6ea9212665845eff3e651117196c9bd1c64e5ae0a429e7f967fc55d4d2b5932a

Analysis

user interaction
yes
max time kernel
898s
max time network
426s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ChatGPT Image Aug 22, 2026, 03_51_27 PM.png
Size 1.1MB
Sample260822-tdnrmafe39
SHA256 6ea9212665845eff3e651117196c9bd1c64e5ae0a429e7f967fc55d4d2b5932a
MD5 e6cd58fe68e98b414932bae3bd83640d
SHA1 ee552fbda80a7a23031ed8aac66fa59178b9ca03
SHA512 ec4c97ea3b40f76820d01c53be6c9287ee5910770029fe19487f3526ab33e6f6ccbd1721ca8233680e24643e9edf5c57ea5ab5787940915e124dbdf6dca89e64
SSDEEP 24576:lyp/NC24DG1pqTnUcP02ID5SXoTKWNbT+/YzNcRyfVIsmUD+HBlg1TeKEYLBvm:0NC24DGKTzP0PkSKWVKYzeSSsmUD+bcu
TLSH
T1E94533CB8CE699EEC573337938F308AAC9775C3E1B36438D84F994307A90B88559169C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4060	mspaint.exe
4060	mspaint.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	firefox.exe
Token: SeDebugPrivilege	4064	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4060	mspaint.exe
4060	mspaint.exe
4060	mspaint.exe
4060	mspaint.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4064	2360	firefox.exe	99
PID 2360 wrote to memory of 4064	2360	firefox.exe	99
PID 4064 wrote to memory of 2108	4064	firefox.exe	101
PID 4064 wrote to memory of 2108	4064	firefox.exe	101
PID 4064 wrote to memory of 2108	4064	firefox.exe	101
PID 4064 wrote to memory of 1044	4064	firefox.exe	103
PID 4064 wrote to memory of 1044	4064	firefox.exe	103
PID 4064 wrote to memory of 1044	4064	firefox.exe	103
PID 4064 wrote to memory of 1044	4064	firefox.exe	103
PID 4064 wrote to memory of 3924	4064	firefox.exe	104
PID 4064 wrote to memory of 3924	4064	firefox.exe	104
PID 4064 wrote to memory of 3924	4064	firefox.exe	104
PID 4064 wrote to memory of 3924	4064	firefox.exe	104
PID 4064 wrote to memory of 3300	4064	firefox.exe	105
PID 4064 wrote to memory of 3300	4064	firefox.exe	105
PID 4064 wrote to memory of 3300	4064	firefox.exe	105
PID 4064 wrote to memory of 2220	4064	firefox.exe	106
PID 4064 wrote to memory of 2220	4064	firefox.exe	106
PID 4064 wrote to memory of 2220	4064	firefox.exe	106
PID 4064 wrote to memory of 2220	4064	firefox.exe	106
PID 4064 wrote to memory of 5932	4064	firefox.exe	107
PID 4064 wrote to memory of 5932	4064	firefox.exe	107
PID 4064 wrote to memory of 5932	4064	firefox.exe	107
PID 4064 wrote to memory of 5932	4064	firefox.exe	107
PID 4064 wrote to memory of 5956	4064	firefox.exe	108
PID 4064 wrote to memory of 5956	4064	firefox.exe	108
PID 4064 wrote to memory of 5956	4064	firefox.exe	108
PID 4064 wrote to memory of 5956	4064	firefox.exe	108
PID 4064 wrote to memory of 5968	4064	firefox.exe	109
PID 4064 wrote to memory of 5968	4064	firefox.exe	109
PID 4064 wrote to memory of 5968	4064	firefox.exe	109
PID 4064 wrote to memory of 5968	4064	firefox.exe	109
PID 4064 wrote to memory of 6012	4064	firefox.exe	110
PID 4064 wrote to memory of 6012	4064	firefox.exe	110
PID 4064 wrote to memory of 6012	4064	firefox.exe	110
PID 4064 wrote to memory of 6012	4064	firefox.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\ChatGPT Image Aug 22, 2026, 03_51_27 PM.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4784

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {7a115829-5441-4297-a8bc-776acd7f5e32} -parentPid 4064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4064" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {65011725-f2b4-43ac-8d20-5433a3d81373} -parentPid 4064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 27276 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3868 -initialChannelId {65181319-e387-4319-82fc-3286c31a57c5} -parentPid 4064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27276 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4136 -initialChannelId {66c2b1a5-1930-4650-8188-7e1abb83e36a} -parentPid 4064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4064" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4344 -prefsLen 34775 -prefMapHandle 4348 -prefMapSize 270279 -jsInitHandle 4352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4332 -initialChannelId {e6673462-070e-4fd0-b9ff-cb6479753e76} -parentPid 4064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 35012 -prefMapHandle 4920 -prefMapSize 270279 -ipcHandle 4296 -initialChannelId {33b16a1b-7d32-4fd4-8d9d-78f3d2a0a988} -parentPid 4064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32900 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {afb58f29-73f7-40c8-b5b8-8c6a276c1b4f} -parentPid 4064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32900 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5188 -initialChannelId {49d5bda6-a0db-451e-8e4e-1e560d3462e9} -parentPid 4064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5456 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5136 -initialChannelId {fa63b0ac-f35e-4b3d-8ab6-ad1765bb50ca} -parentPid 4064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 50378eb5285339be179db2525f2f427a5845d61eebdf5349995933b00a0d0a7e
MD5 9bd5cb54983bbe5fed1c4338d46ed268
SHA1 7a2a03914b14dc817dcf2a881bc0091d2981c014
SHA512 068e3c0fcff6507926c9e2b376d73d638b8bf68123211d06bbe850beb3ff935c6f56d7d5da48c3fd91f039204941fa1d0ee534abcaaf4fd43da2f28225bf8b28
SSDEEP 384:HXkRyiO024YuDL84KKDL849B7SOEAd9KVRaAcP+AWRMAZ:3mZYuDL8lKDL8CB7S/AmVAf+hRMc
TLSH
T129727E7D4F403CAC15A7C0E8C5F992A94D18B7A7DFE680AD21183D0DCA9896DB1F508F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 62c8aa59cf78defbb2a84726cd28ad813306c8ae3499a97efb3c7e7b81c6ba0a
MD5 d58e98d201f0df467bf8e4997bed30fe
SHA1 9267adefcaa2d5e344e0a31b5c0b1788c140a5a8
SHA512 478496f03877151334dbe15b18e45f95a34dcfac0f165a5ae4501a1ca1cd60be9e3b602f05cf6607ab3582cd9bf28e52b34f68a23223ef1d12820ffd29a2d983
TLSH
T1E961B758F229863FE445413ACC821B452F347442A8AF7F2A35AC604D1E5B2CD368D07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d0c915e6533606081ea70f7bd553192445e145df7c8a5b122382e8559eba63c6
MD5 769fbf92020cbd225319343a98b89daf
SHA1 c31a37d13ef24b50456ce672f1e9282e58f8e19d
SHA512 9dab13d0625aac956c5e7a9adbd506593760462d303267dc95c3b2663f5fbb562e4587e20513ecc110c76682af7449d647cd56ca22a991aaf473b445391f23e7
SSDEEP 192:jOv5zboPAZmlyjQM11d66JozGzgCl6mc0dz:sbo4Zmlyjdd66JozGzgC1jd
TLSH
T1C5E11DA8EA28863FC409127BCCA21F450F35399AA84E3F1931DD611D2C5B6DE369E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 092d056ec33e8d93e0880f12250cf56c395e57d9c64585e049efe13aaac1df33
MD5 707496ed7f04e135307ad8e59badb354
SHA1 5b557a937f45af81d3e244dfb42768e3a4a0a9af
SHA512 107eb82976bfb1609e50f48fd7c3eac70f815195af34cdda56ff62a1760fb39aef74e312ba0eca44d0e6eaf0ce172d71cda4e9ff025aca5c5de84550c8de262e
SSDEEP 384:bcCitrMfOClJCGGcmhuG5t0K+vOHzbYb2amd66JozGzgC1jIbozmlyjj:bc7GJCGGcmhu6CK+vOHzbYbxnEang
TLSH
T183D2FE44FB2A953FD41552BBDCA50B002F79B88A581A2F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6b0cb01bbe925de048d0b87c5127527b4e59061049c58a41a330ca5cd8ffcf09
MD5 ae9e235446f66f32561f4c9b86e1bd48
SHA1 23ceef5bc54b95b9564c9e64dd694f4a1d35cbf2
SHA512 4f75844c3898e1a7de2d025df7b441638e0750a4b2e959f476770030778b67609e9867ff78ab16eb07b5841c901efa559b08b0724cec34edbf4268d6afa6423d
TLSH
T15F21379C3AF84D6A6C86F29C78810A8E53918E0784871D474E02FFCDCE81BD9326E439
MD5 SHA1 SHA512 TLSH

Submit Download

637173c9-16f2-44ac-b132-3207e4958749

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\637173c9-16f2-44ac-b132-3207e4958749
Size 235B
SHA256 98d6358ee80d29645a0082f965557efa2c53d7bcfbb9ea6c8e0785d857015f59
MD5 fcc21fc73dbbf36507d9d002706972b6
SHA1 b20d4ce6a42addfe4f4fc2867636e9e1af5853d3
SHA512 e3aea28c81972a83cf4a51335210338f60f5eeb30034728fec392b979567899e9d163767f7add8dce74b403e68b55dc8b979b4eed56c41a5441d02ab6ccd8fa9
TLSH
T1FCD0978218C8B39D08080F07F0A039C230944C3310609810D6618234EDBCBC742D280A
MD5 SHA1 SHA512 TLSH

Submit Download

74001e28-331b-4816-8d00-e0d2bb632870

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\74001e28-331b-4816-8d00-e0d2bb632870
Size 2KB
SHA256 a9eb0ed8b2c0fa0166270a967c09dd6b516f0e72d8d792c8fefc7138b8c850ae
MD5 5b2aefcf978ba67ea176960a16d1ff22
SHA1 dbaf8920d6beecd2fd8d43f6f31ea440998e0251
SHA512 b802a4c7dd1629511c7d102f87ddd99488beba2094ed55bed6eb9eedbeb19d7ff232dd6290fdeefdeb3c8b9718062d139232808a03d8df7f7304adea9af43e91
TLSH
T12341F05C76785C775DAAF5DCD142238E53B48A4310C218432EA2EE0C8C967AD336E13A
MD5 SHA1 SHA512 TLSH

Submit Download

b985c237-01f7-4582-b299-d354d2c51640

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\b985c237-01f7-4582-b299-d354d2c51640
Size 883B
SHA256 d78ab9d66b7db7dbe14c9c69c785dc5d7fa8c2aefadf1eb4f07353bea3d9b475
MD5 1b986be92a40015a596d49a3cfeb708b
SHA1 8f9435209927f5f66bb323d9b8a5d1d4a8f36cbc
SHA512 117cc8d630d9201f5e200ed65d8f46819946fcd0d2905ac22017653c502cadb9fc1d7b32de72b9f32485144536507dee83a4e1cea3f52e721ab5626e005f5563
TLSH
T16311E781D674B5B3CD6CD15FC55537458BE4792380C655083EE156240D7E91E536F20B
MD5 SHA1 SHA512 TLSH

Submit Download

bedc0a7a-67dd-4a1b-b9ef-562d2cad3374

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\bedc0a7a-67dd-4a1b-b9ef-562d2cad3374
Size 235B
SHA256 f4a90dee91241396ebba763d6a6dc712dd10d9bc6469d7841aba4f4c5ba8c9f7
MD5 ac218b6d07d3093155fc1ea9ea75fd76
SHA1 939bc058d3ac5c57040eee148a37da48de7e6be1
SHA512 a14bd7b1a8c7b9f7cdce0d0d935035acf074ec072e8f106cc7b61ca29253a8f2b9ba8b7e031d2163edef525ec92b86c531d490306f274ad0fdabba2373d9e5da
TLSH
T1D4D0978014A8631D08241F03F0E0A8C230588C332875B8A0C6E284B899F8AC88222C86
MD5 SHA1 SHA512 TLSH

Submit Download

c70a8960-b58e-493f-84df-96090b16c718

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\c70a8960-b58e-493f-84df-96090b16c718
Size 886B
SHA256 5372c3447e96261c3788f8df64f5ce7ce9052ac0a812f224a000415536de9aa3
MD5 f229d21dd40c4c25be12720de9331ea1
SHA1 de03731be5c505c688bb5d413af87a4718eed1a4
SHA512 989aa2bb4a26edda1ebf12138ecbcdc5fb0f8065ac7bf30e16a9f43338a9d94c88e2ef3cea39d0964d45a9d566580d08517886142338f91ec7808caeb780d29c
TLSH
T14A11239197B474B28CB8E29F94D5370687F0B62390C7690C7E9057180CBA51E636720B
MD5 SHA1 SHA512 TLSH

Submit Download

f0f9729d-0a12-4db9-9e74-f05edd45e13f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\f0f9729d-0a12-4db9-9e74-f05edd45e13f
Size 16KB
SHA256 68fd5b464c6fbac0ea9b2f763e2ee3c25e7aabb376976657544b23566e1e1714
MD5 87635283b1742c126d0cb04c6772618b
SHA1 1864bde396559764f37ec6f4b488d25aa2e4e9a6
SHA512 9c6f08093c4379fffaf6dfc144bed2d6362463cd06f3728a8e0fec37e3898f679ccd739acd9bc88ae09cf0fc47519ec990b9c848e04ad9ee61dda155786c4a0d
SSDEEP 192:wNy3Q0G4tMjMU5X+QJq2XxEk/QzEzD6f7qAL+2g1WBjiuc2ZzxDfSXgt4oiJjqK7:wNy3sVzuf7t+2Ntc2ZlDfSX92vQ
TLSH
T1A572C856686045BA8651E368D4FC7FC3E6F528CF4C419FCACBE4BE0869DA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\extensions.json
Size 16KB
SHA256 b34dc57512bb9350999de14659638c981d373d09a5f95ba9de5e7cfff30d467e
MD5 8f565de166f43df7b0d9375607a2db85
SHA1 3df15d2df1754770964dce4aae676c73033ef6f8
SHA512 4cfe8893399be57546cac92ebfa1b84a70b7c8e064c81292f7e136390bef507e85750c031d2ff8687c73e9f34ef5a39ff44cbd7f540edfc224965bcb03d03a1a
SSDEEP 384:okI4v2UmldvV8dhWk94zH96oLL4HkL4PRL4HgL4HuL4HKq4hrZ:/I4+RfmXt4Z644e4R4i404l4xZ
TLSH
T1B872521545049EB8294FA79BAA367E02C37D473B60845C78F4DD8FC802FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 8KB
SHA256 12696129ba84ed0c0159271918b2ca79b77db406ee4574df94582231de2596c8
MD5 fee754108a8481f756f2f212d07a282b
SHA1 551e2282e682e6d0223f3dc3d293b58d0bd2d558
SHA512 0b6ba789690080d7eca38a648e8512bdf8f1803a49de5255eeed5948d1e4919ad46d41f2158be40d600ebe1741dee1ce58fbc096e77943958aca2c1c4f803606
SSDEEP 96:xHBFTUxVqGq5f+LVG4ObzSGAKSSlWdv9jJnqWRhr8vfLRLuBw88HTg2h8L4cn+wa:HHR5f+LVG4UAKSSMRELRLuBw88lbB
TLSH
T1A0020D785404CB7F64B676BCAC2449705AA2023BB7BF6CD710B9A4C5450CF3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 12KB
SHA256 ff1e6b392f5a48a6147d1369855128539b3cbc82fe5093428ff3fd44b717f942
MD5 9ce40b3945fc87b78993f5b8d33e6af3
SHA1 1dcaaefd73fb68e97a7aa4db972201719fc071cd
SHA512 1e9709be42d4c0840ece7d465c6a4443f6eaa1ce45c54f7fc218e8a544eefc68c312f7fc495004c6fffe08ccfaf54b57208b65249e961cdf85d24ac3b730c275
SSDEEP 192:fHR5f+LVG4UAKSSnLRBLPLZOBw8OqeBkV7hB:vjR4w/Un
TLSH
T1DD42CA3864448F7F24B2327DAC2549B019A2422BB6BFBCD705F9A4C2445DF2541F6AFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 6KB
SHA256 2c02a2780e5e3e112d7d80e7c640fdc7ba88d8e7a7fb2f09113e8344a32571e9
MD5 1e8e75374f36a0fc3a5dd7315ec1f9d0
SHA1 721cee3be8871e07e189d83f3915ddf06cdda865
SHA512 4ff3c59c946ffa85ae0a3f79486cc6f0fa1a2fe357f8a0e64fe0ac204fb800d6400d59db0e74aa2a2abf2cd1abe4204e7421389b931d4c688ec4083bd75d3ae4
SSDEEP 96:xHBUTUxVqGq5fgG41zSGAKSSlWdv9jJnqH/8MBw88n8L4cn+wGLGS:HyR5fgG4bAKSSNdBw88hB
TLSH
T155E10F7894088B7F64B676ACAC688C715AB2413BB7BF68C710B654C4051CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 4e5d40167d0300cecb6a54b8d916f36eee5fbd585c7920f986ff1eafd232f209
MD5 80ae3e63eb3a751336a78898dd0ed30a
SHA1 73d6014385a0387200334d810fdd1c8309b339c0
SHA512 a831a2168b5811925aad1a8435922edbc20b1f3cf70080303f50009c3c3971d891890a5aaada8c477f7d6abc0a4bd2ec6bcbc5e5965e5474ed59e4fb7e5a9a51
SSDEEP 96:xHBUTUxVqGq5fg9o1zSs9kSSlWdv9j3nqH/8MBw88n8L4cn+wGC:HyR5fg9o5kSS/dBw88hC
TLSH
T184E130789508CB7F74B676ACAC688C715AB2013BB7BF28C710BA5484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 46e0c7736e8674c4858986c5db0457827d132b24a2f0ea71e12b3cae7d61a6cb
MD5 316707935a363fc782c6c058de67e853
SHA1 d26d7269a547dc08f9717062d698626dd1af8c37
SHA512 5498edf35df12125214877fc15768c93314b681174e8de6ca38987455f00e75819902b1d4f7145fe1574ddf4d30d56ff55be3f56c21ecd61ce64251e7147299b
TLSH
T19621B7C6AF2E2DE66294C14DD4C91BD4E7A4E021815CB8E0AC9A550126C460932DE60A
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 f011f19e419b0a717c1f39782392df1092cae410ae4da67541f604e057fffc52
MD5 f4dfe87ad427e1d74a187f8a9c9e746b
SHA1 74488475ed4210682d77ba3827165d6e5d95ef13
SHA512 39e56f9efd27a9fd6680aa2b4c88f708f3d8092db1b77363bc317b036dd230564e0b505b6773baa251308da57140833b6595ade441fc0517d829ec47e2915d14
SSDEEP 49152:XiwbkMngvZR+Uh3YdAn5uQ9hJTHkda1NPUTD:ywbkMngRp5uQ9h1HkdQ4
TLSH
T1961639F824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.6MB
SHA256 f7aa791f39cc653d2894cb1bc5603c5a2386b6e0a9f5001b7ab9417bcc47d5f0
MD5 d174ab139b711ae036ac7805be906882
SHA1 de0084c813b93ed0a7e788f9698452619703db34
SHA512 6991138a7a7d31e849522980f93dff7edc073c22ff9eeeefd5407922162c4cdd60e1d450e10319e3dbe6bf9d52d2457530f95dded942cf753a580d13f5d8a53f
SSDEEP 49152:P9yWkzn/X1te7y2D3/YVzF/I4lkF2QkW90LPM8QiLYz4ZZwtdRjq7ji1Q9YSIFhg:qih0t7s1sPxA1F9
TLSH
T1CD665CE420E29252F34144B3719A53EB11EFC00C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download