3c6705e804b7ed6b750f2232a167c4a41e5485a4576c38c7a1dbe453e83023be

Analysis

user interaction
yes
max time kernel
531s
max time network
534s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/08/2026, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
injector.exe
Size 20KB
Sample260815-16llasaa26
SHA256 3c6705e804b7ed6b750f2232a167c4a41e5485a4576c38c7a1dbe453e83023be
MD5 ede35dc0808a0d518447fac5a33938f0
SHA1 3de80bb8ec8c74eb38485608b0ea8c79fbe76d4f
SHA512 deba79e592ce9c0af18d4b51e68c6f153c203ae05e98f297800345011768f5d721e2b1c57a49072dbdbfa0f361594a1476aba80624ec864323881af541e7404c
SSDEEP 384:52ZhzWSsXirbaOYBJT/sqAK6FvBWBpI5t7x87j0:52uurbW+KCBCIT7K
TLSH
T176926D49FE054E73EA7001F815BA563AC97B76323B1990EBFF694A9601683D4BC3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	injector.exe

Checks processor information in registry 2 TTPs 42 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe
3116	injector.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	656	firefox.exe
Token: SeDebugPrivilege	656	firefox.exe
Token: SeDebugPrivilege	656	firefox.exe
Token: SeDebugPrivilege	656	firefox.exe
Token: SeDebugPrivilege	656	firefox.exe
Token: SeDebugPrivilege	656	firefox.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe

Suspicious use of SetWindowsHookEx 55 IoCs

pid	Process
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe
656	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 656	824	firefox.exe	102
PID 824 wrote to memory of 656	824	firefox.exe	102
PID 656 wrote to memory of 2676	656	firefox.exe	103
PID 656 wrote to memory of 2676	656	firefox.exe	103
PID 656 wrote to memory of 2676	656	firefox.exe	103
PID 656 wrote to memory of 1596	656	firefox.exe	104
PID 656 wrote to memory of 1596	656	firefox.exe	104
PID 656 wrote to memory of 1596	656	firefox.exe	104
PID 656 wrote to memory of 1596	656	firefox.exe	104
PID 656 wrote to memory of 4732	656	firefox.exe	105
PID 656 wrote to memory of 4732	656	firefox.exe	105
PID 656 wrote to memory of 4732	656	firefox.exe	105
PID 656 wrote to memory of 4732	656	firefox.exe	105
PID 656 wrote to memory of 1876	656	firefox.exe	106
PID 656 wrote to memory of 1876	656	firefox.exe	106
PID 656 wrote to memory of 1876	656	firefox.exe	106
PID 656 wrote to memory of 3880	656	firefox.exe	107
PID 656 wrote to memory of 3880	656	firefox.exe	107
PID 656 wrote to memory of 3880	656	firefox.exe	107
PID 656 wrote to memory of 3880	656	firefox.exe	107
PID 656 wrote to memory of 5824	656	firefox.exe	108
PID 656 wrote to memory of 5824	656	firefox.exe	108
PID 656 wrote to memory of 5824	656	firefox.exe	108
PID 656 wrote to memory of 5824	656	firefox.exe	108
PID 656 wrote to memory of 5840	656	firefox.exe	109
PID 656 wrote to memory of 5840	656	firefox.exe	109
PID 656 wrote to memory of 5840	656	firefox.exe	109
PID 656 wrote to memory of 5840	656	firefox.exe	109
PID 656 wrote to memory of 5852	656	firefox.exe	110
PID 656 wrote to memory of 5852	656	firefox.exe	110
PID 656 wrote to memory of 5852	656	firefox.exe	110
PID 656 wrote to memory of 5852	656	firefox.exe	110
PID 656 wrote to memory of 5864	656	firefox.exe	111
PID 656 wrote to memory of 5864	656	firefox.exe	111
PID 656 wrote to memory of 5864	656	firefox.exe	111
PID 656 wrote to memory of 5864	656	firefox.exe	111
PID 656 wrote to memory of 5176	656	firefox.exe	112
PID 656 wrote to memory of 5176	656	firefox.exe	112
PID 656 wrote to memory of 5176	656	firefox.exe	112
PID 656 wrote to memory of 5176	656	firefox.exe	112
PID 656 wrote to memory of 3836	656	firefox.exe	113
PID 656 wrote to memory of 3836	656	firefox.exe	113
PID 656 wrote to memory of 3836	656	firefox.exe	113
PID 656 wrote to memory of 3836	656	firefox.exe	113
PID 656 wrote to memory of 5260	656	firefox.exe	114
PID 656 wrote to memory of 5260	656	firefox.exe	114
PID 656 wrote to memory of 5260	656	firefox.exe	114
PID 656 wrote to memory of 5260	656	firefox.exe	114
PID 656 wrote to memory of 4100	656	firefox.exe	115
PID 656 wrote to memory of 4100	656	firefox.exe	115
PID 656 wrote to memory of 4100	656	firefox.exe	115
PID 656 wrote to memory of 4100	656	firefox.exe	115
PID 656 wrote to memory of 972	656	firefox.exe	116
PID 656 wrote to memory of 972	656	firefox.exe	116
PID 656 wrote to memory of 972	656	firefox.exe	116
PID 656 wrote to memory of 972	656	firefox.exe	116
PID 656 wrote to memory of 6024	656	firefox.exe	117
PID 656 wrote to memory of 6024	656	firefox.exe	117
PID 656 wrote to memory of 6024	656	firefox.exe	117
PID 656 wrote to memory of 6024	656	firefox.exe	117
PID 656 wrote to memory of 556	656	firefox.exe	118
PID 656 wrote to memory of 556	656	firefox.exe	118
PID 656 wrote to memory of 556	656	firefox.exe	118
PID 656 wrote to memory of 556	656	firefox.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\injector.exe
"C:\Users\Admin\AppData\Local\Temp\injector.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3788

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27100 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {40d9a0ce-2658-458b-aab2-3063dd829efa} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27136 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {a3d389a1-8610-49e1-b9ca-fc716bffe291} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2712 -prefsLen 27277 -prefMapHandle 2916 -prefMapSize 270279 -jsInitHandle 2820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3084 -initialChannelId {9643c8ab-ad59-4b8e-a2c0-6a4f9845ebcb} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3708 -prefsLen 27277 -prefMapHandle 3712 -prefMapSize 270279 -ipcHandle 3796 -initialChannelId {1faa575c-5895-462e-bd01-19a07963b36c} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4360 -prefsLen 34776 -prefMapHandle 4364 -prefMapSize 270279 -jsInitHandle 4368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4284 -initialChannelId {5dc1f442-9472-46cf-b010-cdf17f87ddd5} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5244 -prefsLen 35092 -prefMapHandle 5248 -prefMapSize 270279 -ipcHandle 5224 -initialChannelId {0f9d736a-b747-4c29-b52b-b6f825a89152} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 33031 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5420 -initialChannelId {c8987ad7-e6ed-4de9-a499-9fe81a1c05ae} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 33031 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5700 -initialChannelId {dfcdf800-7948-4f6d-b872-6ead87920451} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5916 -prefsLen 33031 -prefMapHandle 5920 -prefMapSize 270279 -jsInitHandle 5924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5928 -initialChannelId {75c3ebc4-912d-42ca-93f6-ab6275edce43} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6344 -prefsLen 33071 -prefMapHandle 4624 -prefMapSize 270279 -jsInitHandle 4628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4636 -initialChannelId {d25566f9-d6be-416b-9db6-bf3878ecdea6} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2900 -prefsLen 36524 -prefMapHandle 3660 -prefMapSize 270279 -jsInitHandle 6632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6684 -initialChannelId {44f0aece-c05b-4a9d-b0c1-9adc5742bd90} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7064 -prefsLen 36758 -prefMapHandle 5004 -prefMapSize 270279 -jsInitHandle 6416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6296 -initialChannelId {317a0150-e037-4eaa-9bab-a1342e481c21} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6732 -prefsLen 36758 -prefMapHandle 6736 -prefMapSize 270279 -jsInitHandle 6408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5112 -initialChannelId {53887a85-c9b6-43d3-8830-9bb77a5bc7c0} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4564 -prefsLen 36758 -prefMapHandle 6372 -prefMapSize 270279 -jsInitHandle 6456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6620 -initialChannelId {2df7d88c-b7b9-42a0-a996-58f43364741b} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6984 -prefsLen 36758 -prefMapHandle 2892 -prefMapSize 270279 -jsInitHandle 4156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7112 -initialChannelId {d0d85ec6-b4a3-4f38-a6d9-b6037e41dd7d} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:6024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6028 -prefsLen 36758 -prefMapHandle 6032 -prefMapSize 270279 -jsInitHandle 6016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5944 -initialChannelId {c551cca3-ec53-41eb-be8a-8fab61ca0a21} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 448 -prefsLen 36758 -prefMapHandle 7044 -prefMapSize 270279 -jsInitHandle 5016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4916 -initialChannelId {7033eb1b-da3b-4f94-a7f8-820825b5fd82} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4328 -prefsLen 36758 -prefMapHandle 7092 -prefMapSize 270279 -jsInitHandle 6560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6316 -initialChannelId {1a7630cf-e40e-47db-b794-b2f4194d3ecc} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:5684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7376 -prefsLen 36758 -prefMapHandle 6680 -prefMapSize 270279 -jsInitHandle 6040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7456 -initialChannelId {0992f8b7-8c0b-47cf-a0bb-c0505a375738} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:4916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7708 -prefsLen 36758 -prefMapHandle 7712 -prefMapSize 270279 -jsInitHandle 7716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7724 -initialChannelId {17265091-2f6d-450b-8c8f-3a3c1f973447} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:1220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1460 -prefsLen 36758 -prefMapHandle 2744 -prefMapSize 270279 -jsInitHandle 5024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3624 -initialChannelId {aed801fd-8131-4156-b543-e4a049912b5d} -parentPid 656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:2004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\33iyexir.default-release\activity-stream.contile.json
Size 4KB
SHA256 c396f31a4ca75e4fd8762ceea99d7f4e96edb9b873f49c0249c9d3b5525ac084
MD5 ce89a34da2bb6e324da8a1b4ca530dac
SHA1 02686d921f74e8cadf6d6c70c5aeaf2f6b665fef
SHA512 91afdd43ea7218958aae68074ff610134cae7fe904b5a52d83512b781f32a567078bd104d6776bbd4fa5b0eda50414b3b498e3ea18442c40298e8376c4ead849
SSDEEP 96:TqjSOID/5USAIClY5T+mRxCmKYcQS4I/NW6DbTb:wgD/ymClHmRxC0O4wbTb
TLSH
T1CEA1E85F945549E32B12AFD03C492BA9E2D37107D4D8CF9CA3A5283341ECA1F819ED84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\33iyexir.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 77b6cbe9ae23f57a93f0b2252a85d2799847f9236b378cfce98a325fd00be7bb
MD5 c867be94351b4164bf5cba46e939b205
SHA1 52d285f58606761b040283acfc95074097455e28
SHA512 8e87e2bc2fe881bd02d2337768503dee32ce33defda8a64ae00db54cb4f2c5a71f81270bdfabdfa22ad0fa16ce4b934be0523fd795cc88c1c57a8e12afca3bea
SSDEEP 384:HXkRyiO024Y4DL84KKDL849B7SOEAd9KVRaAcP+AWRMAVZw:3mZY4DL8lKDL8CB7S/AmVAf+hRM2Zw
TLSH
T1EE728F3D4F003CAC15A780ECC5B982AA4D08B7A7DFEAC0AD21583D0DC798969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C9F33E66B3E0502A44D1BB6BFBD700FE7B51204B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\33iyexir.default-release\cache2\entries\C9F33E66B3E0502A44D1BB6BFBD700FE7B51204B
Size 134KB
SHA256 c28ee425c74503c1850a808f97969b26f187954f334294dcc3bf802fdbcf9d76
MD5 91b4942675245b09c7312eeeb8e17b4a
SHA1 4883839419844fc07181d2a49ef07b1a7c410cce
SHA512 4fc7e00099623b984d92dd84ed4eb9c5a226c18512badba1e53abe42ec3d11b93bfd204dcac6445d31e55824d7659b9a978d24e99eb18d6326bad89b68f02383
SSDEEP 3072:LVHkYBB+LRUV9IMc2STYFfOOAiXloIg3yz/ES+NsA+yoiUH:5kYb+LkKYl5mIg8YNsV
TLSH
T15DD3122368114C0347E1B2C2D2EDAFA35D7A36A3C8B6F0C9A1252516AF60F6E165F15B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 11KB
SHA256 2698957240ce9c90904151aed7bf91d10f76406c64ca5c6737f4e74e5e9663bc
MD5 ab974eb956ecc351d5871a505c51cdc7
SHA1 8dadbb12b3ba631398fced61230a03691794a6d2
SHA512 d60b7b21ac10cd1e62be88108a8fd0843ccf04b9d29890c66ee368524b918e4832fdb8ba71a533ce627c9a50bceb40c35b6e0dce30a3239f5139cea5ac64cf02
SSDEEP 48:UHdPJ5Ugdwih0zKIdPJ/6BdwihkKKdPJ/adwihmAxNdPJ1YdwihYcK2dPJZYwD3a:QM/V/M1jkNO+/DHZ7wO+60
TLSH
T1E532CE011BF70AD5FAF34A32BA3277436B73FD01DB0A561EC18262494972760857AFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 15KB
SHA256 bea6a544bd0fb9b0110a80fa8e7efb5cdcadaa4bc4043def6b325054efc27005
MD5 17851ba62e3ea067d507fe201605b751
SHA1 027ca43ea12e32f18897e4b887b1ca86f618ba7c
SHA512 bc0103c53bb6495baa40a159e4ec31e1f34d8d4d815ee214ebe0d1ed4890da93f9765461784d06f7c4a832a45bdc519d834217646ef2647ce2cc0378e84415d3
SSDEEP 96:IA/B/61j8oi9DWDUIQo2xjC6mQNO+/DHZHwO+60:IAp/61j8ollQo2w6mQNF9wA0
TLSH
T17362E00117F60A95F6F35E72BE36B7436B33FC02CB0A561E8181A2490972750D5BAFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\AlternateServices.bin
Size 10KB
SHA256 06ed89d99d193813d124156d5b9e2a40b0c197bdb994c2514929cbeb7b393036
MD5 0907696173c7294344045f5df64e9328
SHA1 d559b26fac667db9d855d750780ed9662657d294
SHA512 0c797e6c171ddaed6b349f395be4cebfa855faac8980470d5c60d3cbc1bd4e1868bba50b8a692426564ddcf55428942078c7afb3b6f08cb3932df30436194e6f
SSDEEP 24:nuhMZL9di91Qwza9xEfzu9BYfzra9VvGfzJ5q9F55A5Pfzi9Fifzu9lefz:9weI4+r0qrr4BGr3I56PrQor0Ur
TLSH
T1FF2281E36F75A472F0A2CFF48069755C8C33172505A89588CB44D0F716D7A99913EBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\AlternateServices.bin
Size 18KB
SHA256 8767eff7a2a9c73b9e1b44ee301685fdfd8bc0ab83d586cfced7f1685255142a
MD5 de5e523882d754bc3414ddf04c89bfb7
SHA1 e8a870ff62908e02f3d099b93aa5e2056ac4c6a6
SHA512 bd2640f44179b5fb49595a19e82cb27d857f24eb3f3c43c40fd853621fa89d0cd3ac2023f2c0e15ee66c90b69cc510c6108dbf1cf573da9b8020661bce20885b
SSDEEP 96:UTeI4+r0qrr4BGr3I56PrQor0Url6iRM/pGFB4GBqOXUOE+hVyx2FD:Perf3vLcGQkhAzmr22F
TLSH
T1538274E32FB5A872F0628FF44469745C9C331B29146C9688CB44D0F706D7EA5D17EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\AlternateServices.bin
Size 21KB
SHA256 faa0bc3846aff44f5bc67e3e9f8861042908c53ef2634e325ab689576e85c03f
MD5 aef7dc0235eac1204dac98fed68b4e85
SHA1 299f485a3d777cd0c01c30e5594dbd2b5d606a4f
SHA512 b46bd73ac1f044b9a1a5653e59e0ace6c5613daebd204170b548035500dc2def5e4cf6b3f9f7185150c7a08eacb2333ad22837901463315eef208400b1579e72
SSDEEP 96:U8VoBFNxrB9uI56KbbjHl6iRM/pGFB4GBqOXUOE+hVyx2FDNyuZFD5y8tFD:nZGQkhAzmr22FpZZFlFtF
TLSH
T1A2A251E32FB56862F0628FF444B9745C9C33162558AC9688CB44D0F706D7AA9D13EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 de001268c116171b244903aef25d21d078ef343f6d701b9b1784c94754b227ec
MD5 b3931c7068c1a432921212fc4d5f5ae1
SHA1 143b96e6cbecba02542fc09858491e6e54bf3e4f
SHA512 3f49680fffd50fe58938e0919d35531c09fc290af5705252e365cd9163200c8b58048ddb1c7a8f6fe67d80ccb21a3f4980be74a6ba8699079be682c54b8b6e7d
SSDEEP 96:aF02FmhF7F8Fk/dd66Joz1zgClKtmc0d/U7SdF95/7bkW6BrcErOhyUR6qx2WZ:Fh1d66Joz1zgCl6mc0dOOv5zboBbrOhL
TLSH
T10AC1CA68F728463BD409027BCCA60F405F76798B988E7F19319D64082D562DE778D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 97KB
SHA256 059be52a5478eb513e9448fc1e49cf52fd82f8a76098761590077cf34f79c3d5
MD5 ef17ed37e80db58aa2ae9c0fc89997b1
SHA1 3b0e8929f29d5e77091cc6cd078be8bcca01ea0b
SHA512 4fe4fc8cf36a082cd495ff787144a1ebe45a8e49617a51d9ac5c6b3ee2032043dbf941d554089ee3d8e48b2267a69cba0e26a9efc7ed27c8807d3b9ff152960e
SSDEEP 1536:mZb3W+aQYuLcYxRI8brRX9731DrWIjXnV+3W44MC55UIbD96094eWYLj:mZLWJWLp1bf3AGlV5n396094eWUj
TLSH
T177A31084EB2A403BE92445BFF4952B282734F4644A595B1B36AC04752DCB3FF2D0E76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 bd8e32aec4078f9ddb07081d1b5675df1691a6e98fb3fe383867c6aba052ddc6
MD5 5350302a830237ac5e78edcc5be89807
SHA1 bb2ac052fa61502af21afef3976a8d3d05b4b517
SHA512 72f23bb9583466549b47a08cd0daedce8e3293cf6ec424897e03a9a7bb51f96637d5d32fccbe8e3274061f6d1cf5453162bde75783007fd0bcb594e4c2e3e62f
SSDEEP 192:rOv5zboADZrOhyjw+Dh1d66Joz1zgCl6mc0d:0boGZrYyj3d66Joz1zgC1j
TLSH
T119E1FFA4F628867BD40502BBCCA60F414F35788B988E3F19359D650C2D572DE378E2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 97KB
SHA256 c116910d07b756417936030daabad97331f79b9fe57c6e5625332b2132e36061
MD5 11f646f3a30a83e25ebdc20c618eb487
SHA1 63e48fe1784ed8a1145cf19951a8f6fe0ca3b103
SHA512 6c639bd54d4766af15b844f2388591f04f871d2565c6b54888d051417387dfdf0693f9b4a24d12aa35429611ec2bd79574166ea5ea94d7b55e58d0eb37c3b887
SSDEEP 1536:MZb3W+aQYuLcYxRI8brRX9731DrWIjXnV+3W44MC55UIbD96094eWYLR:MZLWJWLp1bf3AGlV5n396094eWUR
TLSH
T1CEA31084EB2A403BE92445BFF4952B282734F4644A595B1B36AC04752DCB3FF2D0E76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 97KB
SHA256 5eaf66ba70987de26eda8f87d53201d49560253e551a92965145ffa06df65cf3
MD5 a500f9c2459c56c4b20b641799207d25
SHA1 e06c866e8ccfb65d0a311fa8840f3277c6c38aad
SHA512 77a430b19b895babdb4c9f651b4c9c2d13a2ac5de73dfaad50ab9503d90b5902c06927b352aac77ec4c02b80c30f9636e4473e4cf99a3ad9db489fc760d02b5a
SSDEEP 1536:+Zb3W+aQYuLcYxRI8brRX9731DrWIjXnV+3W44MC55UIbD96094eWYL3:+ZLWJWLp1bf3AGlV5n396094eWU3
TLSH
T158A31084EB2A403BE92445BFF4952B282734F4644A595B1B36AC04752DCB3FF2D0E76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 97KB
SHA256 2148f00b6e1c479ee429b208fb4c803e81516798d54e361946fb6dcc4ecee187
MD5 ce457bebac413ecca0edbea29728f62a
SHA1 34914e0e7caaa304102c815b43cf514db90d2371
SHA512 dd9d2a7a4c66c8b47cd875f05a48dd73052b4d486174052b05d95bc1e9847e4ee8ddce7f7eae3e8af943107a7f38123eff8374d810bebb1eba76cc21484b9081
SSDEEP 1536:IZb3W+aQYuLcYxRI8brRX9731DrWIjXnV+3W44MC55UIbD96094eWYLJ:IZLWJWLp1bf3AGlV5n396094eWUJ
TLSH
T127A31084EB2A403BE92445BFF4952B282734F4644A595B1B36AC04752DCB3FF2D0E76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ac28f07c7ecb3032107754fbb2c2f0f6f349478861e215ca6a83f9eab5b458da
MD5 f5286b8038a117a706125ca6f57a36e9
SHA1 40289b8d9f2f0546e9415c6499006b80c1fc840c
SHA512 fcb58b76adc3b49f817d868fd4b44bd1903a9704e60702cfc9823be277440982d9e02f14f61fa2ecd92c48f43a7b8130ca9fd6c8960894a8b7d22ccbaf8ee967
TLSH
T13C116DDC3EF94D7A998BE29C7552128D53528A0704C71C438E02EF8CDEC0AD9322D43C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\events\events
Size 4KB
SHA256 f640beaf700fe1dc805e2e640a1353e4d06db753075f77601a1d4f638fbc4572
MD5 f396e7f417a3428b730bb748268780fd
SHA1 0d9352c1612a8a062b271863b004eb149ceba507
SHA512 bccfa24dbdca89d3465f01d056b9dcfc0e530183432154b0c5b7cb7984f4340d67c5666e6206bf1ee69af6b28dcebb601cddd09294b287f81f2365248d6e5eca
SSDEEP 48:Ypyl5YA971W1qr5C/JNx0di/WyN3Snw7Bp+JgjPk5mV4Apcn5OddnYUY05tmd0Vz:LwN/N0USkB8+kC4A+EdRP+dILsc7T
TLSH
T15B91125C7AF90C7F2A97D38DB492038D87994B0394C719878EC7EE59CD85A89321E13D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14d3f38d-86e3-4ef5-83fd-2841d2aa28fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\14d3f38d-86e3-4ef5-83fd-2841d2aa28fa
Size 16KB
SHA256 12e9f5696817dfc6ede088d7ec9cca955c6a1b6127d857291b50ddbd5dc68bca
MD5 d86838a7f08bb37bd1cb16491645fefe
SHA1 d7e717f137a5353af873edc667f154d21f16cab2
SHA512 665239166fc830eb63539d5feff7a7c15d1ad6529b34a79bf112e551016a091754c98089a2fd1369e585de6ecf5a98ac20e84892e45d3c1ba8d4774f7968698a
SSDEEP 384:RF1z33PzA6TyV9bsuUJHMubFm6tUEmtLT:RFJ33P9H1FRs
TLSH
T10772DA16287045BA9251E3A898FC7FC3E6F528CF4C419FCE9BE4BD0859DE0AD112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68ff8dd9-1b45-48b0-b348-83ad77a5de1b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\68ff8dd9-1b45-48b0-b348-83ad77a5de1b
Size 883B
SHA256 c3f7050918a829cd7d5f1f45c196f5f19ba6f1ff439616ded3a130402a0b95b1
MD5 7f85206143fadd0b6bb372cdfccd789d
SHA1 c5fe9d18012a7aa2336654541cac7f2e961946bf
SHA512 6aeaa2002e03699ec9b8c244c34d24cc95cad87b325a99ae8d1e389b10b3b6fdef8b571e9fe24b646ccc499f36a10871ac2a15d77686c94d31f52f72439fd64c
TLSH
T19C11E350963479B2DCA8928FCD6637029FE8B52380C654183EE56E044D7E65E93AB34B
MD5 SHA1 SHA512 TLSH

Submit Download

9c7b8a9d-8763-4203-9878-3f51e8394ce9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\9c7b8a9d-8763-4203-9878-3f51e8394ce9
Size 886B
SHA256 dbfbeb65aa79311555122f943f1c331fe1e7aa0ad10f986a00d125ca2633c099
MD5 b10f685bd8b845f7c1dfe9b2690ba221
SHA1 3cec3ae38e1b75c4745da65395f5dfc9bc39ec2c
SHA512 04f693197c4665927d81a80b328f4f4955524cce802603ac656874da02f14bb0c7d7050615edd0252dab803d5fe9b7eaf91428994ce6ea7372732383d7b15057
TLSH
T1A31104805A7479B29C69928BC8A677425BE4B41380C60C047D656F0849BA51E93A7307
MD5 SHA1 SHA512 TLSH

Submit Download

e4760881-025d-424a-adaf-92645d54bb0b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\e4760881-025d-424a-adaf-92645d54bb0b
Size 2KB
SHA256 cfeb71ee2fe325878144bcd7c7ce21f3a1b4aa74c31daa362966e3d64e29e3c1
MD5 3b7b766282663ae12d35543cbe6d7299
SHA1 42fa7bd68c42c5000d5807e1b32d7ad2762c2880
SHA512 0cdb6569c65b6efccdf63e1ad37997e581f3591bd349e14972f4709a0a72a5ae875432ac7fbf6ec20356edfef5422901a5eeddfcac479fc41810f83be53a6749
TLSH
T16D41235C36B44DB79CDFF19DD882334E53208A0340C628432D62EE0C9C9AA9E336A57B
MD5 SHA1 SHA512 TLSH

Submit Download

e5bee3c3-e7d7-454c-a3cb-0b086d557dd5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\e5bee3c3-e7d7-454c-a3cb-0b086d557dd5
Size 235B
SHA256 4254861774cc969dd2f630c1399f96ed9eba5b8c3687c2bf3483d1b51c8c15ff
MD5 61f53308b1ba4d1cc19ca5edfd27434c
SHA1 2e22691f732d0fce95f86e67a3143712b97d4fef
SHA512 b5b5807af2510f72d7d964aa1d859491b02761194206d4a9fa574e09bf09742354ed3c268a3ea7f56b159eed83c06b5befc7215a1f2da1abd28289b4dee89dad
TLSH
T161D0978428AC276D08115F03B0B22CC630884C3B18E5AC20956609B89ABEED86192C0B
MD5 SHA1 SHA512 TLSH

Submit Download

ede516f0-1eb5-4e24-a30c-bed33495aee1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\ede516f0-1eb5-4e24-a30c-bed33495aee1
Size 235B
SHA256 53fe3fe8da6fd31cc350115e98f760a66ae0292f7b22b38b52e42937d25b96d3
MD5 ebcddd10d789f0197d9f050ec8643d48
SHA1 98c9b565f3526624e6cdf5cde8050fea28a288e4
SHA512 16c4048497d83d1fca4ea4c9b0d75ad752f56e7d8448766cf5f1c3daf15acbdd70405d8049fea9816eb70a1053b618504951c1b311f67d03b4736d65368fb7a6
TLSH
T14CD097C1249C6B5F09140F06B0A138CB30548C3368B168588961043899F8DC401B280B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\extensions.json
Size 16KB
SHA256 d33376ac26c485ddc5092a6e8d450f921b2008967f80bf8d96902ab8bbdcd18e
MD5 ada8becbc77c51eddf1cb038ed85e22a
SHA1 86fa386a3d1de3b448a1b926f8c42360d78d6497
SHA512 83728bd5ec5756dbb6b850613034225eab2c04e9540475ad9cd0e77fe980550604490a37ca1378168e7e3bcf4b5e7aac811b4f0acf7359e124807f88db230673
SSDEEP 384:VkI4vIUmldvT8dhWh94zX96ouL4HeL4PEL4HvL4HcL4Hsm4hR:GI4gRfwXk4x634E424T4W4v4P
TLSH
T1A072411545049EB8298FA78BAA367E01C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs-1.js
Size 8KB
SHA256 6009182cb9b5dd3c372d1c63ec33e691f9d7dcc9df9e76ca50f4239da7d44263
MD5 e3fcd0f04414a4b9d127eeeb67c4b6f7
SHA1 9ade2603789a25340939905a62f1ed6c8a2f5adb
SHA512 d6a0e87fe57956a058e0d8e39c04da914efab78f47dd722fb153cf28604070568521bdd6031927db38667dfb0373c701b26e7ed24f61a7e853ff0bf3fff4bca5
SSDEEP 96:xHTh5TUQqGqyf32b/6NbzSF3zSSlNdv9jDsnZRWRxPoedPBw88i58L4cnVWBGS:zSRyf32b/6w3zSSXu8RNTxBw88k
TLSH
T136021F785504CF7F74B276ACAC3989705AB2023B76BF68D710BA9484015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs.js
Size 6KB
SHA256 9662763de633320d65e7131c360c57d2c9c286422522599c7d3f31031c6c916b
MD5 a7762be14494848f7ff55c6b0d681ac6
SHA1 3c31666f655f720a1eeedaae1e59a7d148474e54
SHA512 4bbaf6c5c5b19cc731d4d1d80591386a15cd28c7cab0fdc050262a751b68371ad8ba82a62b6d96faf5972c26200a45131b6c4697e736ab516f7daec024a19ea1
SSDEEP 96:xHThUTUQqGqyf1B3J1zS+SSlNdv9jenZRHboedaBw88P8L4cnVWE:zrRyf/3JbSSY9bT4Bw88m
TLSH
T149E120789508CB7F74B676ACAC6889315AB2413B77BF28D750BA5484050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs.js
Size 6KB
SHA256 76e1c3c2b1478cc960baf8ec8a18f001fa0c8108cfe079d41fe34f51343d7724
MD5 f6f153c72a4cff907f38adb15646bc70
SHA1 2927da3ca716e72da6d3c066dac44e1c0c9d953b
SHA512 19eedbcaab6678fe6207a64467e671cb6f31bd74bca0bffc3443448eab2f70669231b514b87e1a037f784dae898da1c070468115c43917e76a782e1245c7ac51
SSDEEP 96:xHThUTUQqGqyf1B2b/61zSF3zSSlNdv9jDsnZRHboedaBw88P8L4cnVWBGS:zrRyf/2b/6E3zSSXu9bT4Bw88V
TLSH
T177E130785508CF7F64B676ACAC6889715AB2413B77BF28D750B954C4010CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs.js
Size 7KB
SHA256 19b2e26fd5294999b743b3a88aa41a98705c5fb10cc72e96988616fbc9250d0d
MD5 49bcd1e4a5063db3cace44393c598d0d
SHA1 bd4bae8880827d801e53caf300775c64deaa4c8e
SHA512 e051b37b49b9f130326d191528aa6468ef0bf2a1f9b325cf2e8a2358b867f24d25695404f26691fa0869d0e5d1ec86a2d6f50dff621634bd4a7c3ff459ad4776
SSDEEP 96:xHThUTUQqGqyf1B2b/6NbzSF3zSSlNdv9jDsnZRHboedaBw88P8L4cnVWBGS:zrRyf/2b/6w3zSSXu9bT4Bw88V
TLSH
T10EE1307895088F7F64B676ACAC6889716AB2413B77BF28C750B954C8010CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 71459b0b19c745ccdea599999830740349e64a1e1fdf25548f54dedcda9bf2fb
MD5 2eb1fea6f98649da25fb5abbcbde3ea5
SHA1 83cf840a96f0d9c35a0f6e70f2a4f28dda0353d6
SHA512 57090bccc82864acb7fed29cb92ad733fea6156b691ed5018e967a3c09026d98d341db951609538e227a85d6a56c177ef9226c85b043e4d09ac2b6e28bab93bf
TLSH
T13E21A7C2C5BB17F6BFB6A062E0864BFEC198302141EA14F4D69D7701258D1CD9ACB51A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 afa5e02cc327774b96ab518fc682988e46edde0d8783b9e581a8e32aef71ea96
MD5 9ba5a206ecc20bef2c2a5c1be244cc07
SHA1 09682186eadc354a6bee9dbe93d7372b962abafd
SHA512 ac97bdadd5c2c602c6e022dadf376f31013e856a9eb4f07e45880f326aa5b780b1c2639839ab59cf610b49e1aba6436b11b0b7a6e3fadf1bf56e91577f6b6aef
SSDEEP 96:R2wJsxzjn99OQyDWkJlvrEfTJ8y1Cd01VrqM4EcZZi6rLKJiY75m2:Rmzh9mD5vrErJ8wi0v/4LY7M2
TLSH
T11D917EA79C1295F7A6B1D0B19CFE0F34C2E31450CCFD0158EF6956B200E8219B56862D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 03f7d9732959463b0c73ef3e23d710473e12f8f93c98ec9b5ae70a5561e63b1d
MD5 e64624547ff150721127a252226238dd
SHA1 2434f23f8694debb8c91e2742d7923f475d61182
SHA512 d98c40a8ae0a450bdae2e60633d6f7ad88336fdead1ced8b25a23005c958d791c334991b6fae429a3b360dd6e7e021de0ac228e7c7ac893d0cf530a2632b0c03
SSDEEP 96:q2wJsxzjn99OQyDWkJlvrEfTJ8yJCd01VrqM4EcZZi6rLKJXtJGftp:qmzh9mD5vrErJ8ci0v/46Ep
TLSH
T10D918E731C13A9F765B1D461DCFA0F7483E31890CEFD5298EE2A56B200E8216A56865D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 ef08acf2de0f9b1208f81387d9be965ba14518d41b82c3c0265d87a1ecdd5105
MD5 1d4ac06f36a383262e362aadecdc9677
SHA1 8545e6c0c85dc6d1e507011a1fb4219b9a48a76d
SHA512 9c0038e7975bba8ac3fc1223121ab49d1f43b64686c7923cd667247039fff5105f57be14e2b7d48cdb9feed406a19442355801743ca033c1a7764e4ee404536c
SSDEEP 96:S2wJsxzjn99OQyDWkJlvrEfTJ8yQCd01VrqM4EcZZi6rLKJXCTtKSdDcUs:Smzh9mD5vrErJ8di0v/47ZKSun
TLSH
T1D0A18EA31C13A5F766B1D471F8FB4F30C2E31451CCBE4188DD3E9AB200A8215A65857E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 4945f47546b73d1dc6727347ffa7b5ec24f88395afa8b85007e91c4f05c50dfe
MD5 783e8180bf0558a430f7016da9157261
SHA1 e32d8ce49c6942552e3f7660c16797bea1fa0d97
SHA512 4d876990f5846beceeb97e89ed2aaf130b5363dd6fd374eda56a390ac459f8af4d736f71a87db59df7c417bbb06be301d3ba533d6edb46ba31ff6bc2b67c5180
SSDEEP 96:G2wJsxzjn99OQyDWkJlvrEfTJ8yQCd01VrqM4EcZZi6rLKJXCT0OU54:Gmzh9mD5vrErJ8di0v/47oOS4
TLSH
T1D1919EA79C13A9F766B1D472ACEB0F31C2E31480CDFE4248ED2A95F300AC119751C16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 3a80ba57fa1255c5bed7bb7906457dfc69565503b899bd8ab4f17c216fae28ea
MD5 19823d85dba193fc4312d0b79bd7eb55
SHA1 272ad6b2b01f6bc1a10f22d6b0107aa1e5116762
SHA512 aada4fd95e786215fb477bbf996cb550f48f1955e9f0b8a014f7a4570fd945a7c174cbae27a3d8375a151fffec895467278a62ec4b97226609c3dd23ef14946d
SSDEEP 96:+2wJsxzjn99OQyDWkJlvrEfTJ8yQCd01VrqM4EcZZi6rLKJXCTtKr9wFFQu:+mzh9mD5vrErJ8di0v/47ZKr9wsu
TLSH
T180A19EA31C13E9FB52B1C461ACEB0F31C1A31451CCFD4149AE7D5EB300A8215AA6863E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 0955234603184b39ea309d96b470bbf37f69c2e83158daaad238dec3476b5216
MD5 e6b4006c15ccefd1a48bea50d9d18740
SHA1 2940fc09016e9f481e103e50a3baaf3738b6aa21
SHA512 9713c73c8ff94af0751d903c4350858ec887349881f00f04c93d76390e941e82908988bc68370e8be7f652e44323da2d7fa693b72206666ee23634af49f91de1
SSDEEP 96:02wJsxzjn99OQyDWkJlvrEfTJ8yQCd01VrqM4EcZZi6rLKJXCTtKr9l+jD4XXc:0mzh9mD5vrErJ8di0v/47ZKr9QjD4nc
TLSH
T16AA17EA32C13D9F766B5D8A1ACFA0F31C2E32895CCFD419CDE7E5AB600A81157A1853D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 21KB
SHA256 dbeb481aadcbe105b5e910592523e7179af098fbf9de71c7ac9f5283ff5b225a
MD5 818fe6bd82325e30e7dca05c288accfb
SHA1 8db21545b3faee8c0a9db074f8adb1b62d82702a
SHA512 e20aef64330a4a59dba3ccd362a3b0eaa7d083ced5afc8029b1c90fbae17d45231ef925c860402ac84ac86e496f42a390b92c951b8c89aeffe0b433b36780ddf
SSDEEP 384:QzhgD5jEapgF6EsGzcClwaq+ehaF/XKmGps+Ym4w0h4EaDAOZ29ZN2eMiFQJ/YFB:Q8oog8GzcClwaTe0FPrXfw0dasS2Z2eX
TLSH
T14DA2D0F37C2AE6B7E2F251231ED64A3B00513D8C84ADC06467163D7D80FADBA9398759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 f53fe2e0da84f0e4c7e98b3a7ee03b1fde6916deaf97052a0c10eee1bb14a70b
MD5 6d2b9d92f3e7c8b863816f699e00c05d
SHA1 9a3d1d2496261c905020330a0ec0a722b679efa8
SHA512 31578fe8c28e7d50be62b8460516c629cb2bc7f3e7f6f5396f0b203d4b882019a4c8d65419457203afa1e58be1e03dcf12b4a49bd771a87850add1144eb5740c
SSDEEP 96:b2wJsxzjn99OQyDWkJlvrEfTJ8yQCd01VrqM4EcZZi6rLKJXCTtKr9q2qm:bmzh9mD5vrErJ8di0v/47ZKr9qPm
TLSH
T1F6A18FA72C13EDF766B1C861ECFB0F7581B31481C8FD5249EE3A5AB300B8115666853D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 b0720b19bcaae18c37869d42cac469644840d9310187e76898e55ea40d41b401
MD5 5ef69ba41c813e3bfe8b50586a440ae2
SHA1 af5596f5c2944b8bb5218a4469b15dbef3b7d1f8
SHA512 4d0aa66a68e6fd6ba1fd8c76c04f5ae272f1babc54021bf67e1be3976b7aaffb11bde33c3c5fba452b482be0b7a58666419cb2f8e49f2bf80f49ba142d367604
SSDEEP 192:2mzh9mD5vrErJ8di0v/47ZKr96j3fHpBfIwIMI707h2:HzhgD5jEapgF6A0JW7h2
TLSH
T1A9F1AFF36D21D5F6D2A1A469DCE30F32C4F22811947D2268D52EF67280257395F15B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 4059ac886e5ae6d3e82478870071fc37aac4cf298b5f2f291d36995347016cf1
MD5 2caa06c741597201952f9635254da3a2
SHA1 c9d904a387699f55803fc12984aff1ee22d506f3
SHA512 9be2dbc6fb5df02ea09644709821a2f0ef2c698b4554d8ad01e08b9ec59ee130eaa7041176ee2f06a0e30232da38b8483981cc81ed1608914a6062cf74c5d543
TLSH
T144515CBA0D1B69B73831C592E9DF0FC0C4A1101005BD7176BD6AA66200DC10AE886B5E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 c4723f98547ed1890bb53726cce3138f957e84d727fcedf0d354b24c69e384fa
MD5 83d4516d06cbeaac457d1c07ac409002
SHA1 0ad0654e668e1e7eef173e851069798abc7f49cf
SHA512 bacce0717f7c3fad308a6b782a4655faa6c581b174067c54647a8ad0d532503377f2ae1766a95ad84d996b591ba73bff2f31cf6d7fd094c7167d86aa5bbe340d
SSDEEP 192:7mzh9mD5vrErJ8di0v/47ZKr96j3fE3/IwkMuXPjV5:yzhgD5jEapgF6ApJHV5
TLSH
T17C029FF36D21E5F3D1A5C466D9E74F7285F22421A5BD125CE81AFB72802433A0B16E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 e050c50854a54b8df079633925b0398a905ba97200bfe4828817f6064f0c10d2
MD5 b322614074a1d784ed159d57188a3afa
SHA1 535fd58d94e4ab3f6398ecbf938af3cb58610ef9
SHA512 d37c4ea4acc009ac0e1122d347b57a257e0d0305f3c18bbc296364d37b3c4bbd7b6681e51ec536d29db6e0dc63b7c0a0218d6c384528faadfe863d1c69874a4d
SSDEEP 192:Bmzh9mD5vrErJ8di0v/47ZKr96j3fE3/IwkMuXB+Wt:czhgD5jEapgF6ApJMWt
TLSH
T1EB02AFF36D21E5F2D1A6C56689E70F3285F2282094BD1358E42AFAB280207360B16A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.jsonlz4
Size 8KB
SHA256 69c07894e6276c06851cfa7154ceecc067f877f265a731a72cf76f83e1eb2004
MD5 6a87887cd301faf17587ec8e99d95f3b
SHA1 5d9b4bd1b4bd2f65c7acc5fc5805c83e40af3a12
SHA512 66374322077a4b5395fc42cc144d82db70e87b8e2cc504288d682628962c9a4b46b72e9b5903131745d3b3ef1e3edbf9289c58532b7e03da1e5e1c60f06d3f19
SSDEEP 192:mmzh9mD5vrErJ8di0v/47ZKr96j3fn1mIwIMYujss:XzhgD5jEapgF6Arpgss
TLSH
T14902BFF36D11D5F7D6A19065C9F70F72C4B22810E4792258E92AFAB28021B361F1AA3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.6MB
SHA256 c54c6d7c0297fd9962dafffae857ce0cf472747432f4b45d07c52de545063f22
MD5 6b3f8ddbe81d6c586c56fffc5f35bcc6
SHA1 49d78b22f9ce7245ad1b67d46c38bdf5c9d77d5c
SHA512 6eb90859a70d0d74618c9655884a1572fd9ce8b647b23d6a0c66dd98721c5b4987d82472df804fc06077a91da6d1d0e2c64a86ec9c15b85f6fce9c92123f5758
SSDEEP 49152:rLALygaeUG6QC5zYY40pJgc3k57Zk1wyS8pEGMT37u6UY58IGPyDi20vuzRQ4ZzK:7mKPyDi20vu6jew
TLSH
T13E665CE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download