Analysis
- user interaction
yes - max time kernel
270s - max time network
269s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/08/2026, 06:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Assembly-CSharp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Assembly-CSharp.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Assembly-CSharp.dll
- Size 5.4MB
- Sample260828-gtwqystdpb
- SHA256 df95fb0019ab4cd8be495373c0e06c7be6ae2b1ff7eb2186b128e2a85c822c61
- MD5 8c69cab66d7cd7a8102c361900cc0051
- SHA1 58c13320bee2b87e80d51ffa8bcce0af1e72f639
- SHA512 72140382f9ffb8b6c3bb54b722d884e04541adb9464bbed7eb421c8e9a0531302d1458758913dd182251a750f3388b67daffe98689299d3a76b90081245316ae
- SSDEEP 98304:r+5KAAT+FNe3IkcEvhya+ovu+r2JaLN+g:r+5KAAT+FNe3IkcEZya+ovuI2JeNN
- TLSH T184465C17E7E8DF62C86F07BAA478154147F2DB8E2342E6960A81F87A38D37516F06317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 799 4844 firefox.exe - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe - Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe - Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage firefox.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children firefox.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f" firefox.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f firefox.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096 firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox" firefox.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children firefox.exe - NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\Downloads\Assembly-CSharp.dll:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\Assembly-CSharp(1).dll:Zone.Identifier firefox.exe - Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 5816 OpenWith.exe 3464 OpenWith.exe 1384 OpenWith.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4844 firefox.exe Token: SeDebugPrivilege 4844 firefox.exe Token: SeDebugPrivilege 4844 firefox.exe Token: SeDebugPrivilege 4844 firefox.exe Token: SeDebugPrivilege 4844 firefox.exe Token: SeDebugPrivilege 4844 firefox.exe Token: SeDebugPrivilege 4844 firefox.exe Token: SeDebugPrivilege 4844 firefox.exe - Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 5816 OpenWith.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 4844 firefox.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe 3464 OpenWith.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4072 wrote to memory of 4844 4072 firefox.exe 91 PID 4072 wrote to memory of 4844 4072 firefox.exe 91 PID 4844 wrote to memory of 3928 4844 firefox.exe 92 PID 4844 wrote to memory of 3928 4844 firefox.exe 92 PID 4844 wrote to memory of 3928 4844 firefox.exe 92 PID 4844 wrote to memory of 4424 4844 firefox.exe 93 PID 4844 wrote to memory of 4424 4844 firefox.exe 93 PID 4844 wrote to memory of 4424 4844 firefox.exe 93 PID 4844 wrote to memory of 4424 4844 firefox.exe 93 PID 4844 wrote to memory of 3400 4844 firefox.exe 94 PID 4844 wrote to memory of 3400 4844 firefox.exe 94 PID 4844 wrote to memory of 3400 4844 firefox.exe 94 PID 4844 wrote to memory of 3400 4844 firefox.exe 94 PID 4844 wrote to memory of 4008 4844 firefox.exe 95 PID 4844 wrote to memory of 4008 4844 firefox.exe 95 PID 4844 wrote to memory of 4008 4844 firefox.exe 95 PID 4844 wrote to memory of 3296 4844 firefox.exe 96 PID 4844 wrote to memory of 3296 4844 firefox.exe 96 PID 4844 wrote to memory of 3296 4844 firefox.exe 96 PID 4844 wrote to memory of 3296 4844 firefox.exe 96 PID 4844 wrote to memory of 4592 4844 firefox.exe 97 PID 4844 wrote to memory of 4592 4844 firefox.exe 97 PID 4844 wrote to memory of 4592 4844 firefox.exe 97 PID 4844 wrote to memory of 4592 4844 firefox.exe 97 PID 4844 wrote to memory of 5388 4844 firefox.exe 98 PID 4844 wrote to memory of 5388 4844 firefox.exe 98 PID 4844 wrote to memory of 5388 4844 firefox.exe 98 PID 4844 wrote to memory of 5388 4844 firefox.exe 98 PID 4844 wrote to memory of 5460 4844 firefox.exe 99 PID 4844 wrote to memory of 5460 4844 firefox.exe 99 PID 4844 wrote to memory of 5460 4844 firefox.exe 99 PID 4844 wrote to memory of 5460 4844 firefox.exe 99 PID 4844 wrote to memory of 5552 4844 firefox.exe 100 PID 4844 wrote to memory of 5552 4844 firefox.exe 100 PID 4844 wrote to memory of 5552 4844 firefox.exe 100 PID 4844 wrote to memory of 5552 4844 firefox.exe 100 PID 4844 wrote to memory of 2128 4844 firefox.exe 106 PID 4844 wrote to memory of 2128 4844 firefox.exe 106 PID 4844 wrote to memory of 2128 4844 firefox.exe 106 PID 4844 wrote to memory of 2128 4844 firefox.exe 106 PID 4844 wrote to memory of 4296 4844 firefox.exe 118 PID 4844 wrote to memory of 4296 4844 firefox.exe 118 PID 4844 wrote to memory of 4296 4844 firefox.exe 118 PID 4844 wrote to memory of 4296 4844 firefox.exe 118 PID 4844 wrote to memory of 5852 4844 firefox.exe 119 PID 4844 wrote to memory of 5852 4844 firefox.exe 119 PID 4844 wrote to memory of 5852 4844 firefox.exe 119 PID 4844 wrote to memory of 5852 4844 firefox.exe 119 PID 4844 wrote to memory of 5168 4844 firefox.exe 120 PID 4844 wrote to memory of 5168 4844 firefox.exe 120 PID 4844 wrote to memory of 5168 4844 firefox.exe 120 PID 4844 wrote to memory of 5168 4844 firefox.exe 120 PID 4844 wrote to memory of 3212 4844 firefox.exe 122 PID 4844 wrote to memory of 3212 4844 firefox.exe 122 PID 4844 wrote to memory of 3212 4844 firefox.exe 122 PID 4844 wrote to memory of 3212 4844 firefox.exe 122 PID 4844 wrote to memory of 2856 4844 firefox.exe 123 PID 4844 wrote to memory of 2856 4844 firefox.exe 123 PID 4844 wrote to memory of 2856 4844 firefox.exe 123 PID 4844 wrote to memory of 2856 4844 firefox.exe 123 PID 4844 wrote to memory of 1952 4844 firefox.exe 124 PID 4844 wrote to memory of 1952 4844 firefox.exe 124 PID 4844 wrote to memory of 1952 4844 firefox.exe 124 PID 4844 wrote to memory of 1952 4844 firefox.exe 124 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Assembly-CSharp.dll,#11⤵PID:1732
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {d81bea80-d88b-4187-8dce-a895e61319e4} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:3928
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2460 -prefsLen 27135 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {5633c5d5-e5ff-4e76-874f-3fdd22cf3761} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:4424
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3728 -prefsLen 27325 -prefMapHandle 3732 -prefMapSize 270279 -jsInitHandle 3736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3744 -initialChannelId {f87a2a34-4b3b-4f85-950e-06d64ea35868} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:3400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3888 -prefsLen 27325 -prefMapHandle 3892 -prefMapSize 270279 -ipcHandle 3992 -initialChannelId {08b2f954-05f3-4363-9b33-749ac3186ea5} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:4008
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3736 -prefsLen 34824 -prefMapHandle 776 -prefMapSize 270279 -jsInitHandle 872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 988 -initialChannelId {e2749ed1-88aa-4239-bbf5-1bdc4eb755da} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:3296
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4788 -prefsLen 34931 -prefMapHandle 4792 -prefMapSize 270279 -ipcHandle 4800 -initialChannelId {7bc74b22-7979-4c2c-bd26-8548a227309e} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:4592
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5148 -prefsLen 32952 -prefMapHandle 5152 -prefMapSize 270279 -jsInitHandle 5156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5112 -initialChannelId {ca786539-9611-4eee-b33a-e68eaa99943d} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:5388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32952 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5300 -initialChannelId {e3aad887-c594-47bc-8a18-169d71924b28} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:5460
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5516 -prefsLen 32952 -prefMapHandle 5520 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {307ed5e0-9f8b-474b-b280-5b16e09e6a7a} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:5552
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6216 -prefsLen 33071 -prefMapHandle 6200 -prefMapSize 270279 -jsInitHandle 6204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6192 -initialChannelId {d294c298-2fee-40ed-9b51-b50f6767d0f3} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:2128
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6716 -prefsLen 34355 -prefMapHandle 6720 -prefMapSize 270279 -jsInitHandle 6724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6732 -initialChannelId {e95e29f7-9a1a-43ca-9443-7e4a1f6cd04c} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
PID:4296
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6596 -prefsLen 37323 -prefMapHandle 4148 -prefMapSize 270279 -ipcHandle 6680 -initialChannelId {946ebb6e-b136-49cf-a66e-2af2d065d999} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility3⤵
- Checks processor information in registry
PID:5852
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6964 -prefsLen 36800 -prefMapHandle 2636 -prefMapSize 270279 -jsInitHandle 6656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6652 -initialChannelId {d9f0fa01-2278-4f3c-bea6-45bf4315c9cd} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
PID:5168
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6012 -prefsLen 36887 -prefMapHandle 6036 -prefMapSize 270279 -jsInitHandle 6196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6432 -initialChannelId {b93e582e-108c-427a-95c4-557abd739bf7} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
PID:3212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 36887 -prefMapHandle 6096 -prefMapSize 270279 -jsInitHandle 5968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2840 -initialChannelId {bcb332ec-ae56-41bb-a82d-5c507dbd4818} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
PID:2856
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5860 -prefsLen 36887 -prefMapHandle 5920 -prefMapSize 270279 -jsInitHandle 5940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6824 -initialChannelId {f79f89d6-2f00-4f9d-b492-789b6f97e2b3} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
PID:1952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7104 -prefsLen 36887 -prefMapHandle 7140 -prefMapSize 270279 -jsInitHandle 7008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6044 -initialChannelId {a6eb3b6f-9c5d-44ad-ad44-080ee8c6d515} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
PID:6140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7408 -prefsLen 36887 -prefMapHandle 7412 -prefMapSize 270279 -jsInitHandle 7416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5620 -initialChannelId {3fa005a6-fc03-46cc-8b68-aec62438f84d} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
- Checks processor information in registry
PID:4320
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7560 -prefsLen 36887 -prefMapHandle 7564 -prefMapSize 270279 -jsInitHandle 7568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7528 -initialChannelId {b6f97d3f-b193-4a90-a48e-fc0160b25901} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
- Checks processor information in registry
PID:5472
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7664 -prefsLen 36887 -prefMapHandle 7668 -prefMapSize 270279 -jsInitHandle 7672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7676 -initialChannelId {c7128230-19fc-496e-aac6-468c873973bb} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab3⤵
- Checks processor information in registry
PID:5212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7828 -prefsLen 36887 -prefMapHandle 7824 -prefMapSize 270279 -jsInitHandle 7820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7812 -initialChannelId {ac081c21-ad04-4938-b3de-c7107d8fe73e} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab3⤵
- Checks processor information in registry
PID:5760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7584 -prefsLen 36887 -prefMapHandle 7532 -prefMapSize 270279 -jsInitHandle 8228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7516 -initialChannelId {595588e1-1131-489a-bcfe-2447a7228997} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab3⤵
- Checks processor information in registry
PID:2964
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6540 -prefsLen 40006 -prefMapHandle 7144 -prefMapSize 270279 -ipcHandle 8256 -initialChannelId {b43bbc25-2d2c-48df-8380-59acf8b9e969} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 utility3⤵
- Checks processor information in registry
PID:4584
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8656 -prefsLen 36887 -prefMapHandle 8636 -prefMapSize 270279 -jsInitHandle 8628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8664 -initialChannelId {35c82907-94b5-4ec1-85e9-2cfcb5c7bbff} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab3⤵
- Checks processor information in registry
PID:1720
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7484 -prefsLen 37047 -prefMapHandle 7468 -prefMapSize 270279 -jsInitHandle 7472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7460 -initialChannelId {b3495ecc-1ad6-447f-afd0-d725eef88737} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab3⤵
- Checks processor information in registry
PID:2164
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8764 -prefsLen 37143 -prefMapHandle 6708 -prefMapSize 270279 -jsInitHandle 8136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6564 -initialChannelId {9c17c5df-bf1b-4d06-bf5f-383813528423} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab3⤵
- Checks processor information in registry
PID:6140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7580 -prefsLen 40310 -prefMapHandle 6056 -prefMapSize 270279 -jsInitHandle 6248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7384 -initialChannelId {2f9730aa-1274-440b-b92f-77c5067fd3fb} -parentPid 4844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab3⤵
- Checks processor information in registry
PID:5716
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5816
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\Downloads\Assembly-CSharp.dll1⤵PID:5848
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\Downloads\Assembly-CSharp.dll2⤵
- Checks processor information in registry
PID:3712
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\Downloads\Assembly-CSharp.dll1⤵PID:5320
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\Downloads\Assembly-CSharp.dll2⤵
- Checks processor information in registry
PID:5384
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3464 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Assembly-CSharp.dll2⤵PID:4116
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1384
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\2906DFA977F53444E51D227FF0573F442BB3B8AD
- Size 30KB
- SHA256 2da28d99d2f5ea74affec45f66b21eb0a24031d727ec28382d8fb119ddbf63bc
- MD5 315c04a1a1f24572854a944393d91af9
- SHA1 f087fefa1c2840eb428a91df4a5081f189d94464
- SHA512 e485134c9a30104dbccec06def792206aaa1cac4c995374ad6886350d96acce0f39688a199887dbd85d56f744ff9b4b3bd51a3d77cf686a1a8dc6e8873d42645
- SSDEEP 768:DlPWCVTYW4Zg4m+8J3WeC7BzuZwFHL0FjdeUFHL0FjdBB7S/AmVAf+hRMTH:p5ZYW4PmjJOtueH4RDH4RB95NH
- TLSH T1D9E2F1756FD038EA52522C9350F84A892E247BC3DEDCDCECB6ABB001D4CC4EA64D458E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
- Size 16KB
- SHA256 510c45fa798da92ba5f2f0ae72c51ab50031e2491fc8defc5ff2c148e124a1f9
- MD5 c77a46d807165310a23f1a96760751b2
- SHA1 d83ece8350a4ed4ebe8f4b951797ccabf8bda765
- SHA512 d1d93c4ae7305a0af1c9a97d3e6bdacc12923330f0c6bfe961e5b15f944bcd27881dadd3d540221225af0a1e9025cb500f5a2dbb70c5036cc7be0be5c4888b00
- SSDEEP 384:HkCjiO024YXDL84KKDL849B7SOEAd9KVRaAcP+AWRMAF:EzZYXDL8lKDL8CB7S/AmVAf+hRMU
- TLSH T16B729E7D5F003CBC1597C1E8C4F592A98D18B7A7CFE6806D21583D0DCB98AA9A0F548F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
- Size 16KB
- SHA256 a8565b5de060deffe68a3decc2d073a3bb5580699bb1e6b83f7b27cd105e7edc
- MD5 9d4875d08b4ec3355a2b52240e6bec30
- SHA1 9465ff9c63c1c5446e04fa2a8394ff72c4acb7fa
- SHA512 e7ab50cf5bbfb58d8d64dd95dd96de73c426e98a79fe90056f0888a617411d7f539279d4f113931b69462473d9d28f4c31c202bdaaeda37667980493b1e11477
- SSDEEP 384:HXkRyiO024YrDL84KKDL849B7SOEAd9KVRaAcP+AWRMA8:3mZYrDL8lKDL8CB7S/AmVAf+hRM5
- TLSH T1FC728E7D4F003CBC25A780E8C5F592AA4E18B7A7DFE6C06D21183D0DC698969B5F948F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\94E606CFB489D4620ED887002A95900AABF80A4C
- Size 50KB
- SHA256 cf42164d72399aadcef0f37122c76aa6fbff9cbaced3243237877b20b750e511
- MD5 406a60c29cde71b059ebf1a2292fa38a
- SHA1 11ea530a07105d21456b42b7c1f2b77d962f2afe
- SHA512 292eef9eace87b0ae03eb8a9d669077d964122d8b4c7c5f17737eca3c30e7d57b328306f1ee74c2131142fb27a8aa9c0cf6674642608de7bce9a15f014549480
- SSDEEP 768:+S0ldsAIfOHbxE56ny0D0t/iAdAOCWFmzbFbgqMpxW1dveRFHL0FjdeUFHL0Fjde:+/8GRAdAOCBhbghgm3H4RDH4RB95NK
- TLSH T160330AF417BC96ACE4534A6EEF2D71E4231FF0FB36988560781F96756243088E91BB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\A4E2E547988B27310B1F47B755A31BD74967412D
- Size 42KB
- SHA256 7073302caa3b1d7d7101f3cb20eda907fd88746a42808b6f5744a35135fe8a22
- MD5 dbe6ad154a29da38035f55ed16444dde
- SHA1 a170e8aa662f2e0386d921fb92b4be2c0aaa210c
- SHA512 346066cf9a7f55e6806ad954065c6b13ae81b0dcd6eb7b069828ae297651096b5f88629c7bdd8a2143064fe34a81f866e6ea24f2e675f7346900e075c0a296c5
- SSDEEP 768:BlNuPst+Il5vU3COwoe2u4hA1gqQSdGthFHL0FjdeUFHL0FjdBB7S/AmVAf+hRMN:Bl0ebvUyOw6hAGqQSEtHH4RDH4RB95NB
- TLSH T17C13E17E8F903E992A71AEA3A1BD8FA5DC14B253DFEC403492733612A1C51DB755888C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\B48CDEEEDAA22B1A43DDAF0C383A1E942524DAC9
- Size 54KB
- SHA256 0adf396fc67c6227fa1c0827b0db3dd925797f39df3bfedb6e5e8f9ded87866a
- MD5 2bdd7acd1f4c353e3cc0dee4be872145
- SHA1 d51a6a614f65340ee618e33f8762b987ac6310d0
- SHA512 2f95d1799f731535b19703d6542db74c76f849eb1ec64b91d746f7a4dea032f0e7cbfc932811f3670c41616c74c2914b69086aa40e6e54650d407dbeb163c293
- SSDEEP 1536:z4L1PRYHVTE8XlD4/+gfHrdWieLTNB2EJH4RDH4RB95N+:0L1ZYHVbXJRadWieXFgDgz5N+
- TLSH T1C34301BC6F42309B1710B8B59894C9A8ADB8B157DFB852E671D2334F62618F6396C433
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\D1962FBEDC048EF4BD266EF5E1E013207A247EED
- Size 529KB
- SHA256 d5d2b7f5fe58a7ebbfa74f3c011de893ff789c39ab512eab6409e2114764c62a
- MD5 138fab1a6ea320e72d6ee2228eafdd91
- SHA1 9c840f5fcf3125895ab7f07c037e8ea7d8406230
- SHA512 4c2d4235b6226fbcd7caa6dc9a7bf23ef0ecce9a208421f487e132a9771c035418d809fa9e772e1a4890fa766485dd7f063e84146ec0e3000c0e569aa4587376
- SSDEEP 12288:u/YzEb3JhCS/y/sS5nA6uVrCBDuGwX7G2cq196U7ayVLqYK6:uQQb3rCVyVLT
- TLSH T16AB4C52AFE416DB3CE2507B0406B23363A7CD4639B92F33B56CE7D21AC593691C615AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\DB82BA9261B72C047D1D4867690A52482CAC8DE0
- Size 3.9MB
- SHA256 0e19d0271f9fdf468f9194426837b63aae809fe790e9a6742eb1a429e1aa8d1b
- MD5 bf267756724442dfe85102a1d0efd8b0
- SHA1 4840fd61301eb6a277a524e0b3658ee9584b5798
- SHA512 2c2015838fb232b4f5dc58c86f93c1a570d68624b35eca17bc403784a4e088fc1682c4a929f195b8efb404cd65149dadb66a129689e68b2c8a03ec7e66732363
- SSDEEP 49152:z+7ibG+SeFj9IlJJQqSMeDuut+Z0OFo64jbwzi:z+uogqV0OQOi
- TLSH T10E162866EE469F62CC1403B184F717353B34E0851BD6E31B6D8FB526BC5B3681E922AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\E97D6E94D065EB2FA169CAB2601CB12454E7109D
- Size 1.1MB
- SHA256 4c08fb0966e9350a905554bd7bd8445c568d8f556e3fd21d6e89ad50378cec65
- MD5 d53f7ab8ed3ba096b73e6ad33618c83c
- SHA1 76ac0abf6f3948d195f5908e786ac3c45e3510bd
- SHA512 6853429176b335252b187a038335caa28ffad78cfe5508619711fa85fb1e329e58d7157edd4c6982009ad38785ca962dcf94e836816e728ead04b92cb426f8d2
- SSDEEP 24576:pzxbxPM5fssQ/0oVisHdMgaCFgiOHHn+OJ+jpf7nZdhKlcoxSBN:pzb05fssQ/0oVimMgaCF7VPnZdhtN
- TLSH T153353A02EFE63A22E4720BB140BF23353A35F4826F96F72F1D8E6115BC657644D21B69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\EC1F490EF5CE96B39C999E23A46616CF1D6592B2
- Size 1.3MB
- SHA256 020d9a2d5055859700941a593f78129ea90727f4d812c3b3cbd0e91284882c59
- MD5 a1259b24ffecfb536fcc82f37053929f
- SHA1 0b5d6bd9f977904a49020ae5b1d61d80c1cc2780
- SHA512 8a3e866ce62cdd9b77faf493f7f0bbe92983400efbde55c1c89328a19788d4abd58da6c6eb44b51ef439211148815948cb68b7d506adbc0c00b7e97a4c2f35f1
- SSDEEP 24576:3Bbj4OCGL7ZNVXxo2OEjI3czncoErX4kD:hjRVL7XVXxo7xD
- TLSH T14E55E91AEE416F53C921077540AB33363B75E4866B92F32B5ACFB122BC1A37C1D615AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\F780DA0D629F803228D965320F7196F831804436
- Size 1.8MB
- SHA256 05f5f4544c384e3db2b0c827d3fc52a30c61b1ace2079a50a5ab259acc14611a
- MD5 a1e795be0acd3fe56f6a2088d50227c4
- SHA1 ddd41b8acf2abd9e76d83917a832c33afc329e06
- SHA512 792972a02dd3418c1d88c790da10d83ebd3d0863500f66d4b7c5232f21fcf2a6a5d051349518127e01f2cb612f800cec40ca66920237f3409cddd81e733bfd44
- SSDEEP 24576:WiWgGE/a55hGvTIrNaYhqpLrYfowpPHZMQzy9yTxN:Xh/a55hGvEroXwBIa
- TLSH T1F5950B26FE91AF62C82503B180B717363735E0456BA6F3176E8FB071BC2B3691D525AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 16KB
- SHA256 b9389f091dae7a0b9e735200d7cfdcbcd7ca942e3688dff847cf3e049863d883
- MD5 e4395508d131e2e040ee728ade8cab5e
- SHA1 8b6e39d84846ae17cf3ea2816836f72e30862535
- SHA512 d1f9046da9c725b0c901f9a9faaeb472034beb5c2a0536a49712113e7c405a5cfbf24e454ed4a6d18c2b722dd0f42a7176cb1495e96c83093cf8d91bdc8b8ec5
- SSDEEP 96:4vMcv/PCv/Veve4bncpIncVSGvmJIknJaGvVv3PmsGvWO+x/kcgXvHO+SuW:s/O/0DTCmZNdfmdWP/nEHEB
- TLSH T1747275002BFB1955F7F78A31BE71B3427737FD029B46652EC28252490A32760D919F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 20KB
- SHA256 f5eb57b2be03e31149c1a57e3c03c99f70cd1d3d89a25951350d3a2929c6605f
- MD5 f6d949c3d1bea0e3e9348a5f13ba7071
- SHA1 0cdcdca2908ae68d7f658e7225e554eea369c86b
- SHA512 830ca8f43455cc06b5dfbe0a91b88abced3252e6516b1dda8d0b4a3a9875b1d982ad965bec93644bfc964d1255b6f9d7c34ea5a183e609937b4403a4183c5db1
- SSDEEP 96:rvMLv/PVv/Vdpve4bncpIncVSxvmJIknJaxvVv3PmsxvWO+x/kcgQvHO+SuQvOQj:Lk1/ThDThmZGdfm2WP/n/HENtwW1
- TLSH T1C19242002BFB1956F6F78A31BE31B7437737F901AB06652EC19252490A32760D919FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\AlternateServices.bin
- Size 10KB
- SHA256 39b712567fd4a61c186cc0f1417b75544c50f50b9ba5f13e58b2bd14dee7d64b
- MD5 76dcd7db8aa24d043b7ea7abbf0d0a37
- SHA1 0e313e222165dcac1c18b573cc0e91cb6f813bdc
- SHA512 0a36fb5a5220865ac7bd0edf6e363ab122cb85f1d8c6b80ada71fb3a753a0abfcd1177ab97b7d308a160cef841f23c6eb4402a272c39e9f62163e0c8c64c16ce
- SSDEEP 24:muhMZl916iV9xOiTk9Bpic9VvTin5q9F55A5yiE9lrij9Bbci:WX/3KyOBG5I56tmkR97
- TLSH T142223CE37BB6A472F0A2CFF48058B58C9C330325196CD1C4C654E0F31286AA9D17FBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\AlternateServices.bin
- Size 18KB
- SHA256 ac5170f2fc26093a5a668359ec883a66943de1870720c6e472713d85c3c79a10
- MD5 f3e0710fc14d119277219490a0abdaec
- SHA1 eaa17ad4567a0358021cfab33a57d5c45202aafc
- SHA512 608e006b764b18800ab0e8eb9a869ce9e918408b19c65f818d30c134f239a5b99a20629e05370a51164ca28cea0789198eb05a2416c6c304e9537484bc642b07
- SSDEEP 96:qX/3KyOBG5I56tmkRJYM/ptdyx2lv4kfZa:RQ5227fZ
- TLSH T1FE8262F76BB66462F092DFB44458748C9C730325495CE6C8C648E0F70286BA6D17FFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\AlternateServices.bin
- Size 25KB
- SHA256 cb57866a201e9e14d47e95075c319507d9b51ba38459add74242685ac34549db
- MD5 c865e0c5d5c272311e63ba8a504cde2f
- SHA1 9c2d82527e0dd25acc3be7bf2ba45a693906494a
- SHA512 49b30af72f38c6b33e9d73054fa0739f12e8a8889247479122aa85041dadc8fdd82d4e32cfcec9cf556af4a6c2c4a211c19a83f1f8573875d901a6b9ce515634
- SSDEEP 96:8Bph0DI0BfIHI56kIktIRJYM/ptdyx2lv4kfZasaTzcfXt:BQ5227fZbXt
- TLSH T159B298F76BB56522F0E2DFF14058748C9C3702255968E6C89608E0F70285BA5D17FFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
- Size 170KB
- SHA256 f087cdbcc8b237c27e206f5c05d5165f96ade29442bbccdf448e569598004f8d
- MD5 9b63f69c451ac3dd17b168eb90d3bcc9
- SHA1 4f262fc1170e95cbb7ce3ca7452f51a77244d452
- SHA512 37627689d01619e60f8cbd14dca7be66c3f8da17d26b2a9181048947403f6ba52da518e8755a4fe460ad58307929863d7578aa37a777ed543b6bafe7b556463b
- SSDEEP 3072:3QdPmg2f2yhvQMq62wETJzvY2QiwB4zM/fMJ2fyF7yv5xyG:3QBmg2f28vQMq62wETJzvY2QiwB4zM/L
- TLSH T1F9047DD4DB26407BFC1485BF7495673C2635F4314A599B0B2AAC04722DCB7BF2D0AB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
- Size 3KB
- SHA256 2db896c8e291c13e19c75964fc725bd3bcb0af3bbfe6246bc153a37b920c397e
- MD5 e6a9c0370a55e14569c0e4372bd99889
- SHA1 95ee78120cbe2c5c12ba571c030f6975d44b5240
- SHA512 1ac0ca563f588572dee0d36dea5639b905570b22ec775eca10619c0b51610f2688495d1fc87297bf4cadb5c4621dc5ba9801650ff153fe7626bfcacbe8646bab
- TLSH T12C61C858F228863FE445913ACC961B416F347452A8AF3F2A35AC614D1E5B3CE76CD07E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 34df49cfe5276bf71d1dcb143ef4f5b555aee52503e84c29e4a154c75d7a41e0
- MD5 0cbbdb58da3ba62fae58c1a4f3af7bf3
- SHA1 42d68a6efa8b24ccfdcce26be4e00520010a6c73
- SHA512 baaab7ff0b297ba5c8abd3dbc107451f81789b3eef9923ad7571552d16f213b2d7ca549beb7542fb58d02ef1656ad5801bb3f3eb0e9f95fd2580fd6cce249ee5
- SSDEEP 192:k1d66JozGzgCl6mc0diOv5zboqZCWyj1uZ:ud66JozGzgC1jPboqZCWyj6
- TLSH T1C4E12264EA28863FC405027BCDA12F414F39398A984E3F2935DD61182C5B2DE36CE1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
- Size 166KB
- SHA256 3f839668bbc3cf1afeee3099fc41ef94f7594e942c7734d8e40708028c63537f
- MD5 1e413b73bcc66ad6f97d19ab181fd61d
- SHA1 1ff29b2db42c0fbaec98b7aa7db52167b757d740
- SHA512 fb4fafc4ec122a0c395eef588bc8dfcbe5b25eb54f56c371b40980f49c9a2cd2f56f2a87b23009b93ae9f2b3de0345223a058d6f9fc617a14779d19b59b69711
- SSDEEP 3072:CUw30DMYTHMJuPwFvq42iK5O1LyLq4zM46MJ6fyF7yv5xBF:CU+0DMiHGuPwFvq42iK5O1LyLq4zM46L
- TLSH T1C1F37CD4DB26407BEC2485BF7495673C2635F4314A599B0B2AEC04721DCB7BF2D0AB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
- Size 170KB
- SHA256 dd9eb8d9f5508be5b29fffff03765ac38d5705728fb8e7448350931a7fcef063
- MD5 0e1652825bcc461d6e70114ea1fa4b1b
- SHA1 30345318f7c70a08f422a7a4648ca85c62cb47a8
- SHA512 19d665f68c88ef3f475506737b5a05e1ef7513c68a8abef740052ee2f25422725a77d42cc44bd004dcdefeb23bae46a09cd26408a0a16821c0a73952ee2e8314
- SSDEEP 3072:iQdPmgMNwyhvQMq62xghJzvY2QiwB4zM/fMJ2fyF7yv5xyF:iQBmgMNw8vQMq62xghJzvY2QiwB4zM/g
- TLSH T123047DD4DB26407BFC1485BF7495673C2635F4314A599B0B2AAC04722DCB7BF2D0AB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
- Size 170KB
- SHA256 7d02b7bcbbfc0f48d8a4e3e5ec20d6da055952c2d6a64ce751063a34247fde1a
- MD5 b866e365adbda09539723bec42a3870e
- SHA1 ed0af9ff63712cb7381ca9cd3980ccc71fd1e037
- SHA512 ff54290f96bc5195894f749b219135945a5bb787e382cef8e5f599535ffcb38c1e62bf8a4f58ba08e5c41e079fd74335c93e741cd52787427ca000f71353e75d
- SSDEEP 3072:7QdPmgMNwyhvQMq62xghJzvY2QiwB4zM/fMJ2fyF7yv5xya:7QBmgMNw8vQMq62xghJzvY2QiwB4zM/B
- TLSH T1BF047DD4DB26407BFC1485BF7495673C2635F4314A599B0B2AAC04722DCB7BF2D0AB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 60d169ee04ea72b35c960a82a5558eab0f657e02196d16752d4bbe591202886c
- MD5 3478c6518bf685a022f8a9421a3d0c51
- SHA1 387d5f9c023dae00f80c991e88ff6c46b06cb2da
- SHA512 46e7aab851105dcca5ccd077ae2b09d3231ef063f3022ba0dbcc16cf58fa1ea72400bbdc3209af9aea1758bdb51a24cab0edb6ccfba76a2315a60243cc9527f9
- TLSH T1A321675C3FB88D6AA99BF29C7481168E53598A0604875D430E42FE8CCE81ADA317A539
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
- Size 4KB
- SHA256 f9877606d706eab37b8c9437fea2fd67ec8b7e09f1ab01b6e72f5e9c35322878
- MD5 e4ebfbf660fd0570514f5a007b92b43f
- SHA1 06a8be324301b3b95e71fb0ba349f0d3692b0b4d
- SHA512 6cae26189845f7fba545a351514eebf4ddce52aefdc00e2f2e641396fb755756f4ca17fff730073ef1d8518cd92a86015335a44cfa8a5359d0c5d7bad12f24dc
- SSDEEP 48:YpYBbYA36hAJQptj8YlOR/i/POkq6QGn5eRKQsH5Q4buRVtAd9U8OkdkqiaTxzXC:uCEO0o6QGlQ4Q4iedH3dkoOayR6Zo
- TLSH T1E4A1101C3BF80C7E69DBD2CDB481168D87DD4A0290871C478CD7FE49CD96A9A322E579
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\05e9c606-d5e5-4937-8fe7-49901463ba62
- Size 886B
- SHA256 f8dd5f4f1a6ee47802cda6433560f0cbe22548441f6ed2914a3cd97010cd7e13
- MD5 e50873856c5f71881985ba7f11380212
- SHA1 dd260e79fcc2b7661b4f6ee846fcdca787970308
- SHA512 21648a89b76db331d4794474fd090e866e5d5a0c43ac1a867a4d59759795dc27a3af4572cb1f43c6dddfb99ee142cfd0197c0b47a3b18ee0a4bd31984099785c
- TLSH T1891123419570F9B2CC79A287D9A17793CEF4B02390C659287D915B180CEE62EA3A6307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\3499ffda-d1e8-40fa-8b25-9f2e4c26beb6
- Size 883B
- SHA256 eb31ef8cdd89f76d356189889d001bef790574bfcfb8c2fbbff57021c1cb6dd6
- MD5 7ea1ab92b598f71705fad32aeb5e034b
- SHA1 e495b17d536512da1d0ca96a6f1b955ce2f38f88
- SHA512 b6c412b91fa934798566997106841c011f0781e0ef85311cabc6838ff261887f0211607710608cc483fb71e568c935d297a195c6340cab56082eacd2df6e6fbf
- TLSH T1431100419634F5B2CD6C924B895177628FF9692380C650183DA14B040CBE61EA3A624B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\36b6e4e4-e058-4bd4-8931-185d1f9c73b8
- Size 235B
- SHA256 07f015f330dc203d4981c92a0801ae9833606d5a7e0a7d5e60f4cba4e3a3b8b6
- MD5 f75f048ccd50a77b8eaf238bc7c73b8b
- SHA1 6b77dedb31bb8975acf989dddd5510d06acabf4f
- SHA512 cdfe6d47f094dbef2dec4707a08fce2b91f0c54af3d3ca23dfee28995bf1c70629083c16dbd58305dfde5a1683c31881730faa5309e43b5b414071b89306328a
- TLSH T1A8D0978828A8A37C08040F1BF0E46BC330588C332164A8509AB10078BEFEDC402D291A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\370e9fe4-c22f-44d3-bf1f-f7b42b19ac84
- Size 869B
- SHA256 46a99a0c379f8dab68bdbd7aabfd8dfdac1e1e2691b91d0948111527cb5e8525
- MD5 4c92cca9bdf2d1a2bf8b256953eb6536
- SHA1 ca33170e485cde5597a33315a8209b284487e470
- SHA512 74204abfc3255a32a3d2921f7d8d1532c631426a10daf97ca4cc45bd36403a5243ba03a34434b544a46de91c523ed718c03839242c2478a6cd3a5d8db1285c12
- TLSH T18211EF819535777269B9D30E89623341B3652202D0D564197EF81F980DFF01B41AF79B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\966ee70d-de99-4536-bd8d-374fc58127ce
- Size 15KB
- SHA256 fd51ea88a951f71f3817bdd94adb4b5c355a6f7520961a8d7652880780990be3
- MD5 1342ddd700ed8b6b14880b3c3223d629
- SHA1 9599b9b5f59c08dbbc65a329f461156275b58bd6
- SHA512 bcbfa95dd4b638497ed86c8a258b4330d41012f1e2f638260cc4f65c5d521243002417c36aa8a2d8d49247020c2572dcef6b9f0195e2ef506721f289bd4476fa
- SSDEEP 192:ZiNjqYBO8Ce1doBEO7ZJk5+O0PogoRorjjMXWnEEyGFni9vbuzp6S7auiReJzJZr:Q1bTCPB/ZO+OWoRWcS2TS7FiReJNZr
- TLSH T1D672B7565820457A8651E3A898F8BFC3F6F638CF4C019FCA9BE4BE045DDE06E112794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\a1ae1cc1-498f-4d5b-ad2b-c43b0b295e87
- Size 2KB
- SHA256 65f7dc56b706aca0eeccdf06ed919d79d6a135f1176651b2ca2c4d3ec694a7ee
- MD5 5a4790fc877108c158ddab56bf3b994d
- SHA1 a65d43bf1810fbeb9bcd2ae6d4418bc9c1ae8816
- SHA512 d23631c1d0110b01364d140983695cad838c07315fce1f1a31161e8d83aa1670954050a332840b0de84e9716b018fea38e28085fd03230e3764830c5bd9a85d6
- TLSH T1AA41235C35785CF68DDBE29DD881334E57708A4300C628932E92DE0DCC9A79E336A167
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\ae120517-2e9d-4312-87b6-95ea97e2f123
- Size 235B
- SHA256 2b2244d1c5096d55184439ca1226d66d2bb4ea5265a2938997e890954cdd08f4
- MD5 085ef9af404cd279a841132dacf12404
- SHA1 c3ad3b7b1d6ae3a9e20bcccab71801424964e234
- SHA512 01e9734b132e9d3b38a5a6c04cec3377a00477c50e07c07c71009ef4fcb5ef8c53a13326c60fef7f9e3f8a6decbcd1ca500004daa62835476a0dfe6efc096719
- TLSH T137D0A7C4689CAB6D98181F16F0A179DA71458C3754A55830D5A1467499F9ECC8262C1A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\extensions.json
- Size 16KB
- SHA256 7d0678ed078bf9e4a0b8565d66ecc7fedd0d3f5862dc5a027d64ccaa7504fbcb
- MD5 c23459dc3079d460f1dcd5fd50b99f29
- SHA1 bd05bf539324184c753c0464c3c0e978c0ad3716
- SHA512 b373a9d7f0a1c2882ae8f953431eb23844babe5c3dbc08ef7f6569ec797c988c30965394e39821d0ba10c7ec8a1d738743e355b17beda1b9847062f55fb45856
- SSDEEP 384:qkI4v3Umldvc8dhWA94z196o3tL4HzlL4PTL4HeL4HCL4HZY4hv:NI4PRflXV4H6Ct4p4H4E4Q4i4h
- TLSH T19872421545048EB8294FA79BAA367E01C37D473B60845C78F4DD8FC842FA5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
- Size 12KB
- SHA256 9a3de95fb048b98de1819ab0614b1a27c6e0d7dc44e04c405175cc414d253080
- MD5 8a7830b7ccffb8c6bb366a858100ac38
- SHA1 112185af511c109fe0fa042d8d9d328c355a3b7c
- SHA512 a4c5edb5333c9bc9870b080be1b77de5825bfa764c52320c910545ccf63771ce59a672bc45322554ed8ccd8089aaf347acd17d8808d032f050ff2138a3f1586d
- SSDEEP 192:xyWCROfpjyMUmSSwaLRTuIaOww889rKHgbk:lvRywxTA
- TLSH T16542CD3866048F3F20B232BDBC255DB019A5022777BFBCD215B9A4C1055CF6541F6AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
- Size 9KB
- SHA256 8f87b2fbbf679397e635316c2f9712d6ecbd1a20caa1481c5d791bdd48fdf2a2
- MD5 680b732207a04454dbd531e104f53244
- SHA1 b531999744a4a89fb67bffc018ffcde2cdc0d657
- SHA512 6890c54c9e7bb00173ec23f5dd76262a486c32520492eeaa060647bc2a902f955bb2653852461ff6898ad9e3cabd81486a05799f9c5ac2a1209903c40d785180
- SSDEEP 96:xHglTUPDqGqnfpjyNbzStUmSSladv9jnKn3WRSgRwVFIaOBw88f10Qmz8L4cnFpB:yyORnfpjyMUmSSwrRTuIaOBw88CQmm
- TLSH T1AD12EC385604CF7F64B636BDAC284C715AA2023BB6BFACD711B964C50548F3441F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
- Size 12KB
- SHA256 590715a2cbeb74124421d8df1992309325399b7a93959ad0fadeec0e7ee46f21
- MD5 fc3529ee1144f494bd509fe15169a9da
- SHA1 442cc1c18f6a6e226dbf799def4b5720fe24ea6b
- SHA512 af45aa1873b44d33fbccdfa489dbd9ef870692874a0ace5d6bed838a6db3d87399c74c679a2bbf69ebdd70af431c43757a13f217e58586745042abfb94934b73
- SSDEEP 192:xyWCRnfpjyMUmSSwaLRTuIaOww889rKHgbk:ovRywxTA
- TLSH T1ED42CD3866048F3F60B232BDBC255DB019A50227B7BFBCD225B9A4C1055CF6541F6AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
- Size 7KB
- SHA256 b27e1b356b503cec5acee0cd85f5762baef0eef01c39b60316b4287e42074696
- MD5 4e272b97cd756e2f02848987165b16b3
- SHA1 7008127748849fd659448e4b1c50259007a109f4
- SHA512 9cfb454ffa066c185a8346a6e717f48d317b5dc6fdf11fff4177f9cf97e67da8e46618681b0fff6660c5498cfab49701a341f62c01c4fc68c5c941443e107154
- SSDEEP 96:xHgUTUPDqGqnfLjyNbzSaSSladv9jnKn3H8RNBw88n8L4cnFpLGS:yfORnfLjyvSSwe8HBw88y
- TLSH T1D1E1307895088F7F64B6776CAC688871AAB2013B7BBF68C750B554C4014CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
- Size 8KB
- SHA256 dacb7e3b4664a08b5924c96840494e81d52cf7c178da90c6dad90183cd6e81a5
- MD5 32a78ec9a54c311fecd072a3943a6604
- SHA1 cac2f052879593a128f2c8221d93005cb96aee45
- SHA512 6c64cba2fe93a70464d48094bbfbcf741dc3d8577914286b42e1ffd0bb5cb375df83d39c3627c4eef74c0208479e7ade41a4d5cd2fd6864f69feedc6fc60d139
- SSDEEP 96:xHglTUPDqGqnfpjyNbzSaSSladv9jnKn3WRSgRUBw88+X8L4cnFpLGS:yyORnfpjyvSSwrRT6Bw88h
- TLSH T1BD02FE785604CF7F64B676BCAC648C715AB2023BB6BFA8D610B564C4054CF3841F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
- Size 6KB
- SHA256 7a2ca17a3e3f27732343a818c28be6d8b5a0d369473b4975f51f30ac216ff770
- MD5 e8feb1565a941a8294ea6599766c277b
- SHA1 fa79b765561651f018365f658106b608c49c6f7a
- SHA512 83dffdc8bd1c85aa719ee043a40d8c6ee1e5d4fdc5e86b145afe10df5ca5d2c015b1a46da3b503f9f0187d8b7b5bf030a3c08cc3ff50c4e52e202c931cf7b374
- SSDEEP 96:xHgUTUPDqGqnfLjykzSaSSladv9jnKn3H8RNBw88n8L4cnFpLGS:yfORnfLjyISSwe8HBw88y
- TLSH T1BFE11F7895088B6F64B6776CAC6888715AB2013B7BBF68D750B554C4014CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
- Size 6KB
- SHA256 2ad9b28fdd5153e40aec2d71f49828c964b59d83333b5fa1671972e95bd1b2bd
- MD5 8ada5446a5e6f52b4a1e7f470a956de9
- SHA1 fa0061f383f3d170ee9095006652fdfd5db01b75
- SHA512 d50e88f2f89a623696ae02e90b440bd1d689cde3343825d567bfb1799c06b15d65481cbe95b4ffd5be2f7ce9b2284d4d2bea9290b2e4988636fd00c8ce0c8f04
- SSDEEP 96:xHgUTUPDqGqnfLLy1zSHSSladv9jnn3H8RNBw88n8L4cnFpC:yfORnfLLyKSSI8HBw885
- TLSH T1FBE120789508CBBF64B6776CAC688871AAB2013B77BF68C750B554C4015CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
- Size 6KB
- SHA256 2c69b1883bf545ab057953e3d8a24349fea67e5d315f1e22e15b2bffac7f899c
- MD5 5798828914740695ea98d13b860d6143
- SHA1 21e33355d17d2a955bf26f9240f91345bbb2262d
- SHA512 67a6fa29210a0677be8e9a3f013e3e7d63396e20b5fcb2cbcb118944f9d1f2a990b18f79a617bd96bf49a39871f86fa8774b39530419eea731290e9f6f4b4720
- SSDEEP 96:xHgUTUPDqGqnfLjy1zSaSSladv9jnKn3H8RNBw88n8L4cnFpC:yfORnfLjy7SSwe8HBw885
- TLSH T104E12F789508CB7F64B6776CAC688871AAB2013B77BF68D750B554C4014CF3842F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
- Size 6KB
- SHA256 031f985114e3a29bd6e82663bbf24e36c798a68550db41cbe9808fadd24e45de
- MD5 a54a48ea0796ce0072826fa3386a7d40
- SHA1 6153b8dcf36bf0daf500e319a9e0374a97e9ff4b
- SHA512 4243c8756039dbb175756acafa750a662d8fac5f59afa2c382add39f0c0e8a6684b19f5d2576aaf1b6815b355ed7a61e2288e0370a8dfd34cc086a8796db068f
- SSDEEP 96:xHgUTUPDqGqnfLLy1zSaSSladv9jnn3H8RNBw88n8L4cnFpC:yfORnfLLy7SSI8HBw885
- TLSH T1E4E110789508CB7F64B6776CAC688871AAB2013B77BF68C750B554C4015CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
- Size 12KB
- SHA256 fca28d69ced8158440914b5aa844b2678fcc1cb56508a0044e9c03ea498f255a
- MD5 5b5579202d0a8ced5b7279334d35e210
- SHA1 23d9f0ed7e7ec547f182ab34f08c37364ff742d1
- SHA512 a093f88a200bacaaba52d46f030b3656b17fcbb6652c8fe0478755e4e19f87bb5fd9cf0f2a70798c00349e13099adac8d9518d4090bcd614d5b6934abc99aa09
- SSDEEP 192:xyORnfpjyMUmSSwaLRTuIaOww889rKHgbk:TvRywxTA
- TLSH T17C42CD3866048F3F60B232BDBC255DB019A50227B7BFBCD225B9A4C1055CF6541F6AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 bcc296b1ffba6afc24a81b06ad9377fbb8640c96b15e611b3652ed02f46ea6c1
- MD5 febd8425c42374bbad2be0d9d8af1674
- SHA1 cb6cb52c403fb6d210798fcaa3c79164a4922b95
- SHA512 ea34a34fad9546b3660071929c62a4220d0a20ee9c63653692b8ee4f929ba08a1cb659546cc4d3b175d9e08fbbe054bec82021b1a53dbc48cf8811db0a939fc6
- SSDEEP 96:F2Tj+90AXjSP9jyxHRlOB6ndaaCd01VrqM4EcZZi6rLKJybvm:FcAXeP92dOBY1i0v/4Fu
- TLSH T14A919BB3AC0AE8F73571D4958C9F0F4081E3081084FC213AEE399A7224AD346ECAC95E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 6KB
- SHA256 d405ed8442b0eb00753b5429b474883ff457b02afc0fe4b071402ae09ea9dffc
- MD5 e67711bddbe1160b140db32b4b8b01bb
- SHA1 bcb84f302a400fb6335b2c4e8456c5e321559cde
- SHA512 fcc5a6391770dd417de8e9e0e1cea8871c59ec558835f71822ace665858536bb9b39a5cf9425a7fcaebba0cc1efac751bbd2d776f8eacc78c0df1d9260d805a5
- SSDEEP 192:vcAXeP92dOBxRDFykwRHGRUkNrr7f9ymbUSEq:jXePwdsxRDskYmRt9X9ZAq
- TLSH T18FE1AFDBE69184B392285643D8C67F4446D2D84BC6ABA0A0FF02243780553A6DBFD3DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 2KB
- SHA256 914c8a9ee925515c3998568b875c212669dd4a8bbb25bbeb02f5f37373a48e35
- MD5 fc7c88153aecbca3775dd803b48efbc8
- SHA1 829717559c80d004488e56ada491e6659973195b
- SHA512 3eee051d72b495fe003e83d0aba6f03511b8cc95d8412c1945c8380f60a447d97012c23dd78af1cd8a8b6da57ecb95519c3346dc92cb3532eaf56e12589db040
- TLSH T107516EBB0C1B3CB73626C456EC5F0FD0CF6220101875655EBEA9A92305ED20A95D9B5F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 7KB
- SHA256 a67f9d997b318b96bfeec28a6c0d886d3477b3362dddb331c73e63e4690ed6b5
- MD5 cf75dcf1369340d90f3b1dced04148f1
- SHA1 5d4608c929b6d719b1104edb73dd7c2ece0b0134
- SHA512 ab0a3152df3f409f1c40b8afdbcfadbcd8740211efbcd679610caaf9dd4f2758d5633db33daaeaf3f5cd316a07604d07b70e6bd37a15cf8d0d2865496a214a63
- SSDEEP 192:8cAXeP92dOBxRDFykwRHGRUkiD+p+i0Bb0EDU:aXePwdsxRDskYmRtZ+H02U
- TLSH T1D9E19ECBBAE184F35524A642C4D23E844AD3D84BC7FAA474DF42143B40523A59AFE3C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 5KB
- SHA256 083286588e6959e5f2cee2fa15e50d0e20b563ffd228ecb3b9017704b3ff63a0
- MD5 65e00dd45f21d5b1947eedb9958bc8b7
- SHA1 ce207d24ee8df8ae8830be2d2294f09250c0ac8f
- SHA512 e38a5e45cc27adc1fc1ee8c13c8e6b050adae94b387048fc45d241f8f3523b3eaa642d8625e482e681237ad57e6c17fd954a5d9ec682ac98407bf1b541b04ff7
- SSDEEP 96:e2Tj+90AXjSP9jyxHRlOB6ERaMwoy5+0fHxH1UXZefhKx4lvnW12Y8Zr816OK3Nz:ecAXeP92dOBxRDFykwRHGGwx4lv7ZA1y
- TLSH T16AC1AEC7F58155B26524A445C8C23F445F93954BC7EE94E0FC0A683A4061B93DBBC2E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 7KB
- SHA256 65294185316000062c017e2b577fe83742ad4b9d3754c0ff7c91299fe78a37d3
- MD5 e89ee5d7a7bfc1fa8807ff9d81ed2096
- SHA1 bd10e17bbd1725c7876655c748057886cc82732a
- SHA512 771e8341160bdd72fd3bcdc4cc87772fbe6d8a689db6efcb369f35fa36c0d63b22594603cb7e37af2420fa7f9230e085ad0a039cccc3202e9a15a9b3c0af9a88
- SSDEEP 192:qcAXeP92dOBxRDFykwRHGRUklahOpwHJC2b4QRI:0XePwdsxRDskYmRt6HJ54QW
- TLSH T16CE19FCBABE150F366289543C4D33E8445D3E84BC6B6A0E4FE06103B505578499FD7DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
- Size 7KB
- SHA256 b27f8f6f8c9d557eb36e7b85df2bb351a0bc2d21efe2aa8cc29cf2aa33352e8e
- MD5 2b8108b6502887f2251e6a52864459d6
- SHA1 4907b048720558761d228c21e89a3bc6c03e6c16
- SHA512 53dc8a8749f0a56862a0eba6e1c90d348cebec2587a9eb017af10df9dc4965b979430fcc107042a8364629f28018e7d0524896b6dc6269dfe7bd6a95f883e6ef
- SSDEEP 192:8cAXeP92dOBxRDFykwRHGRUkt2hOpwHJC2b4CgSYnOYQS:aXePwdsxRDskYmRtuHJ542iz
- TLSH T1FDF1A0DB7BA190E36728A543C4D23EC406D3E84BC6BA60E4FE05107F80927815BFD78A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.jsonlz4
- Size 7KB
- SHA256 223c938c672096e0036e2d1c32bf11cfc3dec24ac3366d87f46796978d8d4ad6
- MD5 9fcba259275b24826a9b2dd4eee9997b
- SHA1 8c837965582adbf62be435458f0a43b5b5dc059b
- SHA512 8b3df9edea44d755e9457fa0277a9e86df397b0cea854a47c5fda2375bb0e5c0016438900858d949054679a4e7d252059be62e6b6b22c825f375bf08ef29b30b
- SSDEEP 192:QcAXeP92dOBxRDFykwRHGRUk+Oi35ttbRQ:+XePwdsxRDskYmRtA53G
- TLSH T120E1AFDBABE184E399246642C4D53F844AC2D847C7F960B4DF05143B40957D49AFE3D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\storage\default\https+++www.playground.ru\idb\1190049872addirc.sqlite
- Size 48KB
- SHA256 c68640d39ddbcc26c7bc39fc4ee18f971a217902a589d66f2ea1e69166e11f43
- MD5 4bf69deb647def62f473ac761922c994
- SHA1 2ce69b64c88e902b86cb76aded6a96f640dc2d6b
- SHA512 d77e09ff5f0c18243fdb37fb05bc568c11643185d110fb5674405541e3ca2e0644098a0ad0edf3bd92d3d9c6fcecf846602ff609ed756e1989f93e7bc2b0c0b9
- SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE4:Oa16S6CKnqlizbxV+2xVeU7X2B04
- TLSH T1FE23708E3F07A511C57AF0B178A08D51BC5E321D07222AD679D0DAE4C8F211AEE5F9B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 6.6MB
- SHA256 08fcfe1b441bbc01dbc9795ab6dbea5c51022de079c5f68ede2d506aabce67b2
- MD5 a059b19991fffdd80446e6f2833c1afd
- SHA1 c7749ff08657f0266c2840a605f904272bd30ac4
- SHA512 01093576a715b1c0640016e4f78a13cde098cd338c7777d52d82a8e5ffd573122d3d60795b47980ba8425b747af5c5c2208939491467146ecc3d797642037693
- SSDEEP 49152:C9yWkun/X1He4y2D3/Y4wbjWTloQfKgvkoqZeowR0oJLZa6nxMkqNh3Gr7DfQpDF:hVh3w7kpD7QagX4
- TLSH T187665BE420E29252F34140B3719953EB21EFC01C6077CE445B9896FAA5B8CEB4E977BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Assembly-CSharp.dll
- Size 5.4MB
- SHA256 df95fb0019ab4cd8be495373c0e06c7be6ae2b1ff7eb2186b128e2a85c822c61
- MD5 8c69cab66d7cd7a8102c361900cc0051
- SHA1 58c13320bee2b87e80d51ffa8bcce0af1e72f639
- SHA512 72140382f9ffb8b6c3bb54b722d884e04541adb9464bbed7eb421c8e9a0531302d1458758913dd182251a750f3388b67daffe98689299d3a76b90081245316ae
- SSDEEP 98304:r+5KAAT+FNe3IkcEvhya+ovu+r2JaLN+g:r+5KAAT+FNe3IkcEZya+ovuI2JeNN
- TLSH T184465C17E7E8DF62C86F07BAA478154147F2DB8E2342E6960A81F87A38D37516F06317
- MD5 SHA1 SHA512 SSDEEP TLSH