Analysis

  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    900s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    13/08/2026, 09:55

General

  • Target
    liquidbounce-177e158.zip
  • Size 46.8MB
  • Sample260813-lyafqsaa79
  • SHA256 cbd3977bc13431d5c3ec3bdf5d8b31a2c3da5d9492c9af55cd741c9787d8f723
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops desktop.ini file(s) 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\liquidbounce-177e158.zip
    1⤵
      PID:4488
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4704
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • Modifies registry class
        • NTFS ADS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5376
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27100 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {fbf6bf62-699b-4aea-aaac-0edb78ef7553} -parentPid 5376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5376" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          3⤵
            PID:1796
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27136 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {90b7c76a-4f3e-4f86-a415-10d2d150b38d} -parentPid 5376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            3⤵
              PID:1552
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 27277 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {ace8ae7f-3c4b-41ae-81e9-c8c1a805709b} -parentPid 5376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
              3⤵
              • Checks processor information in registry
              PID:4980
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27277 -prefMapHandle 3976 -prefMapSize 270279 -ipcHandle 4076 -initialChannelId {7d0caf41-567b-4397-93cf-13fb5ba9716c} -parentPid 5376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5376" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
              3⤵
                PID:2080
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4408 -prefsLen 34830 -prefMapHandle 4412 -prefMapSize 270279 -jsInitHandle 4416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {337e9aca-bb7b-4ef5-8a19-f5ee4deb7f47} -parentPid 5376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                3⤵
                • Checks processor information in registry
                PID:1660
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5056 -prefsLen 35092 -prefMapHandle 5052 -prefMapSize 270279 -ipcHandle 5096 -initialChannelId {b2f4e962-4c5a-4363-94fb-17b06cd64a5d} -parentPid 5376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                3⤵
                • Checks processor information in registry
                PID:1040
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32979 -prefMapHandle 5204 -prefMapSize 270279 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {9732f2e3-6c2c-4a64-8597-65f4a2a02813} -parentPid 5376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                3⤵
                • Checks processor information in registry
                PID:3576
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5320 -prefsLen 32979 -prefMapHandle 5324 -prefMapSize 270279 -jsInitHandle 5328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5336 -initialChannelId {abae0bb5-b1e9-4963-a8c5-e9c6c49a35c0} -parentPid 5376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                3⤵
                • Checks processor information in registry
                PID:2340
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 33031 -prefMapHandle 5476 -prefMapSize 270279 -jsInitHandle 5200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {2357740c-1615-4545-b040-6d5cedffe535} -parentPid 5376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                3⤵
                • Checks processor information in registry
                PID:4908
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20980 -prefsLen 37372 -prefMapHandle 20888 -prefMapSize 270279 -jsInitHandle 20884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20960 -initialChannelId {94b807bc-3fe3-4e38-a61f-5ce44cd08d25} -parentPid 5376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                3⤵
                • Checks processor information in registry
                PID:236
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20992 -prefsLen 37372 -prefMapHandle 20680 -prefMapSize 270279 -jsInitHandle 20552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7268 -initialChannelId {d01b8777-2515-4f4b-9d59-1f77a06607a7} -parentPid 5376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
                3⤵
                • Checks processor information in registry
                PID:5132
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:2924

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                activity-stream.contile.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\activity-stream.contile.json
                • Size 5KB
                • SHA256 1ab12d32a24f4a94b7faf9ea2532fa554202f697c3b9fdca461060e8f6800543
                • MD5 SHA1 SHA512 SSDEEP TLSH

                activity-stream.discovery_stream.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\activity-stream.discovery_stream.json
                • Size 76KB
                • SHA256 3f24b2bb6a3779e2c5bb0af1e1587c78b66cb790ebd3922cbea324d31420c4bb
                • MD5 SHA1 SHA512 SSDEEP TLSH

                86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                • Size 16KB
                • SHA256 7fefc011a3f7cc9d8bec58490d29f30c77eb3e25ac6dd993c1133e4a1fc1a4c1
                • MD5 SHA1 SHA512 SSDEEP TLSH

                F0E9A905769F697D83320C9760DFFE0C8AEE0201

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\cache2\entries\F0E9A905769F697D83320C9760DFFE0C8AEE0201
                • Size 19KB
                • SHA256 0bb9cbac1f3992cc6ca967142b7c6ce3bf3459fa23a2fac626918f137ab137c8
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_arts_and_entertainment.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                • Size 67KB
                • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_autos_and_vehicles.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                • Size 44KB
                • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_beauty_and_fitness.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                • Size 33KB
                • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_blogging_resources_and_services.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                • Size 33KB
                • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_books_and_literature.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                • Size 67KB
                • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_business_and_industrial.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                • Size 45KB
                • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_computers_and_electronics.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                • Size 45KB
                • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_finance.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_finance.json
                • Size 33KB
                • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_food_and_drink.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                • Size 67KB
                • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_games.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_games.json
                • Size 44KB
                • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_health.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_health.json
                • Size 33KB
                • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_hobbies_and_leisure.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                • Size 67KB
                • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_home_and_garden.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                • Size 33KB
                • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_internet_and_telecom.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                • Size 67KB
                • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_jobs_and_education.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                • Size 33KB
                • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_law_and_government.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                • Size 68KB
                • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_online_communities.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                • Size 67KB
                • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_people_and_society.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                • Size 45KB
                • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_pets_and_animals.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                • Size 44KB
                • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_real_estate.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                • Size 67KB
                • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_reference.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_reference.json
                • Size 56KB
                • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_science.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_science.json
                • Size 56KB
                • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_shopping.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_shopping.json
                • Size 67KB
                • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_sports.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_sports.json
                • Size 56KB
                • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_travel.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\nb_model_build_attachment_travel.json
                • Size 67KB
                • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recipe_attachment.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\personality-provider\recipe_attachment.json
                • Size 1KB
                • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                • MD5 SHA1 SHA512 TLSH

                webext.sc.lz4

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\startupCache\webext.sc.lz4
                • Size 104KB
                • SHA256 91545b53223a97459bc24991362743b6d5c558d9e351ea8fdb250251f1ae05b8
                • MD5 SHA1 SHA512 SSDEEP TLSH

                9e4e9f1c-7fc0-404c-b8c5-3c3457a46862.zip

                • Path C:\Users\Admin\AppData\Local\Temp\9e4e9f1c-7fc0-404c-b8c5-3c3457a46862.zip
                • Size 3.8MB
                • SHA256 0c21f80ad1b3796c49429949e6a3d52cbe9c3b5b4c317690a749d80076396d0c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                remote-settings-startup-bundle-

                • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                • Size 563KB
                • SHA256 4088e48fda921a15c9bd0c1b0d7bad4843659744780e646866c6c8484b6c6cdc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 11KB
                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 502KB
                • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon-1

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                • Size 21.6MB
                • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                6824f4a902c78fbd.customDestinations-ms

                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                • Size 7KB
                • SHA256 1c45d05e7e4b2f94371e6eb10d7cecd5bbeadde11d63e47eac9d98c419cddb81
                • MD5 SHA1 SHA512 SSDEEP TLSH

                6824f4a902c78fbd.customDestinations-ms

                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                • Size 5KB
                • SHA256 59f0c6a2d2a596d0a6f146bf4c310724ffd66bac93fd8551b37198b9c6512968
                • MD5 SHA1 SHA512 SSDEEP TLSH

                6824f4a902c78fbd.customDestinations-ms

                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                • Size 7KB
                • SHA256 7928b83343842ae71fa0d4ca3d2d206cf387aac9224948e0db8c8a885f2d1de9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                addonStartup.json.lz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\addonStartup.json.lz4
                • Size 4KB
                • SHA256 3061b42ad07690e8765423892a2a43e577928d1d5d2ee653b08ad1218ba04d59
                • MD5 SHA1 SHA512 SSDEEP TLSH

                bookmarks-2026-08-13_10_TCeJ6D9VXjXyejSI_AjQECjIwiuRTGxB2KxWmgN3jm8=.jsonlz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\bookmarkbackups\bookmarks-2026-08-13_10_TCeJ6D9VXjXyejSI_AjQECjIwiuRTGxB2KxWmgN3jm8=.jsonlz4
                • Size 855B
                • SHA256 b569f6fe8126466616c6ba2b4d61f87bde14d14179f49cc26cc60d76907a9172
                • MD5 SHA1 SHA512 TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
                • Size 3KB
                • SHA256 5c7637f7d3bead7b5a6df09a8d50a23a1f1e395163e6a463ab635c0558d1fce3
                • MD5 SHA1 SHA512 TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
                • Size 68KB
                • SHA256 c0c7c926473cdf6b28f1acfcfcb49cef8173a73036d46002a82bde816349a3cc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
                • Size 67KB
                • SHA256 cd245b06dd5b25fdc6f2ecf12e2526ac959080e085838a699d8ba5663b82f99e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
                • Size 6KB
                • SHA256 74e3b07a6df6b98e965bbb518f6515cbfb2b2f2d07ef7758dbbf20a125deb152
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
                • Size 67KB
                • SHA256 ceaa32e753adcada6c3feae4b11316f1b3dd2a059d4c83c6ac34f28d4447af30
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
                • Size 7KB
                • SHA256 b1b5d15ef72abdc5247d113986493f6384a2bbbd851ab3ea4b4232931bd5b445
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
                • Size 28KB
                • SHA256 3f3eddc2b37f3b0b068baecbdcbddfa0125acd4c3b5002c849b8ac2202f47da3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
                • Size 28KB
                • SHA256 63a2547faba27acbff1b19796a69b6f2f5cb6e4da0bf22e7e7f7a01e472aab90
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
                • Size 28KB
                • SHA256 6cc3fdf85ceaeef67ef5c19b9bcf70d9eadfda21b707df6d44819cf583859856
                • MD5 SHA1 SHA512 SSDEEP TLSH

                events

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\events\events
                • Size 1KB
                • SHA256 ca61de2d0c5474ed7ac4f05286c3a40b0f3284e40c5e46847498cdd108bc0af5
                • MD5 SHA1 SHA512 TLSH

                1864dcc8-277f-4b74-8ed0-71c8dfa9f282

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\1864dcc8-277f-4b74-8ed0-71c8dfa9f282
                • Size 235B
                • SHA256 84ec8cf4e9b63dd8fb7de3676a7234522177868588fd0a029b205a7468957b9e
                • MD5 SHA1 SHA512 TLSH

                48aee215-86fe-481f-933a-a4375fdc4d0b

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\48aee215-86fe-481f-933a-a4375fdc4d0b
                • Size 2KB
                • SHA256 fc40d93829f5f3ff4775307982eaac6d488075d50b200debb4b5f06ee1809670
                • MD5 SHA1 SHA512 TLSH

                84a279a6-21bd-4f4d-8683-7e27d5fbc789

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\84a279a6-21bd-4f4d-8683-7e27d5fbc789
                • Size 886B
                • SHA256 660297be084c1b45ad828aa75226b23a1ea8f622d2b106897255d661be715805
                • MD5 SHA1 SHA512 TLSH

                8960dfd3-93c9-4be4-995e-f5b08dc546a5

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\8960dfd3-93c9-4be4-995e-f5b08dc546a5
                • Size 883B
                • SHA256 71cf87b2e8cee519c5cc777b455c6c3332520835be9af695764c3db522e9214f
                • MD5 SHA1 SHA512 TLSH

                ca25bea4-e222-4a5c-92b5-aa7f78bcac40

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\ca25bea4-e222-4a5c-92b5-aa7f78bcac40
                • Size 235B
                • SHA256 cfdfe257c9fbd28e852809b09acaa094df97c7c3d4edd5b36d77e008c86082c3
                • MD5 SHA1 SHA512 TLSH

                dbfc06b2-09dc-466a-907e-fb676b9b1819

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\dbfc06b2-09dc-466a-907e-fb676b9b1819
                • Size 15KB
                • SHA256 01226f096de70aa1390f5682188ac1f42aa0f756979405902d6d804dc77c96c3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                extension-preferences.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\extension-preferences.json
                • Size 942B
                • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                • MD5 SHA1 SHA512 TLSH

                extensions.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\extensions.json
                • Size 16KB
                • SHA256 4c2e3b287a7a79eb49d6a97c4ffd4310001017d61f2bbbc277187700be632105
                • MD5 SHA1 SHA512 SSDEEP TLSH

                gmpopenh264.dll

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                • Size 1.1MB
                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                • MD5 SHA1 SHA512 SSDEEP TLSH

                gmpopenh264.info

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                • Size 116B
                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                • MD5 SHA1 SHA512 TLSH

                LICENSE.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
                • Size 473B
                • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                • MD5 SHA1 SHA512 TLSH

                manifest.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                • Size 1002B
                • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                • MD5 SHA1 SHA512 TLSH

                widevinecdm.dll

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                • Size 21.6MB
                • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs-1.js
                • Size 8KB
                • SHA256 b30731334e83be361fdcbb7fe7d80a22d4cfeea16217143d95b757accb3b7f51
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs-1.js
                • Size 12KB
                • SHA256 3beae26a6485226061f0e619413f0209afe5aba601bdb2edf82d698cd42b788a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs-1.js
                • Size 11KB
                • SHA256 af778ba1a1812530d30b4ad47da07c5aa834ce22f9a5e62f8e70aa3d4d7d40a1
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs-1.js
                • Size 12KB
                • SHA256 ed0efac6eda0efd7a3065f6e8d135052177f1ebcf57ba55adaaad36e5477341f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs.js
                • Size 6KB
                • SHA256 df8f052e7efdaac9cc767a6af6f452f0bc5101cd900ef6c4390439b7c9ad088e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs.js
                • Size 6KB
                • SHA256 7fa8578ea5453764b4ca43dc1fd46727071911f27d3f924c39cfef2e3f763495
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionstore-backups\recovery.baklz4
                • Size 4KB
                • SHA256 1fe6351ecc8d340184770adca13a92a16bbff70b59c3583b53574afffce5418c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionstore-backups\recovery.baklz4
                • Size 4KB
                • SHA256 45d3625b42486385f5d89e7f4e8d79f7a7c307ad4644e95fc570b54ffd558f46
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionstore-backups\recovery.baklz4
                • Size 4KB
                • SHA256 a17865014d352255bea86261082b1e571a6d0d1ab8c00b63f5614806a117598e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recovery.baklz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionstore-backups\recovery.baklz4
                • Size 4KB
                • SHA256 da0e55e66f33253f6ab6b331bbe6dfc2727580ac5b39511435f53e6aa83519f5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recovery.jsonlz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionstore-backups\recovery.jsonlz4
                • Size 1KB
                • SHA256 f55308c74aa1051c92b8b1c73a4b47825966457f1764fd2fed1b3fe3bec83dfa
                • MD5 SHA1 SHA512 TLSH

                {b7a8b0ed-2ef3-4843-ae40-e1cd09d2b33d}.final

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\storage\default\https+++mega.nz\cache\morgue\61\{b7a8b0ed-2ef3-4843-ae40-e1cd09d2b33d}.final
                • Size 1KB
                • SHA256 4564b6c7621a5c0e4bbd0da9845cad643d999e43c4446a5085085625681d8065
                • MD5 SHA1 SHA512 TLSH