Overview
overview
3Static
static
1Postal 2.7z
windows11-ltsc_2024-x64
1Postal 2/4...N!.txt
windows11-ltsc_2024-x64
1Postal 2/g...ls.ukx
windows11-ltsc_2024-x64
3Postal 2/g...rs.ukx
windows11-ltsc_2024-x64
3Postal 2/g...ns.ukx
windows11-ltsc_2024-x64
3Postal 2/g...rs.ukx
windows11-ltsc_2024-x64
3Postal 2/g...ds.ukx
windows11-ltsc_2024-x64
3Postal 2/g...rs.ukx
windows11-ltsc_2024-x64
3Postal 2/g...ns.ukx
windows11-ltsc_2024-x64
3Postal 2/g...er.scc
windows11-ltsc_2024-x64
3Postal 2/g...ig.xml
windows11-ltsc_2024-x64
1Postal 2/g...rs.xml
windows11-ltsc_2024-x64
1Postal 2/g...at.xml
windows11-ltsc_2024-x64
1Postal 2/g...em.xml
windows11-ltsc_2024-x64
1Postal 2/g...ni.xml
windows11-ltsc_2024-x64
1Postal 2/g...ig.xml
windows11-ltsc_2024-x64
1Postal 2/g...el.xml
windows11-ltsc_2024-x64
1Postal 2/g...de.psk
windows11-ltsc_2024-x64
3Postal 2/g...de.xml
windows11-ltsc_2024-x64
1Postal 2/g...el.xml
windows11-ltsc_2024-x64
1Postal 2/g...at.xml
windows11-ltsc_2024-x64
1Postal 2/g...el.xml
windows11-ltsc_2024-x64
1Postal 2/g...em.xml
windows11-ltsc_2024-x64
1Postal 2/g...el.xml
windows11-ltsc_2024-x64
1Postal 2/g...ni.xml
windows11-ltsc_2024-x64
1Postal 2/g...el.xml
windows11-ltsc_2024-x64
1Postal 2/g...ts.psk
windows11-ltsc_2024-x64
3Postal 2/g...ts.psk
windows11-ltsc_2024-x64
3Postal 2/g...ts.psk
windows11-ltsc_2024-x64
3Postal 2/g...ts.psk
windows11-ltsc_2024-x64
3Postal 2/g...er.scc
windows11-ltsc_2024-x64
3Postal 2/g...es.htm
windows11-ltsc_2024-x64
1Analysis
- max time kernel
303s - max time network
344s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 02:50
Static task
static1
Behavioral task
behavioral1
Sample
Postal 2.7z
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
Postal 2/4-!!INFORMACION!.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
Postal 2/gamedata/Animations/Animals.ukx
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral4
Sample
Postal 2/gamedata/Animations/Characters.ukx
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral5
Sample
Postal 2/gamedata/Animations/FP_Weapons.ukx
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral6
Sample
Postal 2/gamedata/Animations/Gary_Characters.ukx
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral7
Sample
Postal 2/gamedata/Animations/Heads.ukx
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral8
Sample
Postal 2/gamedata/Animations/Krotchy_Characters.ukx
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral9
Sample
Postal 2/gamedata/Animations/Patch1_FP_Weapons.ukx
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral10
Sample
Postal 2/gamedata/Animations/vssver.scc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral11
Sample
Postal 2/gamedata/KarmaData/All_Big.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
Postal 2/gamedata/KarmaData/All_Characters.xml
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Postal 2/gamedata/KarmaData/All_Fat.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
Postal 2/gamedata/KarmaData/All_Fem.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Postal 2/gamedata/KarmaData/All_Mini.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Postal 2/gamedata/KarmaData/Avg_Big.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Postal 2/gamedata/KarmaData/Avg_Big_Skel.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Postal 2/gamedata/KarmaData/Avg_Dude.psk
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral19
Sample
Postal 2/gamedata/KarmaData/Avg_Dude.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
Postal 2/gamedata/KarmaData/Avg_Dude_Skel.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
Postal 2/gamedata/KarmaData/Avg_Fat.xml
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Postal 2/gamedata/KarmaData/Avg_Fat_Skel.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
Postal 2/gamedata/KarmaData/Avg_Fem.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral24
Sample
Postal 2/gamedata/KarmaData/Avg_Fem_Skel.xml
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral25
Sample
Postal 2/gamedata/KarmaData/Avg_Mini.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
Postal 2/gamedata/KarmaData/Avg_Mini_Skel.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
Postal 2/gamedata/KarmaData/Big_M_LS_Pants.psk
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral28
Sample
Postal 2/gamedata/KarmaData/Fat_M_LS_Pants.psk
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral29
Sample
Postal 2/gamedata/KarmaData/Female_LS_Pants.psk
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral30
Sample
Postal 2/gamedata/KarmaData/Mini_M_Jacket_Pants.psk
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral31
Sample
Postal 2/gamedata/KarmaData/vssver.scc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral32
Sample
Postal 2/gamedata/System/changes.htm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
300 seconds
General
- Target Postal 2/gamedata/System/changes.htm
- Size 4KB
- Sample260815-dbzs4sysbx
- SHA256 e3e1f2e4f0df27848096290a186ce527e7e6bc55a5b4774deec90cf9dca7b2e4
- MD5 b58ccba15e581bf62b3cadb3489dbaf5
- SHA1 ac46009bfd68ddf415af1c26d3343af63b37518c
- SHA512 0e2ab8bfafa23a0f43443d990690df4fbba0f8957bae90962db3bb6611b4bc0e7aaf3090d6a1cb93ce0fc3ab85b1b0c41cf9b3b223a430d180362d41ad084907
- SSDEEP 96:t2Jc4eLM4aO8bSeGRM4L9s1Zpl7+3J+8Yay3:ozeLM4aPyR4bl232
- TLSH T14791515327D42A5141725165BE4AB3932B29E068736C0FD678CF500F30CAB684EFB6ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 19 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 812 firefox.exe Token: SeDebugPrivilege 812 firefox.exe Token: SeDebugPrivilege 812 firefox.exe Token: SeDebugPrivilege 812 firefox.exe Token: SeDebugPrivilege 812 firefox.exe Token: SeDebugPrivilege 812 firefox.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 812 firefox.exe 812 firefox.exe 812 firefox.exe 812 firefox.exe 812 firefox.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 812 firefox.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 5208 wrote to memory of 812 5208 firefox.exe 88 PID 5208 wrote to memory of 812 5208 firefox.exe 88 PID 812 wrote to memory of 4600 812 firefox.exe 89 PID 812 wrote to memory of 4600 812 firefox.exe 89 PID 812 wrote to memory of 4600 812 firefox.exe 89 PID 812 wrote to memory of 108 812 firefox.exe 90 PID 812 wrote to memory of 108 812 firefox.exe 90 PID 812 wrote to memory of 108 812 firefox.exe 90 PID 812 wrote to memory of 108 812 firefox.exe 90 PID 812 wrote to memory of 6060 812 firefox.exe 91 PID 812 wrote to memory of 6060 812 firefox.exe 91 PID 812 wrote to memory of 6060 812 firefox.exe 91 PID 812 wrote to memory of 6060 812 firefox.exe 91 PID 812 wrote to memory of 5624 812 firefox.exe 92 PID 812 wrote to memory of 5624 812 firefox.exe 92 PID 812 wrote to memory of 5624 812 firefox.exe 92 PID 812 wrote to memory of 1516 812 firefox.exe 93 PID 812 wrote to memory of 1516 812 firefox.exe 93 PID 812 wrote to memory of 1516 812 firefox.exe 93 PID 812 wrote to memory of 1516 812 firefox.exe 93 PID 812 wrote to memory of 3404 812 firefox.exe 94 PID 812 wrote to memory of 3404 812 firefox.exe 94 PID 812 wrote to memory of 3404 812 firefox.exe 94 PID 812 wrote to memory of 3404 812 firefox.exe 94 PID 812 wrote to memory of 3192 812 firefox.exe 95 PID 812 wrote to memory of 3192 812 firefox.exe 95 PID 812 wrote to memory of 3192 812 firefox.exe 95 PID 812 wrote to memory of 3192 812 firefox.exe 95 PID 812 wrote to memory of 4136 812 firefox.exe 96 PID 812 wrote to memory of 4136 812 firefox.exe 96 PID 812 wrote to memory of 4136 812 firefox.exe 96 PID 812 wrote to memory of 4136 812 firefox.exe 96 PID 812 wrote to memory of 2420 812 firefox.exe 97 PID 812 wrote to memory of 2420 812 firefox.exe 97 PID 812 wrote to memory of 2420 812 firefox.exe 97 PID 812 wrote to memory of 2420 812 firefox.exe 97 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Postal 2\gamedata\System\changes.htm"1⤵
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Postal 2\gamedata\System\changes.htm"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27098 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {1e0fca1e-2b2b-45b4-90a3-5ff244aaf364} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:4600
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27134 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {77d0691a-a261-4d34-9223-a6b5c60f04a1} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:108
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27323 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {4a4963cc-d2ca-4706-b015-f39502bc4b96} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:6060
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27323 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {6108bab8-bd62-4b32-99d0-0f373511918b} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:5624
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2876 -prefsLen 34822 -prefMapHandle 2700 -prefMapSize 270279 -jsInitHandle 2968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4444 -initialChannelId {8fde0eab-3643-4b83-94ac-2b97d0114aaf} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:1516
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5052 -prefsLen 35010 -prefMapHandle 5056 -prefMapSize 270279 -ipcHandle 5064 -initialChannelId {2f11f71e-8c97-42af-b35b-d7fefc16d3fc} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:3404
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5436 -prefsLen 32952 -prefMapHandle 3300 -prefMapSize 270279 -jsInitHandle 3308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5452 -initialChannelId {455ace7c-aa49-46d1-a2e2-f49446f1bf1a} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:3192
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 32952 -prefMapHandle 5636 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3300 -initialChannelId {8a9cbc53-e41b-440e-ba0e-9bfb0372b8ba} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:4136
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5792 -prefsLen 32952 -prefMapHandle 5796 -prefMapSize 270279 -jsInitHandle 5800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5808 -initialChannelId {a0f993fa-1f87-4f1b-85dd-9ccc95642651} -parentPid 812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:2420
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
- Size 16KB
- SHA256 1342cdfe1f54bb295092c2034c9d6fe8ef523ef1e8d6df562acfac90a396bc4d
- MD5 1f78dc3443e6d76e61763bf036adbc7a
- SHA1 cad4bc782838b0e2f4f75d5eeae83dbb2b58de0c
- SHA512 aa406e74f6843d8dfed1d3897c23907f45ae406641b197cb025bc58145d31307111d1f7a3143f8219b4b987be0d0731ea129e1b4d89686ab7015110199930e05
- SSDEEP 384:HXkRyiO024Y6DL84KKDL849B7SOEAd9KVRaAcP+AWRMA+:3mZY6DL8lKDL8CB7S/AmVAf+hRMj
- TLSH T11A728E3D5F003CAC15A7C0F8C5A982AA4D08B7A7DFE6C06D21183D0DC798969B5F558F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\BCE77F27AF7DB788AE98BB53D806DDBEAF80E5E1
- Size 23KB
- SHA256 e60472c33cd50f9d69463228891236c0a8f58c2b410d94626c681581c9feb600
- MD5 73aad46115665d07f2d0c18a976a70f5
- SHA1 a6390fa8d4707f245d8c2d47c3593cfe58e3fb5a
- SHA512 df192f06a55617b2e507d47ece3cbff49fd1d36534a240861adb4702a6454e1191ac794133ae96c295fc5482275147a29f7f1a881078f06818cde0be03219634
- SSDEEP 384:kjbMegNp7L7KCopFDUtCZvjU73zqFiub08WpR8WMaGUzHODWoh1B9M0lpDIIMjoK:kjUp37K7D4CZvja3+Fc8WpR8WMaGUzH3
- TLSH T1BFB2C07B5C634464CD9200F3A8AD74869D6AAB670EB4691E6F1C3805C844BF4A7F4ECD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LJ5IR4S0SIT2U3N0BZAB.temp
- Size 7KB
- SHA256 7b471277d3de13d4b2b5603bccade1b49e654c623b9d182494d3f1ac1ed1b598
- MD5 892712dc48e502571fbd19f0777c6e1a
- SHA1 4555b64af1e4efec7185456502a5f193efc0f382
- SHA512 bacd913535c0d30eb7adc8579331032b3da45f8380a689529a0bf2cfd3350d5c29a90e87e9e17b7b3584243594f5836511117820415c866b9faab3a917f0c33a
- SSDEEP 48:rwpdi1J5UgdwK4q2zxRpdi1J/6BdwK4qA3x/pdi1J/adwK4qYwMipdi1J9Ui+7dQ:3x4qB/i4qh/S4qK9JgD8E4q03V
- TLSH T187F1CF024FF70966F4F39A322A326B439773FD115B1F225DC18262554A323A0596EFE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 ebf709e0abf075295206792533cdd8820eedc2664580ea93f0790b8f24e885f3
- MD5 46bef25bd076272919baac1654274575
- SHA1 6c599d9b577359f9230ac8437d867994f169e845
- SHA512 b8567f26f1b231de26183a9cc405db19f450c39804144bd12755378c2a3d0ff1341c3d02901954d8206d98ff99c3cbb3e31a3f5cd3d78cbada85d1941423e47a
- SSDEEP 192:gV1d66JoztdzgCl6mc0dAtOv5zbo7LZCQyjj3:Ud66Joz/zgC1jqCboPZCQyj
- TLSH T1B7E10FA4E628463FC408427BCCA61F450F39389B9C4E3F19359C651C2D5B2DE768E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 1fc33ed1e03f403062380a27000794525e787995b64cdcaa52ccd21621aa4988
- MD5 938b22f48777d08677cc6f473ebe11e8
- SHA1 0b40e5831112808e60263c7f20df7d4db253aca7
- SHA512 95119f831391189dc58fb39afe094aca4344fab4c4dc3bd1136b85080d485bb3284c6a622a238167e1add62bff3f59bfe000707dda16f042ed90561def915c3c
- SSDEEP 192:1tOv5zboqbCQyjj3zV1d66JoztdzgCl6mc0d:1CboqbCQyjbd66Joz/zgC1j
- TLSH T16AE10EB5EA28463FC408567BCCA50F410F39385B9C4E3F2935AD650C2D5A29E768D1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 509d4677eea5540ea154f7880b15d8be98b9193163f4706c72c6307a3abc5576
- MD5 1146951679f19bc204f4b75e3a7b86ae
- SHA1 3edd05381af2e64d149c2a00bc98ef5addbb693d
- SHA512 4aecdeadbde68dc12b0dc8714d68341dae58ced435efce531769063bedcffbf6ac4c39da828870d69eb7b22678818b0bbd0065b8a479d4fde238cf990dcfff7e
- SSDEEP 192:UtOv5zbo/bCQyjj3zV1d66JoztdzgCl6mc0d:UCbo/bCQyjbd66Joz/zgC1j
- TLSH T1C4E11EB4E628863FC408437BCCA50F450F39395B9C4E3F1935AD650C2D5A29E768E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 4761ea862fb72a1d9e964c7bb52e08eeca203e02cceeddac9c35799897b67aea
- MD5 8780d58efad225e4818958ef9685fca7
- SHA1 6d822f68d5f3a1e5e788526df2373dc145f95e9f
- SHA512 c0ee491bc4053b48df70f7ab66f07f733771a359fe69fede5f1796baa2cfa2700676aa937809e20e7903dc008d798b65dd85539a5b5ded280183a40e59554039
- TLSH T1BC21385C39A64D6AA8C6F29CB452028E53818D4A08871C43CE53EF8DCED26DA316A46D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\0ec8a0ff-dd3f-44f3-9749-8cde1a9bbf4e
- Size 235B
- SHA256 0c7fad9f1e2a1ef697fcfa3d49552a851ec193706e2e2a057288bf19d91114fb
- MD5 48176754ffd68d63b9c18e082a6ef2cf
- SHA1 ed5a63d73b34e06a5a4f360e29a9594958be0927
- SHA512 33542bbcc22f3c737a08681e4d0bc10f70444e53adaa5a3417b82885f987c443ccdbfdb4aa887d704d3b8805b271e5fbdc1837110c68db56b03366b8e484ce6e
- TLSH T1C4D09781248CB36C88140F07F0E02CCA30CE4C33187CF8209D50007CAAF9DC841A1C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\8e2e1d79-44f3-4a96-b626-6ddd895322c1
- Size 15KB
- SHA256 39f6be187782073f5eec02a5a96518fc15bccd43bcd588653c247f2121bd27bc
- MD5 6c1aac87f20f617c060275dbf9ebf1ee
- SHA1 00d0f053a6cdf6fd4a97f04fa92eab37f0c4d0ad
- SHA512 90351b2f002e72cfe2470779588999add82688bf4f1c7fc6b56fb1c9c9d735810093c234b5c06ac6ed8435ba07b9e847eb0cac9b45de152110ea3d8b8a53c255
- SSDEEP 192:a7rRizUyt1kSK7hyHOhwSMwSRF1dBwv3Z+UxT5alqhNrae2Tzyd0itL/4u6J238L:2RiIytWSK9yHqY9BmdlavXyVtzJt38L
- TLSH T11D62E9666420497B8591E368D8EC7FC3F5F518CF8C029FCD9BE47E086AEA09E5127847
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\aba342de-f87e-4558-a379-d46fb218ca10
- Size 886B
- SHA256 5e95ddd0ed5e1555896dd2e216ec8545c04fc389877fc18c7765f2bf202b4735
- MD5 8bb109958589321e855a498ba9f0e4f3
- SHA1 79d9151cccdeb52b5ddaab0354d6d65803b4f6fc
- SHA512 835c46bf6533204638982f5daf0ec5f6499de212189ed56caffa6d12e94dd452c8f68088c0bffe9702b43b482428b4bf0fbc149e2c2f92b62c445479282fb56a
- TLSH T1EF1104914B2575B38C38924F84D577538AE4A513C0C645287DA05F184EBE51FB3A6307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\bbc5d9ed-98ce-4b77-b850-f6a9a77db4d9
- Size 2KB
- SHA256 6e0a53e00d71c54382cb153be2112a35b4ddcc13aa48c2a6120949e800210b75
- MD5 ffe7b01e3a4ff9b674ba3df3e0fa18f3
- SHA1 7394d8fd12e17d67bc4cc7bcc0a4ad2f4f77290f
- SHA512 6bf8e61ca37a1d84cf64df4b5301e874bfbd2f77c78b3ffc3041367896d3bea8dca6f74a28e9c66c5f0418ee8daf9fade85bcc1f5f9a80d5d5487678b017f3c8
- TLSH T15241446C36785D7A9CCEE54E809227CE93E08A03948218832D51DF0CCEA639E776A51B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\e1f51c7c-e9ed-4d17-ad2b-4bd55e43df58
- Size 235B
- SHA256 b97834fc589d6e0b114e4b6a9401637eea98f8556ecd5dab9d1a2b7e5a807e5d
- MD5 c82856af3033f0c16869476e3c0e5720
- SHA1 752b4a8f2b8411b881b96bba48098e97bb2c8dae
- SHA512 78e3fd87550c9b25b6753f9449bae8023442dc0540f57c249d952a6092a1b8db1bbe216b843c17641a5260338d835277acf4b1678aef1f70959ab045773235b5
- TLSH T154D023C098A82B6C38208F0FF0F069C730898C3318B86814D7A15434CDFCEC48271C07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\e8f6c2f4-d5e7-4fef-8226-0f0e931a7e88
- Size 883B
- SHA256 d0f9a8f6adf1e6e7f5f959ede0b4c1ac6be8cfe8680d32dc6f2c9a8f251a8571
- MD5 593a6151045b8a72eb07e9d8851c4fe0
- SHA1 943f9346c873228dc0059b13306c0698df2075fa
- SHA512 a1ff8e71447095db9bd23063cb6888edd397b2e597672cdca7e3faaa231494482a67ed67b5407ea6728b561346cc823b45df541888bf063b25a21bec7f827f6d
- TLSH T1E5114491562175B2CC3C828F84953B024AF4E41380CA40142CA04F044E7E60FA3B6247
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\extensions.json
- Size 16KB
- SHA256 85065813d4d5093996b44f6cd7be73b6e3eee3102261d16b5bdbae488082f054
- MD5 288521046e62064787b211140f142bdf
- SHA1 558cbfc956d56480e16e333834cdf4adab09ee00
- SHA512 c85a73d7d93f76044a5834a3d733a258a2d7d2ceeb9ac0916766aaade76b46f210b256e0c39b7db44569020b96d1ffd0deaeba72434a58a39e4edc76f3544a91
- SSDEEP 384:LkI4vUUmldvS8dhWp94z7j96ohiL4HsL4PoL4HFL4HwL4Hek4h7:4I4cRfHXY4Z6N4G4y4F4S4/4t
- TLSH T12A72521545049EB8298FA78AAA367E01C37D473B70845C78F4DD8FC802FA5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
- Size 6KB
- SHA256 b12790b2b5573b11bd287da9e71f7a34fd54943d0fee5c968cec60409776035f
- MD5 28df68283465859c5eb25b82e4662b0f
- SHA1 d4bb1b4c66259fa77e9f1bdfb587bf239fe5d3fb
- SHA512 344e80255677cac8a3d168f35cb7d8047d8448ab90f81d55df309907fafc43ae01bb8feabe3c9043886aed0e60f0bc242b2f9093aa5172d79cd2fa40480cfbc4
- SSDEEP 96:xHGqUTUmK4qGqvfsAr1zSMSSlQdv9jhnoRHmBw88u8L4cnSqoL0:oqWKTRvfsArNSSd9mBw88nZ
- TLSH T12DE11F7891188F6F74B6776CAC6888716A72023B7BBF68D710B954C4450CF3482F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
- Size 7KB
- SHA256 ce1f3a843361312edad87e2c66dad4dbd514a9e11fa7794183810d21ad99b1e0
- MD5 dd2e5d0009a9ac36751258b6a53ff4d3
- SHA1 b543a229ed2fb6c21aec2bcaad2a12017b8638dd
- SHA512 b1c93b69379eabed516babff7044496652359872599da72eb66a3cdf259f76e4feb78ab2c755e12966a3b7a97e8374e8ed8d6724685f945744ad15c646ad44ce
- SSDEEP 96:xHGq9TUmK4qGqvfsf+ObzSHDSSlQdv9jwnoRWR95EJuBBw88mD8L4cnSqoL0:oqLKTRvfsf+dDSS28R3Bw88hZ
- TLSH T1D6F1FD789004CF7F64B2366CAC2949715A62023BBBBF68D710BA44C4455CF3881E9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
- Size 6KB
- SHA256 ad39b9ba9b82e42224ce3f9aad94303dc4b63e775f66afda657ced0e4a8ebac4
- MD5 add8b7933ea27e0c450549cce9bd052c
- SHA1 349233d53eebc361b0079b70127bea1b686b926a
- SHA512 422c235854f1f10564f606f1d112e945a78dc3829b6eaa3ff03c659accfe86cb2b5a03c4aa78ccd623df615ecad818b00680a47cda1adb60c60b501e169b74b8
- SSDEEP 96:xHGqUTUmK4qGqvfsf+1zSHDSSlQdv9jwnoRHmBw88u8L4cnSqoL0:oqWKTRvfsf+aDSS29mBw88nZ
- TLSH T1B6E10D7890188F7F64B6776CAC6888716A72023B7BBF68D750BA44C4451CF3482F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
- Size 1KB
- SHA256 fee009f3a699fa9fbba81680015d2855de7224f8b3328ac8015a8ac263241c84
- MD5 dd0b444dfa5ba6abd641c4bf5562af48
- SHA1 c6f8f05aa421891268c23365cec2c8d4d78ddd2e
- SHA512 74d7dbb20ac0a61bf725658ccba10ceb0325ae23024a7618be608e2ee352dbd6c288fdce0d7162d9534132d31b76fca0608cecae737cd58ca1881fb8926a1af8
- TLSH T171210B039DA73FA37782A1CBD4019F6587BA3030497418F042C597442D39947B74D60C
- MD5 SHA1 SHA512 TLSH