Resubmissions

25/08/2026, 02:53

260825-ddhydassdw6

25/08/2026, 02:37

260825-c359jawdka6

25/08/2026, 02:21

260825-cs56sa1zh16

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    895s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/08/2026, 02:53

General

  • Target
    http://4bpq4qnk4lnqa5irjbtbsybvcvbixa2cxjnmdyure6w3xnpswfhllkad.onion
  • Sample260825-ddhydassdw

Malware Config

Signatures

  • Drops desktop.ini file(s) 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Checks processor information in registry 2 TTPs 30 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://4bpq4qnk4lnqa5irjbtbsybvcvbixa2cxjnmdyure6w3xnpswfhllkad.onion"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4552
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://4bpq4qnk4lnqa5irjbtbsybvcvbixa2cxjnmdyure6w3xnpswfhllkad.onion
      2⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {79e3a8bb-3217-4749-8b6b-18aab2a53cf8} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:644
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2472 -prefsLen 27135 -prefMapHandle 2476 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {b3dbb11c-cfed-4a10-80ab-d6fee2ac4f2f} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:3804
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25164 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {032eb956-c50d-4c1b-a8aa-955e41d8c365} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:1428
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27276 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {f0e15aa4-6cf9-4994-9dc9-98311491147f} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:5116
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4364 -prefsLen 34775 -prefMapHandle 4368 -prefMapSize 270279 -jsInitHandle 4372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2880 -initialChannelId {aca7c232-3e14-4c68-a041-a2d2f3cff333} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:1860
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4716 -prefsLen 35012 -prefMapHandle 4712 -prefMapSize 270279 -ipcHandle 4724 -initialChannelId {b82c3674-6e84-47bc-b209-7afc01aa8fdf} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:4644
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4896 -prefsLen 32900 -prefMapHandle 4992 -prefMapSize 270279 -jsInitHandle 4996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2660 -initialChannelId {3d70f77b-ef9a-4cae-b0be-ec22d59ef0e6} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:2440
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5012 -prefsLen 32900 -prefMapHandle 5016 -prefMapSize 270279 -jsInitHandle 5020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2708 -initialChannelId {a9bddb0f-f41a-4813-88f8-a1f71ce89b12} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:2644
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4856 -prefsLen 32952 -prefMapHandle 2656 -prefMapSize 270279 -jsInitHandle 4332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5284 -initialChannelId {e0f758c3-920a-4461-939f-f390582c7cea} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:4604
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5116 -prefsLen 36931 -prefMapHandle 5100 -prefMapSize 270279 -jsInitHandle 5104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6040 -initialChannelId {dccda4ec-b1c5-4a43-8c85-ae8061945d73} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
              3⤵
              • Checks processor information in registry
              PID:3412
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6140 -prefsLen 36931 -prefMapHandle 6108 -prefMapSize 270279 -jsInitHandle 3716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3396 -initialChannelId {f0830daa-e803-473f-9ff3-c558f8ce6b91} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
              3⤵
              • Checks processor information in registry
              PID:5100
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6316 -prefsLen 36931 -prefMapHandle 6288 -prefMapSize 270279 -jsInitHandle 6304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6340 -initialChannelId {01051e81-db30-42aa-a33d-b291ca5278cb} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
              3⤵
              • Checks processor information in registry
              PID:4500
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5068 -prefsLen 36931 -prefMapHandle 5052 -prefMapSize 270279 -jsInitHandle 5076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3136 -initialChannelId {499ef10e-f6f5-43ac-bd78-2c37cc42ea5b} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
              3⤵
              • Checks processor information in registry
              PID:4324
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5296 -prefsLen 36931 -prefMapHandle 5252 -prefMapSize 270279 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4844 -initialChannelId {18380ee0-9b78-4f08-9766-afc7bd408e4f} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
              3⤵
              • Checks processor information in registry
              PID:3084
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4896 -prefsLen 36931 -prefMapHandle 5228 -prefMapSize 270279 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6120 -initialChannelId {25a3c4f8-9ecb-4945-bf8c-f3d6bd703136} -parentPid 4664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
              3⤵
              • Checks processor information in registry
              PID:1040

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              activity-stream.discovery_stream.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\activity-stream.discovery_stream.json
              • Size 76KB
              • SHA256 f6a0d46588e36f96396e316583d2d2e494faf2d3215060055b5c6cfa79a3e716
              • MD5 SHA1 SHA512 SSDEEP TLSH

              86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
              • Size 10KB
              • SHA256 fb4ca52673596b6e404624dd48d03fa72dac8eb6bcc69e9f8f1642efb41ad5d3
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_arts_and_entertainment.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
              • Size 67KB
              • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_autos_and_vehicles.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
              • Size 44KB
              • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_beauty_and_fitness.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
              • Size 33KB
              • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_blogging_resources_and_services.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
              • Size 33KB
              • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_books_and_literature.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
              • Size 67KB
              • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_business_and_industrial.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
              • Size 45KB
              • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_computers_and_electronics.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
              • Size 45KB
              • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_finance.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_finance.json
              • Size 33KB
              • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_food_and_drink.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
              • Size 67KB
              • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_games.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_games.json
              • Size 44KB
              • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_health.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_health.json
              • Size 33KB
              • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_hobbies_and_leisure.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
              • Size 67KB
              • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_home_and_garden.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
              • Size 33KB
              • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_internet_and_telecom.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
              • Size 67KB
              • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_jobs_and_education.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
              • Size 33KB
              • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_law_and_government.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
              • Size 68KB
              • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_online_communities.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_online_communities.json
              • Size 67KB
              • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_people_and_society.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
              • Size 45KB
              • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_pets_and_animals.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
              • Size 44KB
              • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_real_estate.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_real_estate.json
              • Size 67KB
              • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_reference.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_reference.json
              • Size 56KB
              • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_science.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_science.json
              • Size 56KB
              • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_shopping.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_shopping.json
              • Size 67KB
              • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_sports.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_sports.json
              • Size 56KB
              • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_travel.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\nb_model_build_attachment_travel.json
              • Size 67KB
              • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recipe_attachment.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\personality-provider\recipe_attachment.json
              • Size 1KB
              • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
              • MD5 SHA1 SHA512 TLSH

              remote-settings-startup-bundle-

              • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
              • Size 567KB
              • SHA256 eb64cdb71aaacbe5bbcd00607dc4645b4a5ff445d8f716aad030e4905c712d1d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              tmpaddon

              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 11KB
              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
              • MD5 SHA1 SHA512 SSDEEP TLSH

              tmpaddon

              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 502KB
              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
              • MD5 SHA1 SHA512 SSDEEP TLSH

              6824f4a902c78fbd.customDestinations-ms

              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
              • Size 22KB
              • SHA256 32a8a54f9dc75fd97892e3e61ef0e9bf7e7ae767f0a873d2040432b4b53d3959
              • MD5 SHA1 SHA512 SSDEEP TLSH

              6824f4a902c78fbd.customDestinations-ms

              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
              • Size 22KB
              • SHA256 5a1b368d5dcd5579c12a970a6194aeeaa3ad5f375a96342de5c2081054bc6faa
              • MD5 SHA1 SHA512 SSDEEP TLSH

              8MTGUIS8C4OY3B4CGNJJ.temp

              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8MTGUIS8C4OY3B4CGNJJ.temp
              • Size 22KB
              • SHA256 ffa5f78bf065d61539d152e6bafc45bef0265d45eaecc73a05dc325e9be27706
              • MD5 SHA1 SHA512 SSDEEP TLSH

              addonStartup.json.lz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\addonStartup.json.lz4
              • Size 4KB
              • SHA256 b6db3f8640a3d751287de1b0e77a0f5f015895f7addde4f86fdef10ff8da0d0f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              bookmarks-2026-08-25_10_qLw4K9m45maT_D78J5qu0rBjNZQ8TqUxYmN2faPaYg4=.jsonlz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\bookmarkbackups\bookmarks-2026-08-25_10_qLw4K9m45maT_D78J5qu0rBjNZQ8TqUxYmN2faPaYg4=.jsonlz4
              • Size 858B
              • SHA256 82975b0983175ae56d26652150863aa89026e1e302c5e6f5d4a8e9e6d54276d8
              • MD5 SHA1 SHA512 TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
              • Size 49KB
              • SHA256 6bd8fef60fc3f711864812b9bac715633ad0a486a2e37a8ca0ca7fef6289ace7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
              • Size 56KB
              • SHA256 eb5870f08182d129f36a528997f5fe790b3f020f5c735ec088d85eeba1a0b2e8
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
              • Size 56KB
              • SHA256 01e71b7f233e601ba2a5823e17c6a06b72a86593236b3f1c82b91eb4477a406c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
              • Size 56KB
              • SHA256 dda632fa3916a4bc6ed4cc25e48c8219ceffad6052917e5c52bb6d924bcaef55
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
              • Size 64KB
              • SHA256 826014364edf5cccfd2f0914966f18527cce3c66116440acc76d93121ac2e061
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
              • Size 28KB
              • SHA256 68a5af91fa1a5b541ff4232ccaee27cf6deef8b94336fe7a43ddfe3ab34592e0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
              • Size 28KB
              • SHA256 aec24edf8b8d837adc0f1f90b6d7e347a8b72aaa32dcf909f54804e543740f74
              • MD5 SHA1 SHA512 SSDEEP TLSH

              events

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
              • Size 1KB
              • SHA256 062310fc1b92e2fef11e0274c2d79050397122dae3dcc9bf43dc3b366d685f96
              • MD5 SHA1 SHA512 TLSH

              pageload

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\pageload
              • Size 5KB
              • SHA256 84395ede44bf7ffe115e68a2f6d3f48ef66d68c07aeab8c40ab97907ba912cb4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              pageload

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\pageload
              • Size 5KB
              • SHA256 15cbb3bd46d5bf0cdab63329b6cb027145b907f38dec4ecddfb5341ca478f32f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              pageload

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\pageload
              • Size 5KB
              • SHA256 6267a134946390ca8601926442d2f1eff6bd6a6d6fc96c5ac30805681ac2c7db
              • MD5 SHA1 SHA512 SSDEEP TLSH

              pageload

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\pageload
              • Size 5KB
              • SHA256 7e7a5a57d57ec7eb9bcb8a433f88659378d71c666da7d4ef6f846835c8406e94
              • MD5 SHA1 SHA512 SSDEEP TLSH

              10bd4697-671e-44ad-a9fd-77690dba2224

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\10bd4697-671e-44ad-a9fd-77690dba2224
              • Size 2KB
              • SHA256 2d650e9fdf2934cf4cb28c9c6e8fd74a901841de3fc3b388fa0eb4d4f11f6e5e
              • MD5 SHA1 SHA512 TLSH

              19825f27-1a3e-4bb1-885f-f237751c3af8

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\19825f27-1a3e-4bb1-885f-f237751c3af8
              • Size 235B
              • SHA256 a3437b5728f029ce9e38763a28e9a08368439e47ebf82eaf8dab2131da777ba4
              • MD5 SHA1 SHA512 TLSH

              1f8c1dbd-9690-4caa-b224-a585f44174db

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\1f8c1dbd-9690-4caa-b224-a585f44174db
              • Size 8KB
              • SHA256 48104ed28274751a7bd14d549302aa7398cc3d0e8d9242bbe8e684c8c5d776f7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              2bf7b7fb-2bcf-4cf7-9ae3-e7b6bcf9e30a

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\2bf7b7fb-2bcf-4cf7-9ae3-e7b6bcf9e30a
              • Size 235B
              • SHA256 5d593b2969b4ad81f603a19fb601a0398bc262f137684880578a27cb8a40ae1d
              • MD5 SHA1 SHA512 TLSH

              2d3278e1-0340-43ab-abf1-0b70c0f9c31b

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\2d3278e1-0340-43ab-abf1-0b70c0f9c31b
              • Size 8KB
              • SHA256 c33a063a36f0a982e7a5fcb0e345e8569a105281cebd139550b533808f524628
              • MD5 SHA1 SHA512 SSDEEP TLSH

              40170c62-7cab-41a9-a4b4-448acbdb34aa

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\40170c62-7cab-41a9-a4b4-448acbdb34aa
              • Size 282B
              • SHA256 de993da955a6ba03b08e8e939470905a82b9b0e7606c1d5db04b277d5c736251
              • MD5 SHA1 SHA512 TLSH

              42209ce0-3805-4870-8b00-1cfc0f6fc588

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\42209ce0-3805-4870-8b00-1cfc0f6fc588
              • Size 8KB
              • SHA256 bed7f1b6c43cc091c994668a07d319282908d961b1a9f2f812f6b0098ee95630
              • MD5 SHA1 SHA512 SSDEEP TLSH

              8c0a08f8-196c-4974-a6c8-a804c910daac

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\8c0a08f8-196c-4974-a6c8-a804c910daac
              • Size 871B
              • SHA256 c9e0d4f656e12610e3860083297066d42191bd41337a810649931ef8a00e302c
              • MD5 SHA1 SHA512 TLSH

              c10a8e0e-6b37-4d2f-8495-8c41050f53d1

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\c10a8e0e-6b37-4d2f-8495-8c41050f53d1
              • Size 4KB
              • SHA256 3f0dbb158d260aa233252e98769732d20dd7b9b4135d3d14a692088dae1924c4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              cc741501-5113-46ba-8e6d-634bff9555b3

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\cc741501-5113-46ba-8e6d-634bff9555b3
              • Size 42KB
              • SHA256 4b39a187c8b2e7036c5d470696d56b8741d5e2da86b286c4495477dba783deed
              • MD5 SHA1 SHA512 SSDEEP TLSH

              da439887-68ae-4a16-829b-1f2db1d8a37b

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\da439887-68ae-4a16-829b-1f2db1d8a37b
              • Size 1KB
              • SHA256 55039c54c9a6fd0878cb46d0c4bf4d33738ffcff329928ccc0e5415ea2d955f2
              • MD5 SHA1 SHA512 TLSH

              e4a15670-8694-4ced-92c3-c165d92ae6b8

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\e4a15670-8694-4ced-92c3-c165d92ae6b8
              • Size 886B
              • SHA256 bbeabb9071709fd5ac0de6cb92b301f7b81a9f8e4c4203be154b425e5df1b87e
              • MD5 SHA1 SHA512 TLSH

              extension-preferences.json

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extension-preferences.json
              • Size 942B
              • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
              • MD5 SHA1 SHA512 TLSH

              extensions.json

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extensions.json
              • Size 16KB
              • SHA256 9744c009cce370968adb05185feb84ec056b7b4acb471a8397b8ce8813ad6609
              • MD5 SHA1 SHA512 SSDEEP TLSH

              gmpopenh264.dll

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
              • Size 1.1MB
              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
              • MD5 SHA1 SHA512 SSDEEP TLSH

              gmpopenh264.info

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
              • Size 116B
              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
              • Size 1002B
              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
              • MD5 SHA1 SHA512 TLSH

              widevinecdm.dll

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
              • Size 21.6MB
              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
              • Size 12KB
              • SHA256 1088d88a0dbc12a3b2c40b4e6f977b353e05d9f26b5c6e9b0957cef8258ed5a0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
              • Size 8KB
              • SHA256 f808d6e29226af298a62a098668fdbac855912cdc6e768a41d8c2101301f7f38
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
              • Size 6KB
              • SHA256 8f9760e60c65e2ac09032182f0486bd00657b966d4aa387ba28766a045b65c0f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
              • Size 12KB
              • SHA256 5decce01278ed2514b45b20f3fe5aef5e46b8add968a5f8cee6557569f1288ee
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
              • Size 6KB
              • SHA256 802c70338bc99f0874fa1273de8d79badb2d3332b5f0a33d2b89670b64829850
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
              • Size 7KB
              • SHA256 112470f3fe872d178d2c880aa3f96660a4dded5b2a4bdf229931f182c87bf1ee
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
              • Size 8KB
              • SHA256 272c6c4fc3347941d6b2ac70234c2a1d05debd2b91a9b7cf6113003a795e6eb0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
              • Size 3KB
              • SHA256 55180ee7a570183cef0552f35279c7c2214319a20aefba2082af4d45ab0bac02
              • MD5 SHA1 SHA512 TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
              • Size 1KB
              • SHA256 ddcb641ffc3380ef7e45edca4c3aa069647102d4d28e7dbc22e26b03bc99668f
              • MD5 SHA1 SHA512 TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
              • Size 1KB
              • SHA256 d8ddae952dfcf7e6297fb2b5d56464a22a93b36ca17fe982d417fcab9a31f028
              • MD5 SHA1 SHA512 TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
              • Size 2KB
              • SHA256 84fc61d7c238d109b3190836d79b06aba52d2853e58d39f409a8ee5ab504df8f
              • MD5 SHA1 SHA512 TLSH

              recovery.jsonlz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.jsonlz4
              • Size 3KB
              • SHA256 11833e5b31bd63d1802e7b884f257fffc5a943fb1a5856b434e31195f9a7e315
              • MD5 SHA1 SHA512 TLSH