Overview

overview

8

Static

static

1

B330D5F2F8...2.html

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    632s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 03:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    B330D5F2F85F4FA784DD92B4D452BBD1-1731878923362.html
  • Size 2KB
  • Sample260905-dwjbvsbf56
  • SHA256 8a97f295278333c024f329005781e3184533b500b987fe5192a99d7ed3ff140e
  • MD5 SHA1 SHA512 TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 19 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 47 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\B330D5F2F85F4FA784DD92B4D452BBD1-1731878923362.html"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\B330D5F2F85F4FA784DD92B4D452BBD1-1731878923362.html
      2⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6076
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27097 -prefMapHandle 1944 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {cf2b48e6-c36f-488b-be65-2998af8869ad} -parentPid 6076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6076" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:3348
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {6ed015e3-31ec-492e-8233-c7bdd6e12455} -parentPid 6076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
            PID:4860
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 27274 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {4a391eb5-a87b-42c4-82d7-68872ec8faee} -parentPid 6076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:4576
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4024 -prefsLen 27274 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 4112 -initialChannelId {389daa74-074a-453d-8f11-8925c3d795e3} -parentPid 6076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6076" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:5456
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4480 -prefsLen 34773 -prefMapHandle 4484 -prefMapSize 270279 -jsInitHandle 4488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4496 -initialChannelId {2dbcc025-5047-4dd1-97ca-a358623b3df3} -parentPid 6076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:2456
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5128 -prefsLen 34822 -prefMapHandle 5132 -prefMapSize 270279 -ipcHandle 5144 -initialChannelId {626c3410-a1b9-4e51-8440-f8bd7fea0ddd} -parentPid 6076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:4372
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3180 -prefsLen 32952 -prefMapHandle 3176 -prefMapSize 270279 -jsInitHandle 3012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5428 -initialChannelId {1fc513e0-c136-4f2c-b290-1d999a68a47f} -parentPid 6076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:4976
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5384 -prefsLen 32952 -prefMapHandle 5380 -prefMapSize 270279 -jsInitHandle 5364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1484 -initialChannelId {ace69be4-97a3-4c85-9062-d246d83d233c} -parentPid 6076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:1352
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32952 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {859e8d24-7555-4fbf-8cd1-3a7aa6977d5d} -parentPid 6076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:2584
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:4384
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5904
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:4040
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:2772
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4688
          • C:\Windows\System32\SecurityHealthHost.exe
            \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
            1⤵
              PID:2920

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  activity-stream.contile.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\activity-stream.contile.json
                  • Size 4KB
                  • SHA256 d03aa9706122889674531fb58d38ad104afae8fe33359c6fddec482f91157e67
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  activity-stream.discovery_stream.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\activity-stream.discovery_stream.json
                  • Size 75KB
                  • SHA256 8a9b88e972a5b53c9125f02bb28cec2fe08c0239f3c08ad08569b537ae2a076c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
                  • Size 16KB
                  • SHA256 8cecc530a84b544d3c34ffeae90bc67e3866aaa11dbd2f40cd1e49bdaba54460
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_arts_and_entertainment.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                  • Size 67KB
                  • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_autos_and_vehicles.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                  • Size 44KB
                  • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_beauty_and_fitness.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                  • Size 33KB
                  • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_blogging_resources_and_services.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                  • Size 33KB
                  • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_books_and_literature.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                  • Size 67KB
                  • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_business_and_industrial.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                  • Size 45KB
                  • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_computers_and_electronics.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                  • Size 45KB
                  • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_finance.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_finance.json
                  • Size 33KB
                  • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_food_and_drink.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                  • Size 67KB
                  • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_games.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_games.json
                  • Size 44KB
                  • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_health.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_health.json
                  • Size 33KB
                  • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_hobbies_and_leisure.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                  • Size 67KB
                  • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_home_and_garden.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                  • Size 33KB
                  • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_internet_and_telecom.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                  • Size 67KB
                  • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_jobs_and_education.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                  • Size 33KB
                  • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_law_and_government.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                  • Size 68KB
                  • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_online_communities.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                  • Size 67KB
                  • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_people_and_society.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                  • Size 45KB
                  • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_pets_and_animals.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                  • Size 44KB
                  • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_real_estate.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                  • Size 67KB
                  • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_reference.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_reference.json
                  • Size 56KB
                  • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_science.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_science.json
                  • Size 56KB
                  • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_shopping.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_shopping.json
                  • Size 67KB
                  • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_sports.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_sports.json
                  • Size 56KB
                  • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nb_model_build_attachment_travel.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_travel.json
                  • Size 67KB
                  • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recipe_attachment.json
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\recipe_attachment.json
                  • Size 1KB
                  • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 607B
                  • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 595B
                  • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  2d06745f-d447-428a-b2d3-a7cc1009dc61.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\2d06745f-d447-428a-b2d3-a7cc1009dc61.zip
                  • Size 3.8MB
                  • SHA256 8679245b0915d024751aa2ee17c6eec65c8638e19a0a6aaf9f05c966f27ebcf4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  remote-settings-startup-bundle-
                  • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                  • Size 576KB
                  • SHA256 59ec4af1f59cfb3da27519c1e2ba477c120bf573044e884baee25f9d37b7322b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 11KB
                  • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 21.6MB
                  • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon-1
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                  • Size 502KB
                  • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  JZNFGV7HN0HF638OJSKM.temp
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JZNFGV7HN0HF638OJSKM.temp
                  • Size 7KB
                  • SHA256 f615ece426e0ca638aba8187702bfadbefdd064575bd81562319851eefb6c872
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bookmarks-2026-09-05_10_2kFx1g0aB74Sr1ETk5SoFRK9LsnBxo2pl3NBsEbZVpI=.jsonlz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\bookmarkbackups\bookmarks-2026-09-05_10_2kFx1g0aB74Sr1ETk5SoFRK9LsnBxo2pl3NBsEbZVpI=.jsonlz4
                  • Size 855B
                  • SHA256 4c288d2e9076c1e2f0bb411f330e9dbf705fa8a392814c7ef81853ac6f8b4eb0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 6KB
                  • SHA256 e623d8e88be841583512ad1d0288a1133d75f1889eea6148287c6d4a4ccf4733
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 41KB
                  • SHA256 b026ac54a3e8fb3f8996dc754f896d73a3011736abeab68e991a6c98c9b7848a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 41KB
                  • SHA256 44165f62dbd2602743ab3df1e53833da8a5a81012889a8e0ddce32c9da705d60
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 41KB
                  • SHA256 fd562336b2e889e42bc80fbf687893aec1ebc9674fc52604ba39e94f1d4172d0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 41KB
                  • SHA256 ad11884ae42a00ef75924e40b696bba2e2931210808273f3a5c30a11c0d313f9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 6KB
                  • SHA256 f61b670066706a2099fbda8800e6da52d2c23291eb5d49fa6b808bdc088b783b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  events
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
                  • Size 1KB
                  • SHA256 caf96bf6431c30185ef764abf3be99bb88b3ced53116863312964c6f954bce19
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  27a568f2-b2dc-40a3-be49-37e2c115bd94
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\27a568f2-b2dc-40a3-be49-37e2c115bd94
                  • Size 886B
                  • SHA256 b2467c0c6062cbc52354c23274406a1495e6ea65f627be3eac847655d64ef406
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  771b6198-35db-466c-a347-311a7b91b7f4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\771b6198-35db-466c-a347-311a7b91b7f4
                  • Size 235B
                  • SHA256 bb1caf046c585151d522b16f74a61180e93434ef999e3974bffd8b07fbfb0e98
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  88ca5896-1151-4770-a19f-9b627fd7ddff
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\88ca5896-1151-4770-a19f-9b627fd7ddff
                  • Size 883B
                  • SHA256 ac602a9fad7960addc1e5bf40638a179f59b87e116759b5c1e454f3ea63a5c46
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  99a3b3e9-391d-4e28-b331-f7ec103fa529
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\99a3b3e9-391d-4e28-b331-f7ec103fa529
                  • Size 16KB
                  • SHA256 419b0cdf5b67012c8ef5355a5c89fe37db34469c4a6a299f3cdd3854f9f85985
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  9c80f484-2b26-4ac5-8c31-664626e76234
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\9c80f484-2b26-4ac5-8c31-664626e76234
                  • Size 2KB
                  • SHA256 84ee070517f556a01fef60745cfbb71cbed2d5b74b5cc683dbe7a1171714bb5e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  d75b4877-06f4-4ce4-99d1-66d510b5606a
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\d75b4877-06f4-4ce4-99d1-66d510b5606a
                  • Size 235B
                  • SHA256 bf8080be67eba7b1903b87ae8dcc04a296589ad17c70b84b1141abe673b02c00
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extensions.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
                  • Size 16KB
                  • SHA256 15a970178d0e7c918de30b240e937da860d6d465f29834a04dd38bf320c525a7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                  • Size 1.1MB
                  • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.info
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                  • Size 116B
                  • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  LICENSE.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
                  • Size 473B
                  • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  manifest.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                  • Size 1002B
                  • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  widevinecdm.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                  • Size 21.6MB
                  • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                  • Size 8KB
                  • SHA256 c27ecee65d450e25c9695779c466f375e7284990826d6664fe9c64a631c61ba0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
                  • Size 6KB
                  • SHA256 4e4869c333b1717b648894029b6629f2e6379ee4a3bbce01bf73c9a466a525a6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
                  • Size 6KB
                  • SHA256 e6199131dee510261a201041d11bef6facea6210d8f0b395040aa0b1d1c21234
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.jsonlz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.jsonlz4
                  • Size 1KB
                  • SHA256 ac23750e08b6b202c6985555738da7a0ad6174dc79daee122ce0270634aae588
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 9.8MB
                  • SHA256 8bebcc6ff6eee6de7f7587469515bf5b63beffd5c3b5444e6931225549115355
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 13.9MB
                  • SHA256 9544580513cf8d7702cda797f2108dcabb8f55ef24f3687b0841fc6624b12167
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 13.9MB
                  • SHA256 49d85d2734b9f0660ef1b7f2964c2767c06ec5dec49dde46dd50ad3755fdaf38
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 14.1MB
                  • SHA256 3fa4b760659e79b673989a151f517059bf1ac288bceb8d65002db2fbdc1c44f8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/2772-8780-0x000001B707750000-0x000001B707850000-memory.dmp
                  Download

                  memory/2772-8843-0x000001B71B750000-0x000001B71B770000-memory.dmp
                  Download

                  memory/2772-8813-0x000001B71B3D0000-0x000001B71B4D0000-memory.dmp
                  Download

                  memory/2772-8829-0x000001B70B1D0000-0x000001B70B1F0000-memory.dmp
                  Download

                  memory/2772-8811-0x000001B708F70000-0x000001B708F90000-memory.dmp
                  Download

                  memory/2772-8964-0x000001B71F000000-0x000001B71F1E3000-memory.dmp
                  Download