12948f7b15b7055b190e6a02a8f8b2bde945e8b396e62f6ce2dce6a2bee10d5c

Resubmissions

13/08/2026, 11:29

260813-nlpe8sgk218

13/08/2026, 11:21

260813-nf5v2agj5z8

Analysis

user interaction
yes
max time kernel
1508s
max time network
1508s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file01.ps1
Size 14KB
Sample260813-nlpe8sgk21
SHA256 12948f7b15b7055b190e6a02a8f8b2bde945e8b396e62f6ce2dce6a2bee10d5c
MD5 3cb72c354ad810bb8e1d475e6107592f
SHA1 82234c08eda6892b53efa2c3a775dd1502b0978a
SHA512 d0cf761e2130edcd7d7c0bc2263f0f67ad3b2acb4176b8573c48513e2ebaec826920ce317c20bd8209b41fbe61b7c0cba2030b5684f72df29d504b850c44d689
SSDEEP 192:+YkEcTS62S9asYy+xUfx/wvbZfj4eBnrN7LUTR7JNPL:03UB6t/PL
TLSH
T10B626ED3575C8FFD53CA08EE80493D1668F6D1A52D382289BED1E153F93AA71A412FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
22	1256	PowerShell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
22	1256	PowerShell.exe

Executes dropped EXE 2 IoCs

pid	Process
4684	2thifgcj.j1o.exe
3880	2thifgcj.j1o.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z.exe:Zone.Identifier	firefox.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1256	PowerShell.exe
4768	powershell.exe
4992	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2thifgcj.j1o.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2thifgcj.j1o.exe

Checks processor information in registry 2 TTPs 31 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z.exe:Zone.Identifier	firefox.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	22	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1256	PowerShell.exe
1256	PowerShell.exe
4768	powershell.exe
4768	powershell.exe
4768	powershell.exe
4992	powershell.exe
4992	powershell.exe
4992	powershell.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	PowerShell.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
2564	explorer.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5416 wrote to memory of 1204	5416	firefox.exe	91
PID 5416 wrote to memory of 1204	5416	firefox.exe	91
PID 1204 wrote to memory of 1348	1204	firefox.exe	92
PID 1204 wrote to memory of 1348	1204	firefox.exe	92
PID 1204 wrote to memory of 1348	1204	firefox.exe	92
PID 1204 wrote to memory of 2004	1204	firefox.exe	93
PID 1204 wrote to memory of 2004	1204	firefox.exe	93
PID 1204 wrote to memory of 2004	1204	firefox.exe	93
PID 1204 wrote to memory of 2004	1204	firefox.exe	93
PID 1204 wrote to memory of 2776	1204	firefox.exe	94
PID 1204 wrote to memory of 2776	1204	firefox.exe	94
PID 1204 wrote to memory of 2776	1204	firefox.exe	94
PID 1204 wrote to memory of 2776	1204	firefox.exe	94
PID 1204 wrote to memory of 2644	1204	firefox.exe	95
PID 1204 wrote to memory of 2644	1204	firefox.exe	95
PID 1204 wrote to memory of 2644	1204	firefox.exe	95
PID 1204 wrote to memory of 1220	1204	firefox.exe	96
PID 1204 wrote to memory of 1220	1204	firefox.exe	96
PID 1204 wrote to memory of 1220	1204	firefox.exe	96
PID 1204 wrote to memory of 1220	1204	firefox.exe	96
PID 1204 wrote to memory of 3332	1204	firefox.exe	97
PID 1204 wrote to memory of 3332	1204	firefox.exe	97
PID 1204 wrote to memory of 3332	1204	firefox.exe	97
PID 1204 wrote to memory of 3332	1204	firefox.exe	97
PID 1204 wrote to memory of 3168	1204	firefox.exe	98
PID 1204 wrote to memory of 3168	1204	firefox.exe	98
PID 1204 wrote to memory of 3168	1204	firefox.exe	98
PID 1204 wrote to memory of 3168	1204	firefox.exe	98
PID 1204 wrote to memory of 1980	1204	firefox.exe	99
PID 1204 wrote to memory of 1980	1204	firefox.exe	99
PID 1204 wrote to memory of 1980	1204	firefox.exe	99
PID 1204 wrote to memory of 1980	1204	firefox.exe	99
PID 1204 wrote to memory of 5844	1204	firefox.exe	100
PID 1204 wrote to memory of 5844	1204	firefox.exe	100
PID 1204 wrote to memory of 5844	1204	firefox.exe	100
PID 1204 wrote to memory of 5844	1204	firefox.exe	100
PID 1204 wrote to memory of 5760	1204	firefox.exe	102
PID 1204 wrote to memory of 5760	1204	firefox.exe	102
PID 1204 wrote to memory of 5760	1204	firefox.exe	102
PID 1204 wrote to memory of 5760	1204	firefox.exe	102
PID 1204 wrote to memory of 3824	1204	firefox.exe	116
PID 1204 wrote to memory of 3824	1204	firefox.exe	116
PID 1204 wrote to memory of 3824	1204	firefox.exe	116
PID 1204 wrote to memory of 3824	1204	firefox.exe	116
PID 1204 wrote to memory of 1928	1204	firefox.exe	118
PID 1204 wrote to memory of 1928	1204	firefox.exe	118
PID 1204 wrote to memory of 1928	1204	firefox.exe	118
PID 1204 wrote to memory of 1928	1204	firefox.exe	118
PID 1204 wrote to memory of 2072	1204	firefox.exe	121
PID 1204 wrote to memory of 2072	1204	firefox.exe	121
PID 1204 wrote to memory of 2072	1204	firefox.exe	121
PID 1204 wrote to memory of 2072	1204	firefox.exe	121
PID 1204 wrote to memory of 4292	1204	firefox.exe	122
PID 1204 wrote to memory of 4292	1204	firefox.exe	122
PID 1204 wrote to memory of 4292	1204	firefox.exe	122
PID 1204 wrote to memory of 4292	1204	firefox.exe	122
PID 1204 wrote to memory of 5528	1204	firefox.exe	123
PID 1204 wrote to memory of 5528	1204	firefox.exe	123
PID 1204 wrote to memory of 5528	1204	firefox.exe	123
PID 1204 wrote to memory of 5528	1204	firefox.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {c7a81853-4009-484d-af25-2dee78504b2a} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2404 -prefsLen 27133 -prefMapHandle 2408 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {b898d2af-4dba-4af7-8c5a-b09d07294950} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3924 -prefsLen 27274 -prefMapHandle 3928 -prefMapSize 270279 -jsInitHandle 3932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3940 -initialChannelId {5d33eb90-3829-4d21-a351-0bb905b9fb78} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4076 -prefsLen 27274 -prefMapHandle 4080 -prefMapSize 270279 -ipcHandle 4176 -initialChannelId {6491efbb-f648-48c1-87b0-fa4ef4d92855} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2984 -prefsLen 34773 -prefMapHandle 3024 -prefMapSize 270279 -jsInitHandle 3028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2992 -initialChannelId {7a6962de-2ab0-41bd-8a9e-fe9d58541061} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5160 -prefsLen 35089 -prefMapHandle 5164 -prefMapSize 270279 -ipcHandle 1616 -initialChannelId {a6ea9ed8-0e0f-49b0-a5d6-1e3235936701} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5172 -prefsLen 33031 -prefMapHandle 2836 -prefMapSize 270279 -jsInitHandle 2924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4636 -initialChannelId {39b0e0d6-89dc-4342-932b-7daf733ba7f0} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2932 -prefsLen 33031 -prefMapHandle 5612 -prefMapSize 270279 -jsInitHandle 5620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {22f7aed3-4e8c-4836-9130-a436175d8746} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5932 -prefsLen 33031 -prefMapHandle 5936 -prefMapSize 270279 -jsInitHandle 5940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5948 -initialChannelId {9a4d1216-7d0c-4fe7-bbfe-c993c0764883} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6660 -prefsLen 33859 -prefMapHandle 6656 -prefMapSize 270279 -jsInitHandle 6664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6636 -initialChannelId {d66f948c-3c52-475b-8f03-54a056c43458} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6964 -prefsLen 37261 -prefMapHandle 6912 -prefMapSize 270279 -jsInitHandle 4880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2928 -initialChannelId {cf0a499e-48ea-45fb-bdd7-e27bd01c5170} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6768 -prefsLen 37301 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 7044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3208 -initialChannelId {01a8a563-5a10-4e0b-81a6-0130308e6020} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:1928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7328 -prefsLen 37301 -prefMapHandle 7332 -prefMapSize 270279 -jsInitHandle 7372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7316 -initialChannelId {ccca2881-0c0b-4603-a419-d096b0a5af79} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:2072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 37301 -prefMapHandle 7192 -prefMapSize 270279 -jsInitHandle 2916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7220 -initialChannelId {b83f71ba-28f7-4876-9136-5b50de8bc2fd} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:4292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7292 -prefsLen 37301 -prefMapHandle 7300 -prefMapSize 270279 -jsInitHandle 7296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2916 -initialChannelId {a220c45f-930d-4e03-9558-4c52658268f5} -parentPid 1204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5528

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
1⤵
PID:4160

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2564

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" " C:\Users\Admin\AppData\Local\Temp\file01.ps1 "
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" " C:\Users\Admin\AppData\Local\Temp\file01.ps1 "
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4020

C:\Users\Admin\AppData\Local\Temp\gj1tjdgs.kse\2thifgcj.j1o.exe
"C:\Users\Admin\AppData\Local\Temp\gj1tjdgs.kse\2thifgcj.j1o.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4684

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5512

C:\Users\Admin\AppData\Local\Temp\gj1tjdgs.kse\2thifgcj.j1o.exe
"C:\Users\Admin\AppData\Local\Temp\gj1tjdgs.kse\2thifgcj.j1o.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1b909c2abef16f8a0cec5e73c46a98f587d6727fa8f67a91d3ce6d36d535e9b3
MD5 8a7647d2459a7c4e1ec4bc7066469b32
SHA1 23255c2932234f0a2ed12b557dddc8e76363292a
SHA512 c30e4a8b52de137512c4caff13125cd15c7a43b4ef205ae27df463a456bb853be124dfa1152d431a6c496ba8e934d8ae66bccdf5a49bb0c75fac2ea8d0a1ab15
TLSH
T138215733B3CC8624CC9A403610CEAD1137B687DB409EDE6BBB84D648B42F589DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 0b9ca35d7c3a939f6496acd440913cf92a28884ed0379d5b9756a0446ef017ec
MD5 e8384d67ca2c2a746cfe621276d427ba
SHA1 cf935f4520cbc26e6e00ccdd4fe598d2acac01ee
SHA512 6ed884b76286a19de7139c57a4af0d24664b337a57098835fe76df7fad6e1b1203a4909ae361cc50eebbcf27f3aee1d0a16324dec74c04953dde97a5f2357a25
TLSH
T175116633F3CC8624DC5A413610CEA81136B687CB40DECE6B7B84D154B42F685DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\activity-stream.contile.json
Size 4KB
SHA256 8bcd405944c31695e8725c86a90a7a6e7374d1519cd9236c7dedbe8946530227
MD5 af4655ee560d4e79c840134f829f58e4
SHA1 02f67d74e125917c4e06f3de701ef9244b25e646
SHA512 0de10a3c90b67aea20d278013c64a7ceb93b83d59fcb57e5853ee4b4771ea9b3071859da14786c8a14ab06f44932a6b2f402933308745e30142f02352c625639
SSDEEP 96:TMO+ysu2A+yjlYzmT+mRCXmKYw4+y/126DgSb:zsu/jl8mRCXOwwgSb
TLSH
T151A1E95BC96449A367239EE03C462F69E293B1C6C9ECCF9CE3A56C22519C32D41DD886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 16KB
SHA256 87415370fef3710afb380e5e0b82ac037a1a67dea2d0cf6c6c24304b45798cad
MD5 81f18b18e2cd89daf8bb21b3a384ea37
SHA1 6ad12fc24ed7a2bd67ffc802be75d3ff61b332fb
SHA512 3e4943b9d8cfdd60bebe435196653fe8f35c615e48670aeb0b0707c5713e5a554e415365501dde65fad76a73cbc51d384422f6bdb422997d91d71482272cdce0
SSDEEP 384:ueSAjgJ4IlP61hu1wdvNd9KVRaAcP+AWRMAKJGI:uBA0J4IlP61hiwdvNmVAf+hRM/GI
TLSH
T170729E3B9F5118EA171398F55C692BE51D45B1C7DBECCADC52683801C0997AF94FC0CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 d60e53071c30b05eb56ec4c014a35e8dd06a1f712349123b40e084bbd9f97bdf
MD5 03bfab527b9b1034694c8a8ae229a619
SHA1 8beb5cc3501ff52507ff18f73080b15ed103465b
SHA512 c4071da6bfb0795a35e89e08dc59260a590efc41720a2df0f11bf9cd9838e5084aa5b348f4f4218f0d9a9f16908874645a8769525e7d5f018a2c6d289c97c2f1
SSDEEP 384:HXkRyiO024Y3DL84KKDL849B7SOEAd9KVRaAcP+AWRMAul1:3mZY3DL8lKDL8CB7S/AmVAf+hRMTl1
TLSH
T1CE728E3D4F003CAC1567C0E8C5B992AA4D18B7A7DFE6806D21583D0DC79896DB5F948F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_aeq1nww3.2ax.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aeq1nww3.2ax.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2thifgcj.j1o.exe

Path C:\Users\Admin\AppData\Local\Temp\gj1tjdgs.kse\2thifgcj.j1o.exe
Size 838KB
SHA256 26817725650583d99ca3e617a618dd75c0f71bd316b5761780b7361f5f824cad
MD5 e96e28b3824abf6496fd0971b3ba7459
SHA1 1195b7ff7090587b1c6d38a959ff7e86ebf22cc6
SHA512 b90609b54666f54e154d4e7c21a505247db811c1da99a02c92a9d7db6c85f1248326ba791f28b8efe4d103ac880981200ac546f2c6730fb95e2bf93c9b89f740
SSDEEP 24576:DzwrgD+SHLYg9WITZMnYy4lbDiPw9ADbDmgZmz6yE:DU8RrYcWVvIDrdgUz6y
TLSH
T12805AD127AE9D0BBD2421132CB1C6BF591FAD7680B3048C763848F5D7B359D1DA3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0IN7DGXVFRW047PQYGCY.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0IN7DGXVFRW047PQYGCY.temp
Size 14KB
SHA256 1429c9786ab081c30ace9a82d38785bb3ef9566ba942287cff95141e0ea9e5b7
MD5 094603bd6a98cc269cbe4787420acbfd
SHA1 0780325a31b248fb00540d7abb40ba25bc15dde4
SHA512 bcdd7a7f35d88bb4759171c9075bdb5ae587797c6193a2f4470596e96167d1607d4f8dfb5d4c19520ba9070a6114b6ad5c26fa57a1763630b41afd5b2f808732
SSDEEP 192:RR0iy/cLPKWyfEMtyfoMByfPMWyfkaImyh:R63gn696N6V6M5
TLSH
T16C620F020FFB097AF8F386327A3167575673FE015A1A8A2DC186B3451D723608D6EB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 67cd95aecda47252ecb7fe1d19133ec1199a4fe8d0b94452117f469cae801a9c
MD5 992506836ac29fccfc00e86b1a97062a
SHA1 77bf28d998544f443a66aa6ccc825e021064b5e4
SHA512 9c9818096c3e317c14b33f5bf074b3690c12d063e7e3bf3e292136e60a716ddde7012153bddb6260d9548a13dd5d34ae3a0a8b9af7a66865fd064c1e343fedd2
SSDEEP 96:8pFjTQXcCDpSwufOFukvhkvCCtn6hyJBgQHJ7ByJBgQHJ/h:8pFjTQXngwaOc6KBgqqBgOh
TLSH
T16ED1BB1027F68609E5F64E7A78BAB3219672FD41EF16DBCF43509519AC30320E93872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 65852516fecf8d22ceaf0253f7437bfc449ebd8083507868fdcddf46b03d891b
MD5 c326a1135fcb6e30fae4e400f13126bc
SHA1 3eeb891d4f6157c66305bd55af832065cca65680
SHA512 62834563d79ce848357dcb5d894fce49b3f9dd5b18fa358d4218dcce407c759f63409e33fe0564ab3c9a51f67b3c5f8c52c5b20e540a1d0af3acb7d521d317ce
SSDEEP 96:JpFjTQXiCDPwXfkFukvhkvCCtn6hyJBgQHJ7ByJBgQHJ/h:JpFjTQX5Pwvkc6KBgqqBgOh
TLSH
T132D1BB1027F68609E5F64E7A6CBAB7219672FD41EF06DBCF43409519AC30320E93872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 20KB
SHA256 2ffb365085e1654019dceacadde8c9a371f0de559a6a989eb56ffee35f01d97d
MD5 53e66ff16f78f6e7af055efb53f5b543
SHA1 98aae37ef2aa65c13af1e1fa96aa336bd2841b51
SHA512 f0fed3a5b396f770ecc464501411461398f8645e35a9acf16088356d0eee0f0ce4d41dc6c7ca7ee4bd5b19d8964cc888e2e033d1582a83e129c5d40e1647b15b
SSDEEP 192:FRQiW/c6OyGvGVGFLPKWy6pIBtmuyAQb6/ltGLyG8GYGoLyGeGKGGLEMtyh:FebjOzO0Bnn7u2e/Kz9ZczfLK9G
TLSH
T1999210051FF70636F5F3CA327AB1A3476A73FD026A068A1E80C663490D727109D5AF9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 20KB
SHA256 debc7363d1c74ee8d976811176f71542dcb8b423cc0bbccdc30ad0c537f6b5bd
MD5 c96c910e8f0bd9af83e3bc6f5e137f1d
SHA1 2d92d12b90794ef7e3942a8c54257530096f60b3
SHA512 31a9804ff4a59e9fc8a250bbd9cb38b2502792ad1cfb1b128920cb461a5d0b73bb0cada72f5187eac03a3f38c7f5d1ddc2c032958ae024f1086473d7a5a9d404
SSDEEP 384:ecEVjLj7WnzWzO0YWPzWMqn7u2Gn/HWz9Z4:elpjYLYOK2GvF
TLSH
T1039231021FF71666F5F3CA327AB163476A73FD015A068A2EC186A3090D327109D5EF9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 18KB
SHA256 89817ff53d1d9305210aee1a3343e7201961d63d40ab1651ce0dd498f45582d4
MD5 09eb02ceed07e2e7991bb52d4be3a22f
SHA1 a5e9fcfcc0d0325eb402f1c545e2316c68c063f8
SHA512 5f8c6cd238147b5927e1b21fd87ed539f131dc12ad0ae01fb6c429adb00316f3e21c2b2dd9c06a72df1f605d59f3e6d9b5a08c054a34ff480a0c06cdf9b856f7
SSDEEP 192:HRai8/c68yGvGVGFJkaImyJPKWyJoKByJEKtyJBKdyJoKXyh:HAxj8zO0PMhnUPUfUGU5G
TLSH
T1AD82DE020FF7097AF8F386327A7157475A73FE015A1B8A2DC186A3451D723208D6EB9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 20KB
SHA256 364b1c1f06ccb4082f811dd3cc8d6a509a8c4e774ef4ceea0d4ee39dc0c98daf
MD5 e3ca5b31ade6e073b7f1c61d8d7dbdad
SHA1 d0fbfa5e0f9241334b62785093983b4466e5ecee
SHA512 89b5e590bdd6618bcea8c28c578b67c1f33ebe401435d7d345bbd2cfd7f9e96dbd9f32721686d05b0329da99af98ab59616df304fed51d5b63bd8fea1cb91701
SSDEEP 192:ZR0iy/c66PKWyfyGvGVGFfoKByfkaImyupIBtmuyAQbu/ltGfyG8GYGoh:Z6/j6nizO0tPiMW7u2C/Gz9Z4
TLSH
T1159233011FF70666F5F38A327AB163476A73FD015A068A1EC186A3090D727509D5EFAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c360dfd99f779275200ff5e2d33811b1b90d40f6b00a1fef49b1a4c86130f44d
MD5 12572f72741a8034b7dcf3e2bd7f51e9
SHA1 8046f5e4c89bc334d695afed338fad598065a89b
SHA512 458736dcee061919fa5cff64a553a32fdc763db5b91c7803a9c8506b5a5dbd4064119abc523179c4daf57b6f5b8400fed19940d5141309d349f52f9b2ef52196
SSDEEP 192:yOv5zbo5bJnyjL+VHn1d66JoztdzgCl6mc0dz:xbo5bJnyj2d66Joz/zgC1jd
TLSH
T11DD10DA4EA39863FC408427BCCA61B414F39394BD84E3F1935DD650C2D5A2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 61KB
SHA256 d46ce4138dbecb3e5711601b56c337a1cac3e2c5a3db9bfbcc68d581dc5f714b
MD5 b1c4d865975a64c6e7c829900d28a68b
SHA1 43da663f25a7414707a25fa8b3b6fe5b3132746a
SHA512 274c4b3c6fe275ae12f98beee92e277dfd208dd904b7a2ea8ddc57c7fe1803ed96ca4135572810be476d33d14f19d776d822717b69578c32720d257f56e0e863
SSDEEP 1536:bnO65LHuavyQZXQ+d5oSV3/WEV00p6KUfH7BUsz6:bO6RHZvrZR1eK18Hj5z6
TLSH
T1B7530044EB1E953FD86802BADC961B003F39F8895A5A2F67375C64782C872DC3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e0e4bd87e2a0f46e98c8f34b472d9ff2ae519237ea25ab90ee79c8aa05499ef9
MD5 9ade7527bbae3c00e2839ba031a8189d
SHA1 c4bace1026ff4ce47cd1bc6e903959b257a666ad
SHA512 400d522da4245d810120d3bd813b25701abf17dccfa01a8a87a528a5a473a128d42a3d85d4b3962a90d786a88c3cba5fe0e85913e31c61af868ea9aea6a31cc2
SSDEEP 192:BOv5zbo7sZJnyjL+VHn1d66JoztdzgCl6mc0d:ebogZJnyj2d66Joz/zgC1j
TLSH
T122E1FCA4EA39863FC408027BDCA61B454F39398AD84F3F1935DC640D2D562DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 58KB
SHA256 a7fe75084a999557e011482423f182716cef2718ff4c5382b3d8a32b5d426999
MD5 eb6077eab83a8c1400011c4407b4df1d
SHA1 d35ae0c74d950d1a5f10f390f302b1a1c7242b38
SHA512 769567670bf910868dc954a3a3a9702740687bc9c497148ca0db1cfdb18fc6621218f145d16d4791a4a901d25433ac979e76bcc6cf1c1f56e0cccffa16c62c24
SSDEEP 1536:TnOwQM9RRqx5RMVIZ0xMDS0966v9PO36Vq1e:TOwrjafHP+AhFAF1e
TLSH
T1C2430144EB1A953FD86802BADCA617003F39F8895A1A2FA7375C54782C872DC3D4E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 77c09a391d98f4db55357d7d5e901011546bdbf3ae68fe096c5f42e80cd7a7e9
MD5 1349d6f5db015098130ea381b87f349f
SHA1 0796198b4da8462ed656034d7b9a7785549b2b06
SHA512 a7bd5975d2f348f7ce10c264b2e9603f219a069a780d83870d2b12e82dc19f6bc45211fb1e9f289f69b1b49779e6850a2d6887226bbff0d8a16902b9df00e14c
SSDEEP 768:5uu1L+DijYmAa6IGcm+ukKzlgNtb35nluybSbvbQbXbNbPbdbJbSbKsq22bpi:F+DijYmqC4bKsq22s
TLSH
T1F2133344EB1A953FD42812BBDCA617002F79F889591A2FA73A4C64786C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 46442509cf3fd3bb097ba08facaf665a985acfbc7793c4b941a4c9000532caa1
MD5 fe6001cd1f75d7d09bb871239cf1373b
SHA1 c895131c71202f4b7122c92530f0dd5739cac07c
SHA512 4c142b5199e54e28ffd414a649226158f02992f184c0ecd1eaacafe85ca9baf9feadce039a2d89a763741453ed54a0e75f66d92d5dab567b57d8e101310f0917
SSDEEP 768:y+DijYmAa6IGcm+ukKzlgNtb35nluybSbvbQbXbNbPbdbJbSbKsq22bpZuu1/:y+DijYmqC4bKsq22j
TLSH
T169133344EB1A953FD42812BBDCA617002F39F889591A2FA73A4C64786C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 f3e83dccf94f128815a7485af8e14c53669c2e9fd08694910a87591c6d6f7ea0
MD5 f24863b11da17494fe230032c584d9b0
SHA1 d0dda6d807f18fd3d91d88439ce15ef21481375f
SHA512 1cfbad0e60152c0ed14fa75f8d10fd2eb90ba0900bfe2ec16699a0ebad3a18ffbf6842131d49fe0bee609dd38bb084936b95c15b60a1dd1f3072b7a063fdb963
SSDEEP 768:S14uW+DijYmAa6IGcm+ukKzlgNtb35nluybSbvbQbXbNbPbdbJbSbKsq22bpi:X+DijYmqC4bKsq22s
TLSH
T1F7133344EB1A953FD42812BBDCA617002F39F889591A2FA73A4C64786C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 95KB
SHA256 300f6532dad218a15767c90ea9e80171acb52e1396848ad15ee480bb0d377d62
MD5 6a63f6de04e82e4e5d88ab0684567027
SHA1 641b9d57b3c8f7a2af929e9062132f1b3d9ac812
SHA512 5d7e301104797c442f1b435768a2f3168df946be8f751b66a8df5177efc8b1b2fbd47d2b62d52e88e54ea0a17b5836701fc4f8ff9269ae424628e373c4aa6c60
SSDEEP 1536:1gtGZsgsqkndNamhkSIXmC73CYiZTZO11BbKiCNty6W2EBukybmL28x:1GGextdNv7CYXmLBbNekcEbybC28x
TLSH
T1CEA33084DB1B403FE82442BBB8D517283B35F8544A5A5B5B3A6C04752DCB3EF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 e225a55d331d8c66ef1989f3c7c7c0ff24fdcb84d23c877109e6908209109b05
MD5 248a4e1372f189577dc3d13233a4f09e
SHA1 fca2c51694000303d38eaec45a0cbbdfb0e2dc1b
SHA512 951557e0d1c089d3552e5b4b44f59ac8e07ffd09fb9c8d3571e4afaebe9e851f63558c5912b4b6fad877d481bbec970ad92ef53ab96fd5d407552ae4603ce60d
SSDEEP 768:S1L+DijYmAa6IGcm+ukKzlgNtb35nluybSbvbQbXbNbPbdbJbSbKsq22bpZu2:s+DijYmqC4bKsq22D
TLSH
T1AB133344EB1A953FD42812BBDCA617002F79F889591A2FA73A4C64786C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e968ac9dcaadb5952bb8e70e7f07b65b4919d4c2612e5f5bf8a85e165fc16951
MD5 c43e6f9fa5370c1eb5a2325241687052
SHA1 c43a3df99f885dbc3becc29ebb9237573f115049
SHA512 9c444132563093c9c3b72aed1561cc524e200b252cbe869e5a1734c3e7aab372d032a1a2d87a27747e85ff3b0aed37457c942b56017616b8cba72626dc9f1d5d
TLSH
T14C31906C36F98D3A5BC7F35C7595034E47A54A47888A1C434E82DF4DCE85AD9322E429
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 5KB
SHA256 ceba31d032543534ba2ef5d4d8dde5f7318bf6f57216ecab926c8f533f6dfd75
MD5 1d6b1c469b74e857a42f3166cbcf3b00
SHA1 f218bbb889c6ca56130e1fe0837a8715d9d201d9
SHA512 bddf161a2c45818b9f4004fc5f6d0773b5bf72f40093a7ca9e14a11845e4f95e5a8bb1441716e38521a6411a26e77b363c9f3e013eaa73123ea310f8c58b7f80
SSDEEP 48:YDcD2a8YAm8CH9CNYRZYZKwpH+LTui/JdOD7KpQDCJeQ2HkZjIZ3uCQcZqCc32aq:DCNKTJPpfJCv9lA2xE4bwL5jp6kmTAi
TLSH
T15AC1032875BA4C7F5AD7D39E7496034D85E90B4388CA1C834DC6DE4D8D8BB96330F52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pageload

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\pageload
Size 5KB
SHA256 51f7a03d6610d02d615ca7f08aec25d9ce397fc3dfe1cedb2320becdf17f5c5c
MD5 d60ebae8feff30776ea7f4ec12d5e2ae
SHA1 9e9f8464f31efd0e3798d08c4b3636e0b10ea676
SHA512 e1c93c73f6d557d5781464477862e10cb1920010597b544e1c21b5d5bb0683ffa97cfca68e5adf47094d8ef59f2596b9b98325f48d17757c62c2d9d79ab6b11a
SSDEEP 96:GUTUHKRp07GZTW4ydQcXhebcyxayngRXQTAwYJ:GVdm7O
TLSH
T162B1592F2952CDBD9B9BC07C75CA43DE6759C3D712D36E539D30EE5DC8C8209211A065
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87762d3e-2f32-46f0-a96c-dfb7c89b5021

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\87762d3e-2f32-46f0-a96c-dfb7c89b5021
Size 235B
SHA256 af0061e92450e229945e46045aca25118a79429edee581bbd45a9b2fb292f917
MD5 e5788500416a1903cf7ca15295f3e071
SHA1 2211d74a98dad69690727aeddc12d0c45b2c324e
SHA512 052ee4ae39e16717ed3fe898a3da7bbfbbaa2ceb472e9267a7feecfe9cb92cb5535463ed0efe44827192748a422d87c19e1fc9d5695a4e09af762f25220dc19d
TLSH
T1A4D097C218D86BAC88040F0AF0A078D634484C3318A4981096604138EEFA9C8415582F
MD5 SHA1 SHA512 TLSH

Submit Download

883d8734-1626-44c3-8b6e-34e8154ddaa3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\883d8734-1626-44c3-8b6e-34e8154ddaa3
Size 883B
SHA256 3d7bf591444acea7f17d351058004c596878e0a63be7ebc5c7253a3a8d331cac
MD5 362ff3b559eb807b7c05e26d056b43df
SHA1 06b68fedf29e94e20ea4e1e4604caff2320cfc5c
SHA512 030e088557e76c4323e0b619a8517c1928aa0a3a6f71dbc8b8dae4a9539e025285ce07c6e7f3ab55bc112428dd8b9a2fa0aa06ce923e557d78a230d8181c1d31
TLSH
T147110080D6327662CC68D24BC9A577429FE8BA1380C755043CD54B084E7965FA7A724B
MD5 SHA1 SHA512 TLSH

Submit Download

9e1e2228-7965-4250-b37d-5fbb5484c9ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\9e1e2228-7965-4250-b37d-5fbb5484c9ec
Size 2KB
SHA256 54a8bd25b0c0b3b89286b04ff0b41c37eb510681d6e9be04c2470b4a197c5e21
MD5 fdb7ef3dacb956d5d855bd143c711699
SHA1 c98f063ade4f1b879f89e7b471bf2e138946dd4e
SHA512 a6420a2803221cd80e246c36c86cd0bafc3cea9a14d9c316659c3cc308700dda60305ae4c07adfc0271bd8db8918ddb59173847c11eff61a05032c268a4cf1d9
TLSH
T14241235C79745E769C86F28D9492338E97A09A0344C71C832DA1EF0CCE9669E336B42F
MD5 SHA1 SHA512 TLSH

Submit Download

a41859cc-a697-4982-af70-d1ad17f85c45

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\a41859cc-a697-4982-af70-d1ad17f85c45
Size 16KB
SHA256 4f9abbb60f243a1ffa58b91d221c22fcf12394adf4a46a828e943bcc9b7995ec
MD5 fc84996ca24296f18cb5bdce3747b18b
SHA1 22bd26914a58998a3047cbb0d070b92f4d439d50
SHA512 ddba41ead7d9f0ae15046311a10e704991dfb8e3bd767e459462575cc70397ca7a1aeb61ba0f8f8146b87f0582e78c1b0bb27fec51237de3a9077a8b26325c28
SSDEEP 192:KtE8hGmm3Z0HfBAma2s5AzdxPO9MNqmxFi1LwBBrYBRM7OCJtBuJxDRiq7hzmR19:KrhC/A69MNqqZBJYQOs4xDRiq7hzS19
TLSH
T18172EC56686055BE8651E3A9D8FC7FC3F2F528CF4C019FCA9BE4BD0819DA09E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8a4a5d2-688d-427d-a1e7-8b5c20f3bc0a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\c8a4a5d2-688d-427d-a1e7-8b5c20f3bc0a
Size 886B
SHA256 460a9eb513591941dc3716bbdb81cb2d0c7484390012022ea4047c12fa5893e0
MD5 c4b268de730929b4ac4da0bae6658146
SHA1 2eb4dd681561f2e5623a33d695a87419760e2405
SHA512 35565c80bf9429adcb3dbb419ba80ba4c5ddbad8167581b8cbd801bf30da2a1af135761a126af04fd9201809c0cfe9a69fdc61d4c2c8c5ccc3f25f649c76c302
TLSH
T1C6110080CA7175B2CC28928BD9A577428FE47513C0CB0A447E949B084DBA29E67A7207
MD5 SHA1 SHA512 TLSH

Submit Download

e1b20ec8-f8b1-466f-a8eb-37a0caf7727f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\e1b20ec8-f8b1-466f-a8eb-37a0caf7727f
Size 235B
SHA256 a3b472bcca36507f8696128d1a47cee1a555245857b734e0d8c028ea73e482a4
MD5 2236378c5abada20620508f006ba0d89
SHA1 9cc95a79be7e42272023929a940ec2ddc8f188cb
SHA512 30629f4c335e8765eb52082b543f0929afcfe04e35d742d050c3ce7d5fbf4f93cacca5e20f6b69f9ef8ac45c6cdd79c9e79018610215ab78534d7d0dabf7dd9b
TLSH
T158D097807C88A35D48204F02F0F02AC23485CC3318706890966A06389AF8DC802B1E2B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 932e4216343d782ee2fd71c8849d408ece584dc8cb960c14ab78fa7872417c5b
MD5 b70a56d0e0f6d1238bbd2df2ada874a9
SHA1 8d8db1898a57dc6e1e17bac48405453f3dc6ef47
SHA512 98d7b580bd17ceff86197ea635faae0a4eb5b26a51ef54382c24a1a527565caee9449c5b714b9d827aac230cfa0c28ce69f059fec3662d2e2e38ae8e177eb184
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4Hft4ho:NI4fRfsXH446+4V4Y4N4Q4V4y
TLSH
T14472521545048EB8294EA78BAA367E02C37D573B60855C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 9KB
SHA256 38c5377f7c1135e04a814bb94b6b0c955b7546019fc4f2a89b145d8e1724cbd4
MD5 60a96fe623b9b71515404d40785b5e89
SHA1 b1617d7d743bcb01ecb388bd489f7d70893166f7
SHA512 69680afbc117c9367c00b8a7f48f3636aff97b328963ea8c3c09eab686feeefc60bfda2fcba8f7288f318abe24cfa1c0fe96a87e4bac6c38ac5176a8309d4d46
SSDEEP 96:xHyNTUWqGqPfC9AObzSI6uSSlvdv9j5Sn+cWRq/CaVut0OBw88TlFQ8L4cnAVSy9:sARPfC9A+rSStRW77OBw88P4V
TLSH
T12C121D3C6004CF7F65B6766DAC688D315AB2023BBABF68C311B95485054CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 12KB
SHA256 8e8fd3b9a0d2a71435e4aec61e020dd400d1daec89d43da50af640b48ab2de53
MD5 339b2a628b73ca023b9b8ab500a37db6
SHA1 71e083a0a72c1e59429ef75ae10c046f77534fee
SHA512 9ad3fe3319ab67363c373593b0caa82fcbf9c3ccbe3958dda22158c84fb66aca2cccf8ede3cf4e799cbd25feb026bba7ab31d888ae2d4f43132b06b6642c8c21
SSDEEP 96:xHyNTUWqGqPfC9ANbzSySSlvdv9j5Sn+cpwoDRq/CaVut0OBw88TD0aiRx8tD2wP:sARPfC9A/SSMLRW77OBw88n+Rx8tDHV
TLSH
T11642BD386040CF3F21F2327DAC694AB029A143277ABFBCD606F89592445DF6451E6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 8KB
SHA256 1580c6a39e346f178e216918ade830337f231620630a66c139c293aec2c79345
MD5 ef43b25dbf0a6ab5f0bb4d996b3102a4
SHA1 43fde0a5e42e34df0b11d37331df03aa7ab63caa
SHA512 bf07d4a9e59f2542e9b465a8d7cc35a87586d389ead35b9e009b620d3c1d2e099fb6ede98dac3a2569ebfbbd91b91777ecac6c575dafac093c8a1bd263ad1d33
SSDEEP 96:xHpNTUWqGqPfC9AObzSI6uSSlvdv9j5Sn+cWRq/CaVuQBw88u8L4cnAVSyGS:vARPfC9A+rSStRW7PBw88qV
TLSH
T1D6020E38A004CF7F75B677ACAC688C315AB2023BBABF58C351A95485015CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 12KB
SHA256 3aa9a04ae6f9ed74d1b75bc366e111dd8752541747c78695e10bfbcda9046f83
MD5 1c900d914fe3e6bd7a7a2fd2443b1205
SHA1 fe63da47f1b231d1b56334020c29b5393297a359
SHA512 e80603b41ddcd06a54a4ba587ce81ac47299e4cfca7d64bba3697f947508636816fbe373cc2863393f0b653cbba410c86cbccead4de5735b2e1ecdefe0841d9f
SSDEEP 96:xHyNTUWqGqPfC9AObzSySSlvdv9j5Sn+cpwoDRq/CaVut0OBw88TD0aiRx8tD2wP:sARPfC9AUSSMLRW77OBw88n+Rx8tDHV
TLSH
T12742BC386040CF3F21F2327DAC694AB029A143277ABFBCD606F89592445DF6451E6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 a2e71bce2964f550112320db51b3becef28e5937748f3efae97945420b9c78cb
MD5 53a415b2796299107c3f47577a24d9f3
SHA1 d563a81a965c45e1ce02994c3d3c69123b746bf7
SHA512 885cc988ab113811623167e170cf5344c8ce83f5f838676b07920bf637962dca27527487f30793da3737981fbdbd140305405b9522456e6442687217e00edec9
SSDEEP 96:xHpUTUWqGqPf2B9A1zSI6uSSlvdv9j5Sn+cHjCa/Bw88u8L4cnAV7wyGS:vRRPf2B9AtrSSoj7/Bw88q7
TLSH
T134E1217890088F7F64B677BCAC688831AAB2413B7BBF68D350B95485015CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 2009494111192d9de5f13b9e33cfbf5ac56f372869e137cf7a1853858dcd87a5
MD5 4a1f98317bfa749b870af3029099bfe3
SHA1 5c1ba247b0b37bdfed3151359a51fb78b8ee7a91
SHA512 3f10ee5bab6794e2c012db4fa95836cf648318207b2fdf95c3f84a7b75fe2bfd890a89c0230235f5bd2c91fdfb96f6ae5ae846800ba5cef7f6ec364ce9225eda
SSDEEP 96:xHpUTUWqGqPf2B661zSILSSlvdv9jWn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2B66tLSSuj7/Bw88qU
TLSH
T1DFE1117890088F7F64B6777CAC688831AAB2013B7BBF28D750B95485015CF7845F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 7KB
SHA256 db40cb90eaee2afa1019e14e3181ec14af2e2fc367db08ca8bfb6b05dd8d66fc
MD5 4f75ea6d789b19d553e10ddcc34715c9
SHA1 7ee6c53d54723cd027c1f1006351eb46ea03e358
SHA512 7c4c5c8d343af9f58bdbbf5b92d8c602e55af740f110b60616458118288b644a932e8990d0fe3dea2c500ecfcf17ea14f9f11781167bb66ace5cd3100d6e2fd0
SSDEEP 96:xHpUTUWqGqPf2B9AObzSI6uSSlvdv9j5Sn+cHjCa/Bw88u8L4cnAV7wyGS:vRRPf2B9A+rSSoj7/Bw88q7
TLSH
T11EE1207891088F7F64B6777CAC688831AAB2413B7BBF68C350B95484015CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 7427c8fed9931a0b1bb8c0ff3361cdf76f2b649b3866dd23b3a17b337ca42b35
MD5 2c34372e09bb27a54c3197105fb159d6
SHA1 a134596f6e3de41af3c6aba396d714373d25d083
SHA512 c77c98f4d366b0781d3322e18003af3787c21a067ac7082e169628b22ad205bb96607435e46516cbd4924aae0f507cd4f7fdd8b6a731a7a4ab9b3e756535ea80
TLSH
T1DF21954AFD2B6DF55256D08AC0C92FA4DAE67062837868F098E82E1241C861EB68634D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 2db5e4f61752e07bc5bbecb20a28b2944e836e274e29062e842bb01eff05e7f1
MD5 9c7e649abe0c2ea3d7c78244868aede3
SHA1 6f42ac9a94724dd6fbac21b114a6c27d7c859e31
SHA512 ff4909363446fcb87db16a5eb15baba96b414db0356f6ff7b3924047282627c2baea022c63786a1bc2c918e3cf2e68e9a0ec280dbb2ac1fef56a6ba5a772b39c
TLSH
T19C21CA57D86B1CF52B26A196C0895FB1CBF93032C67854F050ED5E52A2CE50DB68221D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 da5485d47a637e82e3b471c44c67e2e39168400aa9bd6257150d17815ac03708
MD5 792671322eeb939d85d8f885a1198422
SHA1 a5d8ad8f316e29db15f186c9541809eed061e6cc
SHA512 bc7c0345b8a8e6fe0a16d458e96d7876c68bb5ab7383892d49e7fe87d15f2ab7176abe027cd317875671b1fd061b19f85e79a0af0eaab6c701c93fc91537885f
TLSH
T1F521B782E90D75F35792E16A09C96F71CBAC710707F948E4E5586612025839BF2FF2C5
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 9a8e8450b4eba0a60b60c2e3f40d4f34f018d1ce6ff900b81d796af5a8ad2903
MD5 2c97344a4b530193995166e85e3b492e
SHA1 16c7e39f9d562d6f3b7de659c11167e781be5969
SHA512 79310fb1244618630178353656c44406cfe20097820be99e700ba1b13ca88aa093e5ea8737f934c51924902a0724f16d46661a9eb60490e3453508fc19ae7cfc
TLSH
T17E21F8CDEC0975F64751C46DACC96736C3E8718702F808F4E198AA12027C28AB29B2C7
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b198b0d468f6dcc84936b213c2437ca4817d7214c4f46dbbbe4f1435c9c79c9e
MD5 05227f5ea146be5308c56268b3b369bb
SHA1 f6f3630fc2f1456c2de7714f61a7ecf6c7ff478c
SHA512 c6997c0dc2948acaf238bef277c13d7034484ef8c2d5372d5a428dcb6a013298235e5da9e63bc7ddacad6cb1a54de423bdc9eba1492af1677deadba48897c6ad
TLSH
T18221D8C99D4AA4F35781915CEDC40B75D3B9724716F488D8D6E8A215416C38FF2CA1CA
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 e3813578fa400fddc03d446b1700cdb064c2cfd948aec54ba3fc29046f818c42
MD5 9728ff4a8e0019fe7a80115224a2052e
SHA1 51f53dae51872c714350843525242ac4a97ae8bf
SHA512 11a5e2ce51f96e2f63b4f679d01aa1a2ed222a862946a0ac9dc49fbd06ff9941d1ee0d4a988004f066fbb6feb4da77c7c024d4c66fbc673af99d292cfa72d36c
TLSH
T1F121B7C19D0E74F65341D0A618896B63C798B11706F918E4D6081222016418EB19F6C5
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 73f2be94ce49ed4602a3e723a5968da8d5452fe0ea24ef6beb6238eb6baac896
MD5 c17f13cb8ef382cc43bc7e918abeccdc
SHA1 f62327a99008eb48d349b6ab6932aaa1e35bcf31
SHA512 285efd4b5a6ff4a3e1213eb791ed42479742211428e8dee037378c7a5e96aedbd11f0270f4176fb4e2c486f6a5198be22eaf6f65e670ae72d6bc6bd61dc91fb4
TLSH
T18E512BEFE809B5B693649CA588C44F9983B031C796F005E88228227745343EDA3DE2DD
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 ebba9909bf8ca300a413195cf3c52025074e7293cccfd062d6f9f1f75ae9f9f7
MD5 25ffbed3f19150d29be9faed18793a07
SHA1 ed8676d557bf50f9d17d6353277016804151ccd0
SHA512 454ae2bfc4cc543a83367d881c8c2975a618d45e614af845765d237ff70b843a74030e491e4f919b295acacae2cf34c1d1eb007b243123ecd7bf11722e57b816
TLSH
T17E512CEFE809B9B682B49CA488C44B5983A031C796F005E48228226745743EDB3DE28D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 1e53645d34d27f29983f091760021a31eb5ba2c2d4d812cee11bfab15fbf11f1
MD5 fbc43170b6c62f650b96f66bdb13490b
SHA1 200f34f0ea5cdf0f72bdc696772157390898b7cc
SHA512 0ef03a8fc45f38e8c57efb2bd0378098746c1d70d5e1b3947a4a5656157f9215b87d772444115b8377a2aaa07eaddf1fbbaf2e475130c1066c4d44dd4aaaa951
TLSH
T11721BAC1ED0A71F72752D05D5D896F32DBB8315706F418E8E648771642A818BB19B38A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 aff2d06bac635cfd44553dc01f46ff2c974c2e67e67eebc0c66642e98acc35fc
MD5 243a4111fa13470a851c09ec6ddf7e6b
SHA1 fc7ab1cbdbcf6ea20f602f53e2a955591ee1ab9d
SHA512 afe9dcb9a2c833aa16c190255b3151eb26cd68d553f2e0849ef346b648cab936eecfa00157d1a9fac9fb6c201e10ee9d4539e051f8f37ac09660690300c105c8
TLSH
T15B31C9C6ED4DE4B69350D568DCC20776C7BBB38B179444E4D1A49101429C1CBB2CD14D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 2365c520d654419a82e67fd3ceb73c2ea4160ad6612dc4721d2fda18321e42c8
MD5 37b4d45ebea71c6c30c718835c18f7c0
SHA1 4dd5c591ac4ce80e2df5736377505cfc0f648386
SHA512 360f9ad62c53d666e2ef580168ac08710c62574079c2d6422aff1132974ee7b3ad167ae9698197015cdad1041474c5d8d608003cc0f4d8db562b5f34f4a7f9c1
TLSH
T1A521E9C9AE4D64BB5B40D568ECC40775D379F2471BE484E4D5A4E11106D92CFB2CA14B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 40757fed79292379d9a299f9bf572910c071ea7fad7859aeb8c639b53532f004
MD5 0cc65faed926a8262c47a747b9cfc36b
SHA1 2d36361006235a5b7193b81c6db1803f60b0e087
SHA512 a450182ca22f9084678af6e0addd8a8a07de039066d1c6153259a543281f609fd46e351150ecceee6013cef36d548b77e132735b84bd249d3446603aacd6b6ef
TLSH
T11031EBC69C4A68B69750D2B9DCC14379D3BDB24B07A8C4D4D164612502DD25FB3CF18D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b0d015f910226eef6063fe1ebc36b3c47b651f8f08ee79480012a48b3f3f8ace
MD5 c805cadc3c56d745b37d7a0cfd5e5f2e
SHA1 096fc85b9bea65061e97f50dff9b5cc15c121479
SHA512 7472cea2c5dae5f17d5bfae7ef754c75ebf22587d359d422df3530097f6ce36011d6813d38b58c397500d014e877666c7af0cb6f79d77309ff5ef33710bccea1
TLSH
T1BB311BC69C4868B69721D3B9D8C10379C3BDB14B07A8C8D4D1A8621102DD26FB3CF189
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 7615ff9d5caa2b1bf892c6948e90fb3547a7deb1bac43c1ec5a7e1582e5d2ef9
MD5 1309821f0e62629e6a122c7ac53fa984
SHA1 b20084266ede038de8c571b9090cce3fa0fbbd39
SHA512 edb1a575786046cec85dc011ffd3c7ccdc531466cac2ed50571aabf33a8dd38161d621236f4e26710684664b605f95c6707c809689ca510d587caf35cb01b256
TLSH
T1583118D9BC08A8760B40CA5AC8C65668C776A20B05848CE4E8E4B20102B42CFA38B38D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 62516abb73a43758266403a88af37bdc39c977a6086786a3f4789cd12c0f8511
MD5 0c98be8ddbe3b07df4858fa351939d97
SHA1 72f54b73da6c63316c766b4e5c25797b4b330c29
SHA512 ec540da13d6b78687a15e9fb622e29900500906751c000bdf846688860663c7e48bae8a348eccac04475d54b8e199bd1fd8ce34be1d8d23265e816e3a272dadb
TLSH
T1C3311ADAED0DB4B50B80CB5AE8E55268D7B9B10F068488D4D5E4B31102A47CFB3DA2CF
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 ff228090965827001e530925dfa42e91353ef93c8951755b71c176c38c229f70
MD5 25fce21c5a3494d9b476f9103e76dfbe
SHA1 d715c10ba9b278c2b2c396617009eeb43730690f
SHA512 5131e853e692e746ef86cd7184c3cf32cd27fcea031190782ebc95d915d0ad3802184c75859e2afcf2b391e1caa0abe592790ad3a1b2c90c61fd4540fd397027
TLSH
T12B31F8D67C0D75B31780C587E9C545A9D3B5F24B0598CCE5D0A8731102B92DBB3D658D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 d3ea257f7f5356b44decd033fdda8e4df483e4a560ea5f4cd4144f0fd1c04717
MD5 b1eab00328388bbdeb5e94d70838a521
SHA1 e8b563c7acdd391601325e3946d01a3046417098
SHA512 ea4722580ee2467dc77121af82a5a7403f93db6cd0432fe6c93bbc434b7e759a1cb8269cb13ea322c098252efd1a6cdec2326f4175fd59f45cb5b411068ebe61
TLSH
T1DE31EA8CAC0566F72B80D890F4D29B97C7ECB24B0A65C4D5E164A12283AC1DFB3DB449
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 3dbfea38a35fbf3b7d80f6d7d5bf5a694b3e9b49c1c200c6739d92b49c9d11c0
MD5 820fe14d37ac9d1a666cbdbecae493be
SHA1 af7233b23027799732eef2beb6974dd1e505a886
SHA512 cf3600c11969bc9ae0f3c31f9cd1de7bcc4127c16ee2c78e8a486082e27bca7d1fc206cfd23852513da20c48c2ec0a8da78f1fea8e9e4c859b673328788848c6
TLSH
T12B31FA4CAC0471F62B91D184F4D2665A87A8714F0765C4D5E164E227479C6CFF3AB489
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 438caf9308c65477c9dd97890f4aff95985285cc3d22ece183f46b07adcccdef
MD5 4f7875386f579986d0353acfc126849a
SHA1 58ef2895142cd5e1d0492fb1e8e29c15463b2dae
SHA512 b2d9d150a9a13aeb6d12a7b911645071523fd7e6af3e318b5463aa3922d572c5803a5d9e4d01d54e1cb0c8b49e4b2b29ef202fb099dcb3be36dc4468796a98d1
TLSH
T1D431D858AC0576F62B90E484F8D2665A87A8714F0764C4D5E164A22647A82CFB3AB489
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 48bb4a6c7a02175b556d4011a31067971ce7bfff404c0de87c9831b7e6c33710
MD5 193b0e9bb8f5efc3c9493c3fddb81731
SHA1 bf280d2d3bfacb8c117bea4ed30191c1e21f3a41
SHA512 89d86cc93bb5220619fa567bcc52759158e560d3f48f4f7f88f6bd197b16b144d17e4dd43851586f9db1974392ecb63f7314556c8e32848047782d8abbfda4b5
TLSH
T15741D9CCAC0575B7A780E445DDD51A6DC7B4A29F086644C8F464B31002A95DBB3AFA8D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 0643cc6ad88d5a880c0634658c2391f38e3904fdf0a8e5bb77cfeae662e47c5d
MD5 6ff402264895f8f97155c425ad94beec
SHA1 cf8d712818428a963f60ff7efc2d2cb21306a9a1
SHA512 9dfb997e1221b904078242641a6e77dcb458743feff3f88b95f77685d84952753908c9e515aca8e62f3fbef3e873fe63a759652e77cb8b684a5c1e66ce2c895c
TLSH
T16B41F9CCA80436B7A780E458EDD51769C7B4A28B0C6A84C8F464A31003A95DBB39FA8D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 60f415f0cff7fff025d52abf07769ca471ee94d53a2e7fc2714112e5f34d99e7
MD5 15bd929bb156d8fd9ad8cfc7a63d35e0
SHA1 bc585547626613ea977759bfc77578ddb1064ce9
SHA512 872dc988a0b61ec813725209e233f8195105bc5823a8aa1bbdc483b2818583b9b52e7ec6460e727cbe86e58d0ff756d734cb0edb3e4585c5d791b296589492f0
TLSH
T16341F9C8BC0472B7A780E4449CD5165AC774E29F0C6684D8F464B21003AE5DFB3AFA8D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 1f3eecd4c23f2f3d5aeb49035eeb4319630987513f70768b7b087e67c09c47f7
MD5 ce7a95aa8b1c516f07063dc4221cae94
SHA1 acc6f842118769c70b3f7dbb4cf43254f0cb13f9
SHA512 1400cacddbe49b16053a908bbc5b81ab52256622fc72ea60ca3b692658380c8de7ebda78798e7088fe3e5109bc96ce3e3d539b9d844538fdbfb7f34a22cfb94b
TLSH
T14A31D8C8EC0831B76B50E084E8D25A96D3F8729F5E64C5E4E468B21507AC6DF73D788D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 e5f8f44967dcc6cc003aa36df6afd02a8644db031f693147354f6debbae20fe7
MD5 407282fa55b13ae881e7e2f64a269211
SHA1 89cec5e3890bd7d20e960c3e03a65c76c484c549
SHA512 fb053664da7bb66269e30a66ce1873879db11b5a8b0e8e6ec5a61d5949c8324b836bfcf223f9020e787068f79281d3dd2270c6576fba21dad6617bd3658eee7d
TLSH
T173310988EC0935775700E188D8D2167693B8764F8DA485F8E5A8B21103A42EF23CB8CC
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 efe4ed8b99a1e22d75e8b7da4ec590b8dcd6a64d7d87dc90e18287324f10e640
MD5 cb62b40a5c287f89fa858a5856ef214e
SHA1 8772e5ec878024c238f64e0fed63835cb63862ea
SHA512 6d9e9dd2092859bf506466575f43ac9883d9b762e250932161ec4f96605c53a43f3d3cec7b034045b254d05335d700ccea3f518b7056c879928cb420d4cde7e5
TLSH
T17341199CBC0D34B79B00D685D4821764C774F98F196488E8A2B8F23503982DFF392A8D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 62de542b3ec0c505ba12dfdc7058a3aaf2bc44518e0ef923f11f81039aeb3375
MD5 ee9f516d2ba9c522c3d7b52be4a64bd8
SHA1 6d9919bc2d1c8a0191390ad156b6f847e2e1cef6
SHA512 da39deddd87c7870b63693ec9f9cfb52302c9f73c0eed95d0fe0984a0313f14d1282b1ec50345040765464d31113a989f78da652954cd7f51ddf65905454ab23
TLSH
T1C241D79CAC0D38B34B40D695D4825764C768F98F195589E8A6A8A62503982DEF38298D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 8ee27029ef3398d320d33019c408b614188b40d597545068a4a36076825e28ce
MD5 a840b2f305dba229933f08102ec2cd3e
SHA1 35ee1d302eccf869f0cfc88860fd2abbccb5a472
SHA512 bf47536537bd0b435f297f8cbd6011981f8d156be6c168f4da6d7187dd8d0921f196d04e4e6f4e067d68750b7a97ec6947230b3d37415471470382504932b275
TLSH
T163412C8CFD0574F35B009584DC42567483B9B98B06D481F4D97CB12403AC2CEA3D39DD
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 e303b98ffb95519b7076c4a6effe5f4a43b03a1c1724438a9be2f6c56c22f6fa
MD5 7c63c592aa597de35d4c9da0dd894e49
SHA1 f5db00c692892abad59983baedddff2048f4bfcd
SHA512 c9e61f8bbd09e75b3e958d06b46f38ab6da8e52de1c9bbc789828fdb53a6d411e21c5b1e34b526c9e796c6bca861fb61a57ff4e03cb6a2fc72a31a3da0dade7e
TLSH
T1241186C4AD1D71F2575191965A9A6B61C7AD311702E84CE0D509761242A818BB16E2C5
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 14.0MB
SHA256 b8385affd5ae41aae7c0bea11f12d18786b84baea7410192e20f6ee243f9a323
MD5 a2080df349796de101ef879502ff6b3a
SHA1 eeea191e35ce6b3ef7e4144032b4ae809ae9402d
SHA512 04c58ac6242d683a51b619c133e712d88fa264c9adee3c89223bbfe036da921d0734ae8095dfeb23b9d6bb68bf5df907d807bf6b0bb5703e6b01b83726a3543d
SSDEEP 49152:HLELyoaeUJ6QC5zYYwe9XWNA6I8uxznVYC0iumJSgHgQC7Cn/TnYTpvKnnWB9jnl:TH5KnnWB97xZM9iLe3gJ
TLSH
T1A0E63B9270E0D692EB0186F2B31F43EB317FC1DC20E589941678B65C596329BEE6F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1256-327-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-8-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-9-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-10-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-11-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-12-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-13-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-320-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-321-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-322-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-7-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-6-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-323-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-324-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-325-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-328-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-329-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-4-0x000001BE7B980000-0x000001BE7B9A2000-memory.dmp

Download

memory/1256-330-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-334-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-336-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-335-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-337-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-338-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-5-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-3-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/1256-0-0x00007FFD08C1F000-0x00007FFD08C20000-memory.dmp

Download

memory/1256-348-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download