Overview

overview

8

Static

static

1

URLScan

urlscan

https://auth.platore...

windows10-2004-x64

8

https://auth.platore...

windows10-ltsc_2021-x64

6

https://auth.platore...

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    600s
  • max time network
    573s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 02:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://auth.platorelay.com/a?d=mOdACeWXRfkQhB56iKY16SIikYksczFvRFpeaDKlQRxSQYPkmgUyu6yvMCLODTjckwbskHEMtsAyaHlHgP33lyqdupIUFlDmeW7JXD1vpps1FikORxVwtKSCTXHDeapAY1LoMMNZ3Jf9v0Z0RoXJvfF5R9iaHIyS1v4igTkjJVOelhAa6shRlZZJLuj0ZkIWFtz5Hlbh7UcerIEkz98I51bMUdY3Q52h4B7UPUoB6bVEQzCItEygH6Rx2Gtiq15qKOMufMDaPKcO16WAzO5KByAdE6wgcdsghTVjRbimpRhssyhZ5yisVrEQADmJhwWWw9Mic7th3WdOvfiiy3ayGotKoNM2lakVP8d1j3j3mg1O5b6bHbjieS5Wu3XzuaTeDzFZX4hc62pszGMrtMgWXLmZ8lZqZ10cKUba54ZST66VUQ7vEKzhJ4923eGu1do7pfnwJvLna7pHbCJRIGMG3DKw3z4jz5yVk6
  • Sample260905-dgnb9sdp8v
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://auth.platorelay.com/a?d=mOdACeWXRfkQhB56iKY16SIikYksczFvRFpeaDKlQRxSQYPkmgUyu6yvMCLODTjckwbskHEMtsAyaHlHgP33lyqdupIUFlDmeW7JXD1vpps1FikORxVwtKSCTXHDeapAY1LoMMNZ3Jf9v0Z0RoXJvfF5R9iaHIyS1v4igTkjJVOelhAa6shRlZZJLuj0ZkIWFtz5Hlbh7UcerIEkz98I51bMUdY3Q52h4B7UPUoB6bVEQzCItEygH6Rx2Gtiq15qKOMufMDaPKcO16WAzO5KByAdE6wgcdsghTVjRbimpRhssyhZ5yisVrEQADmJhwWWw9Mic7th3WdOvfiiy3ayGotKoNM2lakVP8d1j3j3mg1O5b6bHbjieS5Wu3XzuaTeDzFZX4hc62pszGMrtMgWXLmZ8lZqZ10cKUba54ZST66VUQ7vEKzhJ4923eGu1do7pfnwJvLna7pHbCJRIGMG3DKw3z4jz5yVk6"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://auth.platorelay.com/a?d=mOdACeWXRfkQhB56iKY16SIikYksczFvRFpeaDKlQRxSQYPkmgUyu6yvMCLODTjckwbskHEMtsAyaHlHgP33lyqdupIUFlDmeW7JXD1vpps1FikORxVwtKSCTXHDeapAY1LoMMNZ3Jf9v0Z0RoXJvfF5R9iaHIyS1v4igTkjJVOelhAa6shRlZZJLuj0ZkIWFtz5Hlbh7UcerIEkz98I51bMUdY3Q52h4B7UPUoB6bVEQzCItEygH6Rx2Gtiq15qKOMufMDaPKcO16WAzO5KByAdE6wgcdsghTVjRbimpRhssyhZ5yisVrEQADmJhwWWw9Mic7th3WdOvfiiy3ayGotKoNM2lakVP8d1j3j3mg1O5b6bHbjieS5Wu3XzuaTeDzFZX4hc62pszGMrtMgWXLmZ8lZqZ10cKUba54ZST66VUQ7vEKzhJ4923eGu1do7pfnwJvLna7pHbCJRIGMG3DKw3z4jz5yVk6
      2⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27097 -prefMapHandle 1944 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {972018b9-3e2f-41c0-908f-2708801d4e75} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:2448
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {2a573578-a006-48e4-b461-2285ce12bc00} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:2348
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3832 -prefsLen 25164 -prefMapHandle 3836 -prefMapSize 270279 -jsInitHandle 3840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3848 -initialChannelId {5e2d4024-6e5a-466b-9aac-7a08c4a746b5} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:5008
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27274 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 4068 -initialChannelId {19242a54-348d-4c3c-9456-1259dcc618f6} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:2888
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2972 -prefsLen 34773 -prefMapHandle 2968 -prefMapSize 270279 -jsInitHandle 2848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2840 -initialChannelId {4feb4391-d65a-4db2-96d0-08941bf0fb7a} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:2456
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5008 -prefsLen 35010 -prefMapHandle 3000 -prefMapSize 270279 -ipcHandle 5100 -initialChannelId {933fda4b-7881-45d5-a560-c0b6c3047e2d} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:4964
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4948 -prefsLen 32952 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 4528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2608 -initialChannelId {391e736e-a2f9-4825-8c1e-a49079d0586b} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:3952
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2836 -prefsLen 32952 -prefMapHandle 3052 -prefMapSize 270279 -jsInitHandle 3264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2784 -initialChannelId {8d04a611-f893-4e35-b97c-5c1bcb3fe3e4} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:4584
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5788 -prefsLen 32952 -prefMapHandle 5792 -prefMapSize 270279 -jsInitHandle 5796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5804 -initialChannelId {2624f09c-9734-4c21-9c8e-9c27fd3690e2} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:1836
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5980 -prefsLen 35062 -prefMapHandle 5984 -prefMapSize 270279 -ipcHandle 5756 -initialChannelId {c0d3a307-0c5c-4e2b-906e-08b798e66e34} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
              3⤵
              • Checks processor information in registry
              PID:3980
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6000 -prefsLen 35062 -prefMapHandle 6100 -prefMapSize 270279 -ipcHandle 5744 -initialChannelId {fd157927-ef57-4f76-a326-446b7c25a5cc} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
              3⤵
              • Checks processor information in registry
              PID:3728
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5548 -prefsLen 32952 -prefMapHandle 5552 -prefMapSize 270279 -jsInitHandle 6524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {591d21b5-1216-4696-bb4e-e98d63eba70e} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
              3⤵
              • Checks processor information in registry
              PID:5792
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:4688
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3844
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:4616
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:796
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4872
          • C:\Windows\System32\SecurityHealthHost.exe
            \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
            1⤵
              PID:4820

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  activity-stream.contile.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\activity-stream.contile.json
                  • Size 4KB
                  • SHA256 fcebb99b4fba995a2a6acd19a005a8f7dfb6c6c75c7bead7ae253432e6477722
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
                  • Size 16KB
                  • SHA256 0945bf7744b228732c7591944a03343aaa66c33aff66a598f5588dd7e08a2d11
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  webext.sc.lz4
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\startupCache\webext.sc.lz4
                  • Size 104KB
                  • SHA256 2ad82f69b9582f3cb2df13848a91a06225bc197b6cd6a05ed8039f6d1a6465bb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 607B
                  • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 11KB
                  • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon-1
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                  • Size 502KB
                  • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  A4ARNJAPTG59KF0WM5N7.temp
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A4ARNJAPTG59KF0WM5N7.temp
                  • Size 8KB
                  • SHA256 88a1e5ab5717b1f3efdc4c198b36b304ffee2cb7555b0009c6e56e4503029371
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AlternateServices.bin
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\AlternateServices.bin
                  • Size 8KB
                  • SHA256 baf1c94c6e7da03a24887f99e6e9cb607c28272765080804c6f5eee51b1056fe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.bin
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.bin
                  • Size 13KB
                  • SHA256 94c504ea9214626e034884eb5d63d5140416755efef5439e9d943ba4694f2b58
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.bin
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.bin
                  • Size 13KB
                  • SHA256 c79dc1eabf901b8fa7c0101795decfe26a6fa365f33e18a1336bcb09082942ba
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 7KB
                  • SHA256 3c24bff09c1cd8fa4590c7fb6401c82f65514f8e769fc52a6c2b7be50df945a8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 7KB
                  • SHA256 51c0882e805605925297f2c2aee1665eb010dce0feda1b3853ab42dc4c250bbc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 13KB
                  • SHA256 fa9fec0497721a13b366b34afd94a52e5f35b181cdf70c3445887142d3b87160
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 13KB
                  • SHA256 3af4df359219602fe798f7e0c8e5edd404d2522d8d456415ed684e65c3de4714
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 29KB
                  • SHA256 ad9ec94942e15208cc91691fa5788b342e1c31d81b6cbc4861bc01a0e5d82d73
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  events
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
                  • Size 1KB
                  • SHA256 5a40dc3ef8a314557fd3be3878af12d9ca7ffa961a7c6929774bc36f2ae70f9c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  0649b27a-ef47-4b0e-afed-50c640adf593
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\0649b27a-ef47-4b0e-afed-50c640adf593
                  • Size 2KB
                  • SHA256 41c7738621377e14c4ce037bc157fdd22051b81c11a6786045d351cc8cfb70ea
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  11d3ce05-8366-42e8-9c35-361bca701a18
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\11d3ce05-8366-42e8-9c35-361bca701a18
                  • Size 235B
                  • SHA256 31c73e75adb7bc62a65fbc17940f0ce0ae9161b9fa3d6302f72c2b11357f47ff
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  5366f627-6bfb-4f16-986f-a1a79862373c
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\5366f627-6bfb-4f16-986f-a1a79862373c
                  • Size 235B
                  • SHA256 548e9a22911b9e53e2da06f10cf299883b41beddbabe02d9dccc6c4943494bbc
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  56fb1070-3108-4175-b92a-096acdfb4c1c
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\56fb1070-3108-4175-b92a-096acdfb4c1c
                  • Size 871B
                  • SHA256 24d4823b4ad8c0cc15a461090199e84b6cec0e5a6460c7d39aed75ca29210644
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  8f53bef8-8f16-4ee3-9989-2e581cd4ec65
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\8f53bef8-8f16-4ee3-9989-2e581cd4ec65
                  • Size 1019B
                  • SHA256 27e6be0e36e0b6924cdaef11ac4b98483a2a6db050783963d7edd30700d9fe06
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  9f3187c0-41db-4fe1-a307-cb78dcf55303
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\9f3187c0-41db-4fe1-a307-cb78dcf55303
                  • Size 23KB
                  • SHA256 31757a1a9624f59b22d20e46381c8a84cac3480e170ba927b3793ab573c73267
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  a16f971c-443f-4a2e-a810-a21545337fcb
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\a16f971c-443f-4a2e-a810-a21545337fcb
                  • Size 4KB
                  • SHA256 1eb07b37d243b80ff7081259bf1efa9f7b962bb630e675f53a9f0107eec919b9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  d57d6e4d-744a-4dca-9e48-8b2e37b70df4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\d57d6e4d-744a-4dca-9e48-8b2e37b70df4
                  • Size 886B
                  • SHA256 de88c29a9001da4ce6af41b7057214eb95f5b0a9d9fae2741b8c9d87859d7fb4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  fb6e7ffb-18f2-4301-9cf5-f7784d9c7cc2
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\fb6e7ffb-18f2-4301-9cf5-f7784d9c7cc2
                  • Size 280B
                  • SHA256 d3a6bd3b324599650668c7486f740da0f46db9fb3af8513e36054f33a4b6acef
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extensions.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
                  • Size 16KB
                  • SHA256 78f888fe9732474fbca02f71630f8f441b3d887dc8ba7441a0b2562c4ae4fa47
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                  • Size 1.1MB
                  • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.info
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                  • Size 116B
                  • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  manifest.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                  • Size 1002B
                  • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  widevinecdm.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                  • Size 21.6MB
                  • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                  • Size 6KB
                  • SHA256 6062546de20c32e66aa9ea49301cb4add551baf82131b4d2aa5397d6ac8b1aad
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                  • Size 8KB
                  • SHA256 c79fce86484cbedbd4f32b3491a3856c39443e17633adb74690b06cd5e9af78e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
                  • Size 12KB
                  • SHA256 f1fdb2fdc7f49446be40471d6a597dc977b66586c23f4bcca49fa78d1eac5bbd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
                  • Size 6KB
                  • SHA256 4e4869c333b1717b648894029b6629f2e6379ee4a3bbce01bf73c9a466a525a6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                  • Size 3KB
                  • SHA256 2e01ff4984d441ff46908a50a92a0e5c909d54c5ceb77cd2820c8dfdc5f640fb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  recovery.jsonlz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.jsonlz4
                  • Size 3KB
                  • SHA256 8f3fd8d9fac0b085ad22db69f93890839c03aebf3f3c4788c3e7f8bc8ce923a4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 5.4MB
                  • SHA256 66c52e097891e89229ed04f165c56ff6a7d8d0979ceffafda03bf3763d363f15
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/4616-971-0x000000000E050000-0x000000000E0FE000-memory.dmp
                  Download

                  memory/4872-800-0x000001669E9F0000-0x000001669EA10000-memory.dmp
                  Download

                  memory/4872-736-0x00000166889C0000-0x0000016688AC0000-memory.dmp
                  Download

                  memory/4872-775-0x000001668E180000-0x000001668E1A0000-memory.dmp
                  Download

                  memory/4872-762-0x000001668BCA0000-0x000001668BCC0000-memory.dmp
                  Download

                  memory/4872-764-0x000001669E270000-0x000001669E370000-memory.dmp
                  Download