ff2de478f2bf0e8b9c22152454c1d68f9d24eff7bf3bc84de7122d8ec0e6b2b0586b2fd11fd10d48ae4d9a6bb881fb3ee91b27570e7385e696825ebecf4b92b
TLSH
T11661C858F228863FE485413ACC961B412F343447A8AF3F2A79AC604D1E5B3CE768D47E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 138KB
SHA256 2cc0e3963912b728e6979a69b54ee862102eb98660125dc935a75361a2b8535e
MD5 9d08004178eae2ee85ebd97e1b8883b0
SHA1 a6fecd7da743db01e68a9e7b5cf9935386d0552a
SHA512 3ca3e322d7ce51f810b2d4f08a33a5f8377c98a937ccd8f1c8520f748dd36bb626b32999f86447a23e5ae58549afad6cba37157a72d2ce7ab6b92ddf91689975
SSDEEP 3072:XDBL7t1FdENLiyIhQ7F/K4zCojAq/KaCv1fy606fia:XDB7t1FdENLiyIhQ5/K4zCojAq/KaCvZ
TLSH
T123D38CD4DB1A407BFC1485BFB495673C2635F4304A599B0B2AAC04761DCB3BF2D0AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 138KB
SHA256 aa53039976eb494901acb47aff102be733a3457fd4a8f7692665ce9378ab6104
MD5 bb149e16fd254edfc5acfcde437a198b
SHA1 c932643be195eadd5515e3b409ac453967a05743
SHA512 a53aa76b728ee389b4e76e4808a2ef6b3ccb68355a7194102f0934b5e4bc250cd62f65aad3fee9251a8b2394022506c43def4a4a83ae87ed90483a1566e8466c
SSDEEP 3072:1DBL7t1FdENLiyIhQ7F/K4zCojAq/KaCv1fy606fis:1DB7t1FdENLiyIhQ5/K4zCojAq/KaCvn
TLSH
T120D38CD4DB1A407BFC1485BFB495673C2635F4304A599B0B2AAC04761DCB3BF2D0AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 138KB
SHA256 36f123ccff4c8942e56dd827bffd679771a21a07fe798b20ada45cc9166fc99d
MD5 7b9992e7af4f7f01d664413eafabaacd
SHA1 49dd4c04d438caedf0eaba6925a3fa7bd37fff30
SHA512 b4bba20b641b6b6ae366bcf0078a91d16b065e80ea8f7b6b6b3c09dc1a233d597a694db54919cd7bc79b0ccb0604a5c7d8751f92828878845f3b9db57c689c0c
SSDEEP 3072:pDBL7t1FdENLiyIhQ7F/K4zCojAq/KaCv1fy606fic:pDB7t1FdENLiyIhQ5/K4zCojAq/KaCv3
TLSH
T1ECD38CD4DB1A407BFC1485BFB495673C2635F4304A599B0B2AAC04761DCB3BF2D0AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b3f2dc2e0aaba4e690c6ee47ebc8c2b4cbed65e2d05c5b65a866f5c361862981
MD5 bfb4cb9e2f4cd6a27f629d72611a75f0
SHA1 52808eea884edadd60151ef22d4327c3672bab2e
SHA512 789e08677be5095cfb0275ea14c5f926fd0e7fbf9d66f6f5de6c53f14242ca9d9b95c24b26c31e3a20925885986c93857939afd0d09b270d85f3ba056e91628e
TLSH
T1BC216A4C39F84D7E59C7E29C7450528E53968E0A04872C874E22EF8DCE91AD9326F83D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\events\events
Size 4KB
SHA256 a5df1151779247b6597d1bb62dd9b3d322e033b1f957dc7c538a2ffd20655899
MD5 f08e78b44bc141d7081c96dfbf46654d
SHA1 b0f3f974f9869f0c523c6f64155ba8031dde1641
SHA512 7257ae740d2010f42d410d6d90774f95cd1f73d47ed72fb0f5fd32d649ee470e86bb43f9f44d1eb1780195a1f9423c07946916823541066af7c2097cf63a1b05
SSDEEP 48:Yp+23YAD6x2OEZKGseyyudLi/ha3aq0f5i9UVJ3E4BTJgPYDdCo9VgOMJvgduV+E:1MVyy64FMas4B2wdBSVCHiTCFe/UP2V
TLSH
T1F1A1EE1C66F90C7E2CD7E39DB851479D4399470284CB2C8B8DE7EE48CE86A99321F439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11180ab4-cc29-46fb-9fe2-2c5ee2a121a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\11180ab4-cc29-46fb-9fe2-2c5ee2a121a7
Size 235B
SHA256 5a52c6fc4028402f75eaef7913c1be2d106b77005920f511be9af6fd7810754f
MD5 89888fbe3a79c170635c39e226c65187
SHA1 b98f7244470cac293c5ca97566209fa0d3fd4d94
SHA512 a2b53f22eab2df8c39f4d487962f563e701dd57eca913ab4d63fe94368e98aa4b9f0caa1dfde9600d1dc1855ad75524a266e6d7512b6b997927686b876a02eda
TLSH
T1E0D097C024CCBB6C08389F2AB0E03CDA30848C3B24B09820D66080B49AB99C541A281B
MD5 SHA1 SHA512 TLSH

Submit Download

30d397a6-f1cd-49f7-b586-195e8c51472b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\30d397a6-f1cd-49f7-b586-195e8c51472b
Size 2KB
SHA256 03f1f926324560c90f85c935234ac69f9e78e753e3a313e3c9100e7e7c5f8353
MD5 37396c24cbc24781abb06877cd2191b2
SHA1 0f2560fd061fc4f63f2fadce72d8c304c5468bd4
SHA512 649c15d331cbe505e5ee6cc77aad7a8c7414f6441be05be9b38c3f96bede41aa7c4b21c691c919c55cf02dcff6c49fd49046d6874e766e7ac13a4d3060d76d57
TLSH
T11841115C35788CB69DDAF19D9482234E57658F1300C228432D65EF0CCD967AE336B436
MD5 SHA1 SHA512 TLSH

Submit Download

58894693-9a01-429e-abfc-c7c7a54dd61f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\58894693-9a01-429e-abfc-c7c7a54dd61f
Size 16KB
SHA256 af5470797b285c6b1a1f2c6167b5ab523b22e72fb3f22863da430ee120ee3fa0
MD5 2c6ceb183f631e158eefed83c31116e1
SHA1 549678196c1c6edcdad2023a558085bab06284b6
SHA512 81421ff69e1d5dfa3b1a69ab91b1456a3c3774e3eb8940c4e59483ad210de03c2a672199ea34c9fdf88bef000b18d03dd67aa9407a2922e231a60b4449fcefef
SSDEEP 192:qUBOdq11TJ4uZJp2WUSgWhvjv/iPbepeMLYYk96ITn6nFMNHuoJcfkQohP7tHzxG:qU5TLN2WVb9jnSb2Q9P7tHliKiQve
TLSH
T1EB72C956686045BA8251E368D4F87FC3E5F528CF4C419FCADBE4BE0869DE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7629f9c3-d526-481e-af15-b119974ae8cc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\7629f9c3-d526-481e-af15-b119974ae8cc
Size 883B
SHA256 355b91f94c2ce59afd22ba9f2c96dbeed0b9e9af2ead4c1bbee32a4ddd838cb9
MD5 5c96fb411e0c8842ed9b360428ed1262
SHA1 1a693650103ebd478f4837a828c5beb0dc40fd6e
SHA512 8d845448304dd8e63cf665e4b4137030cbb9b951c8a8a9679aaefd5048da90196db07de3b24bc4745f94db181f7df9e409c32abd401980c3444093db616c4a36
TLSH
T16E110081A635B9B79CACD25B85553B064BF47A1380C554083DB15B180D7EA2EA36B20B
MD5 SHA1 SHA512 TLSH

Submit Download

9ed79f7e-aab3-4a4d-b175-6b40b8b0e7ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\9ed79f7e-aab3-4a4d-b175-6b40b8b0e7ad
Size 235B
SHA256 46c7c8a8780818809c88c6d2d5beba82739efd4392aa01bdfea9e47a3400918a
MD5 04f765ee333e8054ae36bb9a0fbb0ad1
SHA1 d4128791410f8d5e8f3ba2c0008fb05d4dd8c098
SHA512 7038d1f36afe85c798531e7160c0c0d0ea0cb4b373f18717c8534d8bdc41aaeebb7d9307bab5ab43f8b6a0d26a8cd21437453f491d2a21f85285fde30bf5abc5
TLSH
T182D0978018DC372E08280F03F0A028C2B1884C332078A810C99244B48AF8AC8826185B
MD5 SHA1 SHA512 TLSH

Submit Download

a15cece6-db64-481c-bc36-80830a89ce1f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\a15cece6-db64-481c-bc36-80830a89ce1f
Size 886B
SHA256 2ab4752fcdf62aab798aac774899fbbe9715b5ce152072da79165cbf3dc85a9c
MD5 32e3d936d25f55ece92d9d79966e09a9
SHA1 1a0749577edb7cf3af20ce7d589a832430255daa
SHA512 9520610bddb041f5ebe219fc65425107a6f65e81097d131c269e84710fdc7710b0b95c8d6ebb7d88d33df6d3d806e4196bdc6801ceb01af42bc0b4dcaf6f3cba
TLSH
T14B116781A774B5B28C74E19F8495370247E0752380C545187F9057180CBB52E735B207
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\extensions.json
Size 16KB
SHA256 e2cb6f2387dd8574e47f2dd2a23c2e0aa6c94b96ddbcb639d8b4d9902f8167a6
MD5 6726e8f9313289e867d5c2dfb9149979
SHA1 6881678ed64ee20f63c6053eaa2e236b72bf2bd5
SHA512 aad5b26da769ad188b1afe3221a5f8c6a90f5edc396b6e506fe8cf3280453999643cfd173876d246e3d30652ea0395c425fa3b9accdc53faba464b56e4ecf104
SSDEEP 384:okI4v2UmldvV8dhWk94zH96oLL4HkL4PRL4HgL4HuL4HkW4hd:/I4+RfmXt4Z644e4R4i404z4/
TLSH
T1F872531545049EB8294FA79BAA367E02C37D533B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 6KB
SHA256 c432aabd3588e0e4ec25d52486cf92a3a5b6557e4931173c0dbb02c847ab07e5
MD5 45633cf73a1f71179e730016c398f5f9
SHA1 ccea397b43c1dd545c00b06c093ba845dc944313
SHA512 effe38942bb950fd4f7695b63088a96d42f9701a314974437a585a2ade4981787ff233da23744485c7a392fabccae606db28dad2ab453d15937461a9c5da33dc
SSDEEP 96:xHBUTUxVqGq5fgmVkzSAFSSlWdv9je4nqH/8MBw88n8L4cn+wGLGS:HyR5fgmVWSS1dBw88hB
TLSH
T1F9E131789418CB7F74B676ACAC688C715AB2013B77BF68C710B65488051CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 8KB
SHA256 de3565484490f4973b790e277e4e34258213f3942b9da0f2a21e1949c4a03609
MD5 4ba3bddb3fe685b4bc15d77ef01dc1c0
SHA1 ee985545a440030f2f0253d68cdc5bcffae6f757
SHA512 15fbe58047c6e1150d87dffc036eac7710709ec4a852b1b589f0d2e4e00a8f905b1bc99b4977454ea055ac9c5f5677da53ce2102fc800ca61e92136d4100016b
SSDEEP 96:xHB1TUxVqGq5fYmVNbzSAFSSlWdv9je4nqWRRr8JBw88NFzEF8L4cn+wGLGS:HXR5fYmV5SSkR6Bw88NFzEHB
TLSH
T13B0210785554CB7F74B6766CAC2889705AB2023BB7BF68C710BA9484051CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 9badb95a580f7d8d73d6fa5ab2b6941dda7b84c327374eaf722d30847d60dc1b
MD5 755c7f01ea374692cf366454c6ec5d06
SHA1 044ef8aa87026cc5db42172017cae084c559c2c3
SHA512 d4b3574ded4555a77c64de1c29207a28cfe0116fa7518d785766b2904e9fe1def58ac871ba5f3e087562f8e2651e30bf84ffaf8fe6c568cb541d598a45fbfdbf
SSDEEP 96:xHBUTUxVqGq5fg9o1zScSSlWdv9jqnqH/8MBw88n8L4cn+wGC:HyR5fg9otSSmdBw88hC
TLSH
T1F5E120789408CB7F74B676ACAC688C715AB2013B77BF28C710BA5488055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 5b078f95834b1c7dfc79db6525c5398a4029983e8cb05c8f37b54de620185578
MD5 02785719d9a4b77284256207fa22891c
SHA1 8270e2662d3731ca8b7f75b262ca9860ca2d3024
SHA512 ca29b5c165e6c544559b3be0bd15c83dc811889eca35e2c5c21a5b044ccf2d5dedb7f951933bff435ed7b26dda7aefedbedab729c83cd8be9a6acaec283975f7
SSDEEP 96:xHBUTUxVqGq5fg9o1zSAFSSlWdv9jqnqH/8MBw88n8L4cn+wGC:HyR5fg9oVSSmdBw88hC
TLSH
T10DE12F789508CB7F74B676ACAC688C715AB2013B77BF28C710B65488055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 543b98854bf9366b4a8b8680197900569fe016708152c2272aafdfb777f63843
MD5 98f36502c0dbcc28949177d27ade3134
SHA1 ef36cfbfe4c561415249c9f8cbcb39763f66a5e5
SHA512 63d331dae04a4db861f3909c24c38c07e42b7531622916c3d665e753bfc2e81b1178a1f0d37dc6df96a0f8ca5169afc6d50854dfbbe4be4341201fb977accca0
SSDEEP 96:xHBUTUxVqGq5fgmV1zSAFSSlWdv9je4nqH/8MBw88n8L4cn+wGLGS:HyR5fgmVVSS1dBw88hB
TLSH
T1ECE130789418CB7F74B676ACAC688C315AB2013B77BF68C710B65488051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 3d75daf5820c55736bb36d45b5bd8d63a3857b0199e5622752a6171d4336a7eb
MD5 ee65347f9aa683ba70759c4cfd9e40b7
SHA1 bd91a269e8b370e847d2f3d024495dc1c9227def
SHA512 094743c9160ea5c3b6ac9c483fab13d0b6381c52467bd40fb99a6c9a0c156c51b3f511fe8dfdc8b12a12cbdb15c2a5ddebf48ab6e77ead4f30e2265fc8a6f168
TLSH
T132814C9BDD6468E28765D05408C85B8D07E0224BDAF01F42EF28D6B718A465AA7B9248
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 87785e6c7506fed029c1cedfa9b632de97bf0a372c52f61b280bdfa98d516e72
MD5 2f856ddd09d034bb0dcab0660ec5b5ef
SHA1 984e3251e824b8246fe7a92f52a1f0a0dc904ebb
SHA512 c11221f0337765c368a28139f1899037d3a26de0e8d461f70f7ad56cdf822008b22ed0f8f69b7d7ab1f122d6bea586918d79eaccbf07351f3d69a898c6642e2e
TLSH
T12A814C9BDD6468E28765D05408C85B8D0BE0214BDAF41F42EF28D67718E4A5AA7B9248
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 7a7c7c7b9b057757a7bba6e49e9ec3374e2e89bff90392e17bd80c5b0d45326a
MD5 8057fc4553b753433d84949ade9e3fe4
SHA1 b78ab7c50b21f8505c6e2955ee0717d4249ec6f5
SHA512 009cc9244e28714f34f8e317002dac39d72401206248d3a1e20cc772f9b00210cb430b2b76a8c3581e6a3420db306c03e3ccc3f56d1b045e1a5c41b83a228789
SSDEEP 96:Z2Y9JjK9iLO2wRD28TmclIluReZFGbQJaqHddeH825pWCig+:Zdu9uUPTNINGbWTp25pa
TLSH
T15FC15C97EB1875E08B24D54904D09F9A13A0255BCDF00607CA2CB97BDAE479B77BD384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 00e1da1379ea85d693bbc49f960e4a0a92434e321ce392d5481fb7cff1bcb594
MD5 d0b038a2c96bc4824a51957c06aa8116
SHA1 f14cc5b5a741cd6d10623e9162674cd85e6b366f
SHA512 5de7cd590a9d0654ec41b66ebc5490fbb8bb741ff09f4ed126beed2b11a7fd985491aa320f9010b650449722f2c5f13047af4409686d3a2bbf870edde7860179
TLSH
T1C531F745DA7D1CF16E72928AA0C41FCAABA8D43E414CE4D8DD8C99A52DF830E339D11E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 7baa96c12844eb5d51a36c2259cee842ec6b9a44107a1d052e44fd8d8a315846
MD5 84a995198b597551ef8d70683746f9a5
SHA1 6e1098de4dd63490471736caa62cd9993e86cd58
SHA512 f9450ab067de88ae57023118dd290b4842b04359f68de4451f2534753f9ebd9b6c1b6183be8c79f2f39b06c0850287cbf56ba71428dfdb3b078d0b5b22c28236
SSDEEP 96:N2Y9JjK9iLO2wRD28TmclIluReZFGbQJaqHddbbgjHCwEVG:Ndu9uUPTNINGbWTYjHZ
TLSH
T1CEC16CA7E71875E08B28D44904D05F5A03E0655BCEF00A16CB2CE97B9AE479A77BD388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usage

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\storage\default\https+++pastebin.com\ls\usage
Size 12B
SHA256 8aebda1168e4058edfefcee07fdba8eb8f5dcdec304e7cb0c2df2fe39b71e124
MD5 20e364811ba2a11c2dc4a8711f04b7f1
SHA1 5e59b0898cc919cdb96e9e06c703143540aeeb1f
SHA512 104c54ced1d7d97e640e731835422e50726eef4fb925dde9acf27f1be4d7fc32aa8bf44b1e6fdc344109f89c94fd5cc7d12da6a78be39ab0542f511da5e64b0f
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 0fb4785be00ec8e94bdf9fb0e4327b0b19cd8ff820e94a8112e6a9b7567b1f66
MD5 c678078e27793b73ac84e76ca7e84764
SHA1 76bfd9887535752821c7fed139854790b45a4ece
SHA512 5fca1b89ace3a94b84c0b4611e0e1168089530a96b639775992734dd02e8e3bd144dd637a5b459d746551f56d38185aa20e1415d526e1814ea387637ac678f17
SSDEEP 49152:ItypcaPn8wAQC/yTjgYsA5rIrx4FF7RJmFWSGB+IB9+1veMXR7:IbyTa4T7TmNGB+IB2Z
TLSH
T19C464BE860D19252F3824073B64993EB21FFC00D5437DA4457A85AE5E478CEF8E27B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4608-15-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/4608-13-0x00000000021B0000-0x0000000002201000-memory.dmp

Download

memory/4608-10-0x0000000010000000-0x0000000010013000-memory.dmp

Download